State of Colorado

Finding 2025-034 Compliance with Activities Allowed or Unallowed, Allowable Costs/Cost Principles, and Eligibility for Medicaid The Department is responsible for ensuring that all of its expenditures under the Medicaid program [ALN 93.778] are appropriate, and that it complies with federal and state program requirements. In Colorado, the responsibility for determining recipient eligibility for Medicaid program benefits is shared between local counties, designated Medical Assistance eligibility sites (MA sites), and the Department (in this case, the State). Individuals and families apply for Medicaid benefits at their local county departments of human/social services, designated MA sites, or online through the Department’s Program Eligibility and Application Kit (PEAK) system. Local counties and MA sites are responsible for administering the benefits application process, reviewing the PEAK system for application data, entering the required data for eligibility determination into the Colorado Benefits Management System (CBMS), and approving or denying an applicant’s eligibility based on program criteria. Federal regulations require state medical assistance programs to renew a beneficiary’s eligibility once every 12 months to determine whether the beneficiary continues to qualify for benefits (also known as redetermination). States must first attempt to redetermine the beneficiary’s eligibility based on information the Department has available at the time, either from the beneficiary’s case file or other electronic data sources, like PEAK and CBMS, without requiring information from the beneficiary. This is called an “ex parte” renewal. If sufficient information is available, the Department can renew eligibility on an ex parte basis and notify the beneficiary that their coverage has been renewed. If sufficient information is not available, the Department will provide the beneficiary with a renewal form and request any additional documentation needed to determine eligibility. Once the renewal forms are completed and returned to the Department for processing, the caseworker enters the applicant’s information into CBMS, and, once all required information is entered, they can mark the application as complete. At that point, CBMS determines the applicant’s eligibility based on the information entered. If the application is incomplete, a caseworker is responsible for contacting the individual to assist with completing their application. An eligible beneficiary’s income and countable resources cannot exceed a limit set by federal and state regulations. CBMS has a system check to mark eligibility as “fail” if the applicant’s reported income exceeds the limit. Eligibility data from CBMS feeds into the Colorado interChange system (Colorado interChange), which issues payments to Medicaid providers for the services that they provide to Medicaid beneficiaries. The Department pays for Medicaid services through one of two reimbursement methods: (1) fee-for-service (FFS) payments for specific services rendered or (2) capitation payments, monthly fixed payments that are paid to managed care entities (MCEs). Once a beneficiary is determined eligible, then they determine whether to enroll in FFS or an MCE. FFS reimbursements are paid directly to providers for services rendered. Capitation payments are paid to MCEs, which are groups or organizations of medical service providers who contract with a network of providers for services. The Department pays monthly capitation payments to MCEs on behalf of beneficiaries based on the number of eligible beneficiaries enrolled in its plan. These payments are made to the MCE regardless of whether the beneficiaries receive medical services during the month. Colorado interChange is programmed to pay the FFS and monthly capitation payments only on behalf of beneficiaries deemed eligible in Colorado interChange based on eligibility information received from CBMS and requirements specified in federal and state rules and regulations. The Department is responsible for supervising and monitoring the local counties’ and MA sites’ administration of Medicaid eligibility determinations. The Department is also responsible for ensuring that it only provides Medicaid payments to eligible providers for providing allowable services on behalf of Medicaid-eligible individuals. What was the purpose of our audit work and what work was performed? The purpose of our audit work was to determine whether the Department had appropriate internal controls over and complied with applicable federal and state Medicaid eligibility requirements during Fiscal Year 2025. Another purpose of our audit work was to determine whether the Department implemented our Fiscal Year 2023 audit recommendation to ensure local counties and MA site caseworkers are appropriately trained and are held to required timelines for processing beneficiary applications, using the correct income thresholds to determine eligibility, and maintaining the required documentation to support eligibility in the case file. The Department planned to implement this recommendation by January 2025. During our audit, we performed testing related to the Department’s Medicaid eligibility internal controls in place during Fiscal Year 2025. In addition, we performed specific testing on a random nonstatistical sample of 125 beneficiaries to determine if they were properly deemed eligible for and received Medicaid benefits during Fiscal Year 2025. Our sampling methodology, including the strata and sample sizes, was developed based on our risk assessment procedures and included the following procedures: *We obtained a listing of Medicaid FFS claims that were submitted by providers and paid by the Department during Fiscal Year 2025 and a listing of capitation payments made to MCEs on behalf of Medicaid-eligible individuals during Fiscal Year 2025. The Department pulled this data from the Colorado interChange claims system. • We summarized each listing by Medicaid ID numbers (ID), and removed any IDs for which total payments and adjustments netted to $0, which can happen when the Department catches and fixes payments made in error. This resulted in two populations: (1) a population of capitation payments totaling $2,156,417,706, made on behalf of 1,398,794 individual beneficiaries, and (2) a population of FFS claims totaling $10,553,035,025, made on behalf of 1,018,911 individual beneficiaries. • We stratified our population, as shown in the following table, into six strata defined by the total amount of payments for each unique ID. As part of our analysis, we noted FFS beneficiaries represented 42 percent of the total number of individual beneficiaries who had payments made on their behalf during Fiscal Year 2025, and beneficiaries with capitation payments represented 58 percent of the total number of individual beneficiaries who had capitation payments made on their behalf during Fiscal Year 2025. Although FFS claims represented only 42 percent of the total number of individual beneficiaries, they represented 83 percent of the total dollar amount of all claims and individual capitation payments made during Fiscal Year 2025. As such, we stratified the data with two strata for capitation payments and four strata for FFS payments. We selected 26 capitation samples and 99 FFS samples from the strata for a total sample of 125 payments for beneficiaries. • For each sampled ID, we tested eligibility covering the dates of service for every Fiscal Year 2025 payment made on the beneficiary’s behalf. See " Schedule of Findings and Questioned Costs" for table/chart. Our testing included reviewing each payment’s supporting documentation, which included case files, information in CBMS data fields related to eligibility determination/redetermination, and Medicaid payment information in Colorado interChange. We performed testwork to determine whether the Department ensured that local county and MA site caseworkers obtained and maintained the required documents that supported eligibility determinations in the case files, correctly entered eligibility data into CBMS, and determined eligibility in a timely manner. What problems did the audit work identify and how were the results measured? Based on the testwork performed, we determined that the Department is still in the process of fully implementing our Fiscal Year 2023 recommendation. While we did not identify any errors related to processing beneficiary applications within the required timeframes, we continued to identify issues related to missing case file documentation and income calculations. We identified at least one error in 7 of the 125 Medicaid case files tested (6 percent). These errors resulted in a total of $240,606 in known federal and state questioned costs for Fiscal Year 2025 ($120,302 in federal costs and $120,304 in state costs). Specifically, we found the following: • Missing Case File Documentation. In three cases, we determined the case file did not have documentation to support income and/or resources, such as wage stubs or bank statements, which are necessary to support the Medicaid eligibility determination, as required by federal and state regulations. This resulted in known questioned costs of $237,745 ($118,872 in federal costs and $118,873 in state costs). Federal regulation [420 CFR 435.914] requires the Department to obtain and maintain documentation to support each beneficiary’s Medicaid eligibility determination. State regulation [10 CCR 2505-10, 8.100.4.B] notes that income may be self-attested by an applicant or member and verified through an electronic data source. If the self-attested income cannot be verified electronically, the applicant must provide documentation of income. Earned income must be verified by wage stubs, tax documents, written documentation from the employer stating the employee’s gross income, or through a telephone call to an employer. State regulation [10 CCR 2505-10, 8.100.7.A] notes that applicants receiving long-term case services under the 300% Institutionalized Special Income category must conform with the regulations regarding resource limits and exemptions set forth in section 10 CCR 2505-10, 8- 100.5, which notes that the resource limit for these long-term care individuals is $2,000. State regulation [10 CCR 2505-10, 8.100.5.M] notes that the resource limit for individuals receiving Home and Community Based Services assistance is $2,000. • Issues with Income Calculations. In four cases, we identified issues with the income calculation used to support the Medicaid eligibility determination, as required by federal and state regulations. Specifically, we found the following: III-8 [the auditor] In two cases, the incorrect number of household members was entered into CBMS, which caused the incorrect income threshold to be used in the income calculation. In addition, one of these cases also incorrectly excluded reportable income in the member’s income calculation. These issues resulted in known questioned costs of $725 ($362 in federal costs and $363 in state costs). In two cases, out-of-date income information was used in the calculation. We noted in both instances, CBMS had current income information that was not used in the income calculation. For one of those cases, if the correct income was used in the calculation, the members’ total income would have been over the eligibility limit. This resulted in known questioned costs of $2,136 ($1,068 in federal costs and $1,068 in state costs). Federal regulation [42 CFR 435.119] requires household income to be at or below 133 percent threshold of the federal poverty level. State regulation [10 CCR 2505-10, 8.100.4.G.4] notes that adults applying for medical assistance shall be determined financially eligible for medical assistance as long as their total household income does not exceed 133% of the federal poverty level. State regulation [10 CCR 2505-10, 8.100.4.C] notes that the financial eligibility of applicants for medical assistance shall be determined based on current or previous monthly household income and family size. The Modified Adjusted Gross Income calculation for the purposes of determining a household’s financial eligibility shall consist of, but is not limited to, earned income in the form of wages, salaries, and tips. Why did these problems occur? We determined that the Department’s existing internal controls over the income calculations and income and resource documentation requirements, which are necessary for Medicaid eligibility determinations, did not ensure caseworkers were determining eligibility appropriately, and in accordance with federal and state regulations. Specifically, caseworkers were not adequately trained or held accountable for ensuring that (1) the required documentation to support the income calculation was maintained within the case file, (2) current income and resource information is used when calculating monthly income and resource amounts, and (3) the correct household composition is used when determining eligibility. Why do these problems matter? As the state department responsible for ensuring that all Medicaid expenditures are appropriate, it is essential for the Department to ensure that eligibility determinations are made appropriately and in accordance with federal and state regulations. This includes ensuring that inaccurate processing of information used to determine Medicaid eligibility does not result in Medicaid benefits being provided to, and paid on behalf of, ineligible individuals, or that eligible individuals are denied benefits. Ultimately, the federal government may disallow federal funds for Medicaid program expenditures that do not adhere to regulations, and the State would be required to bear the cost of these errors. See " Schedule of Findings and Questioned Costs" for table/chart. Recommendation 2025-034 The Department of Health Care Policy and Financing should strengthen its internal controls over the income calculation and income and resource documentation requirements that are necessary for Medicaid eligibility determinations to ensure eligibility is determined appropriately and in accordance with federal and state regulations. This should include ensuring that (1) local counties and Medical Assistance site caseworkers are sufficiently trained to maintain the required documentation to support eligibility in the case file, (2) current income and resource information is used when calculating monthly income and resource amounts, and (3) the correct household composition is used when determining eligibility. Response Department of Health Care Policy and Financing Agree Implementation Date: February 2027 The Department agrees with the recommendation and will strengthen internal controls over Medicaid eligibility determinations to ensure compliance with federal and state regulations. The Department will issue formal Management Decision Letters to the identified counties requiring the development and implementation of Department-approved Corrective Action Plans. These plans will be required to address root causes related to income and resource calculation, documentation of eligibility determinations, and household composition, including any necessary training or guidance for county and Medical Assistance site caseworkers. The Department will review, approve, and monitor corrective actions to ensure deficiencies are appropriately addressed.

Finding 2025-035 Compliance with Activities Allowed or Unallowed, Allowable Costs/Cost Principles, and Eligibility for Children’s Basic Health Plan The Department is responsible for ensuring that all federal Children’s Health Insurance Plan (CHIP) [ALN 93.767] expenditures are appropriate, and that the State complies with federal and state program requirements. CBHP, Colorado’s state-administered children’s health plan, is partially funded with federal CHIP dollars. In Colorado, the responsibility for determining recipient eligibility for CBHP program benefits is shared between local counties, designated MA sites, and the Department. For CBHP, individuals and families apply for benefits at their local county departments of human/social services, designated MA sites, or online through the PEAK system. When applying in person, the local counties and MA sites are responsible for administering the benefits application process, entering the required data for eligibility determination into CBMS, and approving or denying an applicant’s eligibility. Once eligibility is determined, the county or MA site is responsible for maintaining records on each applicant in a case file, and then retaining those case files for the periods required by federal and state laws. After an individual is determined eligible for CBHP, the individual is enrolled into an MCE plan. The specific MCE plan the individual is enrolled in is based on the county the individual lives in. The Department provides all county, MA site, and Department eligibility staff with copies of its Department-prepared policy and operational training documents and guides for reference. These documents are meant to provide eligibility staff with consistent and accurate program information, and are posted online for all county and MA sites to use. For CBHP, the Department contracts with MCEs, which are groups or organizations of medical service providers that furnish services to CBHP members under capitated reimbursement agreements. Under these agreements, MCEs contract with a network of providers to provide services to CBHP members. The CBMS eligibility data feeds into the Department’s medical claims system, Colorado interChange, which is programmed to pay MCEs in lump-sum monthly payments (capitation payments) for the services that they provide on behalf of CBHP beneficiaries. Colorado interChange makes these payments based on eligibility information received from CBMS and requirements specified in federal and state regulations. The Department pays MCEs based on the number of eligible beneficiaries enrolled in its plan. Capitation payments are paid to the MCE regardless of whether the providers serve beneficiaries during the month or not. What was the purpose of our audit work and what work was performed? The purpose of our audit work was to review the Department’s internal controls over the CBHP eligibility determination process, as well as to determine whether the Department complied with applicable federal and state CBHP eligibility requirements during Fiscal Year 2025. Another purpose of our audit work was to determine whether the Department implemented our Fiscal Year 2023 audit recommendation to ensure local counties and MA site caseworkers are appropriately trained and held to required timelines for processing beneficiary applications, eligibility requirements related to applicants that have other health insurance, and maintaining the required documentation to support eligibility in the case file. The Department planned to implement this recommendation by January 2025. During our audit, we reviewed the Department’s CBHP eligibility internal controls in place during Fiscal Year 2025. In addition, we performed testing on a random nonstatistical sample of 60 beneficiaries to determine if they were properly determined eligible and received CBHP benefits during Fiscal Year 2025. We obtained a listing of CBHP capitation payments totaling $256,524,048, that were submitted by MCEs and paid by the Department during Fiscal Year 2025 on behalf of 156,430 individual beneficiaries. From that listing, we selected 60 beneficiaries to determine whether those individual’s CBHP eligibility determinations were appropriate. Our testing included reviewing supporting documentation, including case files, information in CBMS data fields related to eligibility determination/redetermination, and CBHP payment information in Colorado interChange. We performed testwork to determine whether the Department ensured that local county and MA site caseworkers obtained and maintained the required documents supporting eligibility determinations in the case files, correctly entered eligibility data into CBMS, and determined eligibility in a timely manner. What problems did the audit work identify and how were the results measured? Based on the testwork performed, we determined the Department is still in the process of fully implementing our Fiscal Year 2023 recommendation. While we did not identify any errors related to processing beneficiary applications within the required timeframes or eligibility requirements related to applicants with other health insurance, we continued to identify issues with missing case file documentation. We identified errors in 7 of the 60 CBHP case files tested (12 percent). These errors resulted in a total of $7,154 in known federal and state questioned costs for Fiscal Year 2025 ($4,650 in federal costs and $2,504 in state costs). Specifically, we found the following: • Missing Case File Documentation. In two cases, we determined the case file did not have documentation to support income, such as wage stubs, which is necessary to support the CBHP eligibility determination, as required by federal and state regulations. This resulted in known questioned costs of $2,553 ($1,659 in federal costs and $894 in state costs). Federal regulation [42 CFR 457.965] notes that the state must include in each applicant’s record facts to support the state’s determination of the applicant’s eligibility for CHIP. State regulation [10 CCR 2505-3, 130] notes that, to be eligible for CBHP, an applicant shall provide minimal verification as required in 10 CCR 2505-10-8.100.4.B. At minimum, applicants seeking medical assistance shall provide all of the following: social security number, verification of citizenship and identity and/or legal immigrant status, and support for earned and unearned income. State regulation [10 CCR 2505-10, 8.100.4.B] notes that income may be self-attested by an applicant or member and verified through an electronic data source. If the self-attested income cannot be verified electronically, the applicant must provide income documentation. Earned income must be verified by wage stubs, tax documents, written documentation from the employer stating the employee’s gross income, or through a telephone call to an employer. • Issues with Income Calculations. In five cases, we identified issues with the income calculation used to support the CBHP eligibility determination, as required by federal and state regulations. Specifically, we found the following: In 1 case, the incorrect number of household members was entered into CBMS, which caused the incorrect income threshold to be used in the income calculation. If the correct number of household members was used in the calculation, the member’s total income would have been over the eligibility limit. This resulted in known questioned costs of $2,037 ($1,324 in federal costs and $713 in state costs). In 3 cases, out-of-date income information was used in the calculation. In 2 of those cases, if the correct income was used in the calculation, the members’ total income would have been over the eligibility limit. This resulted in known questioned costs of $1,423 ($925 in federal costs and $498 in state costs). In 1 case for a self-employed individual, an incorrect expense amount was used in the member’s income calculation, which caused total income to be understated in the calculation. If the correct expense amount was used in the calculation, the member’s total income would have been over the eligibility limit. This resulted in known questioned costs of $1,141 ($741 in federal costs and $400 in state costs). State regulation [10 CCR 2505-3.110.1.E] notes that, to be eligible for the CBHP, an eligible person shall have a household income greater than 142 percent, but not exceeding 260 percent of the federal poverty level, adjusted for household size for children younger than age 19. State regulation [10 CCR 2505-3, 150.1] notes that the income calculation for the CBHP shall be determined by following the Medicaid Modified Adjusted Gross Income Methodology for income calculation, which is defined in 10 CCR 2505-10-8-100.4.C. State regulation [10 CCR 2505-10, 8.100.4.C] notes that the financial eligibility of applicants for medical assistance shall be determined based on current or previous monthly household income and family size. The Modified Adjusted Gross Income calculation for the purpose of determining a household’s financial eligibility shall consist of, but is not limited to, earned income in the form of wages, salaries, and tips. State regulation [10 CCR 2505-10, 8.100.3.K.9] notes that in order to determine the net profit (or income) of a self-employed applicant, the cost of doing business (expenses) should be deducted from gross income. Why did these problems occur? We determined that the Department’s existing internal controls over CBHP eligibility determinations did not consistently ensure caseworkers were determining eligibility appropriately and in accordance with federal and state regulations. Specifically, caseworkers were not adequately trained or held accountable for ensuring that the required documentation to support the income calculation was maintained within the case file, and that the correct income and income thresholds were used when determining eligibility. Why do these problems matter? As the state department responsible for ensuring that all expenditures under CBHP are appropriate, it is essential for the Department to ensure that eligibility determinations are made appropriately and in accordance with federal and state regulations. This includes ensuring that inaccurate processing of information used to determine eligibility does not result in CBHP benefits being provided to, and paid on behalf of, ineligible individuals, or that eligible individuals are denied benefits. Ultimately, the federal government may disallow federal funds for the CBHP program expenditures that do not adhere to regulations, and the State would be required to bear the cost of these errors. See "Schedule of Findings and Questioned Costs" for table/chart. Recommendation 2025-035 The Department of Health Care Policy and Financing should strengthen its internal controls over the Children’s Basic Health Plan eligibility requirements to ensure eligibility is determined appropriately and in accordance with federal and state regulations by addressing the issues identified in the audit. This should include ensuring that local county and Medical Assistance site caseworkers are appropriately trained on and comply with requirements to maintain appropriate income documentation to support eligibility in the case file, and comply with requirements to use the correct income and income thresholds when determining eligibility. Response Department of Health Care Policy and Financing Agree Implementation Date: February 2027 The Department agrees with the recommendation and will strengthen internal controls over Children’s Basic Health Plan eligibility determinations to ensure compliance with federal and state regulations. The Department will issue formal Management Decision Letters to the identified counties requiring Department-approved Corrective Action Plans. These plans will be required to address root causes related to income documentation, application of correct income thresholds, and compliance with CBHP eligibility requirements, including any necessary training or guidance for county and Medical Assistance site caseworkers. The Department will review, approve, and monitor corrective actions to ensure deficiencies are addressed.

The following findings and recommendations relating to internal control deficiencies classified as Material Weaknesses were communicated to the Department of Health Care Policy and Financing (Department) in the previous year and have not been remediated as of June 30, 2025 because the original implementation dates provided by the Department were in a subsequent fiscal year. These complete findings and recommendations can be found within the original report and the complete recommendations can be found within Section IV: Disposition of Prior Audit Recommendations of this report. See "Schedule of Findings and Questioned Costs" for table/chart. Finding 2024-032 Compliance with Activities Allowed or Unallowed and Allowable Costs/Cost Principles for Medicaid

Medicaid Claims Payments

The Department reimburses medical providers, pharmacies, and medical equipment providers for claims submitted to the Department for services provided to eligible beneficiaries in the Medicaid program. To be allowable, Medicaid costs for services must be (1) covered by the CMS-approved state plan or the CMS-approved waivers; (2) reviewed by the Department consistent with the Department’s documented procedures and system for determining the medical necessity of claims; (3) properly coded; and (4) paid at the rate allowed by the state plan. A Medicaid state plan is a formal, written agreement between a state and the federal government describing how a state administers its Medicaid program, which includes both the basic requirements of the program and individualized content that reflects the characteristics of the state’s program [42 CFR 430.10]. The state plan is written by the state and must be approved by CMS in order for the State to access federal Medicaid funds.

The Department uses Colorado interChange as its medical claims system. Colorado interChange is programmed to make Medicaid claims payments on behalf of eligible beneficiaries in accordance with federal and state Medicaid rules and regulations. During Fiscal Year 2024, the Department contracted with a fiscal agent, Gainwell Technologies (Gainwell), to manage Colorado interChange. A fiscal agent is a contractor that acts on behalf of the Department in respect to claims processing activities, including evaluating and approving or rejecting claims payments in accordance with established Department policies. Although Gainwell receives and processes all claims, the Department is ultimately responsible for ensuring that the claims are paid in accordance with federal and state regulations.

Providers are responsible for preparing and submitting Medicaid claims to Gainwell for processing in compliance with the Department’s claim filing requirements. All provider claims must include a diagnosis code, procedure code, and the provider’s usual and customary charges for payment (Provider Rate). Procedure codes are dependent on the type of service and claim type.

Colorado interChange is programmed with CMS-approved rates for each procedure code. Gainwell will use the claims information received by the provider, including the specific procedure codes and Provider Rate, to process and pay the claims in Colorado interChange. Providers are advised by the Department to bill their usual and customary charges for services, and the Colorado interChange system pays the lower of either (1) the Provider Rate, or (2) the Department’s CMS-approved rates.

If needed, all claims may be adjusted for increased payment, decreased payment, or recovery without repayment. Adjustments that increase or decrease the original payment amount are processed as a two-part transaction in Colorado interChange—the first piece of the transaction reverses the previously made payment, and the second piece of the transaction repays the claim at the corrected rate. If a previously paid claim is adjusted to pay less than the original amount, the adjustment will result in a retraction of the difference between the original payment and the corrected payment amount. If a previously paid claim is adjusted to pay more than the original amount, depending on if the provider billed usual and customary rates, the adjustment will result in an additional payment to the provider.

The Department authorizes updates to the rate tables in Colorado interChange whenever there are changes in the claims rates. All provider rate increases are subject to CMS approval prior to implementation of an increase. Rate changes are generally made at the beginning of each fiscal year, but can be made anytime an update is required, such as when CMS issues a rate change that is based on the federal fiscal year (which begins on October 1). To make a change in the rate tables, Department staff fill out a change request form (Update Form) including the purpose of the request, instructions on the specific information that needs updating, and any other special instructions related to the request. The Department must include specific instructions on the Update Form if any claims have to be reprocessed as part of the request. A reprocessing request is needed if the actual rate change is made after the effective date of the change. For example, if a rate change was effective at the beginning of the fiscal year (July 1) but processed on July 15, the Update Form should include a specific request to reprocess claims with dates of service from July 1 to July 15, which would ensure the claims are paid at the correct rates. Once complete, Department staff send the Update Form to Gainwell for processing in Colorado interChange.

What was the purpose of our audit work and what work was performed?

The purpose of our audit work was to review the Department’s internal controls over the Medicaid claims payment process and to determine whether payments were processed and paid in accordance with state and federal regulations during Fiscal Year 2024.

During our audit, we obtained a list of all Medicaid claims that were paid by the Department during Fiscal Year 2024, which included 77,824,795 individual Medicaid claims totaling $11,542,679,377. We performed testing on a randomly selected sample of 40 Medicaid claims paid during Fiscal Year 2024 totaling $4,486,936 to determine whether the claim (1) matched the claims information that was reported in Colorado interChange; (2) was paid at the rate allowed by the state plan; and (3) beneficiary was eligible for the Medicaid program at the time of service.

How were the results of the audit work measured?

We measured the results of our audit work against the following requirements:

Federal regulations [45 CFR 75.403] require that costs under federal awards must be necessary, reasonable, and allocable; conform to any limitations or exclusions; be consistent with policies and procedures; receive consistent treatment; adhere to Generally Accepted Accounting Principles (GAAP); not be used for cost sharing of other programs; and be adequately documented.

Section 25.5-4-301(2), C.R.S., states that any overpayment to a provider is recoverable, regardless of whether the overpayment is the result of an error by the state department, a county department of human or social services, an entity acting on behalf of either department, or by the provider or any agent of the provider.

Federal regulations [45 CFR 75.303] state that recipients of federal funds must establish and maintain effective internal controls over its federal awards, which provide reasonable assurance that the recipient is managing its federal grants in compliance with federal statutes, regulations, and the award terms and conditions. These internal controls should be in compliance with “Standards for Internal Control in the Federal Government” (Green Book), published by the U.S. Government Accountability Office. Principles 3.09-3.10, Documentation of the Internal Control System, state that management is to develop and maintain documentation of its internal control system. This documentation should establish the who, what, when, where, and why of internal control execution to personnel. Documentation also provides a means to retain organizational knowledge and mitigate the risk of having that knowledge limited to a few personnel. What problem did the audit work identify?

Based on our audit testwork, we determined that one of the 40 claims tested (2.5 percent) contained procedure codes that were paid at the incorrect rate for Fiscal Year 2024. Specifically, the claim selected for testing contained three specific procedures, two of which were paid at the rate in effect during Fiscal Year 2023 instead of the correct Fiscal Year 2024 rate. The third procedure code had the same rate for both Fiscal Year 2023 and 2024, so no difference was noted. The total known questioned costs for this claim were $137.20. See Schedule of Findings and Questioned Costs for chart/table. We provided the claim to Department staff to research, and they determined that this claim was part of a group of 2,423 individual claims with specific procedure codes that were paid at the rate in effect during Fiscal Year 2023 instead of the correct Fiscal Year 2024 rate. The total known questioned costs for this group of claims, including the sample tested above, was $189,015.98. Why did this problem occur?

The Department does not have adequate internal controls, including formal policies and procedures, in place related to the rate updating process in Colorado interChange. Specifically, the Department lacked policies and procedures detailing how to complete the rate Update Form, requiring a secondary review process over the completed Update Form prior to submission to Gainwell, and requiring a post-implementation review of the rate changes made in Colorado interChange to confirm they were correctly made by Gainwell. On July 21, 2023, Department staff completed and submitted an Update Form to Gainwell to process the annual rate updates; the Department staff who processed the rate update had been trained on the process before, but this was the first time they completed the process independently and they overlooked including specific instructions to reprocess any claims with dates of service before the update (July 1, 2023 to July 21, 2023) at the new rate. This caused the Fiscal Year 2024 rate changes to take effect on July 21, 2023 instead of July 1, 2023 (the first day of the fiscal year). The Department did not have a review process in place to confirm that the Update Forms were completed accurately and included all necessary information, so the Department was unaware of the issue until it was identified during our audit.

Once notified of the error, Department staff contacted Gainwell to initiate an adjustment to correct all claims with dates of service from July 1, 2023 to July 21, 2023 that were paid at the incorrect rate. The Department also notified all providers of the issue on the Department’s Provider Resources website and in the December 2024 Provider Bulletin. The adjustment was processed on November 22, 2024.

Why does this problem matter?

Strong internal controls over the Medicaid claims process—including documented policies and procedures detailing how to complete the Update Form and an effective review process—are necessary to ensure that Medicaid claims are paid at the correct rates approved by the state plan and in accordance with federal and state regulations. In addition, making payments over the specific rates can result in the Department having to repay the federal government for the federal portion of the overpayments. See Schedule of Finding and Questioned Costs for chart/table. Recommendation 2024-032

The Department of Health Care Policy and Financing (Department) should strengthen its internal controls over the Medicaid claims process by developing, documenting, and implementing formal policies and procedures over the rate updating process in Colorado interChange, the Department’s medical claims system. These policies and procedures should include details on how to complete the rate change request form (Update Form), require a secondary review process over the completed Update Form prior to submission to Gainwell Technologies—the Department’s contracted fiscal agent that manages Colorado interChange—and require a post-implementation review of the rate changes made in Colorado interChange to confirm they were correctly made by Gainwell.

Response Department of Health Care Policy and Financing

Agree Implementation Date: July 2025

The Department of Health Care Policy and Financing has examined rate maintenance practices since FY2024 to determine the best course of action to strengthen internal controls to subsequently develop formal policies and procedures. The Waiver and Fee Schedule Rates section will develop a formal, recorded training and corresponding training materials based on current, informal processes on completion of the rate update form to be submitted to the Department's fiscal agent, Gainwell Technologies. Since FY2024, the Waiver and Fee Schedule Rates section has implemented a multilevel secondary review process prior to any rate change submission to ensure accuracy in rate update submissions. The Rates section has also worked closely with other internal partners to formalize informal update processes for quality assurance and maintenance of a minimal error percentage. The Rates section has also implemented a post-implementation data analysis review of all rate update submissions to ensure the update was implemented as directed and expected to ensure accountability on behalf of the Department's fiscal agent Gainwell Technologies. The Rates section is currently in process of documenting and formalizing all rate update processes and policies for future training and process maintenance.

The following findings and recommendations relating to internal control deficiencies classified as Material Weaknesses were communicated to the Department of Health Care Policy and Financing (Department) in the previous year and have not been remediated as of June 30, 2025 because the original implementation dates provided by the Department were in a subsequent fiscal year. These complete findings and recommendations can be found within the original report and the complete recommendations can be found within Section IV: Disposition of Prior Audit Recommendations of this report. See "Schedule of Findings and Questioned Costs" for table/chart. Finding 2024-033 Compliance with Eligibility for Medicaid and CBHP

Ex Parte Renewal Process

Federal regulations require state medical assistance programs to renew a beneficiary’s eligibility once every 12 months to determine whether the beneficiary continues to qualify for benefits. States must first attempt to redetermine the beneficiary’s eligibility based on information the Department has available at that time, either from the beneficiary’s case file or other electronic data sources, without requiring information from the beneficiary. This is called an “ex parte” renewal. If sufficient information is available, the Department can renew eligibility on an ex parte basis and notify the beneficiary that their coverage has been renewed. If sufficient information is not available, the Department will provide the beneficiary with a renewal form and request any additional documentation needed to determine eligibility.

What was the purpose of our audit work and what work was performed?

The purpose of our audit work was to review the Department’s internal controls over the Medicaid and CBHP eligibility determination process, as well as to determine whether the Department complied with applicable federal and state Medicaid and CBHP eligibility requirements during Fiscal Year 2024.

During our audit, we inquired with the Department on the ex parte renewal process for Medicaid and CBHP beneficiaries.

How were the results of the audit work measured?

We measured the results of our audit work against the following:

Federal regulations require states to complete a redetermination of eligibility based on available information for each individual in the household, regardless of the eligibility of others in the household unit. Specifically, these regulations require that states complete a redetermination of eligibility for all beneficiaries without requiring information from the individual if able to do so based on reliable information contained in the individual’s case file or more current information available to the state (ex parte basis) [42 CFR 435.916(b)(2) and 457.343]. If they are unable to do so, the state must provide the individual with a pre-populated renewal form and give them at least 30 calendar days to respond and provide any necessary information [42 CFR 435.916(b)(2)].

Federal regulations [42 CFR 435.952(d) and 457.380(f)] specify that states may not terminate eligibility or reduce benefits on the basis of information obtained through the ex parte renewal process without first contacting the beneficiary and offering them an opportunity to provide new information.

What problem did the audit work identify?

The Department reported to us that they were not in compliance with eligibility requirements related to the ex parte renewal process during Fiscal Year 2024. As CMS worked with individual states on their COVID-19 unwinding plans, they identified 29 states that were not in compliance with certain ex parte renewal requirements for Medicaid and CBHP beneficiaries, including Colorado. The Department was inappropriately conducting ex parte renewals at the household level rather than individual level, without using individually-specific eligibility statutes and income thresholds for individuals within the household. Specifically, if eligibility could not be renewed on an ex parte basis for at least one member of a household, renewal forms were sent to the entire household. If the renewal forms were returned, the appropriate eligibility determinations were made and those who are eligible were approved. If the renewal forms were not returned, the Department’s eligibility system, the Colorado Benefits Management System (CBMS), would disenroll all individuals in the household, including any who may have been determined to be eligible through the ex parte process.

Why did this problem occur?

In August 2023, CMS instructed all states to review their ex parte renewal process to assess compliance with federal requirements to complete eligibility redeterminations based on the available information for each individual in the household, regardless of the eligibility of others in the household unit. States that identified any areas of noncompliance were required to (1) pause terminations for any ex parte renewal processes that are not compliant with federal guidance and whose coverage may be terminated inappropriately; (2) reinstate coverage for all affected individuals who have been disenrolled due to a failure to complete redeterminations based on the available information for each individual in the household; (3) fix the state’s systems and processes to ensure that redeterminations are conducted appropriately; and (4) implement a mitigation strategy to prevent continued inappropriate terminations until the state has fixed all systems and processes to be in compliance with federal renewal requirements. States were required to submit the state’s plan and timeline for remediation to CMS.

In September 2023, the Department reported to CMS that it was not fully in compliance with the federal requirements for determining eligibility for each individual in the household, and it submitted a mitigation plan and timeline to fix the CBMS system and Department’s processes to ensure that redeterminations were conducted appropriately in the future. As part of the Department’s mitigation plan, automatic terminations of any households who did not return a renewal form were temporarily paused until a short-term system fix was put in place. In October 2023, a CBMS fix was put into place for households that did not return their renewal forms. CBMS continued to send renewal forms to households requesting additional information; however, for any multi-member household that did not return its form, the Department started reviewing eligibility for all members of the household individually. This short-term system fix brought the Department into compliance with federal ex parte renewal requirements. The Department is currently working on a permanent system change for CBMS that will only send out renewal forms for individuals not eligible through the ex parte process, with targeted implementation by December 2026.

Why does this problem matter?

When the Department is out of compliance with federal requirements, such as Medicaid requirements, the Department risks sanctions and/or other penalties. After CMS identified the Department’s noncompliance related to the Medicaid ex parte renewal issue, the Department researched the issue and identified 7,510 individuals who were incorrectly disenrolled from Medicaid or CBHP during the period May 2023 to October 2023. In November 2023, the Department retroactively reinstated these individuals’ eligibility back to the date at which their household was terminated, without a gap in coverage. In addition, the individuals were notified that their coverage had been reinstated and provided information on how to obtain payment for unpaid medical bills and/or ensure that any eligible service during the period that the individual was disenrolled were covered. See Schedule of Findings and Questioned Costs for chart/table. Recommendation 2024-033

The Department of Health Care Policy and Financing should strengthen its internal controls over Medicaid eligibility to ensure compliance with federal and state regulations by continuing to implement the Colorado Benefits Management System change related to the ex parte eligibility process to ensure that eligibility is determined on an individual rather than household basis, as required.

Response Department of Health Care Policy and Financing

Agree Implementation Date: December 2026

The Department agrees to strengthen its internal controls over Medicaid eligibility to ensure compliance with federal and state regulations. Colorado will continue its approved Centers for Medicare and Medicaid mitigation plan to ensure that eligibility is determined on an individual rather than a household basis. The Department will continue to conduct ex parte reviews to determine eligibility for all household members based on available information. Those members identified as eligible at ex parte will be approved, regardless if others in the household continue to need verifications or are no longer eligible. The Department is currently working on a permanent system change for CBMS that will only send out renewal forms for individuals not eligible through the ex parte process, with implementation by December 2026.

Finding 2025-038 Internal Controls and Compliance over Student Financial Assistance Cluster – NSLDS Reporting The federal Department of Education (USDE) requires institutions of higher education who receive Title IV Student Financial Assistance funds (Title IV) to report student enrollment information within specified timeframes to the USDE through its central database for student financial assistance, the National Student Loan Data System (NSLDS). Enrollment reporting, including the submission of student roster files and enrollment status changes, assists the federal government in managing the Pell Grant and Direct Loan programs, which are both parts of the Student Financial Assistance Cluster. In accordance with federal requirements, each campus within the Colorado State University – System (CSU-System)—Colorado State University, Colorado State University – Pueblo and Colorado State University – Global Campus—submits student roster files to NSLDS via a thirdparty servicer, the National Student Clearinghouse (Clearinghouse), and each roster file is then uploaded by the Clearinghouse directly to NSLDS. The Registrar’s Office at each campus of the CSU-System compiles the student roster files to report details such as the campus-level enrollment and program attendance for the students who have received federal Title IV aid at the CSU-System. Each campus performs an initial review of participating students’ enrollment information during each semester’s census, which is typically during the second week of the semester, for reporting to USDE through the NSLDS. The initial review of participating students’ enrollment information is performed using enrollment information generated by each campus’s Financial Aid system (reporting system). After the census date each semester, the Registrar Office’s staff prepare student roster files of enrollment status that include information on reductions or increases in attendance levels, graduation, withdrawals, and/or students who have been accepted for enrollment but never attended. The Registrar’s Office prepares this through a manual comparison of applicable students’ enrollment status at the census date to the current enrollment status per each campus’s reporting system. During Fiscal Year 2025, the CSU-System issued approximately $306.0 million of federal Title IV aid during the year, which included approximately $64.6 million and $238.0 million of Pell Grant and Direct Loan funding, respectively. What was the purpose of our audit work and what work was performed? The purpose of our audit work was to determine whether each campus within the CSU-System had adequate internal controls over and complied with federal Title IV Student Financial Assistance enrollment reporting requirements regarding the student attendance status changes for Pell Grants and Direct Loan programs during Fiscal Year 2025. As part of our Fiscal Year 2025 testwork, we reviewed a total random sample of 40 student’s enrollment status change information, consisting of 26 students at Colorado State University, 10 students at Colorado State University – Global Campus, and 4 students at Colorado State University – Pueblo, that was required to be reported to USDE through NSLDS during Fiscal Year 2025 The sample consisted of enrollment status changes that occurred during the Fall 2024 and Spring 2025 semesters. For each student in our sample, we compared information within the CSU-System’s Financial Aid system to information contained on the NSLDS website for the specific enrollment status change selected, such as a withdrawal, graduation, or a change in enrolled credit hours, to determine if the information was reported accurately and within the federally required timelines. How were the results of the audit work measured? We measured the results of our audit work against the following: Under the federal Pell Grant and Direct Loan program requirements, 34 CFR 690.83(b)(2) and 34 CFR 685.309(b)(2), an institution must report any enrollment status changes, including the date of the change, per the institution’s reporting system, to NSLDS for participating students within 60 days of the change. An institution must report a change in a student’s enrollment status to NSLDS when there is a (a) reduction or increase in the student’s attendance levels, (b) graduation, (c) withdrawal, and/or (d) a student who has been accepted for enrollment but never attended. Institutions are responsible for timely reporting whether they report directly or via a third-party servicer. We measured the results of our testing against the USDE-required 60-day timeframe for submission of student roster files. What problems did the audit work identify? We found that the Colorado State University and Colorado State University – Pueblo campuses did not timely report the student enrollment status changes to the USDE through NSLDS for 2 out of the 40 (5 percent) students we tested during the Fall 2024 and Spring 2025 semesters. Specifically, one student’s enrollment status information during the Fall 2024 semester at Colorado State University was submitted 166 days beyond the federal reporting requirement and one student’s enrollment status information during the Fall 2024 semester at Colorado State University – Pueblo was submitted 18 days beyond the federal reporting requirement. Why did these problems occur? The Colorado State University and Colorado State University – Pueblo campuses did not have adequate review processes in place to ensure that it fully complied with federal student enrollment reporting requirements for the Title IV Student Financial Assistance program. For both instances, the Student Financial Assistance Office staff at each campus indicated that the student enrollment status was not reported timely because the new students, who were first enrolled at their respective campus during the Fall 2024 semester, were not included in the student roster files used to compare each students’ enrollment status at the census date to the current status in the reporting system due to the reports used to perform the manual comparison not being correctly configured to capture all student enrollment status of students who first enrolled during the Fall 2024 semester. Additionally, the review process failed to adequately ensure the completeness of the prepared student roster files. As a result, those changes were not included in the enrollment status report submitted by the Clearinghouse to NSLDS within the required federal reporting timeframe. Why do these problems matter? Enrollment reporting assists lenders in the determination of whether a borrower should be moved into loan repayment status or if they are eligible for an in-school deferment. Thus, if the CSUSystem campuses fail to meet the required reporting timelines, the borrower’s repayment responsibilities may be reported incorrectly and result in either a lack of timely repayments by the borrower or the student being inappropriately moved into loan repayment status. See "Schedule of Findings and Questioned Costs" for table/chart. Recommendation 2025-038 The Colorado State University and Colorado State University – Pueblo campuses should strengthen their internal controls over reporting Student Financial Assistance Pell Grants and Direct Loan Program’s student enrollment to the U.S. Department of Education (USDE) to ensure student enrollment status changes are submitted by the National Student Clearinghouse to USDE’s National Student Loan Data System within 60-days of any enrollment change. This should include improving their review processes over the preparation and completeness of the student roster files used to compare each student’s enrollment status at the census date to current enrollment status in the reporting system to ensure that the student roster files include all students that are newly enrolled at the campus. Response Colorado State University System Agree Implementation Date: June 2026 The Colorado State University and Colorado State University – Pueblo campuses will strengthen their internal controls to ensure enrollment changes are reported within the required 60-day timeline for newly enrolled students. Additionally, the Colorado State University and Colorado State University – Pueblo campuses will improve the documentation provided as part of compliance testing as both students referenced within the finding were unique situations. In both instances referenced, additional context was not provided during compliance testing for both students that was not captured on the provided National Student Loan Data System Campus Enrollment Details webpage that showed the appearance of reporting an enrollment status change outside of the 60-day requirement. For the Colorado State University, the student was reported with an effective date of the beginning of the Fall 2024 Semester but did not complete verification procedures until February 2025 and was then disbursed the Fall 2024 portion of their Pell Grant. For Colorado State University – Pueblo, the student was reported with an effective date of the beginning of the Fall 2024 Semester, but corrections were required on the student’s FAFSA before federal student financial aid could be disbursed. The campuses will improve documentation provided during compliance testing for when these unique situations with enrollment reporting occur.

Finding 2025-039 Internal Controls and Compliance with Special Tests and Provisions for Student Financial Assistance Metropolitan State University of Denver (MSU-Denver) receives funding from the federal Department of Education’s (USDE) Title IV Student Financial Assistance (Student Financial Aid) program, which requires MSU-Denver to obtain sensitive data from students. For example, MSUDenver obtains personally identifiable financial and tax information from students in order to administer its federal Student Financial Aid program. As a result, MSU-Denver’s Information Technology Services (ITS) department is responsible for ensuring compliance with the federal Gramm-Leach-Bliley Act (GLBA). The GLBA, which was enacted in 1999, mandates that financial institutions disclose their information-sharing practices and provide consumers with opt-out options for their personal data. It also established the Financial Privacy Rule, which requires institutions to protect sensitive customer information and provide clear privacy notices to customers. Before MSU-Denver receives federal Student Financial Aid from USDE, MSU-Denver agrees to adhere to compliance requirements within a Program Participation Agreement (PPA), and a Student Aid Internet Gateway Agreement (SAIGA). One of the compliance requirements MSU-Denver agrees to within the PPA and SAIGA is the GLBA, which requires MSU-Denver to explain their information-sharing practices with their students and safeguard sensitive data, with particular attention to information provided to MSU-Denver by the USDE or otherwise obtained in support of the administration of MSU-Denver’s Student Financial Aid program. The GLBA requirements are codified in Title 16, Part 314, Section 4 of the Code of Federal Regulations (16 CFR 314.4), and requires MSU-Denver to develop, implement, and maintain a comprehensive written information security program (WISP) in one or more readily accessible parts. This federal regulation also specifies the elements and safeguards that MSU-Denver’s WISP needs to include for the protection of students’ financial aid information. What was the purpose of our audit work and what work was performed? The purpose of our audit work was to review MSU-Denver’s internal controls over its WISP, and determine if it included the minimum elements and safeguards required by the GLBA during Fiscal Year 2025. Our review included obtaining MSU-Denver’s WISP and performing the following procedures: • We met with MSU-Denver’s ITS management to determine how it developed, implemented, and maintained its WISP. • We compared MSU-Denver’s WISP to the elements and safeguards required by the GLBA. • We reviewed the ITS’ policies and procedures to determine if MSU-Denver had suitably designed and implemented the GLBA required elements and safeguards during Fiscal Year 2025. How were the results of the audit work measured? We measured the results of our audit against federal regulation 16 CFR 314.4, which states that an institution’s WISP, at a minimum, must include the seven following elements that include eight minimum safeguards: 1. Designate a qualified individual responsible for overseeing and implementing the institution’s information security program and enforcing the information security program. 2. Provide for the information security program to be based on a risk assessment that identifies reasonably foreseeable internal and external risks to the security, confidentiality, and integrity of customer information that could result in the unauthorized disclosure, misuse, alteration, destruction, or other compromise of such information, and assesses the sufficiency of any safeguards in place to control these risks. 3. Provide for the design and implementation of safeguards to control the risks the institution identifies through its risk assessment. At a minimum, the following are the eight safeguards that a WISP must address: i. Implement and periodically review access controls. ii. Conduct a periodic inventory of data, noting where it is collected, stored, or transmitted. iii. Encrypt customer information on the institution’s system and when it is in transit. iv. Assess applications developed by the institution. v. Implement multi-factor authentication for anyone accessing customer information on the institution’s system. vi. Dispose of customer information securely. vii. Anticipate and evaluate changes to the information system or network. viii. Maintain a log of authorized users’ activity and keep an eye out for unauthorized access. 4. Provide for the institution to regularly test or otherwise monitor the effectiveness of the safeguards it has implemented. 5. Provide for the implementation of policies and procedures to ensure that personnel are able to enact the information security program. 6. Address how the institution will oversee its information system service providers. 7. Provide for the evaluation and adjustment of its information security program in light of the results of the required testing and monitoring; any material changes to its operations or business arrangements; the results of the required risk assessments; or any other circumstances that it knows has reason to know may have a material impact on the institution’s information security program. What problem did the audit work identify? Based on our audit work, we determined that MSU-Denver’s WISP addressed some, but not all, of the elements that institutions must address. Specifically, the WISP did not address the three following elements: 1. Design and implementation of the three following safeguards: i. Conducting a periodic inventory of data, noting where it is collected, stored, or transmitted. ii. Assessing applications developed by the institution. iii. Implementing multi-factor authentication for anyone accessing customer information on the institution’s system. 2. Regular testing or monitoring the effectiveness of the safeguards MSU-Denver implemented. 3. Evaluation and adjustment of MSU-Denver’s WISP in light of the results of the required testing and monitoring. Why did this problem occur? MSU-Denver did not have adequate internal controls in place to ensure that its WISP fully complied with the requirements of federal regulation 16 CFR 314.4 because its WISP was only in draft form and the ITS department did not have a proper process in place to review its WISP and update it to reflect current federal requirements. MSU-Denver’s ITS management indicated that a WISP that meets these federal requirements is being developed and, once approved by MSU-Denver leadership, will become an official policy. Why does this problem matter? Protecting students’ sensitive data is a critical compliance requirement for institutions participating in the USDE’s Student Financial Aid program. Without the proper development, implementation, and maintenance of a WISP to ensure that MSU-Denver addresses all of the required elements and safeguards specified in federal regulation 16 CFR 314.4, MSU-Denver increases its exposure to potential data breaches, loss of data, or other fraudulent acts that could occur. Additionally, failure to comply with the GLBA increases MSU-Denver’s risk of material noncompliance with the USDE’s Student Financial Aid program requirements. See " Schedule of Findings and Questioned Costs" for table/chart. Recommendation 2025-039 The Metropolitan State University of Denver’s (MSU-Denver) Information Technology Services (ITS) department should strengthen its internal controls over information security by establishing, implementing, and maintaining a comprehensive written information security program (WISP) that reflects the current federal requirements of the Gramm-Leach-Bliley Act. This should include processes for ITS to test and monitor its information security to determine when adjustments are needed to the MSU-Denver WISP, and to obtain a formal review and approval of the WISP from MSU-Denver’s leadership. Response Metropolitan State University of Denver Agree Implementation Date: June 2026 MSU Denver IT Security will update its written information security program to address the necessary requirements of the Gramm-Leach-Bliley Act. The WISP will be reviewed and updated at least once each year, with updates being based on risk assessments, audits, changes to the environment, and any incidents which indicate a need for changes to the WISP. The updated WISP will include existing policies as well as new policies that describe standards for: • Periodic inventory of data • Multi-Factor Authentication, Single Sign-On, and passwords • Assessment of applications developed by the institution • Testing our safeguards The updated WISP will be formally reviewed and approved by the Chief Financial Officer by June 30, 2026.

Finding 2025-040 Internal Controls and Compliance Over Student Financial Assistance Cluster – NSLDS Reporting The federal Department of Education (USDE) requires institutions of higher education that receive Title IV Student Financial Assistance (Student Financial Aid) funds to report enrollment information within specified timeframes to the USDE through its central database for student assistance, the National Student Loan Data System (NSLDS). Enrollment reporting, through the submission of student roster files with enrollment status changes, assists the federal government in managing the Pell Grant and Direct Loan programs, which are both parts of Student Financial Aid. In accordance with federal requirements, the Metropolitan State University of Denver (MSUDenver) submits student roster files with enrollment status changes to the National Student Clearinghouse (Clearinghouse), a third-party service provider. The Clearinghouse uploads MSUDenver’s student roster files with enrollment status changes directly to NSLDS. MSU-Denver’s Registrar’s Office (Registrar’s Office) compiles the student roster file to report details about students, such as the campus-level enrollment and program attendance for the students who have received Student Financial Aid at MSU-Denver. The Registrar’s Office performs an initial review of participating students’ enrollment information during the census, which is typically during the second week of the semester, for reporting to NSLDS. After the census date each semester, the Registrar’s Office staff prepare student roster files of enrollment status changes, such as a withdrawal, graduation, or a change in enrolled credit hours, through a manual comparison of applicable students’ enrollment status at the census date to the current enrollment status on MSUDenver’s reporting system, Banner. During Fiscal Year 2025, MSU-Denver issued approximately $95.1 million in federal Student Financial Aid to its enrolled students during the year, which included approximately $40.5 million and $52.7 million of Pell Grants and Direct Loan funding, respectively. What was the purpose of our audit work and what work was performed? The purpose of our audit work was to determine whether MSU-Denver had adequate internal controls over, and complied with, requirements for reporting enrollment status changes to the USDE for Pell Grants and Direct Loan programs during Fiscal Year 2025. As part of our Fiscal Year 2025 testwork, we reviewed enrollment information that MSU-Denver was required to report to USDE via NSLDS during Fiscal Year 2025 for a random sample of 40 students. For each student in our sample, we compared information within MSU-Denver’s Financial Aid system to information contained on the NSLDS website for the specific enrollment status change selected, such as a withdrawal, graduation, or a change in enrolled credit hours, to determine if MSU-Denver reported the information accurately and no later than USDE’s deadlines. How were the results of the audit work measured? We measured the results of our audit work against the following: Under the federal Pell Grant and Direct Loan program requirements, 34 CFR 690.83(b)(2) and 34 CFR 685.309(b)(2), an institution must report any enrollment status changes through student roster files, including the date of the change, to NSLDS for participating students within 60 days of the change. An institution must report a change in a student’s enrollment status to NSLDS when there is a (a) reduction or increase in the student’s attendance levels, (b) graduation, (c) withdrawal, or (d) a student accepted for enrollment but never attended. Institutions are responsible for submitting their enrollment status reporting no later than the required federal deadlines regardless of whether they report directly through NSLDS or via a third-party servicer. We measured the results of our testing against the USDE’s 60-day timeframe for submitted roster files. What problem did the audit work identify? We found that MSU-Denver did not report enrollment status changes to the USDE by the required federal deadlines for 14 of the 40 (35 percent) students we tested. Specifically, MSU-Denver reported enrollment status changes for these 14 students between 18 to 53 days after USDE’s 60- day enrollment status change reporting requirement. These delays occurred between December 2024 and April 2025 and related to the following enrollment status changes: 12 of the students we tested graduated from MSU-Denver, one of the students we tested withdrew from MSU-Denver, and one of the students we tested had a change in enrolled credit hours. Why did this problem occur? MSU-Denver did not have adequate internal controls in place to ensure that it fully complied with federal student enrollment reporting requirements for the Student Financial Aid program. The Registrar’s Office staff indicated that the student roster files prepared from Banner that were submitted to the Clearinghouse were rejected by the Clearinghouse due to errors within the configuration of student roster files. This technical issue required the Registrar’s Office to reconfigure the student roster files that are prepared for submission to the Clearinghouse. The timing of when the Clearinghouse notified the Registrar’s Office of the rejections of the student roster files, and the reconfiguration that was required, resulted in MSU-Denver not reporting enrollment status changes within USDE’s required timeframe. Why does this problem matter? Enrollment reporting is a critical compliance requirement for institutions participating in the federal Student Financial Aid program. For recipients of Pell Grants, timely enrollment reporting by institutions assists with their eligibility, future disbursement amounts, and continued access to Student Financial Aid. For borrowers of Direct Loans, timely enrollment reporting by institutions assists the USDE in the determination of whether a borrower should be moved into loan repayment status or if they are eligible for an in-school deferment. Failure to meet the USDE’s required enrollment status change reporting timelines increases MSU-Denver’s risk of material noncompliance with federal Student Financial Aid program requirements. See " Schedule of Findings and Questioned Costs" for chart/table. Recommendation 2025-040 The Metropolitan State University of Denver (MSU-Denver) should strengthen its internal controls over enrollment reporting to the federal Department of Education (USDE) for students who receive Title IV Student Financial Assistance through Pell Grants or the Direct Loan Program. This should include preparing student roster files in the correct configuration to ensure that these changes are submitted by the National Student Clearinghouse (NSC) to USDE’s National Student Loan Data System within 60-days of the enrollment change, as required by federal regulations. Response Metropolitan State University of Denver Agree Implementation Date: June 2026 MSU Denver manages enrollment reporting within the Office of the Registrar. We develop a schedule each calendar year and semester with NSC to identify scheduled reporting dates for each term in alignment with critical semester dates (start, end, drop, etc.). In Fiscal Year 2025, there was a technical issue in which we had to work with our ERP vendor, Ellucian, to provide a solution. The Office of the Registrar will strengthen its internal controls to ensure enrollment changes are reported within the required 60-day timeline.

Finding 2025-041 AWARE – Information Security and Change Management Government Auditing Standards allow for information that is considered sensitive in nature, such as detailed information related to IT system security, to be issued through a separate “classified or limited use” report because of the potential damage that could be caused by the misuse of this information. We consider the specific technical details of this finding, along with the response, to be sensitive in nature and not appropriate for public disclosure. Therefore, the details of the following finding and response have been provided to the Department in a separate, confidential memorandum. The Department of Labor and Employment’s Division of Vocational Rehabilitation administers the federal Rehabilitation Services – Vocational Rehabilitation Grants to States [ALN 84.126] (Vocational Rehabilitation) program and relies on its Accessible Web-Based Activity and Reporting Environment (AWARE) IT system to aid with management of the program and to track expenditures. The AWARE system is a configurable, off-the-shelf (COTS) system that is managed and hosted by the Department’s third-party IT service provider, Alliance Enterprises (Alliance). Department staff access the system via a secure Web portal. Program information is stored on servers and databases managed by Alliance. Alliance developed the AWARE system specifically to meet federal requirements for Vocational Rehabilitation program services and is used by multiple states. In order for the Department to achieve its objectives and respond to risks, including those related to the federal programs it administers, management should establish a strong framework of internal controls that also includes information system controls. Specifically, information system controls typically start with management documenting IT policies that address IT general control responsibilities and procedures that document the more granular details of how to implement Department policies. These IT general control policies and procedures should include those policies and procedures that are specific to information security and access management. The Department has policies that define the rules for various software systems based on the Department’s needs and security requirements; and the AWARE System Security Plan (SSP), which lists security requirements and describes the controls that must be in place to ensure all the security policy requirements are met. Once policies and procedures have been formalized and communicated to responsible staff and the Department’s contractor, specific internal control activities can be implemented and operationalized. What was the purpose of our audit work and what work was performed? The purpose of the audit work was to gain an understanding of, and determine whether the Department had designed and implemented IT general controls, specifically information security and change management controls, over the AWARE system. Our audit work consisted of inquiries to the Department to gain an understanding of these IT general control areas, along with a review of related documentation provided by the Department staff. How were the results of the audit work measured? We applied the following criteria when evaluating the design effectiveness of the IT general controls: • The Governor’s Office of Information Technology (OIT)’s Colorado Information Security Policies (Security Policies). • Federal regulations [2 CFR 200.303] require the Department to establish and maintain effective internal controls, including IT general controls, over federal awards that provide reasonable assurance that the Department is managing its federal awards in compliance with federal statutes, regulations, and the terms and conditions of the federal award. • Standards for Internal Control in the Federal Government (Green Book), published by the U.S. Government Accountability Office (GAO), is a leading industry internal control framework. The Office of the State Controller (OSC) has adopted the Green Book as the State’s standard for internal controls, which all state agencies must follow. Green Book, Paragraphs 3.09, Documentation of the Internal Control System, and 12.02, Documentation of Responsibilities through Policies, requires that management develop and maintain documentation of its internal control system and document in policies the internal control responsibilities of the organization. Green Book, Paragraph 12.05, Periodic Review of Control Activities, also requires that management periodically review policies and procedures for continued relevance and effectiveness in achieving the entity’s objectives or addressing related risks. If there is a significant change in an entity’s process, management should review this process in a timely manner after the change to verify that the control activities are designed and implemented appropriately. • Green Book, Paragraph 14.03, Communication throughout the Entity, prescribes that management should communicate quality information to enable personnel to perform key roles in achieving objectives, addressing risks, and supporting the internal control system. In these communications, management should assign the internal control responsibilities for key roles. What problems did the audit work identify? During Fiscal Year 2025, we identified problems with the Department’s information security and change management IT general controls for the AWARE system. Why did these problems occur? According to the Department, it is in the final stages of modernizing a new case management system that will replace its current AWARE system and, therefore, did not update its SSP or policies and procedures for AWARE during Fiscal Year 2025. Department staff indicated that they expected AWARE to be decommissioned prior to the end of Fiscal Year 2025, and therefore determined it was not feasible to update the AWARE SSP during Fiscal Year 2025 to comply with OIT’s Security Policies. However, deployment of the new system was delayed due to the Department working through the new system’s User Acceptance Testing. The Department indicated that it will develop policies for the new case management system during the modernization process, which it expects to be finalized with the decommissioning of AWARE in January 2026. Why do these problems matter? It is important for the Department to have an effective system of internal controls in place in order to meet its objectives and comply with federal requirements for the Vocation Rehabilitation program. Without an effective internal control system, the reliability of the data processed, stored, and reported on by the Department’s IT system for the Vocational Rehabilitation program can be adversely impacted. When IT policies and procedures are not maintained, updated, and communicated, Department staff, and others who are subject to the requirements and processes, may not be able to adequately manage or consistently apply IT policy requirements and processes to meet management’s objectives and expectations, respond to risks appropriately, and ensure the confidentiality, integrity, and availability of the Department’s information systems. See "Schedule of Findings and Questioned Costs" for table/chart. Recommendation 2025-041 The Department of Labor and Employment should improve its overall IT governance and information security IT general controls for the information system used for the Rehabilitation Services – Vocational Rehabilitation Grants to States program by: A. Implementing recommendation Part A as noted in the confidential finding. B. Implementing recommendation Part B as noted in the confidential finding. Response Department of Labor and Employment A. Agree Implementation Date: July 2026 The Department will implement Part A of the confidential finding. B. Agree Implementation Date: July 2026 The Department will implement Part B of the confidential finding.

Finding 2025-042 MyUI+ – IT Governance and Information Security Government Auditing Standards allow for information that is considered sensitive in nature, such as detailed information related to information technology system security, to be issued through a separate “classified or limited use” report because of the potential damage that could be caused by the misuse of this information. We consider the specific technical details of this finding, along with the response, to be sensitive in nature and not appropriate for public disclosure. Therefore, the details of the following finding and response have been provided to the Department in a separate, confidential memorandum. The Department administers the federal Unemployment Insurance (UI) program, and relies on its IT system, MyUI+, to aid with determining applicants’ eligibility for the UI program and to provide data necessary for federal reporting to the U.S. Department of Labor for the UI program. The Department is the business owner of the MyUI+ system and works with OIT and the Department’s external IT service provider to manage MyUI+. The OSC has adopted the GAO’s Green Book as the State’s standard for internal controls, which all state agencies must follow. For the Department to achieve its objectives and respond to risks, including those related to the federal programs it administers, management should establish a strong framework of internal controls that also address information system controls. Specifically, information system controls typically start with management documenting IT policies that address IT general control responsibilities and procedures that document the more granular details on how to implement Department policies. These IT general control policies and procedures should include those policies and procedures that are specific to information security, for example controls related to issuing new user credentials. Once the Department has formalized and communicated its policies and procedures to responsible staff, specific internal control activities can be implemented and operationalized. OIT has promulgated the Security Policies that apply to the Department and its systems, and outline specific business owner IT requirements with which the Department must comply. What was the purpose of our audit work and what work was performed? The purpose of our audit work was to determine whether the Department implemented our Fiscal Year 2024 audit recommendations related to MyUI+. As part of our recommendations, we recommended that the Department should improve its IT governance for the MyUI+ system by: • Formalizing and communicating IT procedures guidance to Department staff and the Department’s IT service provider performing IT general control activities, including a Department-defined periodic review process of OIT’s Security Policies to ensure the Department’s IT policies, procedures, and rules align with the most current version of the Security Policies. • Implementing the recommendation as noted in the confidential finding. The Department agreed with these recommendations and planned to implement them by June 2025. Our audit work consisted of assessing the design and implementation of the Department’s IT policies and procedures, through inquiry with Department staff and inspection of supporting documentation. How were the results of the audit work measured? We measured the results of our audit work against the following: • OIT Security Policies that are developed, published, and required to be followed by the Department and its external IT service providers state within the Policy section and the General Responsibilities section, specifically 8.3.1 and 8.3.2 for business owners, that all agencies, including the Department, must implement governance principles, which would include IT policies and procedures, for promoting data quality and integrity for their systems. OIT Security Policies also indicate that the Department, as the business owner for MyUI+, is responsible for following and adhering to all identified business owner requirements. • OIT Security Policies and IRS Publication 1075, Tax Information Security Guidelines for Federal State and Local Agencies. Department management stated that it aligns with IRS Publication 1075 for its systems even though MyUI+ does not contain Federal Tax Information, which is the focus of Publication 1075’s security requirements. • Federal regulations [2 CFR 200.303] require the Department to establish and maintain effective internal controls, including IT general controls, over federal awards that provide reasonable assurance that the Department is managing its federal awards in compliance with federal statutes, regulations, and the terms and conditions of the federal award. • Green Book, Paragraphs 3.09, Documentation of Internal Control System, and 12.02, Documentation of Responsibilities through Policies, states that management should develop and maintain documentation of its internal control system and document in policies the internal control responsibilities of the organization. Paragraphs 11.06 and 11.07, Design Appropriate Types of Control Activities, state that management should design appropriate types of control activities in the entity's information system, including information system general controls that facilitate the proper operation of the entity’s systems. What problems did the audit work identify? The Department did not fully implement our prior audit recommendations to improve its IT governance related to MyUI+ during Fiscal Year 2025. Specifically: • The Department took steps to implement the recommendation by beginning to formalize IT procedures for MyUI+, including those that defined a required periodic review of OIT’s Security Policies; however, the Department did not have the formalized procedures in place nor had it communicated the procedures to employees or its IT service provider by the end of Fiscal Year 2025. • We found that the Department did not fully implement the confidential prior audit recommendation during Fiscal Year 2025, which put the Department at risk for not complying with Publication 1075. Why did these problems occur? According to the Department, the review, updating, and communication process of its procedures did not occur by the end of Fiscal Year 2025 due to turnover and contract renegotiations, resulting in partial implementation of the recommendations by fiscal year end. Why do these problems matter? The lack of established IT policies and procedures make it difficult for Department management to measure and hold staff accountable for meeting management’s expectations, as well as ensuring risks are addressed and overall objectives and missions are fulfilled. Without policies and procedures, staff may not perform processes and controls in a consistent manner. The identified deficiencies increase the risk of system compromise and can affect the confidentiality, integrity, and availability of the MyUI+ system, as well as adversely impact the reliability of data that is processed, stored, and generated by the system. Additionally, if the MyUI+ information security processes and controls are not appropriately implemented and operating effectively, the Department may not be able to ensure compliance with federal requirements, OIT’s Security Policies, and Publication 1075. See "Schedule of Findings and Questioned Costs" for table/chart. Recommendation 2025-042 The Department of Labor and Employment (Department) should improve its overall IT governance and information security IT general controls, and work with its IT service provider, as applicable, for the MyUI+ information system by: A. Prioritizing staffing to complete and communicate the formalized IT procedures, including a required Department-defined periodic review process of the Colorado Information Security Policies, developed and published by the Governor’s Office of Information Technology, to Department staff and the Department’s IT service provider performing IT general control activities for MyUI+. B. Implementing recommendation Part B as noted in the confidential finding. Response Department of Labor and Employment A. Agree Implementation Date: April 2026 The Department will complete and communicate formalized IT procedures to staff and IT service providers for IT general control activities for MyUI+ by April 2026. B. Agree Implementation Date: April 2026 The Department will implement Part B of the confidential finding.

Finding 2025-043 Compliance with Reporting for Community Development Block Grant program The Department administers the federal Community Development Block Grant/State’s program and Non-Entitlement Grants in Hawaii (Community Development Block Grant or CDBG) [ALN 14.228] for non-entitlement municipalities and counties to carry out community development activities. The federal government splits the Department’s CDBG program into sub-programs related to the CARES Act (CDBG-CV), Disaster Recovery (CDBG-DR), and the Neighborhood Stabilization Program (CDBG-NSP). The CARES (Coronavirus Aid, Relief, and Economic Security) Act, enacted March 27, 2020, appropriated $5.0 billion in CDBG-CV funds to be allocated to about 1,250 states, local governments, and insular areas to fund activities to prevent, prepare for, and respond to Coronavirus. CDBG-CV and CDBG grants are a flexible source of funding that can be used to pay costs that are not covered by other sources of assistance, particularly to benefit persons of low and moderate income. The primary objective for CDBG-DR is to provide disaster relief, long-term recovery, restoration of infrastructure and housing, and economic revitalization in the most impacted and distressed areas resulting from a major disaster, declared pursuant to the Robert T. Stafford Disaster Relief and Emergency Assistance Act of 1974. The objectives of the CDBG-NSP are to: (1) stabilize property values, (2) arrest neighborhood decline, (3) assist in preventing neighborhood blight, and (4) stabilize communities across America hardest hit by residential foreclosures and abandonment. These objectives have been achieved through the purchase and redevelopment of foreclosed and abandoned homes and residential properties that allows those properties to turn into useful, safe and sanitary housing. The grants are to be considered CDBG funds. The Department is required to submit financial information electronically to the federal Housing and Urban Development (HUD) Exchange IT system on an annual basis. The Department is required to submit various reports that include the following: • Performance reports titled, Performance and Evaluation Financial Summary Reports (PR28), are required to list all of the financial activity related to the CDBG program and CDBG-CV subprogram. • Quarterly Performance Reports for the CDBG-DR program and CDBG-NSP. The Quarterly Performance Reports include the Department’s activities related to the CDBG grant for these sub-programs on a quarterly basis. The Department is also required to comply with the Federal Funding Accountability and Transparency Act of 2006 (Transparency Act or FFATA) for its CDBG awards. The Transparency Act was created to empower Americans with the ability to hold the government accountable for each spending decision and, as a result, to reduce wasteful spending by the government. The Transparency Act requires the federal government to make certain information on federal awards, including information about amounts passed through to subrecipients, or subawards, given to other governments or nonprofit organizations, available to the public. Federal regulations [2 CFR 200.1] define a subaward as an award provided by a pass-through entity, in this case the Department, to an entity to carry out part of a federal grant award received by the pass-through entity. A subrecipient is defined in federal regulations [2 CFR 200.1] as an entity, usually but not limited to non-federal entities, that receives a subaward from a pass-through entity to carry out part of a federal award; but does not include an individual that is a beneficiary of such award. A subrecipient may also be a recipient of other federal awards directly from a federal awarding agency. The Department is required to submit FFATA information through the FFATA Subaward Reporting System (formerly FSRS)—the System for Award Management (SAM.gov). Once the Department submits a report to SAM.gov, the public can view information from the report, including the subrecipient’s name, subaward identification number, subaward obligation/action date, subaward amount, federal awarding agency and subagency, the Department’s name, and the Department’s grant award identification number. In Fiscal Year 2025, the Department made 25 CDBG subawards to 18 subrecipients totaling $10.2 million that were subject to FFATA reporting. What was the purpose of our audit work and what work was performed? The purpose of the audit work was to identify and review the operational effectiveness of the Department’s internal controls and compliance over the federal reporting process for the CDBG program, and determine whether the reports were prepared and submitted in accordance with state and federal regulations. During our audit, we reviewed two PR28 Performance and Evaluation Financial Summary Reports—one for CDBG overall and one for the CDBG-CV sub-program filed by the Department during Fiscal Year 2025—and the related supporting documentation. We also reviewed eight Quarterly Performance Reports—four reports for each of the CDBG-DR and CDBG-NSP subprograms filed by the Department for Fiscal Year 2025—and the related supporting documentation. Additionally, we received the Department’s sub-awardee report submitted to SAM.gov for FFATA reporting for Fiscal Year 2025 for the CDBG grant and tested 7 of the 25 subawards listed on the report. We used both performance and sub-awardee reports to determine if the financial activity in these reports could be traced to the expenditures recorded within the Colorado Operations Resource Engine (CORE), the State’s accounting system, for the CDBG grant program for Fiscal Year 2025. We also performed testwork to determine if the performance and sub-awardee reports were reviewed and approved internally, submitted in a timely manner, and approved by HUD. How were the results of the audit work measured? For the CDBG program, we measured the results of our audit work against the following requirements: • As noted previously, the Department is required to submit certain financial information electronically to HUD through its HUD Exchange system on an annual basis. HUD requires that the reports be prepared in accordance with Generally Accepted Accounting Principles (GAAP). Per the federal Office of Management and Budget’s (OMB) Compliance Supplement, the various reports that the Department must submit include the following: PR28 Performance and Evaluation Financial Summary Reports for the CDBG program and CDBG-CV sub-program. This report is required to list all of the financial activity related to the CDBG program, such as the overall benefit to low- and moderate-income persons, the maximum allowable costs for administration, technical assistance, and overall planning, management and administration, and must be submitted quarterly, 30 days after the reporting period end date. Quarterly Performance Reports for the CDBG-DR program and CDBG-NSP. The Quarterly Performance Reports must cover all expenditures on the cooperative agreement from the start date of the reporting period to the reporting period end date related to the CDBG grant for these sub-programs and must be submitted on a quarterly basis. • In accordance with federal regulations [2 CFR 170, Appendix A], the Department is required to report subawards of $30,000 or more to SAM.gov by the end of the month following the month in which the award was made. For example, the Department would have to submit a FFATA report to SAM.gov in May 2025 if it made an award or supplemental award equal to or greater than $30,000 in April 2025. • Federal regulations [2 CFR 200.303] state that recipients of federal funds must establish and maintain effective internal controls over their federal awards which provide reasonable assurance that the recipient is managing its federal grants in compliance with federal statutes, regulations, and the award terms and conditions. These internal controls should be in compliance with the Standards for Internal Control in the Federal Government (Green Book), published by the U.S. Government Accountability Office. Green Book states in Paragraphs 3.09 and 3.10 that management is to develop and maintain documentation of its internal control system, establishing the who, what, when, where, and why of internal control execution to personnel. What problems did the audit work identify? We identified problems in all of the Department’s reports for CDBG that we tested for Fiscal Year 2025. Specifically: • We identified issues in both of the two (100 percent) PR28 performance reports we reviewed. Specifically, we could not tie disbursement amounts for the CDBG program and CDBG-CV sub program totaling approximately $15,000 and $21.7 million, respectively, contained on the two PR28 performance reports to the Department’s accounting records. Additionally, the Department could not provide evidence that Department staff reviewed and approved the reports internally prior to submission to the federal government. • We identified issues in 7 of the 8 (88 percent) Quarterly Performance Reports we reviewed. The following table reflects quarterly amounts expended that could not be tied out for each programmatic report: See "Schedule of Findings and Questioned Costs" for table/chart. *The Department did not submit 4 of the 7 (57 percent) FFATA reports to SAM.gov within the required time period. We specifically noted that the Department submitted these four subawards to SAM.gov after the close of Fiscal Year 2025 in October 2025, which caused them to be out of compliance by up to 14 months. Why did these problems occur? The Department did not have adequate internal controls over its federal reporting processes, such as supervisory review and approval of the PR28 and FFATA reports prior to submission and publication. In addition, the Department failed to maintain adequate records of submissions and accounting support due to a lack of internal monitoring and review processes necessary for tracking report submissions and ensuring reports are submitted timely and are complete. The Department stated that the delay in the submission of the FFATA reports was due to technical difficulties experienced by the Department when the federal government switched from requiring the use of the previous FSRS system to SAM.gov on March 8, 2025. Why do these problems matter? By not providing accurate information to HUD or maintaining support for the Department’s performance reports, it is not meeting federal requirements. Further, the Department may not be addressing CDBG regulatory requirements that are intended to result in an overall benefit to lowand moderate-income persons and an overall benefit to the public. Additionally, inaccurate reporting could result in actual costs exceeding the maximum allowable costs for technical assistance, and overall planning, management and administration. By failing to report the subawards to SAM.gov in a timely manner, as required under FFATA, the Department is out of compliance with federal reporting requirements and risks federal sanctions. Additionally, by not reporting the relevant information—including subrecipient name, subrecipient Data Universal Numbering System number, amount of subaward, subaward obligation/action date, date of report submission, subaward number, subaward project description, subrecipient names, and compensation of highly compensated officers—the Department is failing to meet the federal intent of transparency for federal program spending. Furthermore, the Department not maintaining documentation of the review and approval of its federal reports can lead to a lack of accountability, making it difficult to verify compliance and potentially resulting in further scrutiny or penalties from federal oversight bodies. See "Schedule of Findings and Questioned Costs" for table/chart. Recommendation 2025-043 The Department of Local Affairs should strengthen its internal controls over federal reporting for its Community Development Block Grant/State’s program and Non-Entitlement Grants in Hawaii, including the Federal Funding Accountability and Transparency Act (FFATA) reporting, and ensure that its reporting meets federal requirements by: A. Ensuring that FFATA reporting occurs as required for subawards of $30,000 or more in the System for Award Management, SAM.gov, by the end of the month following the month the subawards are made. B. Documenting and implementing internal monitoring policies and procedures, including the performance of reconciliations of reports, to ensure that the required Performance and Evaluation Financial Summary Reports (PR28) and Quarterly Performance Reports are accurate and complete. This should include maintaining documentation of evidence of the review and approval of each report prior to its submission to the federal government. Response Department of Local Affairs A. Agree Implementation Date: April 2026 The Department will strengthen its internal controls over federal reporting by implementing policies and procedures that include a monitoring process to ensure that FFATA reporting occurs as required for subawards of $30,000 or more in SAM.gov by the end of the month following the month the subawards are made. B. Agree Implementation Date: April 2026 The Department will document and implement internal monitoring policies and procedures, including the performance of reconciliations of reports, to ensure that the required PR28 and Quarterly Performance Reports are accurate and complete. This will include maintaining documentation of evidence of the review and approval of each report prior to its submission to the federal government.

Finding 2025-044 Compliance with Activities Allowed or Unallowed and Allowable Costs/Cost Principles for the Coronavirus Capital Projects Fund The Department administers the federal Coronavirus Capital Projects Fund program (CCPF) [ALN 21.029] for non-entitlement municipalities, counties, and subcontractors to carry out capital development and infrastructure activities related to increasing awareness, education, and monitoring of the Coronavirus emergency by developing broadband infrastructure. Examples of activities related to CCPF include the development of fiber-optic broadband infrastructure and investments in improving broadband infrastructure within a municipality, addressing affordability and access to broadband infrastructure, and the development and improvement of buildings that directly enables work related to the education and monitoring of the Coronavirus emergency. The Department’s accounting section records all financial transactions within CORE and must ensure the accurate reporting of federal award expenditures and reimbursements and maintain adequate supporting documentation related to transactions recorded in CORE. The Department’s accounting section is also responsible for providing information through the submission of exhibits to the Office of the State Controller (OSC) to assist in preparation of the State’s financial statements, required note disclosures, and the State’s Schedule of Expenditures of Federal Awards (SEFA). For Fiscal Year 2025, the Department reported $33.7 million in expenditures for CCPF. What was the purpose of our audit work and what work was performed? The purpose of the audit work was to review the Department’s internal controls over the CCPF payment processes and to determine whether payments were processed and paid in accordance with state regulations and federal “allowable cost” requirements during Fiscal Year 2025. As part of our audit work, we obtained from the Department the Fiscal Year 2025 expenditures listing for CCPF, comprised of eight transactions. We tested five transactions as part of our testing of the Department’s compliance with federal allowable cost requirements for the CCPF program. We also reviewed the Department’s Exhibit K1, Schedule of Federal Assistance, which it submitted to the OSC for Fiscal Year 2025 year-end reporting, and the related supporting documentation, including CORE transaction detail for revenues and expenditures associated with CCPF, to determine whether Department accounting staff prepared the exhibit in accordance with the OSC’s Fiscal Procedures Manual (Manual), and to determine whether the Exhibit K1 was accurate and complete. How were the results of the audit work measured? We measured the results of our audit work against the following requirements: • Federal regulations [2 CFR 200.403] require that costs under federal awards must be necessary, reasonable, and allocable; conform to any limitations or exclusions; be consistent with policies and procedures; receive consistent treatment; adhere to GAAP; not be used for cost sharing of other programs; and be adequately documented. • Federal regulations [2 CFR 200.302] require that recipients must expend and account for the federal award in accordance with State laws and procedures for expending and accounting for the State’s funds. All recipients’ financial management systems, including records documenting compliance with federal statutes, regulations, and the terms and conditions of the federal award, must be sufficient to permit the preparation of reports required by the terms and conditions; and tracking expenditures to establish that funds have been used in accordance with federal statutes, regulations, and the terms and conditions of the federal award. • The OSC’s Manual contains instructions for the completion of exhibits. Specifically, the Exhibit K1 is used to report federal expenditure information to the OSC for inclusion in the State’s SEFA. • Federal regulations [2 CFR 200.303] state that each recipient of federal funds must establish and maintain effective internal controls over its federal awards, which provide reasonable assurance that the recipient is managing its federal grants in compliance with federal statutes, regulations, and the award terms and conditions. The OSC has adopted the Green Book as the State’s standard for internal controls, which all state agencies must follow. Green Book, Paragraphs 3.09 and 3.10, states that management is to develop and maintain documentation of its internal control system, establishing the who, what, when, where, and why of internal control execution to personnel. What problem did the audit work identify? Through our audit testwork, we identified an error with 1 of the 5 expenditures (20 percent) tested. Specifically, the Department recorded the expenditure transaction, which totaled $3,266,662, twice in CORE. Further, because CORE is programmed to automatically record earned federal revenue when a federal expenditure is recorded, the Department also recorded federal revenue in CORE to match the duplicate federal expenditure. As a result, the Department overstated both revenues and expenditures for CCPF by $3,266,662. In addition, the Department overstated its Fiscal Year 2025 CCPF expenditures on its Exhibit K1 by $3,266,662. After we notified Department staff of the errors, they provided a corrected Exhibit K1 to the OSC. The Department passed on correcting the overstated expenditures and revenues in CORE because, based on discussions with the auditors, the amount was not material. Why did this problem occur? The Department lacked sufficient internal controls during Fiscal Year 2025 over its financial management and federal allowable cost compliance requirements for the CCPF program. Specifically, the Department lacked sufficient training over the calculation of its year-end accrued liabilities. The Department incorrectly calculated and recorded the year-end accrual entry in CORE, and lacked adequate internal review processes, including a supervisory review process, to ensure the program’s accrued expenditures—and ultimately amounts reported on the Exhibit K1—were accurate and complete. Why does this problem matter? By failing to have strong internal controls over the recording and monitoring of federal expenditures and revenues, the Department cannot ensure that financial records are accurate, complete, and recorded in a timely manner. Internal review and approval processes reduce the risk of material misstatements affecting federal awards. Additionally, insufficient controls over federal program requirements can lead to a lack of accountability, making it difficult to demonstrate compliance and potentially resulting in further scrutiny or penalties from federal oversight bodies. Finally, failing to properly report expenditures of federal funds on its Exhibit K1, if uncorrected, could cause the State’s overall SEFA to be inaccurate and out of compliance with federal regulations. See "Schedule of Findings and Questioned Costs" for table/chart. Recommendation 2025-044 The Department of Local Affairs should strengthen its internal controls over the financial management of federal Coronavirus Capital Projects Fund grant expenditures by implementing an adequate supervisory review process and training for staff over year-end estimates/accruals to ensure transactions are accurately recorded in the Colorado Operations Resource Engine (CORE), the State’s accounting system; and that the Exhibit K1, Schedule of Federal Assistance, is accurate and complete. Response Department of Local Affairs Agree Implementation Date: April 2026 The Department of Local Affairs (Department) agrees with the recommendation to strengthen internal controls over the financial management of federal Coronavirus Capital Projects Fund grant expenditures and the accuracy and completeness of the Exhibit K1, Schedule of Federal Assistance. The Department will develop a corrective action plan that includes enhanced procedures for the performance of year-end estimates/accruals. The Department will create and implement staff training for staff that are responsible for preparing and reviewing the estimates/accruals, the Exhibit K1, grant transactions and enhancements.

Finding 2025-045 Compliance with Reporting for Immunization Cooperative Agreements – FFATA Reporting The Department is required to comply with the Federal Funding Accountability and Transparency Act of 2006 (Transparency Act or FFATA) for its Immunization Cooperative Agreements program [ALN 93.268] (Program). The Transparency Act was created to empower Americans with the ability to hold the government accountable for each spending decision and, as a result, to reduce wasteful spending by the government. The Transparency Act requires the federal government to make certain information on federal awards available to the public, including information about amounts passed through to subrecipients. The Department is required to report information about subgrants, or subawards, given to other governments or to nonprofit organizations, also referred to as subrecipients. Federal regulation [2 CFR 200.1] defines a subaward as an award provided by a pass-through entity, in this case the Department, to an entity to carry out part of a federal grant award received by the pass-through entity. A subrecipient is defined in federal regulation [2 CFR 200.1] as an entity, usually but not limited to non-Federal entities, that receives a subaward from a pass-through entity to carry out part of a federal award; but does not include an individual that is a beneficiary of such award. A subrecipient may also be a recipient of other Federal awards directly from a federal awarding agency. The Department is required to submit FFATA information through the federal government’s System for Award Management website, SAM.gov. Once the Department submits a report to SAM.gov, the public can view information from the report, including the subrecipient’s name, subaward identification number, subaward obligation/action date, subaward amount, federal awarding agency and subagency, the Department’s name, and the Department’s grant award identification number. In Fiscal Year 2025, the Department reported $112.0 million in total Program expenditures. Of this amount, the Department issued $15.8 million in subawards under the Program. The Department had 70 subrecipients with subawards for which it was required to submit FFATA information through SAM.gov during the fiscal year. What was the purpose of our audit work and what work was performed? The purpose of the audit work was to determine whether the Department had adequate internal controls over and complied with FFATA reporting requirements for the Program during Fiscal Year 2025. As part of our audit work, we requested the Department’s policies and procedures over FFATA reporting and a list of all subrecipients for the Program during Fiscal Year 2025. We also inquired with Department staff about its internal control processes related to FFATA reporting. How were the results of the audit work measured? We measured the results of our audit work against the following requirements: In accordance with federal regulations [2 CFR 170, Appendix A], the Department is required to report subawards of $30,000 or more to SAM.gov by the end of the month following the month in which the award was made. For example, the Department would have to submit a FFATA report to SAM.gov in May 2025 if it made an award or supplemental award equal to or greater than $30,000 in April 2025. Federal regulations [2 CFR 200.303] require the Department to establish and maintain effective internal controls over federal awards that provide reasonable assurance that the Department is managing its federal awards in compliance with federal statutes, regulations, and the terms and conditions of the federal award. The Department’s policies and procedures related to FFATA reporting state that its grants accountant is responsible for performing monthly FFATA reporting. What problem did the audit work identify? We determined that the Department did not comply with FFATA reporting requirements for the Program during Fiscal Year 2025. Specifically, the Department did not submit any FFATA reports to SAM.gov for the Program’s subawards issued during Fiscal Year 2025 and, as a result, did not report approximately $15.2 million in subawards for Fiscal Year 2025. Why did this problem occur? The Department did not have adequate internal controls over federal reporting requirements in place for the Program during Fiscal Year 2025. Specifically, the Department’s existing policies and procedures were not detailed enough to ensure that FFATA reporting was completed in accordance with federal requirements. The procedures in place designated one individual who was responsible for the FFATA reporting process, but did not include procedures to identify when FFATA reporting was required for subawards or to ensure that appropriate reporting was completed when required. Additionally, the Department’s procedures did not include any secondary review process over FFATA reporting or a process to ensure that FFATA reporting had been completed as required. Why does this problem matter? By failing to properly report FFATA subawards through SAM.gov, the Department is out of compliance with federal reporting requirements, risks federal sanctions, and does not meet the federal intent of transparency for federal program spending. See "Schedule of Findings and Questioned Costs" for table/chart. Recommendation 2025-045 The Department of Public Health and Environment should strengthen its internal controls over, and ensure it complies with, the Federal Funding Accountability and Transparency Act of 2006 (FFATA) reporting requirements for its Immunization Cooperative Agreements program. This should include updating its existing policies and procedures to include a monthly review of all subawards in order to identify those required to be reported each month and a secondary review process of the FFATA reports and submissions to ensure that FFATA reporting has been completed as required. Response Department of Public Health and Environment Agree Implementation Date: July 2026 CDPHE fiscal procedures have been updated to reflect changes to the reporting process, specifically noting the recent federal website change and adding the requirement of a secondary level of review. By July 31, 2026, all outstanding FFATA reports will be filed with the federal government and the monthly review process in the updated fiscal procedures will be implemented.

Finding 2025-046 Compliance with Subrecipient Monitoring for Disaster Grants The Federal Emergency Management Agency (FEMA) Disaster Grants program [ALN 97.036] provides supplemental assistance to recipients to assist communities with responding to and recovering from major disasters or emergencies. The program also provides funding for hazard mitigation measures to help communities implement hazard mitigation projects that can protect them from future disasters. The Disaster Grants program is based on a partnership between FEMA, the recipient (in this case, the Department), and, as applicable, the subrecipient (local governments). FEMA is responsible for managing the Disaster Grants program, approving grants, and providing technical assistance to the state, local, tribal, and territorial governments. The Department, as a recipient of Disaster Grants program funds, is responsible for providing technical advice and assistance to eligible subrecipients, providing support for damage survey activities, ensuring that all potential applicants are aware of funding assistance available, and submitting documents necessary for grant awards. A subrecipient is defined in federal regulations [2 CFR 200.1] as an entity, usually but not limited to non-federal entities, that receives a subaward from a pass-through entity to carry out part of a federal award; but does not include an individual that is a beneficiary of such award. A subrecipient may also be a recipient of other federal awards directly from a federal awarding agency. Federal regulations [2 CFR 200.1] define a subaward as an award provided by a pass-through entity (such as the Department) to an entity (subrecipient) to carry out part of a federal grant award received by the pass-through entity. Specifically for this program, the subrecipient is expected to request assistance, as needed; identify the damaged facilities; provide information to support its funding requests; maintain accurate documentation; and perform other work, as necessary. As part of its subrecipient monitoring process, the Department should complete an annual risk assessment to determine the extent of its subrecipient monitoring activities. The risk assessment should include considerations of financial risk factors, such as financial implications of operational and compliance failures; operational risk factors, such as risks resulting from inadequate internal controls; and compliance risks, such as violations with laws, regulations, and internal policies. In addition, the Department should be using monitoring tools to track the status of whether the subrecipient underwent a Single Audit, if applicable, and whether that audit has been reviewed by Department staff and any resulting management decisions issued by those staff to the subrecipient, if applicable, that address the Department’s assessment and planned actions to address any findings or issues identified in the audit During Fiscal Year 2025, the Department passed approximately $76.0 million to 66 subrecipients for responses to various disasters covered by the Department’s Disaster Grants program. In addition, the Department reported that it approved no new subawards during Fiscal Year 2025. All funds passed through to subrecipients by the Department were related to reimbursements for prior period expenses. In total, the Department reported that it had passed through Disaster Grant funding to another 68 subrecipients in prior years who did not receive funding passed through from the Department during Fiscal Year 2025; many of these subrecipients had multiple open projects that had been completed in prior years but were awaiting final approval and close-out from FEMA. What was the purpose of our audit work and what work was performed? The purpose of the audit work was to determine whether the Department had adequate internal controls in place over, and complied with, subrecipient monitoring requirements over the Disaster Grants program during Fiscal Year 2025. Another purpose of the audit work was to determine whether the Department implemented our Fiscal Year 2024 audit recommendation to review all subrecipients’ federally-required Single Audit reports, as required. The Department agreed with the recommendation and planned to implement it by June 2025. As part of our audit work, we performed testwork to determine whether the Department obtained its subrecipients’ Single Audit reports and issued a management decision, if applicable. We also determined whether the Department performed risk assessments on the subrecipients as required by federal regulations. Finally, we performed this testing over a random sample of 9 of 68 subrecipients that received pass-through funding in the current year. How were the results of the audit work measured? We measured the results of our audit work against the following requirements: • Federal regulations [2 CFR 200.332] require the Department to evaluate each subrecipient’s risk of noncompliance with federal statutes, regulations, and the terms and conditions of the subaward for purposes of determining the appropriate level of subrecipient monitoring based on the Department’s assessment of risk posed by the subrecipients. Additionally, it requires the Department to verify that every subrecipient is audited as required by 2 CFR 200, Subpart F, Audit Requirements, which sets forth the federal regulations around Single Audit threshold requirements for subrecipients. It also covers the federal regulations to consider whether the results of the subrecipient’s audits indicates conditions that necessitate adjustment to the passthrough entity’s—in this case, the Department’s—own records. Further, federal regulations [2 CFR 200.521] require the Department to issue a management decision, which is defined as the Department’s written determination of the adequacy of the subrecipient’s proposed corrective action to address any findings in the subrecipient’s Single Audit reports within 6 months of the federal audit clearinghouse’s acceptance of the audit report. • The Department’s Division of Homeland Security and Emergency Management’s (DHSEM) Subrecipient Monitoring policy states that it “…will perform an annual evaluation of Subrecipient’s risks prior to the start of each State fiscal year, analyzing active awards and assessing Subrecipients for the upcoming year to determine the financial status of each Subrecipient and which subrecipients will receive on-site monitoring which may include desk reviews.” The policy further goes on to indicate that each subrecipient will receive an overall risk score that is used to determine which subrecipients will undergo monitoring review during the fiscal year based on the quantitative and qualitative data used for the assessment inputs. • The DHSEM Subrecipient Monitoring policy also states that “DHSEM will perform reviews of single audit results for Subrecipients who have expended Federal grant funds in excess of $750,000 of which some portion is passed through DHSEM.” • Federal regulations [2 CFR 200.329] stipulate that the non-federal award recipient—in this case the Department—is responsible for oversight of the operations of its federal award-supported activities. The regulations further state that the “non-federal entity” must monitor its activities under federal awards to assure that compliance with applicable federal requirements and performance expectations is being achieved. What problems did the audit work identify? Based on our audit work, we determined that the Department did not fully implement our prior audit recommendation by its planned implementation date of June 30, 2025, and did not complete required subrecipient monitoring activities for its Disaster Grants program. Specifically, we found that the Department did update the risk assessment policies for the 2025 risk assessment and fully assessed risks for subrecipients for Fiscal Year 2025. However, there was one subrecipient that had not yet issued a finalized audit report and, therefore, the Department’s subrecipient monitoring process was pending completion. Why did these problems occur? Although the Department designated staff to obtain and review Single Audit reports for all of its subrecipients, Department staff stated that they were not able to complete their reviews of previously unreviewed Single Audit reports during Fiscal Year 2025, as letters were still being processed for execution and distribution under the updated policies. The Department also subsequently stated that some of these reviews were incomplete due to the subrecipients not yet finalizing their Single Audits with their auditors. Why do these problems matter? By failing to complete all of its reviews of subrecipients’ Single Audit reports, the Department is out of compliance with both federal requirements and with its policy to complete monitoring reviews for each subrecipient. This could result in the Department not timely identifying enforcement actions that may be needed against noncompliant subrecipients and then making revisions, as applicable, to its monitoring risk assessment for the subrecipient. See "Schedule of Findings and Questioned Costs" for table/chart. Recommendation 2025-046 The Department of Public Safety (Department) should continue to implement its subrecipient monitoring policy and ensure the Department is in compliance with federal regulations to review all subrecipients’ Single Audit reports in a timely manner. This should also include the Department completing its reviews of the subrecipients’ prior year’s Single Audit reports and issuing the management decision letters for those reports. Response Department of Public Safety Agree Implementation Date: June 2026 The Department will continue to follow the current Policy and Procedure related to the Single Audit reviews and has allocated an individual to review the Single Audits. This includes issuing a management decision letter if required, in accordance with the timeline established in federal guidance.

Finding 2025-047 Compliance with Reporting for the Highway Safety Cluster The Department is required to comply with the Federal Funding Accountability and Transparency Act of 2006 (Transparency Act or FFATA) for its Highway Safety Cluster programs, specifically the State and Community Highway Safety [ALN 20.600] and National Priority Safety Programs [ALN 20.616] (Programs). The Transparency Act was created to empower Americans with the ability to hold the government accountable for each spending decision and, as a result, to reduce wasteful spending by the government. The Transparency Act requires the federal government to make certain information on federal awards available to the public, including information about amounts passed through to subrecipients. The Department is required to report information about subgrants, or subawards, given to other governments or to nonprofit organizations (also referred to as subrecipients). Federal regulation [2 CFR 200.1] defines a subaward as an award provided by a pass-through entity, in this case the Department, to an entity to carry out part of a federal grant award received by the pass-through entity. A subrecipient is defined in federal regulation [2 CFR 200.1] as an entity, usually but not limited to non-federal entities, that receives a subaward from a pass-through entity to carry out part of a federal award; but does not include an individual that is a beneficiary of such award. A subrecipient may also be a recipient of other federal awards directly from a federal awarding agency. The Department is required to file FFATA reports through the System for Award Management website, SAM.gov. Once the Department submits a report to SAM.gov, the public can view certain information from the report, including the subrecipient’s name, subaward identification number, subaward obligation/action date, subaward amount, federal awarding agency and subagency, the Department’s name, and the Department’s grant award identification number. In Fiscal Year 2025, the Department reported approximately $12.9 million in total for the Programs’ expenditures. Of this amount, the Department issued about $6.8 million in subawards under the Programs. The Department had 70 subrecipients with subawards it was required to submit FFATA information for through SAM.gov during the fiscal year. What was the purpose of our audit work and what work was performed? The purpose of our audit work was to determine whether the Department had adequate internal controls over and complied with FFATA reporting requirements for the Highway Safety Cluster Programs during Fiscal Year 2025. Another purpose of our audit work was to determine whether the Department implemented our Fiscal Year 2024 audit recommendations to strengthen its internal controls over and to ensure it complies with FFATA reporting requirements for the Highway Safety Cluster Programs. The Department agreed with these recommendations and planned to implement them by June 2025. As part of our audit work, we selected 24 Fiscal Year 2025 subrecipient expenditure transactions out of a total of 70 subrecipient transactions for which FFATA reporting was required for these Programs. We obtained copies of the FFATA reports that the Department uploaded to SAM.gov and obtained subaward agreements and purchase orders for each sample. We compared the Department’s subaward information to the information the Department submitted to SAM.gov to determine whether the Department reported accurate information. In addition, we performed testwork to determine whether the Department submitted the FFATA reports within the month following the month it made the subaward, as required by federal regulations. We also tested the Department’s progress in implementing our prior audit recommendations by reviewing their updated policies and procedures. How were the results of the audit work measured? We measured the results of our audit work against the following: • Federal regulations [2 CFR 170] require direct recipients of federal grants to report subawards of $30,000 or more to SAM.gov by the end of the month following the month in which the award was made. For example, the Department would have to submit a FFATA report to SAM.gov in May 2025 if an award or supplemental award equal to or greater than $30,000 was made in April 2025. Federal regulations [2 CFR 200.303] require the non-federal entity—in this instance the Department—to establish and maintain effective internal controls over the federal award that provides reasonable assurance that the non-federal entity is managing the federal award in compliance with federal statutes, regulations, and the terms and conditions of the federal award. • Federal regulation [2 CFR 200.332 (a)(1)] states that the Department’s subawards must clearly identify certain information, including but not limited to, the unique entity identifier, the Assistance Listing Number, the federal award date, and the federal award identification number. What problem did the audit work identify? Based on our audit work, we determined that the Department did not fully comply with FFATA reporting requirements for the Programs during Fiscal Year 2025 and did not fully implement our prior audit recommendations. Of the 24 subaward reports selected for testing, we identified issues on 5 subaward reports (21 percent). Specifically, we identified the following issues: • The Department was unable to provide documentation demonstrating that two subaward FFATA reports related to Fiscal Year 2024 awards had been submitted in SAM.gov. These submissions could not be located in SAM.gov. The amount of the subawards not submitted was $375,553. We further noted that these two reports had still not been submitted during Fiscal Year 2025. • For three subawards totaling $771,258, the Department did not maintain adequate documentation to support the amounts reported in SAM.gov. Specifically, the Department reported amounts of $537,573 for the three subawards, which did not agree to the Department’s subaward records, and represented a difference of $233,684. In addition, the Department did not meet the required FFATA reporting timelines for these subawards. Specifically, one subaward was reported 271 days late and two were reported 301 days late. Why did this problem occur? The Department did not have adequate internal controls in place related to FFATA reporting for the Highway Safety Cluster during Fiscal Year 2025 that ensured that reporting occurred as required for subawards of $30,000 or more in SAM.gov by the end of the month following the month the subawards are made. The Department implemented policies and procedures related to FFATA reporting during the fiscal year; however, Department staff indicated that staff were still being trained on these new procedures. In addition, the Department did not have procedures in place to ensure that, when an unsubmitted FFATA report is identified, the report is subsequently filed in SAM.gov, even if the submission is late. Why does this problem matter? By failing to properly report FFATA subawards through SAM.gov, the Department is out of compliance with federal reporting requirements, risks federal sanctions, and does not meet the federal intent of transparency for federal program spending. See "Schedule of Findings and Questioned Costs" for table/chart. Recommendation 2025-047 The Department of Transportation (Department) should strengthen its internal controls over and ensure it complies with Federal Funding Accountability and Transparency Act (FFATA) reporting requirements for the Highway Safety Cluster by: A. Ensuring that FFATA reporting occurs as required for subawards of $30,000 or more by the end of the month following the month the subawards are made and, if an unsubmitted FFATA report is identified, subsequently filing the report as soon as possible through SAM.gov, even if the submission is late. B. Providing training to Department staff to follow FFATA reporting policies and procedures. C. Ensuring Department staff follow the Department’s FFATA policies and procedures to ensure that FFATA reports are accurate and complete. Response Department of Transportation A. Agree Implementation Date: June 2026 The Department agrees with the recommendation. The Department will review, assess, and, where necessary, update existing procedures for FFATA reporting relating to the requirement that state subawards for $30,000+ be submitted within 30 days of committed budget. This will include ensuring that the confirmation date is documented. This process will be a coordinated effort between the Office Transportation Safety (OTS) and the Center for Accounting. This will include updating our reconciliation process to include additional data, reviewing and updating reconciliation and review procedures as needed, and reconciling Grants awarded in prior fiscal years that are still active and ensuring they have been appropriately reported. The findings related to this recommendation are in part the result of a federal reporting system limitation, and a federal system conversion. The legacy reporting system, FSRS, had a system limitation, which prevented the full amount of the award being reported in the case of three awards. Additionally, this conversion resulted in some data conversion issues impacting one additional award B. Agree Implementation Date: June 2026 The Department agrees with this finding and will provide any training needed to staff members to ensure that all components of the FFATA are completed accurately, timely and with proper reviews. This training will include leadership reviewing NHTSA/Federal guidelines and SAM.Gov training on FFATA reporting and requirements, documenting controls and ensuring the approvers have access to all supporting schedules, forms and systems and that they understand the subawards, and process for late submissions if needed. C. Agree Implementation Date: June 2026 The Department agrees with the finding and will ensure that staff follow all internal policies and procedures to maintain accurate and complete FFATA reporting. To achieve this, staff will review existing procedures and make any necessary updates regarding report compilation. Additionally, we will review control points to ensure they are consistently followed and approved by the team supervisor or team manager.

Finding 2025-048 Compliance with Period of Performance for the Highway Safety Cluster The objective of the federal National Highway Traffic Safety Administration’s Highway Traffic Safety Grant Programs (Highway Safety Cluster) is to provide a coordinated national highway safety program to reduce traffic crashes, deaths, injuries, and property damage. Non-federal entities apply for federal Highway Safety Cluster funds to add or improve safety features on highways and roads around the country. A condition of receiving these federal dollars is that the recipient must comply with various rules on how and when the money can be spent. The recipient must also establish and maintain effective internal controls to ensure compliance with federal statutes, regulations, and the terms and conditions of the federal award. One of these requirements is that the Department must spend the funds within the period of performance identified in the grant award. For Fiscal Year 2025, the periods of performance for the Department’s grant awards for this program were each 4-year periods, as follows: October 1, 2022 through September 30, 2026; October 1, 2023 through September 30, 2027; and October 1, 2024 through September 30, 2028; depending on the year of grant funding. The Department requires a minimum of two staff that are a different reviewer and approver for all costs charged to the grant. Expenditures charged to the grant are reviewed and entered into the Department’s enterprise resource planning system, Systems, Applications, and Products in Data Processing (SAP), by grant coordinators, and then reviewed and approved by the Department’s headquarters business office staff. Grant coordinators that provide a first-level review of the grant expenditures entered into SAP and the Department’s headquarters business office staff should all be knowledgeable in allowable costs and period of performance requirements for the Highway Safety Cluster. What was the purpose of our audit work and what work was performed? The purpose of our audit work was to determine whether: the Department had adequate internal controls over federal period of performance requirements for the Highway Safety Cluster; the Department recorded Highway Safety Cluster expenditures during the approved period of performance for the Highway Safety Cluster during Fiscal Year 2025; and costs were allowable under the grant. As part of our audit work, we selected all seven expenditure transactions charged to the Highway Safety Cluster grant during the first 30 calendar days of the period of performance for the four grant awards in place during Fiscal Year 2025. For example, for the Fiscal Year 2025 grant awards, the beginning date of the period of performance was October 1, 2024, so we reviewed expenditures charged to the grant from October 1 through October 30, 2024. We reviewed the Department’s supporting documentation to support the date each expense was incurred and evidence of internal controls related to approval of the expense. Another purpose of our audit work was to determine whether the Department implemented our Fiscal Year 2024 audit recommendations to: • Enforce its existing policies and procedures that require that grant expenditures be allowable, and that two individuals review the related supporting documentation for compliance with grant requirements. This should include monitoring to ensure that Department personnel performing the reviews review the related supporting documentation for incurred dates in order to verify that expenditures comply with the applicable award period of performance; adjustments should be made for any expenditures charged to an award outside the proper period of performance. • Provide additional training to Department personnel on period of performance compliance requirements. The Department agreed with these recommendations and planned to implement them by June 2025. How were the results of the audit work measured? We measured the results of our audit work against the following requirements: • Federal regulations [2 CFR 200.308, 200.309, and 200.403(h)] state that a non-federal entity may charge only allowable costs incurred during the approved budget period of a federal award’s period of performance and any costs incurred before the federal awarding agency or passthrough entity made the federal award that were authorized by the federal awarding agency or pass-through entity. A period of performance may contain one or more budget periods. A budget period represents the specific time frame approved by the federal awarding agency for using grant funds. • The Department’s internal control procedures over federal expenditure approval and processing require that all federal grant expenditures must have adequate supporting documentation, such as an invoice, purchase order, or reimbursement request, included with the transaction and the supporting documentation must be reviewed for allowability under the applicable federal grant program by two individuals. What problems did the audit work identify? Based on our audit work, we determined that the Department did not fully comply with the period of performance requirements for the Highway Safety Cluster during Fiscal Year 2025 and did not fully implement our prior audit recommendations. Based on our audit testwork, 2 of the 7 transactions selected for testing (29 percent) had expenses recorded to the grant that were incurred outside the period of performance; each expense was incurred one day prior to the start of the period of performance. We further verified with the Department that the expenditures were not specifically authorized by the federal awarding agency to be charged to the grant. These errors resulted in questioned costs totaling $347. Why did these problems occur? This problem occurred because the Department’s internal controls were not operating effectively to ensure that expenditures charged to the Highway Safety Cluster were incurred within the award’s period of performance. Specifically, the Department’s reviewers of the transactions for which the problems occurred did not ensure the transactions were fully within the period of performance. Both transactions related to employee reimbursements of travel expenses for the period September 30, 2024 through October 4, 2024. The Department’s reviewers did not identify that the expenses for September 30, 2024 should have been charged to a different grant award, and the Department did not split the invoice into two transactions to allocate the expenses to the appropriate grant award based on the period of performance of those grant awards. Department personnel did not appear to be sufficiently trained on the Highway Safety Cluster’s period of performance compliance requirements. Why do these problems matter? By failing to properly record expenditures to the Highway Safety Cluster within the grant award’s period of performance, the Department risks its costs being deemed unallowable by the federal awarding agency. See "Schedule of Findings and Questioned Costs" for table/chart. Recommendation 2025-048 The Department of Transportation (Department) should ensure that it complies with federal Highway Safety Cluster grant period of performance requirements by: A. Enforcing its existing policies and procedures that require that grant expenditures be allowable, and that two individuals review the related supporting documentation for compliance with grant requirements. This should include ensuring that Department personnel performing the reviews review the related supporting documentation for incurred dates in order to verify that expenditures comply with the applicable award period of performance and making adjustments for any expenditures charged to an award outside the proper period of performance. B. Providing training to Department personnel to ensure that staff understand and can apply the period of performance requirements. Response Department of Transportation A. Agree Implementation Date: April 2026 The Department agrees with the recommendation. The Center for Accounting (CFA) and the Office of Transportation Safety (OTS) have coordinated to implement updated reviews and controls. This implementation involves reviewing current processes to ensure supporting documentation is vetted and grant compliance is verified prior to payment. It also includes assessing the need for increased monitoring to ensure initial program reviews are complete and accurate. This remediation effort was finalized on June 30, 2025, following the September 2024 transaction in question. Additionally, the Department plans to review the remediation plan with all relevant staff again this season. This will ensure that all supporting documentation is thoroughly vetted and that expenditures comply with the applicable award period of performance B. Agree Implementation Date: April 2026 The Colorado Department of Transportation (CDOT) agrees with the recommendation. The Center for Accounting (CFA) and the Office of Transportation Safety (OTS) have coordinated on its implementation. The Department has assessed and updated training for staff responsible for reviewing and approving invoices for Highway Safety Cluster grants, with a specific focus on the period of performance. This training plan will be revisited and reviewed with all staff involved by April 2026.

The following finding and recommendation relating to an internal control deficiency classified as a Significant Deficiency was communicated to the Department of Transportation (Department) in the previous year and has not been remediated as of June 30, 2025 because the original implementation date provided by the Department was in a subsequent fiscal year. This complete finding and recommendation can be found within the original report and the complete recommendation can be found within Section IV: Disposition of Prior Audit Recommendations of this report. Finding 2024-058 Compliance with Subrecipient Monitoring for the Formula Grants for Rural Areas and Tribal Transit Program, Highway Safety Cluster, and SLFRF

The Department receives federal grant funds directly from the federal government for the Formula Grants for Rural Areas and Tribal Transit Program, Highway Safety Cluster, and the Coronavirus State and Local Fiscal Recovery Funds (SLFRF) program and then subgrants, or passes through, a portion of the funds to cities and counties and other organizations that are considered to be either a subrecipient or a contractor.

For Fiscal Year 2024, the Department had the following transactions that were subject to subrecipient monitoring testing:

• Formula Grants for Rural Areas and Tribal Transit Program – 783 subrecipient transactions totaling $23,075,270.

• Highway Safety Cluster – 829 subrecipient transactions totaling $5,669,865.

• SLFRF – 232 subrecipient transactions totaling $38,321,493.

For the SLFRF program, Intergovernmental Agreements are executed between the Department and subrecipients to communicate all relevant federal award information. For both the Formula Grants for Rural Areas and Tribal Transit Program and Highway Safety Cluster, Subaward Agreements (subawards) are executed between the Department and subrecipients to communicate all relevant federal award information. Intergovernmental Agreements and subawards are signed by authorized State personnel, generally the State Controller and the Department’s Chief Engineer. The Department includes a “Subrecipient Risk Assessment” tool with its Intergovernmental Agreements or subawards, which must be completed by Department staff prior to making the award. The Department’s subrecipient monitoring procedures are dependent on the assessed risk level noted in the Subrecipient Risk Assessment tool.

Federal regulations [2 CFR Part 200 Section F] state that a non-federal entity that expends $1,000,000 or more in federal awards during the non-federal entity’s fiscal year must have a Single Audit conducted in accordance with 2 CFR 200.514. The Department’s Internal Audit Division staff tracks and receives Single Audit reports from its subrecipients. As part of the Department’s monitoring procedures, the Internal Audit Division personnel complete a “Single Audit Report Review Summary” form to show they reviewed the subrecipient’s Single Audit report, summarized any findings, and concluded on any risks presented to the Department and any related future actions to be taken. The form is signed by a Department preparer and a Department reviewer. For those subrecipients not required to file a Single Audit, an “Audit Division Single Audit Certification Form” must still be submitted by the subrecipients to the Department. These forms note that the entity was exempt from a Single Audit.

What was the purpose of our audit work and what work was performed?

The purpose of our audit work was to determine if the Department complied with federal requirements for subrecipient monitoring during Fiscal Year 2024 for the Formula Grants for Rural Areas and Tribal Transit Program, Highway Safety Cluster, and the SLFRF program and to determine whether the Department had adequate internal controls over subrecipient monitoring.

As part of our audit work, we reviewed the Department’s internal controls over compliance for subrecipient monitoring and tested the Department’s compliance with federal subrecipient monitoring requirements. Specifically, we performed the following testwork related to each of the following federal programs:

• Formula Grants for Rural Areas and Tribal Transit Program—We selected and reviewed a random sample of 40 subrecipient payment transactions. We reviewed subawards, amendments, and other supporting documentation provided by the Department.

• Highway Safety Cluster—We selected and reviewed a random sample of 40 subrecipient payment transactions. We reviewed subawards, amendments, and other supporting documentation provided by the Department.

• SLFRF—We selected and reviewed a random sample of 29 subrecipient payment transactions. We reviewed Intergovernmental Agreements, amendments, and other supporting documentation provided by the Department.

How were the results of the audit work measured?

Our audit work was designed to measure the Department’s compliance with the following criteria:

• Federal regulation [2 CFR 200.303] states that the Department, as a federal grant recipient, must “establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award.”

• Federal regulation [2 CFR 200.332 (a)(1)] states that the Department’s subawards must clearly identify certain information, including but not limited to, the ALN, the Federal Award Date, and the FAIN.

• Federal regulation [2 CFR 200.331] states that a pass-through entity, in this case the Department, must make case-by-case determinations as to whether each agreement it makes for the disbursement of federal program funds represents a payment of funds to a subrecipient or a contractor, depending on the role the entity plays.

What problems did the audit work identify?

We determined that the Department did not fully comply with subrecipient monitoring requirements during Fiscal Year 2024. Specifically, we noted the following:

• Formula Grants for Rural Areas and Tribal Transit Program

o For 10 of 40 (25 percent) subrecipient payment transactions selected for testing, we determined the subaward documents did not contain the federal award date in the subaward agreement, as required. The 10 transactions totaled $7,432,248 in subrecipient awards.

• Highway Safety Cluster

o For 1 of 40 (3 percent) subrecipient payment transactions selected for testing, we determined that the subrecipient should have been classified as a contractor, not a subrecipient. The transaction totaled $75,325. The Department had not made an adjusting entry in CORE to reclassify the transaction and correct this error by the end of our audit testwork.

o For 5 of 40 (13 percent) subrecipient payment transactions selected for testing, we determined the subaward documents did not contain the federal award date in the subaward agreement. The 5 transactions totaled $25,100 in subrecipient awards.

• SLFRF

o For 2 of 29 (7 percent) subrecipient payment transactions selected for testing, we determined that the Intergovernmental Agreement did not include the FAIN and Federal Award Dates. The 2 transactions totaled $3,277,779 in subrecipient awards.

o For 1 of 29 (3 percent) subrecipient payment transactions selected for testing, we determined the transaction did not include the ALN. This transaction totaled $1,851,279 in subrecipient awards.

Why did these problems occur?

The Department’s procedures and internal controls were not sufficient to ensure that Intergovernmental Agreements and subawards included all the required information to be included in the subaward, and internal controls did not prevent or detect errors. Department staff were not aware that this information was needed for the subaward to be in compliance with federal regulations. In some situations, the FAIN was only provided to the Department from the U.S. Department of Transportation subsequent to when the subaward was made. In these instances, the Department was not aware that they were required to provide the FAIN to their subrecipients once it was determined by the U.S. Department of Transportation.

The Department’s procedures and internal controls were not sufficient to ensure that payments were properly classified as general disbursements or subrecipient payments, and internal controls did not prevent or detect errors. Department staff lacked the appropriate knowledge of the difference in contractors and subrecipients to ensure the proper classification of expenditures. The Department’s reviewers did not complete a sufficient review of the expense classifications to be able to identify the misclassification and propose a subsequent correction.

Why do these problems matter?

Based on the issues we identified, the Department is out of compliance with federal subrecipient requirements and could face sanctions or other penalties. In addition, by failing to properly report the required federal grant award information at the time of subaward issuance, subrecipients may be uninformed about what funding the subaward related to. This could result in misclassification of subaward information on the subrecipients’ Schedules of Expenditures of Federal Awards (SEFA) and the subrecipient may not know what federal requirements they need to follow as part of receiving the federal award funds. The Department’s improper classification of expenses as general disbursements versus subrecipient payments could lead to misstatements in the amounts reported on the SEFA, both for the State as a whole and at the subrecipient level. See "Schedule of Findings and Questioned Costs" for chart/table.

Recommendation 2024-058

The Department of Transportation (Department) should strengthen its internal controls over and ensure that it complies with federal subrecipient monitoring requirements for the Formula Grants for Rural Areas and Tribal Transit Program, the Highway Safety Cluster, and the Coronavirus State and Local Fiscal Recovery Funds. Specifically, the Department should ensure that all required information is included in subawards or intergovernmental agreements or provide amendments to the subawards or intergovernmental once the Department receives the necessary information from the federal government, and that Department staff are sufficiently aware of the difference in subrecipients and contractors and properly classify general disbursements versus subrecipient payments.

Response Department of Transportation

Agree Implementation Date: June 2026

Department will strengthen controls to ensure that the required award information is provided, once available. Certain information such as Federal Award Identification Number and Federal Transit Administration and National Highway Traffic Safety Administration award date are not available at the time of contracting CDOT is working on a process to provide this information, once it is available in a publicly available format on CDOT’s website or on a subrecipient facing grant management site. We will add a note to the contract explaining where the information will be posted on our site when it becomes available. The Department will also identify staff requiring additional training on classification and coding for contractors vs. subrecipients.

The following finding and recommendation relating to an internal control deficiency classified as a Significant Deficiency was communicated to the Department in the previous year and has not been remediated as of June 30, 2024 because the original implementation date provided by the Department was in a subsequent fiscal year. This complete finding and recommendation can be found within the original report and the complete recommendation can be found within Section IV: Prior Audit Recommendations of this report. See Schedule of Finding and Questioned Costs for chart/table.

Finding 2023-050 Colorado Child Care Assistance Program

The Department is responsible for monitoring each county’s administration of CCCAP. County caseworkers enter a CCCAP adult caretaker’s application information, including household employment and income, household size, and the names and number of children needing care, into the Department’s Child Care Automated Tracking System (CHATS). CHATS aggregates the information for the county caseworker to determine whether an adult caretaker applying for benefits will be eligible for CCCAP assistance. For example, the adult caretaker’s household income must not exceed 85 percent of the State’s median household income. CHATS uses the household income and the household size entered by the county caseworker to calculate the copayment amount, or parent fee, the household must pay per month for child care services. CHATS then generates a letter that must be sent by the county caseworker to the household that summarizes the information and must be verified by the adult caretaker.

In addition to families that apply for child care assistance, CCCAP also provides child care benefits for children in protective services and for families in the Temporary Assistance for Needy Families, or Colorado Works, program. Children in protective services have been placed by the county departments of human/social services in a foster care home. The Colorado Works program provides assistance to families in need by providing benefits to help families become self-sufficient.

During Fiscal Year 2023, the Department provided approximately $133.2 million in child care benefits through CCCAP for 24,592 children.

What was the purpose of our audit work and what work was performed?

The purpose of the audit work was to determine whether the Department had adequate internal controls over CCCAP enrollment processing and to determine whether the Department complied with federal and state CCCAP requirements during Fiscal Year 2023.

During our audit, we reviewed the Department’s internal controls over CCCAP that were in place during Fiscal Year 2023. In addition, we performed testing of a sample of 60 children who were deemed eligible for child care services through CCCAP and received $348,581 in CCCAP benefits during Fiscal Year 2023 to determine whether the children’s eligibility was correctly determined. Our testing included reviewing the supporting documentation and the case files for each sample, along with determining the accuracy of data entered into CHATS. We performed testwork to determine whether the county caseworkers obtained and maintained the required documents supporting the eligibility determinations and annual redeterminations in the case files and determined eligibility in a timely manner.

How were the results of the audit work measured?

We measured the results of our audit work against the following:

• According to federal regulation [45 CFR 98.11], the Department “has broad authority to administer the program through other governmental or non-governmental agencies”, such as county departments of human/social services. In addition, the regulation states that the Department “shall retain overall responsibility for the administration of the program” including monitoring programs and services, and ensuring that the departments of human/social services “operate according to the rules established for the program.”

• State regulation [8 CCR 1403-1, 3.103.YYY] defines a parent fee or copayment as the “household’s contribution to the total cost of child care paid directly to the child care provider(s) prior to any state/county child care funds being expended.”

• State regulation [8 CCR 1403-01, 3.124.A] states that “parent fees are based on gross countable income for the child care household compared to the household size, taking the number of children in care into account.”

What problems did the audit work identify?

We found that the Department did not fully comply with federal and state CCCAP requirements during Fiscal Year 2023. Specifically, we identified errors in 2 of the 60 case files (3 percent) that we tested, resulting in a total of $1,543 in known questioned costs. Specifically, we identified the following:

In two cases, the caseworker incorrectly entered information into CHATS when determining eligibility, which resulted in the adult caretakers being charged an incorrect parent fee. In one case, the caseworker entered the adult caretaker’s income incorrectly as $2,125 instead of the correct amount of $2,215, which caused the parent fee to be incorrectly calculated as $848 instead of the correct amount of $879. In the other case, the caseworker incorrectly entered the number of hours worked by the adult caretaker when calculating the caretaker’s income, which resulted in the income being incorrectly calculated as $1,974 instead of the correct amount of $3,637, which caused the parent fee to be incorrectly calculated as $352 instead of the correct amount of $551. Because parent fees are required to be paid before CCCAP benefits are paid, the errors in these two case files resulted in $1,543 in known questioned costs.

Why did these problems occur?

The Department lacked sufficient internal controls to ensure compliance with federal and state requirements for CCCAP during Fiscal Year 2023. The program was previously administered by the DHS, and this is the first year that the Department was in charge of the program. Program staff reported that they are working to implement effective internal controls, including policies and procedures requiring that Department CCCAP staff adequately monitor the county departments of human/social services to ensure the counties are conducting a secondary review over child care case files.

Why do these problems matter?

It is essential for the Department to ensure that child care eligibility is properly determined in accordance with state and federal regulations. Inaccurate processing of case file information for eligibility determination can result in counties improperly granting CCCAP benefits to ineligible individuals, denying benefits to eligible individuals who rely on those benefits in order to work and provide for their families, or assessing an incorrect parent fee. The federal government can disallow the payment of federal funds for program expenditures that do not adhere to regulations, which would require the State to use General Funds to cover the expenditures.

Recommendation 2023-050

The Department of Early Childhood (Department) should strengthen its internal controls over, and ensure it complies with, requirements for the federal Child Care and Development Fund Cluster grant by monitoring the county departments of human/social services to ensure they are performing supervisory and/or secondary reviews over case files after eligibility is determined in order to ensure eligibility is appropriately determined and that parent fees are accurate, and to address the issues identified in the audit.

Response Department of Early Childhood

Agree Implementation Date: December 2024

In December 2023, CCCAP automated case reviews in CHATS and required counties to submit reviews monthly. The results of the reviews are included in the performance monitoring process. The information gathered from the reviews will be used to target policy and system improvements and identify future training needs. Policy and system improvements to identify future training needs will be completed by December 2024.

Finding 2024-031 Trails – Information Security

Government Auditing Standards allow for information that is considered sensitive in nature, such as detailed information related to information technology system security, to be issued through a separate “classified or limited use” report because of the potential damage that could be caused by the misuse of this information. We consider the specific technical details of this finding, along with the response and addendum, to be sensitive in nature and not appropriate for public disclosure. Therefore, the details of the following finding, response, and addendum have been provided to OIT in a separate, confidential memorandum.

The Department of Human Services (Department), as the business owner, utilizes a statewide automated child welfare information system, known as Trails, to aid in administering a number of federally-funded child welfare programs, including the federal Foster Care Title IV-E program [ALN 93.658] (Program). Trails went live in 2001, and in Fiscal Year 2017, the Department and OIT—the Trails IT service provider—began a multi-phase and multi-year modernization project that continued during Fiscal Year 2024.

OIT, working closely with the Department’s Trails Security Administrators, is responsible for certain access management procedures related to Trails.

What was the purpose of our audit work and what work was performed?

The purpose of our audit work was to determine the disposition of our Fiscal Year 2023 audit recommendation where we recommended that OIT improve access management IT general controls over Trails. Our audit work was performed through interviews conducted of OIT staff and reviewing supporting documentation. OIT agreed with this recommendation and provided a June 2024 implementation date.

How were the results of the audit work measured?

We measured the results of our audit work against Colorado Information Security Policies, which are developed and published by OIT.

What problem did the audit work identify?

During our Fiscal Year 2024 audit, OIT reported that it did not implement our prior audit recommendation related to access management IT general controls for Trails.

Why did this problem occur?

OIT communicated that it was still in the process of working with the Department to ensure controls are properly implemented.

Why does this problem matter?

When access management IT general controls are lacking, management may not be able to ensure their expectations and the entity’s objectives are being met, that risks are responded to appropriately, and that a strong system of internal control is established, which increases the risk of unauthorized access and can impact the confidentiality, integrity, and availability of the Trails system. See schedule of Findings and Questioned Costs for chart/table. Recommendation 2024-031

The Governor’s Office of Information Technology should improve access management IT general controls over the Trails system by implementing the recommendation noted in the confidential finding.

Response Office of the Governor

Agree Implementation Date: February 2025

The Governor’s Office of Information Technology agrees with this recommendation and will remediate the finding by February 2025.

Finding 2024-032 Compliance with Activities Allowed or Unallowed and Allowable Costs/Cost Principles for Medicaid

Medicaid Claims Payments

The Department reimburses medical providers, pharmacies, and medical equipment providers for claims submitted to the Department for services provided to eligible beneficiaries in the Medicaid program. To be allowable, Medicaid costs for services must be (1) covered by the CMS-approved state plan or the CMS-approved waivers; (2) reviewed by the Department consistent with the Department’s documented procedures and system for determining the medical necessity of claims; (3) properly coded; and (4) paid at the rate allowed by the state plan. A Medicaid state plan is a formal, written agreement between a state and the federal government describing how a state administers its Medicaid program, which includes both the basic requirements of the program and individualized content that reflects the characteristics of the state’s program [42 CFR 430.10]. The state plan is written by the state and must be approved by CMS in order for the State to access federal Medicaid funds.

The Department uses Colorado interChange as its medical claims system. Colorado interChange is programmed to make Medicaid claims payments on behalf of eligible beneficiaries in accordance with federal and state Medicaid rules and regulations. During Fiscal Year 2024, the Department contracted with a fiscal agent, Gainwell Technologies (Gainwell), to manage Colorado interChange. A fiscal agent is a contractor that acts on behalf of the Department in respect to claims processing activities, including evaluating and approving or rejecting claims payments in accordance with established Department policies. Although Gainwell receives and processes all claims, the Department is ultimately responsible for ensuring that the claims are paid in accordance with federal and state regulations.

Providers are responsible for preparing and submitting Medicaid claims to Gainwell for processing in compliance with the Department’s claim filing requirements. All provider claims must include a diagnosis code, procedure code, and the provider’s usual and customary charges for payment (Provider Rate). Procedure codes are dependent on the type of service and claim type.

Colorado interChange is programmed with CMS-approved rates for each procedure code. Gainwell will use the claims information received by the provider, including the specific procedure codes and Provider Rate, to process and pay the claims in Colorado interChange. Providers are advised by the Department to bill their usual and customary charges for services, and the Colorado interChange system pays the lower of either (1) the Provider Rate, or (2) the Department’s CMS-approved rates.

If needed, all claims may be adjusted for increased payment, decreased payment, or recovery without repayment. Adjustments that increase or decrease the original payment amount are processed as a two-part transaction in Colorado interChange—the first piece of the transaction reverses the previously made payment, and the second piece of the transaction repays the claim at the corrected rate. If a previously paid claim is adjusted to pay less than the original amount, the adjustment will result in a retraction of the difference between the original payment and the corrected payment amount. If a previously paid claim is adjusted to pay more than the original amount, depending on if the provider billed usual and customary rates, the adjustment will result in an additional payment to the provider.

The Department authorizes updates to the rate tables in Colorado interChange whenever there are changes in the claims rates. All provider rate increases are subject to CMS approval prior to implementation of an increase. Rate changes are generally made at the beginning of each fiscal year, but can be made anytime an update is required, such as when CMS issues a rate change that is based on the federal fiscal year (which begins on October 1). To make a change in the rate tables, Department staff fill out a change request form (Update Form) including the purpose of the request, instructions on the specific information that needs updating, and any other special instructions related to the request. The Department must include specific instructions on the Update Form if any claims have to be reprocessed as part of the request. A reprocessing request is needed if the actual rate change is made after the effective date of the change. For example, if a rate change was effective at the beginning of the fiscal year (July 1) but processed on July 15, the Update Form should include a specific request to reprocess claims with dates of service from July 1 to July 15, which would ensure the claims are paid at the correct rates. Once complete, Department staff send the Update Form to Gainwell for processing in Colorado interChange.

What was the purpose of our audit work and what work was performed?

The purpose of our audit work was to review the Department’s internal controls over the Medicaid claims payment process and to determine whether payments were processed and paid in accordance with state and federal regulations during Fiscal Year 2024.

During our audit, we obtained a list of all Medicaid claims that were paid by the Department during Fiscal Year 2024, which included 77,824,795 individual Medicaid claims totaling $11,542,679,377. We performed testing on a randomly selected sample of 40 Medicaid claims paid during Fiscal Year 2024 totaling $4,486,936 to determine whether the claim (1) matched the claims information that was reported in Colorado interChange; (2) was paid at the rate allowed by the state plan; and (3) beneficiary was eligible for the Medicaid program at the time of service.

How were the results of the audit work measured?

We measured the results of our audit work against the following requirements:

Federal regulations [45 CFR 75.403] require that costs under federal awards must be necessary, reasonable, and allocable; conform to any limitations or exclusions; be consistent with policies and procedures; receive consistent treatment; adhere to Generally Accepted Accounting Principles (GAAP); not be used for cost sharing of other programs; and be adequately documented.

Section 25.5-4-301(2), C.R.S., states that any overpayment to a provider is recoverable, regardless of whether the overpayment is the result of an error by the state department, a county department of human or social services, an entity acting on behalf of either department, or by the provider or any agent of the provider.

Federal regulations [45 CFR 75.303] state that recipients of federal funds must establish and maintain effective internal controls over its federal awards, which provide reasonable assurance that the recipient is managing its federal grants in compliance with federal statutes, regulations, and the award terms and conditions. These internal controls should be in compliance with “Standards for Internal Control in the Federal Government” (Green Book), published by the U.S. Government Accountability Office. Principles 3.09-3.10, Documentation of the Internal Control System, state that management is to develop and maintain documentation of its internal control system. This documentation should establish the who, what, when, where, and why of internal control execution to personnel. Documentation also provides a means to retain organizational knowledge and mitigate the risk of having that knowledge limited to a few personnel. What problem did the audit work identify?

Based on our audit testwork, we determined that one of the 40 claims tested (2.5 percent) contained procedure codes that were paid at the incorrect rate for Fiscal Year 2024. Specifically, the claim selected for testing contained three specific procedures, two of which were paid at the rate in effect during Fiscal Year 2023 instead of the correct Fiscal Year 2024 rate. The third procedure code had the same rate for both Fiscal Year 2023 and 2024, so no difference was noted. The total known questioned costs for this claim were $137.20. See Schedule of Findings and Questioned Costs for chart/table. We provided the claim to Department staff to research, and they determined that this claim was part of a group of 2,423 individual claims with specific procedure codes that were paid at the rate in effect during Fiscal Year 2023 instead of the correct Fiscal Year 2024 rate. The total known questioned costs for this group of claims, including the sample tested above, was $189,015.98. Why did this problem occur?

The Department does not have adequate internal controls, including formal policies and procedures, in place related to the rate updating process in Colorado interChange. Specifically, the Department lacked policies and procedures detailing how to complete the rate Update Form, requiring a secondary review process over the completed Update Form prior to submission to Gainwell, and requiring a post-implementation review of the rate changes made in Colorado interChange to confirm they were correctly made by Gainwell. On July 21, 2023, Department staff completed and submitted an Update Form to Gainwell to process the annual rate updates; the Department staff who processed the rate update had been trained on the process before, but this was the first time they completed the process independently and they overlooked including specific instructions to reprocess any claims with dates of service before the update (July 1, 2023 to July 21, 2023) at the new rate. This caused the Fiscal Year 2024 rate changes to take effect on July 21, 2023 instead of July 1, 2023 (the first day of the fiscal year). The Department did not have a review process in place to confirm that the Update Forms were completed accurately and included all necessary information, so the Department was unaware of the issue until it was identified during our audit.

Once notified of the error, Department staff contacted Gainwell to initiate an adjustment to correct all claims with dates of service from July 1, 2023 to July 21, 2023 that were paid at the incorrect rate. The Department also notified all providers of the issue on the Department’s Provider Resources website and in the December 2024 Provider Bulletin. The adjustment was processed on November 22, 2024.

Why does this problem matter?

Strong internal controls over the Medicaid claims process—including documented policies and procedures detailing how to complete the Update Form and an effective review process—are necessary to ensure that Medicaid claims are paid at the correct rates approved by the state plan and in accordance with federal and state regulations. In addition, making payments over the specific rates can result in the Department having to repay the federal government for the federal portion of the overpayments. See Schedule of Finding and Questioned Costs for chart/table. Recommendation 2024-032

The Department of Health Care Policy and Financing (Department) should strengthen its internal controls over the Medicaid claims process by developing, documenting, and implementing formal policies and procedures over the rate updating process in Colorado interChange, the Department’s medical claims system. These policies and procedures should include details on how to complete the rate change request form (Update Form), require a secondary review process over the completed Update Form prior to submission to Gainwell Technologies—the Department’s contracted fiscal agent that manages Colorado interChange—and require a post-implementation review of the rate changes made in Colorado interChange to confirm they were correctly made by Gainwell.

Response Department of Health Care Policy and Financing

Agree Implementation Date: July 2025

The Department of Health Care Policy and Financing has examined rate maintenance practices since FY2024 to determine the best course of action to strengthen internal controls to subsequently develop formal policies and procedures. The Waiver and Fee Schedule Rates section will develop a formal, recorded training and corresponding training materials based on current, informal processes on completion of the rate update form to be submitted to the Department's fiscal agent, Gainwell Technologies. Since FY2024, the Waiver and Fee Schedule Rates section has implemented a multilevel secondary review process prior to any rate change submission to ensure accuracy in rate update submissions. The Rates section has also worked closely with other internal partners to formalize informal update processes for quality assurance and maintenance of a minimal error percentage. The Rates section has also implemented a post-implementation data analysis review of all rate update submissions to ensure the update was implemented as directed and expected to ensure accountability on behalf of the Department's fiscal agent Gainwell Technologies. The Rates section is currently in process of documenting and formalizing all rate update processes and policies for future training and process maintenance.

Finding 2024-033 Compliance with Eligibility for Medicaid and CBHP

Ex Parte Renewal Process

Federal regulations require state medical assistance programs to renew a beneficiary’s eligibility once every 12 months to determine whether the beneficiary continues to qualify for benefits. States must first attempt to redetermine the beneficiary’s eligibility based on information the Department has available at that time, either from the beneficiary’s case file or other electronic data sources, without requiring information from the beneficiary. This is called an “ex parte” renewal. If sufficient information is available, the Department can renew eligibility on an ex parte basis and notify the beneficiary that their coverage has been renewed. If sufficient information is not available, the Department will provide the beneficiary with a renewal form and request any additional documentation needed to determine eligibility.

What was the purpose of our audit work and what work was performed?

The purpose of our audit work was to review the Department’s internal controls over the Medicaid and CBHP eligibility determination process, as well as to determine whether the Department complied with applicable federal and state Medicaid and CBHP eligibility requirements during Fiscal Year 2024.

During our audit, we inquired with the Department on the ex parte renewal process for Medicaid and CBHP beneficiaries.

How were the results of the audit work measured?

We measured the results of our audit work against the following:

Federal regulations require states to complete a redetermination of eligibility based on available information for each individual in the household, regardless of the eligibility of others in the household unit. Specifically, these regulations require that states complete a redetermination of eligibility for all beneficiaries without requiring information from the individual if able to do so based on reliable information contained in the individual’s case file or more current information available to the state (ex parte basis) [42 CFR 435.916(b)(2) and 457.343]. If they are unable to do so, the state must provide the individual with a pre-populated renewal form and give them at least 30 calendar days to respond and provide any necessary information [42 CFR 435.916(b)(2)].

Federal regulations [42 CFR 435.952(d) and 457.380(f)] specify that states may not terminate eligibility or reduce benefits on the basis of information obtained through the ex parte renewal process without first contacting the beneficiary and offering them an opportunity to provide new information.

What problem did the audit work identify?

The Department reported to us that they were not in compliance with eligibility requirements related to the ex parte renewal process during Fiscal Year 2024. As CMS worked with individual states on their COVID-19 unwinding plans, they identified 29 states that were not in compliance with certain ex parte renewal requirements for Medicaid and CBHP beneficiaries, including Colorado. The Department was inappropriately conducting ex parte renewals at the household level rather than individual level, without using individually-specific eligibility statutes and income thresholds for individuals within the household. Specifically, if eligibility could not be renewed on an ex parte basis for at least one member of a household, renewal forms were sent to the entire household. If the renewal forms were returned, the appropriate eligibility determinations were made and those who are eligible were approved. If the renewal forms were not returned, the Department’s eligibility system, the Colorado Benefits Management System (CBMS), would disenroll all individuals in the household, including any who may have been determined to be eligible through the ex parte process.

Why did this problem occur?

In August 2023, CMS instructed all states to review their ex parte renewal process to assess compliance with federal requirements to complete eligibility redeterminations based on the available information for each individual in the household, regardless of the eligibility of others in the household unit. States that identified any areas of noncompliance were required to (1) pause terminations for any ex parte renewal processes that are not compliant with federal guidance and whose coverage may be terminated inappropriately; (2) reinstate coverage for all affected individuals who have been disenrolled due to a failure to complete redeterminations based on the available information for each individual in the household; (3) fix the state’s systems and processes to ensure that redeterminations are conducted appropriately; and (4) implement a mitigation strategy to prevent continued inappropriate terminations until the state has fixed all systems and processes to be in compliance with federal renewal requirements. States were required to submit the state’s plan and timeline for remediation to CMS.

In September 2023, the Department reported to CMS that it was not fully in compliance with the federal requirements for determining eligibility for each individual in the household, and it submitted a mitigation plan and timeline to fix the CBMS system and Department’s processes to ensure that redeterminations were conducted appropriately in the future. As part of the Department’s mitigation plan, automatic terminations of any households who did not return a renewal form were temporarily paused until a short-term system fix was put in place. In October 2023, a CBMS fix was put into place for households that did not return their renewal forms. CBMS continued to send renewal forms to households requesting additional information; however, for any multi-member household that did not return its form, the Department started reviewing eligibility for all members of the household individually. This short-term system fix brought the Department into compliance with federal ex parte renewal requirements. The Department is currently working on a permanent system change for CBMS that will only send out renewal forms for individuals not eligible through the ex parte process, with targeted implementation by December 2026.

Why does this problem matter?

When the Department is out of compliance with federal requirements, such as Medicaid requirements, the Department risks sanctions and/or other penalties. After CMS identified the Department’s noncompliance related to the Medicaid ex parte renewal issue, the Department researched the issue and identified 7,510 individuals who were incorrectly disenrolled from Medicaid or CBHP during the period May 2023 to October 2023. In November 2023, the Department retroactively reinstated these individuals’ eligibility back to the date at which their household was terminated, without a gap in coverage. In addition, the individuals were notified that their coverage had been reinstated and provided information on how to obtain payment for unpaid medical bills and/or ensure that any eligible service during the period that the individual was disenrolled were covered. See Schedule of Findings and Questioned Costs for chart/table. Recommendation 2024-033

The Department of Health Care Policy and Financing should strengthen its internal controls over Medicaid eligibility to ensure compliance with federal and state regulations by continuing to implement the Colorado Benefits Management System change related to the ex parte eligibility process to ensure that eligibility is determined on an individual rather than household basis, as required.

Response Department of Health Care Policy and Financing

Agree Implementation Date: December 2026

The Department agrees to strengthen its internal controls over Medicaid eligibility to ensure compliance with federal and state regulations. Colorado will continue its approved Centers for Medicare and Medicaid mitigation plan to ensure that eligibility is determined on an individual rather than a household basis. The Department will continue to conduct ex parte reviews to determine eligibility for all household members based on available information. Those members identified as eligible at ex parte will be approved, regardless if others in the household continue to need verifications or are no longer eligible. The Department is currently working on a permanent system change for CBMS that will only send out renewal forms for individuals not eligible through the ex parte process, with implementation by December 2026.

Finding 2024-034 Compliance with Eligibility for Medicaid

The Department is responsible for ensuring that all expenditures under Medicaid are appropriate, and that the State complies with federal and state program requirements. In Colorado, the responsibility for determining recipient eligibility for Medicaid program benefits is shared between local counties, designated Medical Assistance eligibility sites (MA sites), and the State. For Medicaid, individuals and families apply for benefits at their local county departments of human/social services, designated MA sites, or online through the Program Eligibility and Application Kit (PEAK) system. Local counties and MA sites are responsible for administering the benefits application process, entering the required data for eligibility determination into CBMS, and approving or denying an applicant’s eligibility. An eligible beneficiary’s income and countable resources cannot exceed a limit set by federal and state regulations. CBMS has a system check to mark eligibility as “fail” if the applicant’s reported income exceeds the limit. The CBMS eligibility data feeds into Colorado interChange, which pays providers for the services that they provide to Medicaid beneficiaries.

The caseworker enters the applicant’s information into CBMS and, once all required information is entered, they can mark the application as complete. At that point CBMS determines the applicant’s eligibility based on the information entered. If the application is incomplete, a caseworker is responsible for contacting the individual to assist with completing their application.

The Department is responsible for supervising and monitoring the local counties’ and MA sites’ administration of Medicaid eligibility determinations. The Department is also responsible for ensuring that only eligible providers receive reimbursement for their costs of providing allowable services on behalf of eligible individuals.

What was the purpose of our audit work and what work was performed?

The purpose of our audit work was to review the Department’s internal controls over the Medicaid eligibility determination process, as well as to determine whether the Department complied with applicable federal and state Medicaid eligibility requirements during Fiscal Year 2024.

During our audit, we reviewed the Department’s Medicaid eligibility internal controls in place during Fiscal Year 2024. In addition, we performed testing on a random non-statistical sample of 60 beneficiaries to determine if they were properly determined eligible and receiving Medicaid benefits during Fiscal Year 2024. We obtained a listing of Medicaid claims, totaling $11,542,679,377, that were submitted by providers and paid by the Department during Fiscal Year 2024 on behalf of 2,906,773 individual beneficiaries. From that listing we selected 60 beneficiaries to determine whether those individuals’ Medicaid eligibility determination was appropriate.

Our testing included reviewing supporting documentation, including case files, information in CBMS data fields related to eligibility determination/redetermination, and Medicaid payment information in Colorado interChange. We performed testwork to determine whether the Department ensured that local county and MA site caseworkers obtained and maintained the required documents supporting eligibility determinations in the case files, correctly entered eligibility data into CBMS, and determined eligibility in a timely manner.

What problems did the audit work identify and how were the results measured?

We identified errors in 7 of the 60 Medicaid case files tested (12 percent). These errors resulted in a total of $328 in known questioned costs for Fiscal Year 2024, as follows:

Details of Errors Identified. Specifically, we found the following: • Timely Processing. In 1 case, the caseworker processed the application in 141 days, or 96 days after the required timeframe of 45 days. No questioned costs were identified in this instance because the beneficiary was appropriately approved for benefits.

State regulation [10 CCR 2505-10, 8.100.3.D] notes that eligibility sites shall process an application for benefits within 90 days for persons who require a disability determination and 45 days for all other applications.

• Income and/or Resource Issues. We identified the following 4 income and/or resource-related issues:

o In 1 case, the caseworker excluded resources when they should have been included when determining eligibility. This individual was requesting eligibility for the Home and Community Based Services (HCBS) program, which has a $2,000 resource limit. No questioned costs were identified in this instance because the correct income threshold was still within federal and state guidelines.

o In 1 case, reportable income was incorrectly excluded when determining the beneficiary’s eligibility. No questioned costs were identified in this instance because the beneficiary’s eligibility was still within federal and state guidelines.

o In 1 case, the resource threshold was left blank in the beneficiary’s resource verification. The individual was requesting eligibility for the HCBS program, which has a $2,000 resource limit. No questioned costs were identified in this instance because the correct resource amounts were still within federal and state guidelines.

o In 1 case, the incorrect income threshold was used when determining eligibility. Specifically, the income standard used in the calculation was effective for Fiscal Year 2023 instead of the updated Fiscal Year 2024 income standard. No questioned costs were identified in this instance because the beneficiary’s income was less than the corrected income threshold.

Federal regulations [42 CFR 435.119] require household income to be at or below 133 percent threshold of the federal poverty level.

State regulation [10 CCR 2505-10, 8.100.4.G.4] notes adults applying for medical assistance shall be determined financially eligible for medical assistance as long as their total household income does not exceed 133% of the federal poverty level.

State regulation [10 CCR 2505-10, 8-100.5.M] notes that the resource limit for individuals receiving Home and Community Based Services assistance is $2,000.

• Missing Case File Documentation. In 3 cases, we determined the case file did not have at least 1 piece of documentation necessary to support the Medicaid eligibility determination, as required by federal and state regulations, including the following:

o In 2 cases, documentation to support the applicant’s completed application for assistance was missing. No questioned costs were identified in this instance because the individuals did not have any claims after the eligibility determination was made.

o In 1 case, documentation to support the applicant’s resource calculation was missing. No questioned costs were identified in this instance because the Department was ultimately able to provide support confirming the applicant was below the resource threshold.

o In 1 case, documentation used to support income and/or resources, such as wage stubs or bank statements, was missing. This resulted in known questioned costs of $328.

Federal regulation [420 CFR 435.914] requires the Department to obtain and maintain documentation to support each beneficiary’s Medicaid eligibility determination.

State regulation [10 CCR 2505-10-8.100.4.B] further specifies that applicants seeking Medical Assistance shall provide a Social Security Number, as well as verification of citizenship and identity. Earned income must be verified by wage stubs, tax documents, written documentation from the employer stating the employee’s gross income, or through a telephone call to an employer.

Why did these problems occur?

We determined that the Department did not have adequate internal controls over Medicaid eligibility to ensure caseworkers determine eligibility appropriately and in accordance with federal and state regulations. Specifically, caseworkers were not adequately trained or held accountable for processing applications timely, using the correct income and resource thresholds to determine eligibility, and ensuring that the required documentation to support eligibility was maintained within the case file.

Why do these problems matter?

As the state Medicaid agency, it is essential for the Department to ensure that Medicaid eligibility determinations are made appropriately and in accordance with federal and state regulations. This includes ensuring that inaccurate processing of information used to determine Medicaid eligibility does not result in Medicaid benefits being provided to, and paid on behalf of, ineligible individuals, or that eligible individuals are denied benefits. Ultimately, the federal government may disallow federal funds for Medicaid program expenditures that do not adhere to regulations, and the State would be required to bear the cost of these errors. See Schedule of Finding and Questioned Costs for chart/table.

Recommendation 2024-034

The Department of Health Care Policy and Financing should strengthen its internal controls over Medicaid eligibility to ensure compliance with federal and state regulations by addressing the issues identified in the audit. This should include ensuring that local counties and Medical Assistance site caseworkers are appropriately trained and are held to required timelines for processing beneficiary applications, using the correct income and resource thresholds to determine eligibility, and maintaining the required documentation to support eligibility in the case file.

Response Department of Health Care Policy and Financing

Agree Implementation Date: February 2026

The Department agrees to strengthen its internal controls over Medicaid eligibility to ensure compliance with federal and state regulations by addressing the findings identified in the audit. The Department will issue formal Management Decision Letters for the identified counties. The Management Decision Letters require the counties to develop and implement a Department-approved Corrective Action Plan that identifies and addresses the root causes of each finding. The Department is also facilitating a change to our current HCPF county administration rules that sets standards that require adequate internal training for system access, state-identified ongoing, mandatory trainings, the certification of county trainers by the state and pre-approval of county training materials. These rule changes have an effective date of July 2025 and will help all counties to improve the accuracy and reduce variability of eligibility determination performance. Additionally, the Joint Agency Interoperability project, which procures a single, unified workload and document management system for all counties, is on track for implementation in 2026-2027. This system will help ensure the appropriate documentation for eligibility determination is retained.

Finding 2024-035 Compliance with Eligibility for CBHP

The Department is responsible for ensuring that all federal Children’s Health Insurance Plan (CHIP) expenditures are appropriate, and that the State complies with federal and state program requirements. Colorado’s state-run children’s health plan, the Children’s Basic Health Plan (CBHP), is partially funded with federal CHIP dollars. In Colorado, the responsibility for determining recipient eligibility for CBHP program benefits is shared between local counties, designated MA sites, and the State. For CBHP, individuals and families apply for benefits at their local county departments of human/social services, designated MA sites, or online through the PEAK system. When applying in person, the local counties and MA sites are responsible for administering the benefits application process, entering the required data for eligibility determination into CBMS, and approving or denying an applicant’s eligibility. The CBMS eligibility data feeds into Colorado interChange, which pays providers for the services that they provide to CBHP beneficiaries. Once eligibility is determined, the county or MA site is responsible for maintaining records on each applicant in a case file, and then retaining those case files for the periods required by federal and state laws. The Department provides eligibility staff with copies of its Department-prepared policy and operational training documents and guides for reference. These documents are meant to provide staff with consistent and accurate program information, and are posted online for all county and MA sites to use.

For CBHP, the Department contracts with managed-care entities (MCEs), which are groups or organizations of medical service providers that serve CBHP beneficiaries, to provide capitation payments to CBHP providers. All CBHP members are enrolled into an MCE plan as soon as the member’s eligibility determination is made. The specific MCE plan is based on the county the member lives in. Capitation payments are lump-sum monthly payments made to MCEs based on the number of eligible beneficiaries enrolled in its plan; the MCEs then contract with a network of providers to provide Medicaid and CBHP services. The service providers are then paid by the MCE. Capitation payments are paid regardless of whether the providers serve beneficiaries during the month or not. Colorado interChange is programmed to pay capitation payments only on behalf of beneficiaries that are deemed eligible in Colorado interChange, based on eligibility information received from CBMS and requirements specified in federal and state regulations.

What was the purpose of our audit work and what work was performed?

The purpose of our audit work was to review the Department’s internal controls over the CBHP eligibility determination process, as well as to determine whether the Department complied with applicable federal and state CBHP eligibility requirements during Fiscal Year 2024.

During our audit, we reviewed the Department’s CBHP eligibility internal controls in place during Fiscal Year 2024. In addition, we performed testing on a random non-statistical sample of 60 beneficiaries to determine if they were properly determined eligible and receiving CBHP benefits during Fiscal Year 2024. We obtained a listing of CBHP claims, totaling $176,890,370, that were submitted by providers and paid by the Department during Fiscal Year 2024 on behalf of 148,009 individual beneficiaries. From that listing we selected 60 beneficiaries to determine whether those individuals’ CBHP eligibility determination was appropriate.

Our testing included reviewing supporting documentation, including case files, information in CBMS data fields related to eligibility determination/redetermination, and CBHP payment information in Colorado interChange. We performed testwork to determine whether the Department ensured that local county and MA site caseworkers obtained and maintained the required documents supporting eligibility determinations in the case files, correctly entered eligibility data into CBMS, and determined eligibility in a timely manner.

What problems did the audit work identify and how were the results measured?

We identified at least one error in 8 of the 60 CBHP case files tested (13 percent). These errors resulted in a total of $1,083 in known questioned costs for Fiscal Year 2024. Specifically, we found the following:

• Missing Case File Documentation. In 5 cases, we determined the case file did not have at least 1 piece of documentation necessary to support the CBHP eligibility determination, as required by federal and state regulations, including the following:

o In 1 case, documentation to support the applicant’s completed application for assistance was missing. No questioned costs were identified in this instance because the individual did not have any claims after the eligibility determination was made.

o In 4 cases, documentation to support income, such as wage stubs, was missing. This resulted in known questioned costs of $919.

o In 1 case, documentation to support citizenship, such as a birth certificate or other allowable records, was missing. This resulted in known questioned costs of $164.

Federal regulations [42 CFR 457.965] note that the state must include in each applicant’s record facts to support the state’s determination of the applicant’s eligibility for the Children’s Health Insurance Program.

State regulation [10 CCR 2505-3.110.1.E] notes that, to be eligible for the Children’s Basic Health Plan, an eligible person shall have a household income greater than 142 percent but not exceeding 260 percent of the Federal Poverty Level, adjusted for household size for children under the age of 19.

State regulation [10 CCR 2505-3.130] notes that, to be eligible for the Children’s Basic Health Plan, an applicant shall provide minimal verification as required in 10 CCR 2505-10-8.100.4.B.

State regulation [10 CCR 2505-10-8.100.4.B] further specifies that applicants seeking Medical Assistance (Medicaid or Children’s Basic Health Plan services) shall provide a Social Security Number, as well as verification of citizenship and identity. Earned income must be verified by wage stubs, tax documents, written documentation from the employer stating the employee’s gross income, or through a telephone call to an employer.

• Incorrect Income Threshold or Income Calculation. In 3 cases, we determined that the incorrect income threshold was used or the incorrect income amount was calculated for the beneficiary’s eligibility determinations. Specifically, we found the following:

o In 1 case, the income threshold was left blank in the beneficiary’s income verification. No questioned costs were identified in this instance because the beneficiary’s income was less than the corrected income threshold.

o In 1 case, the incorrect income threshold was used because the incorrect number of household members was entered into CBMS. No questioned costs were identified in this instance because the beneficiary’s income was less than the corrected income threshold.

o In 1 case, reportable income was incorrectly excluded when determining the beneficiary’s eligibility. No questioned costs were identified in this instance because the beneficiaries’ income was still within federal and state guidelines.

State regulation [10 CCR 2505-3.110.1.E] notes that, to be eligible for the Children’s Basic Health Plan, an eligible person shall have a household income greater than 142 percent but not exceeding 260 percent of the Federal Poverty Level, adjusted for household size for children under the age of 19.

State regulation [10 CCR 2505-3.150.1] notes that the calculation of income for the Children’s Basic Health Plan shall be determined as required in 10 CCR 2505-10-8-100.4.C.

State regulation [10 CCR 2505-8.100.4.C] notes that the Modified Adjusted Gross Income calculation for the purposes of determining a household’s financial eligibility shall consist of, but is not limited to, earned income in the form of wages, salaries, and tips.

Why did these problems occur?

We determined that the Department did not have adequate internal controls over CBHP eligibility to ensure caseworkers determine eligibility appropriately and in accordance with federal and state regulations. Specifically, caseworkers were not adequately trained or held accountable for ensuring that the required documentation to support eligibility was maintained within the case file, and that the correct income thresholds were used to determine eligibility.

Why do these problems matter?

As the State department responsible for ensuring that all expenditures under CBHP are appropriate, it is essential for the Department to ensure that eligibility determinations are made appropriately and in accordance with federal and state regulations. This includes ensuring that inaccurate processing of information used to determine eligibility does not result in CBHP benefits being provided to, and paid on behalf of, ineligible individuals, or that eligible individuals are denied benefits. Ultimately, the federal government may disallow federal funds for Medicaid program expenditures that do not adhere to regulations, and the State would be required to bear the cost of these errors.

See Schedule of Finding and Questioned Costs for chart/table.

Recommendation 2024-035

The Department of Health Care Policy and Financing should strengthen its internal controls over the Children’s Basic Health Plan eligibility to ensure compliance with federal and state regulations by addressing the issues identified in the audit. This should include ensuring that local counties and Medical Assistance site caseworkers are appropriately trained to maintain the required documentation to support eligibility in the case file and use the correct income thresholds to determine eligibility.

Response Department of Health Care Policy and Financing

Agree Implementation Date: February 2026

The Department agrees to strengthen its internal controls over Children’s Basic Health Plan eligibility to ensure compliance with federal and state regulations by addressing the findings identified in the audit. The Department will issue formal Management Decision Letters for the identified counties. The Management Decision Letters require the counties to develop and implement a Department-approved Corrective Action Plan that identifies and addresses the root causes of each finding.

The following findings and recommendations relating to internal control deficiencies classified as Material Weaknesses and Significant Deficiencies were communicated to the Department of Health Care Policy and Financing (Department) in the previous year and have not been remediated as of June 30, 2024 because the original implementation dates provided by the Department were in a subsequent fiscal year. These complete findings and recommendations can be found within the original report and the complete recommendations can be found within Section IV: Prior Audit Recommendations of this report. Finding 2023-053 Medicaid Controls Over Eligibility Determinations

The Department is responsible for ensuring that all expenditures under Medicaid are appropriate, and that the State complies with federal and state program requirements. In Colorado, the responsibility for determining recipient eligibility for Medicaid program benefits is shared between local counties, designated Medical Assistance eligibility sites (MA sites), and the State. For Medicaid, individuals and families apply for benefits at their local county departments of human/social services, designated MA sites, or online through the Program Eligibility and Application Kit (PEAK) system. Local counties and MA sites are responsible for administering the benefits application process, entering the required data for eligibility determination into the Colorado Benefits Management System (CBMS), and approving or denying an applicant’s eligibility. An eligible beneficiary’s income and countable resources cannot exceed a limit set by federal and state regulations. CBMS has a system check to mark eligibility as “fail” if the applicant’s reported income exceeds the limit. The CBMS eligibility data feeds into the Colorado interChange system (Colorado interChange), which pays providers for the services that they provide to Medicaid beneficiaries.

If the application is complete, the caseworker enters the information into CBMS, at which point CBMS determines the applicant’s eligibility based on the information entered. If the application is incomplete, a caseworker is responsible for contacting the individual to assist with completing their application.

The Department is responsible for supervising and monitoring the local counties’ and MA sites’ administration of Medicaid eligibility determinations. The Department is also responsible for ensuring that only eligible providers receive reimbursement for their costs of providing allowable services on behalf of eligible individuals.

What was the purpose of our audit work and what work was performed?

The purpose of our audit work was to review the Department’s internal controls over the Medicaid eligibility determination process, as well as to determine whether the Department complied with applicable federal and state Medicaid eligibility requirements during Fiscal Year 2023.

During our audit, we reviewed the Department’s Medicaid eligibility internal controls in place during Fiscal Year 2023. In addition, we performed testing on a random non-statistical sample of 60 beneficiaries to determine if they were properly determined eligible and receiving Medicaid benefits during Fiscal Year 2023. The Department operated under the continuous enrollment condition from July 1, 2022 to March 31, 2023, or 75 percent of the fiscal year. We obtained a listing of 106,314 beneficiaries who were determined to be newly eligible and who had a payment made on their behalf to a Medicaid provider during this period. We noted approximately 63 percent of all beneficiaries that received benefits during Fiscal Year 2023 had claims during the first 3 quarters of the fiscal year. From that listing we selected 38 beneficiaries (63 percent of the total sample) to determine whether those individuals’ Medicaid eligibility determination was appropriate.

The Department started its unwinding process in April 2023 and continued the process through June 2023 (25 percent of the fiscal year). We obtained a list of 62,296 beneficiaries whose eligibility was reviewed as part of the Department’s renewal unwinding process and who had a payment made on their behalf to a Medicaid provider during this period. We noted approximately 37 percent of all beneficiaries that received benefits during Fiscal Year 2023 had claims during the last quarter of the fiscal year. From that list, we selected 22 beneficiaries (37 percent of the total sample), to determine whether those individuals’ Medicaid eligibility determination was appropriate.

Our testing included reviewing supporting documentation, including case files, information in CBMS data fields related to eligibility determination/redetermination, and Medicaid payment information in Colorado interChange. We performed testwork to determine whether the Department ensured that local county and MA site caseworkers obtained and maintained the required documents supporting eligibility determinations in the case files, correctly entered eligibility data into CBMS, and determined eligibility in a timely manner.

Additionally, we reviewed the Department’s progress in implementing our Fiscal Year 2020 audit recommendation related to Medicaid eligibility. During the prior audit, we recommended the Department strengthen its internal controls over Medicaid by providing adequate training to caseworkers to ensure they properly determine eligibility when processing beneficiary applications.

What problems did the audit work identify and how were the results measured?

We identified at least 1 error in 3 of the 60 Medicaid case files tested (5 percent). These errors resulted in a total of $95 in known questioned costs for Fiscal Year 2023, as shown below.

Details of Errors Identified. Specifically, we found the following:

• Timely Processing. In one case, the caseworker processed the application in 73 days, or 28 days after the required time frame of 45 days. No questioned costs were identified in this instance because the beneficiary was appropriately approved for benefits.

o State regulation [10 CCR 2505-10, 8.100.3.D.] notes that eligibility sites shall process an application for benefits within 90 days for persons who require a disability determination, and 45 days for all other applications.

• Incorrect Income Threshold. In one case, CBMS used the incorrect income threshold for the beneficiary’s eligibility determination. Specifically, CBMS used the income standard that was effective for Fiscal Year 2022 instead of the updated Fiscal Year 2023 income standard. The beneficiary’s income was less than the correct income threshold and, therefore, this error did not result in questioned costs.

o Federal regulation [42 USC 1395w-114] requires an individual to meet income limits in order to receive Medicaid benefits.

• Missing Case File Documentation. In one case, we determined the case file did not have the documentation necessary to support the Medicaid eligibility determination, as required by federal and state regulations. Specifically, the case file was missing a copy of the beneficiary’s birth certificate, or other evidence that the individual was a qualified non-citizen when processing the application. This resulted in known questioned costs of $95.

o Federal regulation [42 CFR 435.914] requires the Department to obtain and maintain documentation to support each beneficiary’s Medicaid eligibility determination.

o State regulation [10 CCR 2505-10, 8.100.3.G.1.g] requires all individuals who apply for Medicaid to be either a citizen of the United States or its Territories, or be a qualified non-citizen. Citizenship or nationality along with identity status must be verified unless satisfactory documentary evidence has already been provided.

Why did these problems occur?

We determined that the Department did not fully implement our prior audit recommendation related to ensuring caseworkers determine eligibility appropriately and in accordance with federal and state regulations. Specifically, caseworkers did not process applications timely, use the correct income thresholds to determine eligibility, and ensure that the required documentation to support eligibility was maintained within the case file.

Why do these problems matter?

As the state Medicaid agency, it is essential for the Department to ensure that Medicaid eligibility determinations are made appropriately and in accordance with federal and state regulations. This includes ensuring that inaccurate processing of information used to determine Medicaid eligibility does not result in Medicaid benefits being provided to, and paid on behalf of, ineligible individuals, or that eligible individuals are denied benefits. Ultimately, the federal government may disallow federal funds for Medicaid program expenditures that do not adhere to regulations, and the State would be required to bear the cost of these errors.

Recommendation 2023-053

The Department of Health Care Policy and Financing should strengthen its internal controls over Medicaid eligibility to ensure compliance with federal and state regulations by addressing the issues identified in the audit. This should include ensuring that local counties and Medical Assistance site caseworkers are appropriately trained and are held to required timelines for processing beneficiary applications, using the correct income thresholds to determine eligibility, and maintaining the required documentation to support eligibility in the case file.

Response Department of Health Care Policy and Financing

Agree Implementation Date: January 2025

The Department recognizes that the training already exists so the Department will work with the individual eligibility sites to develop a Corrective Action plan for timelines for processing beneficiary applications, using the correct income thresholds to determine eligibility, and maintaining the required documentation to support eligibility in the case file.

The following findings and recommendations relating to internal control deficiencies classified as Material Weaknesses and Significant Deficiencies were communicated to the Department of Health Care Policy and Financing (Department) in the previous year and have not been remediated as of June 30, 2024 because the original implementation dates provided by the Department were in a subsequent fiscal year. These complete findings and recommendations can be found within the original report and the complete recommendations can be found within Section IV: Prior Audit Recommendations of this report. See Schedule of Finding and Questioned Costs for chart/table.

Finding 2023-054 Children’s Basic Health Plan Controls Over Eligibility Determinations

The Department is responsible for ensuring that all federal CBHP expenditures are appropriate, and that the State complies with federal and state program requirements. In Colorado, the responsibility for determining recipient eligibility for CBHP program benefits is shared between local counties, designated MA sites, and the State. For CBHP, individuals and families apply for benefits in person at their local county departments of human/social services and designated MA sites, or online through the PEAK system. When applying in person, the local counties and MA sites are responsible for administering the benefits application process, entering the required data for eligibility determination into CBMS, and approving or denying applicants’ eligibility. The CBMS eligibility data feeds into Colorado interChange, which pays providers for the services that they provide to CBHP beneficiaries. Once eligibility is determined, the county or MA site is responsible for maintaining records on each applicant in a case file, and then retaining those case files for the periods required by federal and state laws. The Department provides eligibility staff copies of all policy and operational training documents and guides for reference. These documents are meant to provide staff with consistent and accurate program information, and are posted online for all county and MA sites to use.

For CBHP, the Department contracts with managed-care entities, which are groups or organizations of medical service providers that serve CBHP beneficiaries, to provide capitation payments to CBHP providers. Capitation payments are lump-sum monthly payments made to managed care entities, which contract with providers for services. These capitation payments are paid regardless of whether the providers serve beneficiaries during the month or not. Colorado interChange is programmed to pay capitation payments only on behalf of beneficiaries that are deemed eligible in Colorado interChange, based on eligibility information received from CBMS and requirements specified in federal and state regulations.

During the COVID-19 PHE, the State was required to maintain continuous enrollment for CBHP- eligible beneficiaries enrolled as of March 1, 2020. The CCA—enacted December 2022 and taking effect April 1, 2023—ended the continuous enrollment condition on March 31, 2023, which meant the State could begin the unwinding process, returning to normal eligibility and enrollment operations.

What was the purpose of our audit work and what work was performed?

The purpose of our audit work was to review the Department’s internal controls over the CBHP eligibility determination process as well as to determine whether the Department complied with applicable federal and state CBHP eligibility requirements during Fiscal Year 2023. During our audit, we reviewed the Department’s CBHP eligibility internal controls in place during Fiscal Year 2023. In addition, we performed testing on a random, non-statistical sample of 60 beneficiaries to determine if they were properly determined eligible and received CBHP benefits during Fiscal Year 2023. The Department operated under the continuous enrollment condition from July 1, 2022 to March 31, 2023, or 75 percent of the fiscal year. We obtained a list from the Department of 7,978 beneficiaries who were determined to be newly-eligible for CBHP during this period and who had a capitation payment made on their behalf to a CBHP provider between July 1, 2022 and March 31, 2023. From that listing we selected 45 beneficiaries (75 percent of the total sample) to determine whether those individuals’ CBHP eligibility determination was appropriate.

The Department started its unwinding process in April 2023 and continued the process through June 2023 (25 percent of the fiscal year). We obtained a list of 3,006 existing CBHP beneficiaries whose eligibility was reviewed as part of the Department’s renewal unwinding process and who had a capitation payment made on their behalf to a CBHP provider between April 1, 2023 and June 30, 2023. From that list, we selected 15 beneficiaries (25 percent of the total sample)—whose eligibility was ultimately reapproved during the renewal unwinding process—to determine whether those individuals’ CBHP eligibility determination or redetermination was appropriate.

Our testing included reviewing supporting documentation, including case files, information in CBMS data fields related to eligibility determination/redetermination, and CBHP payment information in Colorado interChange. We performed testwork to determine whether the Department ensured that local county and MA site caseworkers obtained and maintained the required documents supporting eligibility determinations in the case files, correctly entered eligibility data into CBMS, and determined eligibility in a timely manner.

Additionally, we reviewed the Department’s progress in implementing our prior audit recommendation related to CBHP eligibility. During our Fiscal Year 2020 audit, we reported that the Department lacked sufficient internal controls to ensure that it complied with federal and state eligibility requirements. At that time, we recommended that the Department strengthen its internal controls over CBHP by providing adequate training to caseworkers to ensure they properly determine eligibility when processing beneficiary applications.

What problems did the audit work identify and how were the results measured?

We identified at least 1 error in 6 of the 60 CBHP case files tested (10 percent). These errors resulted in a total of $7,912 in known questioned costs for Fiscal Year 2023. Specifically, we found the following:

• Timely Processing. In 3 cases, the caseworkers did not process the application within the 45-day requirement. One case was processed 48 days late, one case was 34 days late, and the third case was 4 days late. No questioned costs were identified in these instances because the beneficiaries were appropriately approved for benefits.

o State regulation [10 CCR 2505-3, 170.4] notes that eligibility sites shall make an eligibility determination within 45 days from the date of the application.

• Ineligible for Program. In two cases, beneficiaries with third-party health insurance at the time of application were not determined ineligible, as required. This error resulted in known questioned costs of $6,361.

o State regulation [10 CCR 2505-3, 120.1.A] notes that in order to be eligible for the CBHP program, an eligible person shall not be covered under a group health plan or under health insurance coverage, excluding coverage under the Consolidated Omnibus Budget Reconciliation Act (COBRA).

• Missing Case Documentation. One case file was missing documentation necessary to support the CBHP eligibility determination, as required by federal and state regulations. Specifically, the case file was missing support for the applicant’s income. This error resulted in known questioned costs of $1,551.

o Federal regulation [42 CFR 457.965] notes the state must include in each applicant’s record facts to support the State’s determination of the applicant’s eligibility for the Children’s Health Insurance Program.

o State regulation [10 CCR 2505-3, 110.1] requires all individuals who apply for CBHP to have a household income not exceeding 260 percent of the Federal Poverty Level, adjusted for household size.

Why did these problems occur?

We determined that the Department did not fully implement our prior audit recommendation related to ensuring caseworkers determine eligibility appropriately and in accordance with federal and state regulations. Specifically, caseworkers did not process applications timely, confirm that applicants were not covered under other health insurance, and ensure that the required eligibility documentation was maintained within the case file.

Why do these problems matter?

As the State department responsible for ensuring that all expenditures under CBHP are appropriate, it is essential for the Department to ensure that eligibility determinations are made appropriately and in accordance with federal and state regulations. This includes ensuring that processing of information used to determine CBHP eligibility does not result in CBHP benefits being provided to, and paid on behalf of, ineligible individuals, or eligible individuals being denied benefits. Ultimately, the federal government may disallow federal funds for CBHP program expenditures that do not adhere to regulations, and the State would be required to bear the cost of these errors.

Recommendation 2023-054

The Department of Health Care Policy and Financing should strengthen its internal controls over Children’s Basic Health Plan eligibility to ensure compliance with federal and state regulations by addressing the issues identified in the audit. This should include ensuring that local counties and Medical Assistance site caseworkers are appropriately trained and are held to required timelines for processing beneficiary applications, eligibility requirements related to applicants that have other health insurance, and requirements for maintaining the required documentation to support eligibility in the case file.

Response Department of Health Care Policy and Financing

Agree Implementation Date: January 2025

The Department recognizes that the training already exists so the Department will work with the individual eligibility sites to develop a Corrective Action plan for timelines for processing beneficiary applications, eligibility requirements related to applicants that have other health insurance, and requirements for maintaining the required documentation to support eligibility in the case file.

The following findings and recommendations relating to internal control deficiencies classified as Material Weaknesses and Significant Deficiencies were communicated to the Department of Health Care Policy and Financing (Department) in the previous year and have not been remediated as of June 30, 2024 because the original implementation dates provided by the Department were in a subsequent fiscal year. These complete findings and recommendations can be found within the original report and the complete recommendations can be found within Section IV: Prior Audit Recommendations of this report. See Schedule of Finding and Questioned Costs for chart/table.

Finding 2023-055 Medicaid Eligibility—Social Security Numbers Associated with Multiple State IDs

Each beneficiary’s Medicaid application must contain specific information, including the beneficiary’s Social Security Number (SSN), a copy of their birth certificate, and support for their income in order for a caseworker to determine their Medicaid eligibility. The local counties and MA sites are responsible for administering the benefits application process, including entering the required data for eligibility determination into CBMS and approving or denying an applicant’s eligibility. CBMS is a shared eligibility system between the Department and the Department of Human Services.

As each beneficiary has one SSN, similarly, the State Identification Module (SIDMOD)—managed by the Governor’s Office of Information Technology (OIT)—assigns a unique State ID for each beneficiary. CBMS interfaces with Colorado interChange on a daily basis to update eligibility information, such as a beneficiary’s eligibility status or termination of benefits. Colorado interChange uses this information to process and pay claims for services provided to eligible Medicaid beneficiaries. When a medical provider submits a claim to the Department, Colorado interChange checks the State ID and the date of birth, but not the SSN, submitted with the claim against the beneficiary’s information on file. If the State ID and the date of birth match an eligible beneficiary within Colorado interChange and the claim is otherwise appropriate, then the claim will be processed and paid through the system. The Department requires local counties or MA site caseworkers to call the OIT Service Desk to obtain approval for changing or updating a SSN in CBMS.

What was the purpose of our audit work and what work was performed?

The purpose of the audit work was to determine whether the Department made claims payments on behalf of beneficiaries with the same SSN but different State IDs, including determining the Department’s progress in implementing our Fiscal Year 2021 audit recommendation related to this area. At that time, we recommended the Department ensure only eligible beneficiaries receive Medicaid benefits by monitoring and correcting any instances of multiple State IDs associated with the same SSN. Specifically, we recommended the Department improve its internal controls in this area by continuing to develop a report that can be used to identify SSNs associated with multiple State IDs, and then establishing and implementing written policies and procedures to outline how the Department will use the report to effectively monitor and correct those discrepancies.

As part of our testing, we reviewed the Department’s Medicaid eligibility internal controls in place during Fiscal Year 2023. We requested a list of all Medicaid claims that were submitted by providers and paid by the Department for the fiscal year, including the beneficiaries’ names, SSNs, and State IDs. The Department provided a list that included approximately 1.4 million beneficiaries who received benefits during the fiscal year. We analyzed this listing to identify any beneficiaries whose SSN was linked to more than one State ID, and to determine if any claims payments were made on behalf of those beneficiaries for Fiscal Year 2023.

How were the results of the audit work measured?

Federal regulation [42 CFR 435.910] states that the Department must require, as a condition of eligibility, that each individual (including children) seeking Medicaid services furnish a SSN. Federal regulation [42 CFR 435.914] further requires that the Department obtain and maintain documentation to support each beneficiary’s Medicaid eligibility determination.

Federal regulation [42 CFR 447.56(e)(2)] states that federal funding will not be provided for payments made by the Department to providers for services provided on behalf of individuals who are not eligible for Medicaid. Further, the Department is required by federal regulations to repay the federal government the federal share of any overpayments within 1 year. Specifically, pursuant to 1903(d)(2)(C) of the Social Security Act [42 U.S.C. 1396b], states have up to 1 year from the date of the overpayment discovery to recover or attempt to recover the overpayment before the federal share must be refunded to CMS, regardless of whether recovery is made from the provider.

According to federal regulation [45 CFR 75.303(a)], the Department, as a recipient of federal funds, must establish and maintain effective internal controls over its federal awards that provide reasonable assurance that the Department is managing its federal grants in compliance with federal statutes, regulations, and the award terms and conditions. These internal controls should be in compliance with guidance in Standards for Internal Control in the Federal Government (Green Book), published by the U.S. Government Accountability Office. Under Paragraph 16.01 of the Green Book, the Department should establish and operate monitoring activities for its internal control system and evaluate the results. Monitoring activities include reviewing reports, performing reconciliations, and observing operations.

What problem did the audit work identify?

We determined that the Department has not fully implemented the prior audit recommendation to improve its internal controls over Medicaid eligibility to ensure it is monitoring and correcting any instances of multiple State IDs associated with the same SSN. During our testing, we identified 200 unique SSNs that each appeared to be inappropriately associated with two State IDs; in total, the 200 SSNs were tied to 400 State IDs. This could indicate that the Department determined eligibility without a beneficiary furnishing the correct SSN. Specifically, we found the following:

• 108 SSNs were tied to 2 separate State IDs (representing 216 potential beneficiaries) that appeared to be for different people based on the names and/or dates of birth. These could represent invalid claims payments on behalf of ineligible beneficiaries.

• 92 SSNs were tied to two separate State IDs (representing 184 potential beneficiaries) that had the same name and date of birth. These SSNs could be valid, but with more than 1 State ID, a provider could submit and have a claim paid for the same services under both State IDs.

We did not identify any instances of individual SSNs being tied to more than 2 State IDs.

These issues affected a total of 400 Medicaid State IDs that had not been corrected as of June 30, 2023, and represented a total of $71,441 Medicaid claims paid through Colorado interChange for Fiscal Year 2023.

We selected a random, non-statistical sample of 12 SSN pairs (24 different State IDs) identified in our testing, representing $6,050 in Medicaid claims, and provided the sample to the Department to research. The Department determined, and we confirmed, that as of the end of our audit in December 2023, payments made for 9 of the 12 SSN pairs were made on behalf of eligible beneficiaries. Of the 9 pairs, 4 had instances where an individual had incorrect information entered into CBMS. The remaining 5 SSN pairs each represented a single beneficiary, but with 2 separate Medicaid IDs that need to be merged within CBMS so that each beneficiary only has one unique Medicaid ID. In total, these 9 sample pairs represented $2,224 of the $6,050 sample.

The other 3 SSN pairs in our sample, totaling $3,826, had at least 1 instance of a SSN not being verified when input into CBMS; therefore, we consider these amounts to be known questioned costs. Of these costs, $2,105 were paid with federal grant funds.

We were unable to determine whether the payments in the remaining 188 SSNs that were each tied to 2 State IDs were made on behalf of eligible Medicaid beneficiaries; therefore, we consider the entire $65,391 in Medicaid claims payments to be likely questioned costs. Of these costs, $36,604 were paid with federal grant funds.

The breakdown of costs we questioned are shown in the following table:

A questioned cost, as defined in federal regulations [45 CFR 75.2 Uniform Administrative Requirements, Cost Principles, and Audit Requirements for HHS Awards] (Uniform Guidance), is “a cost that is questioned by the auditor … (1) Which resulted from a violation or possible violation of a statute, regulation, or the terms and conditions of a Federal award, including for funds used to match Federal funds; [or] (2) Where the costs, at the time of the audit, are not supported by adequate documentation….” We have identified these questioned costs as “known questioned costs” that are further defined in Uniform Guidance [45 CFR 75.516] as questioned costs that are specifically identified by the auditor.

Why did this problem occur?

The Department did not have adequate internal controls in place to prevent or detect and correct all instances of multiple State IDs associated with a single SSN in Colorado interChange and, as a result, could not ensure only eligible beneficiaries received Medicaid services. In addition, we determined that the Department did not fully implement our prior audit recommendation related to developing a report to identify single SSNs associated with multiple State IDs, and establishing and implementing written policies and procedures outlining how the Department will use the report to effectively monitor and correct SSN and State ID discrepancies. Specifically, the Department deployed a dashboard report in April 2023, but it did not provide enough detail for caseworkers to be able to effectively monitor and correct SSN and State ID discrepancies. In addition, Department staff reported they have not yet finalized written guidance on how to use the dashboard report at either the Department or county and MA-site level to identify and resolve discrepancies.

Why does this problem matter?

Failing to institute appropriate controls over the processing of Medicaid eligibility can result in the counties and MA sites granting Medicaid benefits to ineligible individuals. As the state Medicaid agency, it is essential for the Department to ensure that Medicaid benefits are paid only for eligible beneficiaries. This includes ensuring that the Department has sufficient internal controls to address risks related to instances in which multiple State IDs are associated with a single SSN. For example, without adequate controls in place to prevent multiple State IDs from being created or to identify and correct these instances, providers could erroneously or fraudulently submit duplicate claims under these State IDs for the same services, resulting in improper payments. Ultimately, the federal government may disallow federal funds for Medicaid program expenditures that do not adhere to regulations, and the State would be required to bear the cost of these errors.

Recommendation 2023-055

The Department of Health Care Policy and Financing (Department) should improve its internal controls over Colorado’s Medicaid Program eligibility by:

A. Researching the remaining questioned claims payments that were identified during our audit to determine whether the local counties or Medical Assistance (MA) sites had a valid Social Security Number (SSN) when determining eligibility, if payments were appropriate—in accordance with federal regulation at the time the payments were made—and repaying the federal government for any payments made to providers on behalf of ineligible beneficiaries in accordance with federal regulations.

B. Continuing to develop a report to identify instances of single SSNs associated with multiple State IDs that, once complete, can be used to monitor that caseworkers are addressing any identified discrepancies in a timely manner.

C. Continuing to establish and implement written policies and procedures outlining how the Department and MA sites will use the report to effectively monitor and correct SSN and State ID discrepancies. The Department’s policies and procedures should include information on the report itself, such as the frequency and timing of when Department staff should generate and review the report, how to monitor caseworkers to ensure that discrepancies are being identified and corrected in a timely manner, and how to identify when additional training may be needed for local counties and MA sites; the MA site policies and procedures should include information on how to read and use the report to identify and correct discrepancies.

Response Department of Health Care Policy and Financing

A. Partially Agree Implementation Date: December 2024

The Department implemented Social Security number (SSN) discrepancy reports within the Monitoring Dashboards in April 2023. The Department will develop and implement policies and procedures outlining how the report will be used to effectively monitor, research, and correct SSN and State ID discrepancies. Once that work is complete, the Department will send updated written guidance to our county and medical assistance sites on how to use system edits, reports, and dashboards to resolve duplicate SSN's with an implementation date of December 2024.

Further, the Department cannot recover any payments from providers since this issue is not related to services provided. When a provider checks a member's eligibility on the day of service and finds the member eligible through the Department’s system, that provider is guaranteed payment if they render an authorized service.

Auditor’s Addendum

The Department is responsible for ensuring that only eligible beneficiaries receive Medicaid benefits by monitoring and correcting any instances of multiple State IDs associated with the same SSN. According to federal regulation [42 CFR 431.958], any payment to an ineligible beneficiary is considered an improper payment, which is any payment that should not have been made or that was made in an incorrect amount, and must be repaid to the federal government within 1 year. Eligibility errors include ineligible individuals who were authorized as eligible when they received services [42 CFR 431.960d(2)(i)].

B. Agree Implementation Date: December 2024

The Department implemented Social Security number (SSN) discrepancy reports within the Monitoring Dashboards in April 2023. The Department will develop and implement policies and procedures outlining how the report will be used to effectively monitor, research, and correct SSN and State ID discrepancies. Once that work is complete, the Department will send updated written guidance to our county and medical assistance sites on how to use system edits, reports, and dashboards to resolve duplicate SSN's with an implementation date of December 2024.

C. Agree Implementation Date: December 2024

The Department implemented Social Security number (SSN) discrepancy reports within the Monitoring Dashboards in April 2023. The Department will develop and implement policies and procedures outlining how the report will be used to effectively monitor, research, and correct SSN and State ID discrepancies. The Department will issue guidance such as the frequency and timing of when Department staff should generate and review the report, how to monitor caseworkers to ensure that discrepancies are being identified and corrected in a timely manner, how to identify when additional training may be needed for local counties and MA sites and information on how to read and use the report and identify and correct discrepancies. Once that work is complete, the Department will send updated written guidance to our county and medical assistance sites on how to use system edits, reports, and dashboards to resolve duplicate SSN's with an implementation date of December 2024.

The following findings and recommendations relating to internal control deficiencies classified as Material Weaknesses and Significant Deficiencies were communicated to the Department of Health Care Policy and Financing (Department) in the previous year and have not been remediated as of June 30, 2024 because the original implementation dates provided by the Department were in a subsequent fiscal year. These complete findings and recommendations can be found within the original report and the complete recommendations can be found within Section IV: Prior Audit Recommendations of this report. See Schedule of Finding and Questioned Costs for chart/table. Finding 2023-056 Presumptive Eligibility for Medicaid and CBHP

Colorado’s Medicaid and CBHP presumptive eligibility program is designed to provide eligible individuals—such as children under the age of 19 and pregnant people—immediate, temporary medical coverage of up to 45 days while they wait for caseworkers to process their regular Medicaid or CBHP application and determine their eligibility status. Although there are fewer eligibility requirements for presumptive eligibility in comparison with regular Medicaid or CBHP coverage, beneficiaries must submit a Medical Assistance application and appear eligible to receive temporary benefits while a caseworker is processing their application.

The Department works with clinics, health care centers, and community resource centers that are certified as presumptive eligibility sites (PE Site) to help manage the application process for individuals needing access to immediate temporary medical coverage. To be certified as a PE Site, the entity must be an existing provider, or have an affiliation with an existing provider, and complete the Presumptive Eligibility General Information Form (Form), which serves as the entity’s application to become a PE Site. Once an entity completes and submits a Form, Department staff review and either approve or deny the application. Final notice of acceptance or denial as an approved PE Site is then sent to the contact person listed on the Form.

The PE Site is in charge of helping individuals complete an application and ensuring that only people meeting the basic eligibility criteria are enrolled in presumptive eligibility programs. The process of enrolling an applicant into a presumptive eligibility program begins when a caseworker at a PE Site collects the minimum information needed to determine presumptive eligibility, including the applicant’s name, age, residency, citizenship, and income. The caseworker enters this information into CBMS, which is used to assist the caseworker in determining whether the applicant is eligible to receive Medicaid or CBHP temporary benefits. If the applicant is deemed presumptively eligible, then CBMS feeds relevant data to Colorado interChange, which issues payments to CBHP and Medicaid providers on behalf of these beneficiaries. If the applicant’s reported information is not in compliance with federal and state requirements, CBMS is programmed to deny the eligibility and mark the applicant’s eligibility as “fail” within CBMS. As a result, the applicant would not be eligible for the payment of services to providers on their behalf through Colorado interChange. Once an applicant’s presumptive eligibility has been determined, the PE Site is required to submit the application along with a transmittal form detailing the beneficiary’s reported information to the appropriate local county or designated MA site within 5 business days, at which point the county or MA site would complete the application process to determine regular (i.e., not presumptive) eligibility for Medicaid or CBHP benefits. The county or MA site must then make a final eligibility determination within 45 days of the application date. Once the applicant is enrolled in the regular Medicaid or CBHP program, the individual’s presumptive eligibility benefits should end.

All PE Sites must be certified by the Department to make presumptive eligibility determinations. PE Sites must also recertify with the Department every 2 years to maintain their active status as a certified PE Site. As part of the recertification process, Department staff will audit 5 percent of the applications the PE Site processed during the previous year to confirm that the applicant’s information was correctly entered into CBMS and that the PE Site followed the appropriate guidance when making presumptive eligibility decisions. If the PE Site fails the audit, the Department requires PE Site staff to undergo customized Department training for the areas they failed within 6 months of the review. As of June 30, 2023, there were 50 certified PE Sites. During Fiscal Year 2023, 17 of those PE Sites determined presumptive eligibility for 531 Medicaid cases and 155 CBHP cases.

What was the purpose of our audit work and what work was performed?

The purpose of our audit work was to review the Department’s internal controls over the processing of presumptive eligibility for Medicaid and CBHP programs, as well as to determine whether the Department complied with the applicable federal and state requirements for Fiscal Year 2023. Additionally, we reviewed the Department’s progress in implementing our prior audit recommendation related to internal controls over presumptive eligibility. Specifically, during the Fiscal Year 2020 audit, we identified problems with the Department’s compliance with applicable federal and state requirements, and recommended that the Department strengthen its internal controls over Medicaid and CBHP presumptive eligibility by developing and implementing (1) a tracking mechanism for monitoring PE Sites; (2) written policies and procedures detailing the requirements for completion of PE Site reviews, timely training for PE Site staff, and timely recertification of PE Sites; and (3) resolving CBMS programming and system issues to appropriately terminate presumptive eligibility when the beneficiaries are enrolled in the regular Medicaid or CBHP program and ensuring CBMS displays consistent applicant information between various screens. As part of our Fiscal Year 2023 audit, we reviewed the Department’s tracking mechanism for monitoring PE Sites, as well as the Department’s updated policies and procedures for completion of PE Site reviews, training for PE Site staff, and timely recertification of PE Sites. In addition, we inquired with the Department about the CBMS programming issues identified during the audit. Department staff reported they implemented changes within CBMS that would address the programming and system issues identified.

As part of our Fiscal Year 2023 audit, we made inquiries with Department staff regarding the policies and procedures for applying to be a PE Site, recertification requirements, and Department site monitoring. During our internal controls testing, we reviewed a listing of all 50 PE Sites and noted that 40 sites were due for recertification in Fiscal Year 2023. We selected six PE Sites that were due for recertification and performed testing to determine whether the sites were appropriately recertified by the Department by performing the following procedures:

• We confirmed that the Department had performed the recertification and reviewed the related case file support for all 6 PE Sites in our sample. • We noted that 4 of 6 PE Sites tested passed their recertification. We reviewed the Department’s case file support and confirmed the sites were appropriately recertified and mailed recertification letters from the Department.

• The eligibility status for the remaining two PE Sites in our sample was terminated by the Department as part of its recertification review. One site did not complete the required paperwork for the recertification and the other did not have a need to provide PE Site services anymore. We reviewed Department correspondence to these sites to confirm the Department notified them that their PE Site status was terminated.

In addition, we randomly selected a sample of 40 Medicaid and 37 CBHP cases for individuals who were deemed presumptively eligible at a PE Site during Fiscal Year 2023 to determine whether the Department complied with federal Medicaid and CBHP presumptive eligibility requirements. Our testing included reviewing the related supporting case file documentation, as well as the CBMS data fields related to presumptive eligibility determinations and payment information in Colorado interChange.

The Department’s process for presumptive eligibility determinations is the same for both Medicaid and CBHP and, therefore, our testing was used to determine compliance for both programs.

What problems did the audit work identify and how were the results measured?

We found that the Department did not fully comply with federal and state regulations regarding Medicaid and CBHP presumptive eligibility requirements during Fiscal Year 2023. Overall, we identified 8 instances of non-compliance with federal and state regulations over presumptive eligibility requirements at 4 separate PE Sites. Specifically, we identified the following:

• Untimely End of Presumptive Eligibility. In 4 of 40 Medicaid (10 percent) and 3 of 37 CBHP cases (8 percent), we found that the Department did not properly end presumptive eligibility within CBMS as required by the federal regulation. In these cases, the beneficiary’s presumptive eligibility did not end until between 6 and 31 days after the beneficiary was determined to be eligible for regular Medicaid and CBHP benefits.

Federal regulation [42 CFR 435.1101)] states that presumptive eligibility should end the day on which a decision is made on the application for Medical Assistance or the last day of the month following the month in which the determination of presumptive eligibility was made.

• Timeliness of Transmittal Letters. In 1 of 40 Medicaid cases (3 percent), we found that the PE Site determining eligibility did not notify the county within five business days that the applicant was

presumptively eligible, as required by state regulation. In this case, notification was made 1 day late.

State regulation [10 CCR 2505-10, 8.100.4.F.4)] states that the presumptive eligibility sites are required to notify the local county within 5 business days that the client is presumptively eligible.

Why did these problems occur?

We determined that the Department’s changes to CBMS to address the programing and system issues identified in our prior audit recommendation did not appropriately terminate beneficiaries’ presumptive eligibility when the beneficiary is enrolled in the regular Medicaid or CBHP program. In addition, the Department lacked sufficient internal controls to ensure that it complied with federal and state presumptive eligibility requirements during Fiscal Year 2023. Specifically, the Department did not adequately train PE Site staff on presumptive eligibility requirements and, as a result, they did not properly end presumptive eligibility and process transmittal letters in a timely manner.

Why do these problems matter?

As the State’s medical assistance agency, it is essential for the Department to ensure that PE Sites’ eligibility determinations are made appropriately and in accordance with federal and state regulations. This includes ensuring that presumptive eligibility determinations are made correctly and do not result in Medicaid or CBHP benefits being provided to, and paid on behalf of, ineligible individuals. Ultimately, the federal government can disallow federal funds for program expenditures that do not adhere to regulations, and the State would be required to bear the cost of these errors.

Recommendation 2023-056

The Department of Health Care Policy and Financing (Department) should strengthen its internal controls over Colorado’s Medicaid Program (Medicaid) and the Children’s Basic Health Plan (CBHP) presumptive eligibility by:

A. Resolving Colorado Benefits Management System (CBMS) programming and system issues to appropriately terminate applicants’ presumptive eligibility when the beneficiaries are enrolled in the regular Medicaid or CBHP.

B. Providing training to presumptive eligibility site staff to emphasize issues that were identified during our audit or that the Department identifies during its ongoing monitoring, including the importance of properly ending presumptive eligibility benefits when the beneficiary is determined to be ineligible for Medicaid and CBHP benefits and processing applications timely.

Response Department of Health Care Policy and Financing

A. Agree Implementation Date: July 2023

The Colorado Benefits Management System (CBMS) programming and system discrepancies to appropriately terminate applicants’ presumptive eligibility when the beneficiaries are enrolled in the regular Medicaid or Children’s Basic Health Plan program was corrected with a data fix in July 2023. The Department found after further research that it is permissible for Presumptive Eligibility Medical Spans and Medical Assistance Medical spans to overlap as these are two separate High level Program groups. Department staff will continue to monitor for future discrepancies.

B. Agree Implementation Date: August 2024

The Department will continue to train presumptive eligibility site staff on the errors identified during this audit including processing applications timely, and those errors that the Department identifies during ongoing monitoring. The Colorado Benefits Management System (CBMS) automatically populates benefit end dates when the Eligibility site worker authorizes the Medicaid and CBHP benefits. The Department staff will continue to monitor for these discrepancies and work with the individual Eligibility sites on their application processing timeliness.

The following findings and recommendations relating to internal control deficiencies classified as Material Weaknesses and Significant Deficiencies were communicated to the Department of Health Care Policy and Financing (Department) in the previous year and have not been remediated as of June 30, 2024 because the original implementation dates provided by the Department were in a subsequent fiscal year. These complete findings and recommendations can be found within the original report and the complete recommendations can be found within Section IV: Prior Audit Recommendations of this report. See Schedule of Finding and Questioned Costs for chart/table.

Finding 2023-057 Payments for Non-Emergent Medical Transportation Claims

Non-emergent medical transportation (NEMT) is a federally-required Medicaid benefit intended to provide recipients prompt, efficient, and medically-necessary transportation services to and from their Medicaid medical services [Section 42 USC 1396a(a)]. NEMT cannot be used as a convenience to the recipient, such as for a trip to a grocery store, or be used by non-recipients unless they are an escort for a recipient who is a child or an at-risk adult [10 CCR 2505-10 8.014.5.D.1]. NEMT is available to all individuals enrolled in Medicaid.

Federal law allows states to provide NEMT services through state-designated entities, such as contracted brokers, as long as the brokers provide cost-effective administration and delivery of services for Medicaid recipients [Section 42 USC 1396a(a)(70)]. Brokers are generally responsible for verifying recipient eligibility for NEMT services, scheduling recipient transportation with ride providers, paying the providers for services, submitting Medicaid claims to the Department through Colorado interChange to cover the cost of services, and retaining supporting documentation for each Medicaid claim. Over the years, NEMT services in Colorado have been brokered in the following ways:

• Prior to July 2020. For 55 counties, various county offices brokered NEMT services for Medicaid recipients. In the remaining nine counties, the Department contracted with IntelliRide to serve as the broker for NEMT services in those areas. IntelliRide is a division of TransDev North America and manages NEMT, demand response transportation, and paratransit programs across the country.

• July 1, 2020 to August 31, 2021. For all 64 counties, the Department contracted with IntelliRide to be the broker for NEMT services; however, our 2021 audits found that the Department also paid about $3.5 million in NEMT claims directly to 66 providers who brokered their own services during the prior audit review period of July 2020 through February 2021.

• September 1, 2021 to Present. The Department returned to having 55 counties broker NEMT services in their areas, and contracting with IntelliRide to serve as the NEMT broker in the remaining nine counties. For rides brokered by IntelliRide, providers upload trip information into IntelliRide’s EcoLane transportation scheduling system, which maintains information on recipients’ requests for rides; the names of the recipient and driver; and trip information, such as the trip date, scheduled pick-up time, and destination.

In our Fiscal Year 2021 Statewide audit and 2021 NEMT performance audit, we identified $291,597 in known questioned costs and about $5.2 million in likely questioned costs related to NEMT services that did not comply with federal and state Medicaid requirements. We recommended that the Department investigate each questioned claim to recover any payments determined to be inappropriate, and repay the federal portion, as appropriate. Federal regulations define known questioned costs as questioned costs that are specifically identified by the auditor and define likely questioned costs as the auditor’s best estimate of total questioned costs [45 CFR 75.516]. Known and likely questioned costs should be investigated by the Department, inappropriate payments should be recovered, and those payments should be repaid to the federal government as appropriate; Medicaid overpayments are recoverable regardless of whether they occurred due to an error by the Department, entity acting on behalf of the Department, or a provider [Section 25.5-4-301(2), C.R.S.]. We also recommended that the Department implement controls to ensure taxi claims are paid in accordance with established requirements and rates. The Department agreed to implement these audit recommendations by December 2022.

What was the purpose of our audit work and what work was performed?

The purpose of our audit work was to review the Department’s implementation of the Fiscal Year 2021 audit recommendations to (1) investigate the known and likely questioned costs identified by the audits, recover inappropriate payments, and repay the federal portion, as appropriate, and (2) implement controls to ensure taxi claims are paid in accordance with established requirements and rates. We reviewed documentation of the Department’s efforts to investigate and recover the known questioned costs identified in the prior audits, and repay the federal portion of the claims. We interviewed Department staff to understand the extent to which steps had been taken to investigate, recover, and repay the likely questioned costs identified. We reviewed Department documentation and interviewed Department staff to understand the internal controls that were implemented to help ensure taxi claims are paid in line with requirements and rates. We also reviewed Department documentation and online information about NEMT fraud schemes that the Department identified starting in Summer 2023.

How were the results of the audit work measured?

The Department must investigate questioned costs related to NEMT claims, recover inappropriate payments, and repay the federal portion, as appropriate. According to federal regulation [45 CFR 75.303(a)], the Department, as a recipient of federal funds, must establish and maintain effective internal controls that provide reasonable assurance that the Department is managing federal funds in compliance with federal statutes, regulations, and federal program terms and conditions. A questioned cost is defined in Uniform Guidance [45 CFR 75.2] as “a cost that is questioned by the auditor … (1) Which resulted from a violation or possible violation of a statute, regulation, or the terms and conditions of a Federal award, including for funds used to match Federal funds; [or] (2) Where the costs, at the time of the audit, are not supported by adequate documentation.…” Questioned costs can result in the misappropriation of federal and state funds. Section 25.5-4-301(2), C.R.S., states that any overpayments of claims to providers are recoverable. These overpayments “are recoverable regardless of whether the overpayment is the result of an error by the state department, a county department of human or social services, an entity acting on behalf of either department, or by the provider or any agent of the provider....” According to federal law, states have up to 1 year from the date of discovery of the overpayment to recover or attempt to recover the overpayment before the federal share (also known as Federal Financial Participation or FFP) must be refunded to CMS, regardless of whether a recovery is made from the provider [42 USC 1396b].

The Department must have internal controls to pay claims based on accurate service rates and trip mileage. The Public Utilities Commission (PUC) sets the rate for each permitted taxi provider, which is generally based on trip mileage. According to the Department’s NEMT Billing Manual and rate schedule for 2021, taxi claims should have been paid at the rate set by the PUC.

What problems did the audit work identify?

The Department has not investigated and recovered as appropriate, the $5.2 million in likely questioned costs related to NEMT claims, or repaid the federal portion. Based on our testwork, we determined that the Department has not fully implemented the Statewide audit and performance audit recommendations from 2021 because it has not investigated the about $5.2 million in likely questioned costs identified by the audits, or attempted to recover and repay the federal portion of those questioned costs. As of June 30, 2023, the Department had investigated and recovered the $291,597 in known questioned costs and repaid the federal portion. In addition, the Department has not fully implemented internal controls to help ensure taxi claims are paid appropriately.

The issues we identified in our 2021 Statewide and performance audits, which resulted in the likely questioned costs between July 2020 and February 2021(the prior audit period), are summarized below:

• About $4.8 million paid for taxi claims without mileage. For 29,049 taxi claims totaling $4,763,071, the Department paid the claims without ensuring taxi providers were paid at their PUC approved per-mile rate, as required by the Department’s NEMT Billing Manual and rate schedule. These claims were submitted directly to the Department by 10 PUC-permitted taxi providers. For example, the Department paid $4,000 to one taxi provider for what appeared to be four 400-mile one-way trips that were given to one recipient within a single day, which did not appear possible and was not paid based on taxi rates. The Department only required taxi providers to submit claims showing only the number of one-way trips driven, not the mileage, and paid the claims as long as they were not more than $1,000 per one-way trip. As a result, the Department lacked internal controls to ensure taxi claims were paid at the correct rates. After the 2021 audits, the Department lowered the maximum per one-way taxi trip within Colorado interChange from $1,000 to $500, but the Department did not implement other internal controls to ensure taxi providers are paid based on their PUC-approved per-mile rates.

• $409,575 paid for taxi claims for providers not permitted as taxis. For 3,284 NEMT claims for taxi services from eight providers, the providers were not permitted by the PUC to operate as taxis, as required by the NEMT Billing Manual and rate schedule. For example, one provider was paid for an NEMT taxi claim for $5,875 for 12 trips, or $490 per trip. Since these providers were not permitted as taxis, they did not have PUC-set taxi rates, so we could not determine how much these providers should have been paid. After the 2021 audits, the Department implemented an internal control to help ensure providers submitting NEMT taxi claims are permitted to operate as taxis.

• $4,718 paid for trips that may not have been to attend medical services. Our 2021 audits found that 13 of a sample of 22 NEMT claims (59 percent) for trips in December 2020 had no medical claims for dates corresponding to the NEMT trips, and 6 of these 13 claims were for recipients who had both Medicaid and other types of medical insurance, such as Medicare. Department staff told us that it was possible that medical providers had not yet submitted medical claims yet, and that the six recipients may have used NEMT trips to access medical services but those services were paid by other insurance, as allowed by state regulations [10 CCR 2505-10 8.014.5.B.2]. Therefore, we could not determine whether the NEMT trips associated with the 13 claims had been for recipients to attend medical services. After the 2021 audits, the Department implemented an internal control to help ensure NEMT services are used to attend medical appointments.

• $3,598 paid for trips that may not have been completed. For 61 of the 362,110 paid claims in the 2021 OSA audit timeframe, the scheduled trips were not marked as complete in IntelliRide’s EcoLane transportation scheduling system, so we could not determine whether they had been completed. After the 2021 audits, the Department worked with IntelliRide to help ensure its system began maintaining complete information on rides.

The Department is currently in the process of investigating NEMT fraud schemes. According to the Department, in Summer 2023 it uncovered an “unprecedented fraud scheme” occurring in the NEMT benefit, affecting “tens of thousands” of NEMT claims. For example, the Department identified an increase in suspicious NEMT billings and program violations, such as recipients receiving inappropriately long trips.

The Department informed the OSA that, as of October 2023, it had issued 50 cease and desist letters to NEMT providers, placed 390 providers on pre-payment review, sent letters to providers with concerns of fraudulent behavior and steps taken, placed a moratorium on new NEMT provider applications—with approval of CMS—and, as a result, denied 632 NEMT provider applications. The Department told us that in addition to fraud schemes among NEMT providers, it is analyzing whether similar issues are occurring in different Medicaid provider types. The Department also informed the OSA that it is working with a number of entities, such as the Colorado Attorney General’s Office and its Medicaid Fraud Control Unit, the Colorado Department of Public Safety, county departments of human services, IntelliRide, CMS, the Office of the Inspector General, the Federal Bureau of Investigations, and other states experiencing NEMT fraud. The Department has posted alerts on its NEMT website to inform Medicaid members of potentially fraudulent NEMT practices.

Why did these problems occur?

The Department lacked sufficient internal controls to investigate questioned costs and to detect improper claims, payments, and provider applications. The Department did not investigate the $5.2 million in likely questioned costs identified by our 2021 audits by December 2022, as it stated it would do within its responses to the prior audit recommendation, demonstrating that the Department did not have sufficient processes in place to implement the recommendation in a timely manner. The Department also reported to us that due to the recent detection of fraud schemes by NEMT providers, the Department does not “have the resources to investigate the likely questioned costs identified in the report” and “is currently unable to follow through on the previous agreement.” The Department stated that once it completes activities related to the recently detected NEMT fraud schemes, it “will go back and review post-payment, if resources allow” that “may include the likely questioned costs.” The Department’s process will need to include implementing internal controls to ensure taxi providers are paid based on their PUC-approved per-mile rates.

Regarding the recent surge in NEMT fraud, the Department indicated that it has developed stronger internal controls to process applications from those seeking to provide NEMT services and to manage billing practices. For example, according to the Department, it is “updating [its NEMT] provider credentialing and billing processes” and conducting reviews to determine whether services and billing are in compliance with federal and state law. The Department stated that if its reviews reveal evidence of non-compliance or intentional fraud, the Department “will initiate additional actions, including but not limited to, referrals to law enforcement.” In the event that the Department identifies improper or overpayments to NEMT providers, it will need to recover those payments and repay the federal portion.

Why do these problems matter?

For the approximately $5.2 million in likely questioned costs identified in our 2021 Statewide and performance audits, the Department paid the NEMT claims, yet there was no supporting documentation or data from IntelliRide, ride providers, or the Department to substantiate that the costs of the claims were accurate, or that the rides complied with federal and state requirements. As such, there was a significant risk of misappropriation of federal and state funds by providers and/or recipients. While we did not identify confirmed fraud by providers or recipients at that time, due to the lack of supporting documentation for these claims, the problems identified by the prior audits demonstrate a potential waste of public funds and abuse of the Medicaid program.

When the Department does not have sufficient internal controls in place to take timely action to investigate questionable claims, this can result in misuse of federal and state Medicaid funds. If the Department had started the recommended investigation in 2021 and completed it by the end of 2022, it may have been able to identify aspects of the NEMT provider fraud scheme and improper payments sooner than Summer 2023.

Recommendation 2023-057

The Department of Health Care Policy and Financing (Department) should comply with federal and state requirements for administering the non-emergent medical transportation (NEMT) benefit, and for paying Colorado Medicaid Program claims by:

A. Investigating the payments that the OSA’s 2021 Statewide and performance audits identified that resulted in likely questioned costs, recover inappropriate payments identified, and repay the federal portion, as appropriate. This process should include implementing internal controls to ensure taxi providers are paid based on their PUC-approved per-mile rates.

B. Continuing to investigate the overpayments and inappropriate payments that the Department identifies through its fraud investigations and that result in known or likely questioned costs, recover inappropriate payments identified, and repay the federal portion, as appropriate.

Response Department of Health Care Policy and Financing

A. Partially Agree Implementation Date: August 2024

HCPF disagrees with the likely questioned costs identified and that it should review these claims. Because supporting documents were not available, the OSA had nothing to review for these claims and so determined that they were likely questioned costs. Of the claims the OSA had documentation to review, though, the documentation supported the claim and so the Department believes it is likely the missing documentation would support the claims as well. HCPF isn’t required to have the documentation up front, and it is the normal practice to pay claims and require the providers maintain the documentation, so this standard process should not create a presumption that the payments were in error. To review all these claims, HCPF would have to request each record from the provider, and the average review of an NEMT claim once the records have been received takes 15-30 minutes, so it would take an estimated 7,262.25-14,524.5 hours to review 29,049 claims. HCPF does it have existing resources to complete this review. HPCF agrees to review the claims where the OSA reviewed the records and determined that the claims were not paid properly. If an overpayment is identified, FFP will be returned as appropriate. We expect this project to be completed by 8/31/24.

HCPF agrees with the taxi rate problem and is implementing internal controls to ensure taxi providers are paid appropriately by discontinuing the specific rate for taxi services and replacing it with the generic mileage rate. This will prevent inaccurate payments. HCPF is no longer required to pay taxi providers the rate stipulated by their individual PUC rate. We expect this project to be completed by 7/31/24.

Auditor’s Addendum

As noted in the audit finding, the Department, its NEMT contractor (IntelliRide), and ride providers did not have data or documentation to support $5.2 million in paid claims for NEMT services, as required. These unsupported payments resulted in likely questioned costs that the Department should investigate, in order to recover inappropriate payments and repay the federal portion, as appropriate. Further, the Department's response describing the audit work and results is incorrect. During the audit, the OSA reviewed all data and documentation that the Department, its NEMT contractor, and ride providers provided to the OSA, and identified $291,597 in known questioned costs for 4,503 claims because the amounts paid were not supported or the claims did not comply with federal or state requirements. For an additional about 29,100 NEMT claims totaling $5.2 million, audit analysis determined that the paid claims appeared noncompliant, and the Department reported that neither it, nor its NEMT contractor or ride providers, could provide support for these claims, which resulted in the likely questioned costs. In 2021 and 2022, the Department agreed that the lack of documentation to support the paid claims was a problem, and agreed to investigate. B. Partially Agree Implementation Date: July 2024

As the Department previously responded to the OSA, the Department will continue to investigate NEMT billing and payments through pre-payment reviews and suspected fraud investigations, and it will further revise rules and policy as needed in order to avoid improper claims payments and to ensure there are improved controls over the NEMT program.

The Department has returned the FFP on the known questioned costs. As to the likely questioned costs, as mentioned in Part A, the Department cannot review every claim, however as previously stated the Department plans to conduct post-payment reviews on identified providers and service types that are suspected of having a high risk of improper payments, if resources allow, which may include reviewing claims identified by the OSA as likely questioned costs. Should the department identify an overpayment during said reviews, the department will return the FPP.

Auditor’s Addendum

As noted in the audit finding, the Department has reported a recent surge in NEMT fraud that the Department is investigating. In the event that the Department's investigations identify improper payments or overpayments that result in additional known or likely questioned costs besides those identified by the prior audit, the Department will need to recover those payments and repay the federal portion, as appropriate.

The following findings and recommendations relating to internal control deficiencies classified as Material Weaknesses and Significant Deficiencies were communicated to the Department of Health Care Policy and Financing (Department) in the previous year and have not been remediated as of June 30, 2024 because the original implementation dates provided by the Department were in a subsequent fiscal year. These complete findings and recommendations can be found within the original report and the complete recommendations can be found within Section IV: Prior Audit Recommendations of this report. See Schedule of Finding and Questioned Costs for chart/table. Finding 2023-063, 2023-064, and 2023-065 Internal Controls Over Colorado Benefits Management System

The Department of Human Services uses the Colorado Benefits Management System (CBMS) for the TANF and SNAP programs. In addition, the Department of Health Care Policy and Financing (HCPF) uses CBMS for the federal Medicaid and the Children’s Basic Health Plan (CBHP) programs. For Fiscal Year 2023, the Governor’s Office of Information Technology (OIT) contracted with independent auditors (service auditors) to perform an evaluation of the Department, HCPF, and OIT’s internal controls for CBMS. For these types of evaluations, the service auditors follow the guidance issued by the American Institute of Certified Public Accountants (AICPA), Statement on Standards for Attestation Engagements (SSAE), within AT-C Section 320, and issue System and Organization Controls (SOC) reports at the conclusion of the evaluation. One type of SOC report—a SOC 1, Type II (SOC 1) report—provides the service auditor’s opinion on the service organization’s internal controls, specifically as to whether the internal controls are suitably designed, implemented, and operating effectively for a specified period. The Fiscal Year 2023 CBMS SOC 1 report covers the period of July 1, 2022 through June 30, 2023.

The Department, HCPF, and OIT can use the CBMS SOC 1 report to obtain assurance that CBMS’s internal controls are in place and working effectively in relation to the related federal programs administered through CBMS. If the SOC 1 report has issues noted, then the departments and office can assess how to address the issues. In addition, when service auditors provide a SOC 1 report with a modified opinion—which indicates that the service auditor has identified internal controls that fail to meet the standard upon which they are being measured or the service auditor was unable to obtain sufficient and appropriate evidence—the Department and HCPF should determine if actions to mitigate the increased risk to their federal programs and related internal control and compliance considerations are necessary.

In April 2023, the Department created a Business Innovation, Technology & Security (BITS) Division within the Department to help manage CBMS. The BITS Division is a new technology management division that works with OIT and vendors to ensure proper management of technology projects and assets. In 2023, the BITS Division took on much of the CBMS management through a joint-agency effort between the Department, HCPF, and OIT. This project was called the “CBMS Realignment” and it shifted centralized OIT staff to the Department and HCPF in an effort to bring CBMS management closer to the programs and the constituents they serve.

What was the purpose of our audit work and what work was performed?

The purpose of our audit work was to determine whether the Department and HCPF had effective internal controls in place related to their federal programs and CBMS for Fiscal Year 2023. Specifically, we requested a copy of the Fiscal Year 2023 CBMS SOC 1 report. We also inquired with the Department and HCPF on the timeline related to the receipt of the report.

How were the results of the audit work measured?

We measured the results of our audit work against the following requirements:

Federal regulation [2 CFR 200.303] requires the non-federal entity, in this instance the Department and HCPF, to establish and maintain effective internal controls over the federal award that provides reasonable assurance that the non-federal entity is managing the federal award in compliance with federal statutes, regulations, and the terms and conditions of the federal award.

According to the OSC’s policy, Internal Control System, the OSC and state departments must use the Standards for Internal Control in the Federal Government (Green Book), published by the U.S. Government Accountability Office, as their framework for their systems of internal control. Green Book Paragraph OV4.01, Service Organizations, states that management retains responsibility for the performance of processes assigned to service organizations. Furthermore, the Green Book specifies that management needs to understand the internal controls that each service organization has designed, implemented, and operates, as well as how each service organization’s internal control system impacts the Department’s internal control systems. Additionally, the Green Book states the following:

• Principle 3.06 states that, to achieve the entity’s objectives, management should assign responsibility and delegate authority to key roles throughout the entity.

• Principle 10.13 states that management should ensure duties are segregated in relation to authority and operation activities, to reduce the risk of overriding existing or established controls and preventing abuse, through potential collusion, in the internal control system.

• Principle 14.3 states that management should communicate quality information down and across reporting lines to enable personnel to perform key roles in achieving objectives, addressing risks, and supporting the internal control system. In these communications, management assigns the internal control responsibilities for key roles.

The CBMS SOC 1 report should be received by the Department, HCPF, and OIT no later than the end of October of each year—or within 4 months of the end of the fiscal year, as identified by industry best practices. This ensures that timely information is provided to the reviewed agency about the system being reviewed on the internal controls in place during the prior fiscal year.

What problem did the audit work identify?

The Department, HCPF, and OIT did not receive the CBMS SOC 1 report for the July 1, 2022 through June 30, 2023 period by October 2023. Rather, the Department received the report on January 26, 2024, 86 days after the end of October. Historically, OIT received this report between September and October each fiscal year and then provided the report to the Department and HCPF.

Why did this problem occur?

The Fiscal Year 2023 CBMS SOC 1 report was late due to the realignment of the CBMS OIT team, which was previously in charge of obtaining the CBMS SOC 1 report. According to the Department, when the CBMS OIT team was transitioned to the Department and HCPF during Fiscal Year 2023, there were coordination issues between the Department, HCPF, and the service auditor regarding the performance of the CBMS SOC 1 audit. In addition, the service auditor identified exceptions that the Department and HCPF were required to respond to prior to issuance of the CBMS SOC 1 report. With the recent changes, the Department, HCPF, and OIT do not have an interagency agreement in place to properly delineate responsibilities for CBMS, including SOC 1 audit oversight and the responsibilities associated with that audit.

Why does this problem matter?

The Department and HCPF are responsible for ensuring they have effective internal controls over their federal programs. By not establishing interagency agreements between the Department, HCPF, and OIT—not having clear roles and responsibilities outlined—the Department and HCPF could miss major CBMS management responsibilities, such as obtaining the CBMS SOC 1 reports in a timely manner. Further, the Department and HCPF have been unable to review the CBMS SOC 1 report for updates to compensating user entity controls and determine if there was a modified opinion in the report and, if so, take action to correct the identified issues.

Recommendation 2023-064

The Department of Health Care Policy and Financing (HCPF) should improve its internal controls over the Colorado Benefits Management System (CBMS) by establishing the roles and responsibilities for HCPF through interagency agreements with the Governor’s Office of Information Technology and Department of Human Services.

Response Department of Health Care Policy and Financing

Partially Agree Implementation Date: November 2024

HCPF does not agree that the late delivery of the CBMS SOC report justifies this recommendation. As identified in Inter-agency Agreements between OIT and the Department and CDHS and OIT, the SOC report for CBMS compliance was owned by the OIT prior to 2022 and CDHS Product Manager currently. CBMS is a multi-agency system owned by CDHS, HCPF, and OIT and as a result OIT, CDHS, and the Department agreed to Inter-agency agreements specifically identifying OIT as the responsible party for reviewing and complying with CBMS SOC requirements.

However, HCPF does agree that establishing the roles and responsibilities for HCPF, OIT, and CDHS is important to its internal controls over CBMS. HCPF will work with CDHS and OIT to establish, document, and formalize the roles and responsibilities.

Auditor’s Addendum

As discussed in the finding, the Department is responsible for ensuring they have effective internal controls over their federal programs, which includes maintaining responsibility for the performance of processes assigned to service organizations [Green Book Paragraph OV4.01]. By not reviewing the CBMS SOC report until almost 7 months after fiscal year end, the Department was unable to determine if any issues were identified in the report, or if any actions were needed to correct the issues identified.

Finding 2024-042 Compliance with Reporting for Foster Care, SSBG, and MHBG

Federal Funding Accountability and Transparency Act

The Federal Funding Accountability and Transparency Act (FFATA or Transparency Act) was created to empower Americans with the ability to hold the government accountable for each spending decision and, as a result, to reduce wasteful spending by the government. The Transparency Act requires the federal government to make certain information on federal awards available to the public. The Department is required to report information about subgrants, or subawards, given to other governments or to nonprofit organizations (also referred to as “subrecipients”). Federal regulations [2 CFR 200.1] define a “subaward” as an award provided by a pass-through entity, in this case the Department, to an entity to carry out part of a federal grant award received by the pass-through entity. A subrecipient is defined in federal regulations [2 CFR 200.1] as “an entity, usually but not limited to non-Federal entities, that receives a subaward from a pass-through entity to carry out part of a federal award; but does not include an individual that is a beneficiary of such award. A subrecipient may also be a recipient of other Federal awards directly from a federal awarding agency.”

The Department is required to file Transparency Act reports (also known as FFATA reports) through the FFATA Subaward Reporting System (FSRS). Once the Department submits a report to FSRS, the public can view certain information from the report, including the subrecipient’s name, subaward identification number, subaward obligation/action date, subaward amount, federal awarding agency and subagency, the Department’s name, and the Department’s grant award identification number. Information submitted via the FSRS is made publicly available at https://www.usaspending.gov/search.

The Department’s required FFATA reports for Fiscal Year 2024 included information on the MHBG, SSBG, and Foster Care programs. FFATA reporting was required for the Department because the Department passed through funds to one or more subrecipients for each of the three programs in excess of $30,000, as follows: MHBG funds to 46 subrecipients, SSBG funds to 64 subrecipients, and Foster Care funds to 64 subrecipients.

What was the purpose of our audit work and what work was performed?

The purpose of our audit work was to determine whether the Department had adequate internal controls over and complied with FFATA reporting requirements for MHBG, SSBG, and Foster Care during Fiscal Year 2024. We also determined the disposition of our Fiscal Year 2022 prior audit recommendation where we recommended the Department ensure that it complies with FFATA for the Foster Care program, including working with the federal government to obtain documented approval for its current approach or report its subawards in accordance with FFATA regulations. The Department agreed with this recommendation and planned to implement it by December 2023.

As part of our audit work, we requested the Department’s policies and procedures over FFATA reporting and the FFATA reports it submitted for MHBG, SSBG, and Foster Care for Fiscal Year 2024. We randomly selected 8 out of 46 county reports submitted for MHBG and compared amounts reported by the Department for subawards in FSRS to the underlying financial records in CORE, and inquired about differences. Additionally, we reviewed the Department’s MHBG subawards and related federal expenditures in Fiscal Year 2024 to determine if the Department reported Transparency Act information through FSRS within the required month following the subaward. We also inquired with Department staff about their internal control processes related to FFATA reporting, including supervisory reviews. We inquired with the Department on whether they submitted FFATA reports for the 64 counties that received SSBG and Foster Care subawards.

How were the results of the audit work measured?

We measured the results of our audit work against the following requirements:

In accordance with FFATA regulations [2 CFR 170, Appendix A], the Department is required to report subawards of $30,000 or more to FSRS by the end of the month following the month in which the award was made. For example, the Department would have to submit a FFATA report to FSRS in May 2024 if it made an award or supplemental award equal to or greater than $30,000 in April 2024.

The FFATA reports are required to include the following key data elements: subrecipient name, subrecipient Data Universal Numbering System (DUNS) number, amount of subaward, subaward obligation/action date, date of report submission, subaward number, subaward project description, subrecipient names, and compensation of highly compensated officers.

The Department’s FFATA Quick Reference Guide, available to program staff, requires that program staff report these key data elements in eClearance, a document depository utilized by the Department, whenever the Department makes a subaward. Program staff are to enter the subaward information into eClearance via an online form called an eForm. Each day, the Department’s accounting manager exports the subaward data that is accumulated in eClearance into a daily report. At the end of the month, the accounting manager combines the daily reports into a monthly summary and compares the monthly summary report to the daily reports to verify the summary report’s accuracy. The accounting manager uses the information summarized within the monthly report to input the required FFATA information into FSRS, which ultimately is submitted as the required monthly FFATA report. Although not explicitly stated in the guide, evidence of review and approval should be documented prior to submission.

What problems did the audit work identify?

We identified problems with the Department’s FFATA reporting for MHBG, SSBG, and Foster Care programs for Fiscal Year 2024. Based on our audit testwork, we determined that the Department did report its subawards in FSRS for MHBG for Fiscal Year 2024. However, for MHBG, the Department failed to provide evidence showing review and approval over the FFATA reports for two out of the eight (25 percent) reports tested. For the other two federal programs— SSBG and Foster Care—the Department failed to report any of the 64 (100 percent) counties’ subawards in FSRS. The following tables summarize the results of our testing and groups each exception within the following categories: subaward not reported, timeliness of report unable to be determined, subaward amount incorrect, and subaward missing key elements.

See Schedule of Findings and Questioned Costs for chart/table.

Why did these problems occur?

For MHBG, the Department did not have adequate internal controls in place related to FFATA reporting, such as an appropriate supervisory review process to ensure that the Transparency Act reporting is completed in accordance with federal requirements. Specifically, the Department’s FFATA Quick Reference Guide did not indicate which documentation Department staff need to maintain to provide evidence of supervisory review.

During our Fiscal Year 2022 audit, the Department stated that it believed the FFATA regulations did not apply to the SSBG and Foster Care programs because both programs are primarily administered by the counties and therefore, the counties should be considered part of the State for FFATA reporting purposes instead of subrecipients. However, the Department could not provide any information from the federal government to support this conclusion. The Department subsequently determined during Fiscal Year 2024 that, because the SSBG and Foster Care funds are awarded to 64 Colorado counties that are subrecipients, and the FFATA regulations specify that the Department “must report each action that equals or exceeds $30,000 in Federal funds for a subaward to a subrecipient,” FFATA reporting is required for subawards under both programs. However, the Department did not report these subawards during Fiscal Year 2024.

Why do these problems matter?

By failing to properly report the subawards to FSRS, the Department is out of compliance with federal reporting requirements and risks federal sanctions. In addition, by not reporting the relevant information, it is failing to meet the federal intent of transparency for federal program spending. Furthermore, not maintaining documentation of the review and approval of the reports can lead to a lack of accountability, making it difficult to verify compliance and potentially resulting in further scrutiny or penalties from federal oversight bodies.

See Schedule of Findings and Questioned Costs for chart/table.

Recommendation 2024-042

The Department of Human Services (Department) should strengthen its internal controls over the Federal Funding Accountability and Transparency Act (FFATA) reporting for the Block Grants for Community Mental Health Services, the Social Services Block Grant, and the Foster Care Title IV-E program, and ensure that its reporting meets federal requirements by ensuring that reporting occurs as required for subawards of $30,000 or more in the FFATA Subaward Reporting System by the end of the month following the month the subawards are made. The Department should also revise the FFATA Quick Reference Guide to include what documentation needs to be maintained to show evidence of review, approval, and submission, and ensure that this evidence is consistently documented and retained.

Response Department of Human Services

Agree Implementation Date: February 2025

The Department agrees with the recommendation to have a digital signature process on each submitted FFATA reports to maintain evidence on when the reports were submitted. We also implemented a process of sending a monthly email to the supervisor with the screenshot of completed reports with the path as of Jan 2024. In addition, the Department will implement the FFATA reporting of the county allocations that are provided through the county year end Federal Financial Award (FFA) report. CDHS utilizes the FFA report established in the calendar year which counties use to report on their SEFA (Schedule of Expenditures of Federal Awards). Therefore, CDHS considers the 30 days due date after Period 6 closes in CORE and plans to submit all the reports in February 2025. In addition, the Department agrees to revise the Quick Reference Guide to include what documentation needs to be maintained to show evidence of review, approval, and submission, and ensure that this evidence is consistently documented and retained.

Finding 2024-043 Compliance with Eligibility and Special Tests and Provisions for Foster Care

The Foster Care program was enacted under Title IV-E of the Social Security Act and is overseen at the federal level by the Department of Health and Human Services. The purpose of this program is to help States provide proper care for eligible children who need placement outside of their homes. A child may be removed from a home either by a court order or a voluntary placement agreement and may be placed with a relative, a foster family home, a residential child care facility, or a group home.

In Colorado, the county departments of human/social services administer the Foster Care program, which includes determining a child’s eligibility to be funded under the program, and the Department supervises and monitors the counties. When a child is removed from the home, the county caseworkers gather necessary information to open a program case for that child. County caseworkers enter the information on a prescribed form for initial determination and redetermination for the program, including date of birth, whether the removal was voluntary or court ordered, household demographics, family income, and how the child was deprived of parental support. This information is also entered into the Department’s case management system, Trails, to document the child’s eligibility for the program. The population of all children funded by the Foster Care program is maintained within the Trails system.

The State mandates specific requirements for the certification and eligibility determination of foster care providers to ensure the safety and well-being of children in the foster care system. Prospective foster homes must complete a state-approved training program, pass comprehensive background checks including fingerprinting and criminal history reviews, and undergo a thorough home study conducted by a licensed child placement agency. This home study includes interviews, home inspections, and assessments of the family's ability to provide a nurturing environment. Additionally, applicants must provide proof of good physical and mental health, demonstrate financial stability, and obtain CPR and first aid certification. Personal references are also required to further validate the suitability of the foster care providers. The population of all providers funded by the Foster Care program is maintained within Trails. Program funds are sent to eligible providers to support the care for eligible children. Another requirement for foster care providers is to complete a rate request form if they need foster care maintenance payments that exceed the amount set by the State. The rate request form is then required to be approved by the Department.

In Fiscal Year 2024, the Department’s expenditures for the Foster Care program were approximately $93.5 million. The Department had 2,245 children and 1,451 providers in the program in Fiscal Year 2024.

What was the purpose of our audit work and what work was performed?

The purpose of the audit work was to review the Department’s internal controls over the Foster Care program’s eligibility determination process, as well as to determine whether the Department complied with applicable eligibility determination requirements during Fiscal Year 2024.

We reviewed a sample of 60 of the Department’s program case files for children who were determined eligible for the program and resided with a provider who received program payments for providing foster care for the child during Fiscal Year 2024. We also reviewed a sample of 60 of the Department’s program provider files for providers who were determined eligible for the program. Our testing included reviewing supporting documentation included in the case files as well as data entered into Trails related to eligibility determinations/redeterminations, and certifications of providers.

How were the results of the audit work measured?

We applied the following criteria during our testing:

• Federal regulation [2 CFR 200.303] states that the Department must “establish, document, and maintain effective internal control over the Federal award that provides reasonable assurance that the recipient or subrecipient is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award.”

• State regulation [12 CCR 2509-7.601.71(D)(3)] requires, as part of a child’s eligibility determination, that a county calculate the determination of need in which (1) the income and resources of the household members of the home the child is removed from must be less than $10,000 in countable resources and (2) the household income after Aid to Families with Dependent Children income tests are applied must be less than the need standard for the household.

• State regulation [12 CCR 2509-7.601.71(J)(2)] requires that the redetermination of Title IV-E Eligibility Requirements be made within 12 months of the date the child enters foster care, and every 12 months thereafter while the child remains in out-of-home care. • 42 U.S. Code § 672(c)(1) notes that “the term “foster family home” means the home of an individual or family that is licensed or approved by the State in which it is situated as a foster family home that meets the standards established for the licensing or approval; and in which a child in foster care has been placed in the care of an individual, who resides with the child and who has been licensed or approved by the State to be a foster parent…”

• 42 U.S. Code § 672(c)(2) notes that in general, “the term “child-care institution” means a private child-care institution, or a public child-care institution which accommodates no more than 25 children, which is licensed by the State in which it is situated or has been approved by the agency of the State responsible for licensing or approval of institutions of this type as meeting the standards established for the licensing…”

• 42 U.S. Code § 671(a)(20)(A) and (B) notes that procedures for criminal records checks, including fingerprint-based checks of national crime information databases, for any prospective foster or adoptive parent must be completed before the foster or adoptive parent may finally be approved for placement of a child…and the State shall check any child abuse and neglect registry maintained by the State for information on any prospective foster or adoptive parent and on any other adult living in the home of such a prospective parent.

• 42 U.S. Code § 671(a)(11) notes the need for a “periodic review…[over] amounts paid as foster care maintenance payments…to assure their continuing appropriateness.”

What problems did the audit work identify?

For Foster Care program eligibility of children, we identified a problem in 1 of the 60 case files tested (2 percent). Specifically, we identified the following:

• One child whose removal home’s income exceeded the limit to be Title IV-E eligible for payments through the program. This was found during the audit process and the total questioned costs were $9,167 in Fiscal Year 2024.

For eligibility and payment rate setting and application testing over providers—a special tests and provisions requirement for the program—we identified problems in 2 of the 60 case files tested (3 percent). These problems resulted in questioned costs of $1,764. Specifically, we identified the following:

• Two providers in which the rate request and approval was not in the case file. This request and approval is required per 42 U.S. Code § 671(a)(11) when the rates paid to providers is not in-line with the approved daily rates. • Two providers had a rate calculated by county staff and paid to them that exceeded the approved rates, and no rate request documentation, including approvals, was contained in the case file.

Why did these problems occur?

The Department lacked sufficient internal controls to ensure compliance with eligibility and special tests and provisions requirements for the Foster Care program during Fiscal Year 2024. For example, the Department did not require the counties to complete a checklist to ensure they comply with all program rules and regulations. In addition, while the Department does have a monitoring process over the counties that includes a quarterly administrative review of the counties’ compliance and data over Child Welfare, this monitoring does not regularly review the counties’ eligibility processes.

The Department communicated that the counties administering the program continue to experience significant turnover in caseworker positions. This turnover results in new, inexperienced county caseworkers determining program eligibility, which further heightens the need for frequent, detailed training and an effective quality review process. Currently, the Department provides annual training to each county; however, the ongoing turnover underscores the necessity for more frequent and comprehensive training sessions to ensure all caseworkers are well-equipped to manage program requirements.

Why do these problems matter?

It is essential for the Department to ensure that a child’s eligibility and provider’s certifications for the Foster Care program are properly determined, documented, and in accordance with state and federal regulations. Furthermore, providing continuous and effective training on eligibility determinations and redetermination will aid in reducing errors and omissions of required documentation. Inaccurate processing of case file information used to determine eligibility can result in counties improperly granting program benefits to ineligible individuals or denying benefits to eligible individuals. Ensuring case file information includes proper payment rate supporting documentation is also required to meet federal regulations around special tests and provisions compliance requirements. The federal government can disallow the payment of federal funds for program expenditures that do not adhere to regulations, which would require the State to use general funds to cover the expenditures. See Schedule of Findings and Questioned Costs for chart/table.

Recommendation 2024-043

The Department of Human Services (Department) should strengthen its internal controls over, and ensure compliance with, the Foster Care Title IV-E program eligibility and special tests and provisions requirements by:

A. Ensuring that county caseworkers are appropriately trained on program requirements. This should include training all caseworkers who work on the program at a frequency that ensures that new caseworkers receive comprehensive training within a reasonable timeframe after hire and requiring at least one representative from each county to attend Department-provided training.

B. Implementing a checklist that the counties must complete for each case to ensure compliance with laws and regulations.

C. Enhancing the Department’s county review process to regularly review the counties’ eligibility processes, which should include a review of the counties’ use of the checklist.

Response Department of Human Services

A. Agree Implementation Date: June 2025

The Department currently provides quarterly training for both new workers and quarterly meetings. The department will require at least one representative from each county to attend a minimum of one training per fiscal year. New workers will still be required to attend a new worker training prior to gaining access to the IV-E module in Trails.

B. Disagree Implementation Date: Not Applicable

The Department currently uses the Trails system as a checklist for eligibility workers. Counties are required to utilize this system for their initial determinations. The department will monitor compliance and provide training to ensure adherence to applicable laws and requirements.

Auditor’s Addendum

Federal regulations require the Department to have internal controls in place to ensure compliance with the Foster Care program requirements. The audit found that the Department’s current internal controls are not effective in ensuring that the Department is in compliance with these requirements. Therefore, the Department should develop a checklist outside of the Trails system to further address caseworker responsibilities and provide a guide for their daily work to complement the Trails system.

C. Partially Agree Implementation Date: June 2025

The Department will review the counties’ eligibility process during their IV-E review entrance meeting and ensure that their processes align with complying to laws and regulations. The department will include this process review in their review finding letter that is sent after each review.

Auditor’s Addendum

Federal regulations require the Department to have internal controls in place to ensure compliance with the Foster Care program requirements. The audit found that the Department’s current internal controls are not effective in ensuring that the Department is in compliance with these requirements. Therefore, the Department should enhance its monitoring and training processes by implementing a checklist outside of the Trails system itself to assist with caseworker knowledge of program requirements and related monitoring by counties’ of these requirements.

Finding 2024-044 Compliance with Activities Allowed or Unallowed and Allowable Costs/Cost Principles for CSS and MHBG

The objective of the MHBG program is to provide funds to states and territories to enable them to carry out their respective plans for providing comprehensive community-based mental health services for adults with serious mental illness and children with serious emotional disturbances. To ensure creative and cost-effective delivery of services, states are encouraged to develop solutions to address the specific mental health concerns of their local communities.

The objectives of the Child Support Services (CSS) program are to (1) locate absent parents, (2) establish paternity, (3) obtain child and spousal support, and (4) enforce support obligations owed by noncustodial parents.

The Department is responsible for monitoring its costs and activities charged to both federal programs for allowability, specifically to ensure costs and activities are permitted under federal regulations and grant agreements.

MHBG allowable activities include services provided through qualified community programs, such as mental health centers, outpatient services, emergency care, day treatment, and patient screening for state mental health facilities. Unallowable activities include providing inpatient hospital services, making cash payments to recipients, purchasing or improving land or major medical equipment, satisfying nonfederal funding requirements, and providing financial assistance to entities other than public or nonprofit entities.

CSS allowable activities include parent locator services, paternity and support services, program administration, and establishing agreements with other agencies and private providers. State programs can also fund support services for individuals with assigned support rights, necessary and reasonable services and activities, minor transportation expenses, pro se access to adjudicative processes, and educational outreach activities. Unallowable activities include administering other Social Security Act titles, construction and major renovations, reimbursed expenditures, jailing parents, and costs of counsel or guardians ad litem in Title IV-D actions. Title IV-D refers to a section of the Social Security Act that deals with child support and establishment of paternity. State programs cannot fund:

• Education and training programs outside Title IV-D agency staff.

• Any expenditures related to carrying out an agreement under federal regulation [45 CFR 303.15] (i.e. agreements to use the Federal Parent Locator Service in parental kidnapping and child custody visitation cases).

• Caseworker costs.

• Medical support enforcement under cooperative arrangements, costs associated with agreements with courts and law enforcement officials (i.e. service of process and court filing fees, unless the court or law enforcement agency would normally be required to pay the costs; costs of compensation of judges and staff of judges; costs of training and travel related to the judicial determination process incurred by judges; and office-related costs), and support enforcement services which are not secured in accordance with Federal Financial Participation.

The Department has established controls that require invoices to be reviewed and approved by different personnel than those requesting the disbursement. In addition, backup documentation must be reviewed for accuracy and allowability before a payment is approved. For Fiscal Year 2024, the MHBG program had 1,177 general disbursement transactions totaling $3,539,878, and the CSS program had 4,321 general disbursement transactions totaling $2,894,463.

What was the purpose of our audit work and what work was performed?

The purpose of our audit work was to determine whether the Department had adequate internal controls over federal allowable activities and allowable cost requirements for the MHBG and CSS programs, and to determine whether the Department complied with federal allowable costs requirements for the two programs during Fiscal Year 2024.

As part of our audit work, we randomly selected 40 cash disbursements for each of the two programs, which consisted of general disbursement transactions. We reviewed supporting documentation provided by the Department for allowability and evidence of internal controls through documented approvals of the expenditures.

How were the results of the audit work measured?

We measured the results of our audit work against the following requirements:

• Federal regulation [2 CFR 200.303] states that the Department must “establish, document, and maintain effective internal control over the Federal award that provides reasonable assurance that the recipient or subrecipient is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award.”

• Federal regulation [2 CFR section 200.403] requires that costs under Federal awards must be necessary, reasonable, and allocable, conform to limitations, be consistent with policies, receive consistent treatment, adhere to Generally Accepted Accounting Principles, not be used for cost sharing of other programs, and be adequately documented.

• The Department’s internal control procedures require that all federal grant expenditures must have adequate supporting documentation, such as an invoice or purchase order, included with the transaction, and the supporting documentation must be reviewed for accuracy and allowability under the applicable federal grant program by two individuals.

What problems did the audit work identify?

Based on our audit test work, we determined that the Department did not ensure that costs charged to either federal grant were allowable, and there was not proper evidence of internal control procedures. Specifically, we identified the following:

• MHBG—For 1 of 40 (3 percent) general disbursement transactions selected for testing, the Department could not provide evidence of Department staff’s review and approval of the transaction. Additionally, this transaction was erroneously charged to the grant. This resulted in questioned costs of $6.

• CSS—For 5 of 40 (13 percent) general disbursement transactions selected for testing, the Department could not provide evidence of Department staff’s review and approval of the transaction. This resulted in questioned costs of $192.

Why did these problems occur?

Per the Department’s policies and procedures, Department staff must obtain documented approval over grant expenditures. However, the Department did not maintain supporting documentation to demonstrate approval of these expenditures because these expenditures involved multiple State entities. The Department did not have procedures in place to obtain documentation of the approvals of these types of expenditures for grant purposes.

Why do these problems matter?

By failing to properly review and approve transactions charged to its federal grants, unallowable costs were charged to both programs. Ultimately, if the Department fails to comply with federal grant requirements, the federal government may disallow the Department’s grant expenditures and the Department would be required to bear the cost of these errors. See Schedule of Findings and Questioned Costs for chart/table.

Recommendation 2024-044

The Department of Human Services (Department) should improve its internal controls over and ensure compliance with federal Block Grants for Community Mental Health Services and Child Support Services programs to ensure costs charged to these grant programs are allowable. Specifically, the Department should update its written procedure to require documented review and approval over all grant expenditures, including those that involve other State entities.

Response Department of Human Services

Partially Agree Implementation Date: April 2025

The Department partially agrees with the recommendation. The Department agrees to inform program staff at the currently set fiscal meetings to review for correct coding related to internally initiated expenditures. The Department disagrees with the recommendation around transactions (IET1) that are automated uploads directly from DPA (Department of Program Administration). The charges do not come through in the CDHS cabinet’s Doc ID. Therefore, we’re unable to review and approve before the automatic posting.

Auditor’s Addendum

As discussed in our finding, the Department is responsible for maintaining documentation of internal controls to evidence review for accuracy and allowability of federal grant program expenditures. Specifically, the Department did not provide evidence that demonstrated approval over these grant expenditures in accordance with their internal control procedures. For transactions that are initiated or processed by other State departments, the Department is still responsible to evidence review for accuracy and allowability of federal grant expenditures. The Department should update its written procedures to address cases where grant expenditures are processed by other State departments to ensure that Department staff knowledgeable about allowability of grant expenditures are reviewing for these requirements. The Department is still ultimately responsible for the allowability of all federal grant expenditures for this Program, regardless of which State Department initiates transactions.

The following finding and recommendation relating to an internal control deficiency classified as a Significant Deficiency was communicated to the Department of Human Services (Department) in the previous year and has not been remediated as of June 30, 2024 because the original implementation date provided by the Department was in a subsequent fiscal year. This complete finding and recommendation can be found within the original report and the complete recommendation can be found within Section IV: Prior Audit Recommendations of this report.

See Schedule of Findings and Questioned Costs for chart/table. Finding 2023-063, 2023-064, and 2023-065 Internal Controls Over Colorado Benefits Management System

The Department of Human Services uses the Colorado Benefits Management System (CBMS) for the TANF and SNAP programs. In addition, the Department of Health Care Policy and Financing (HCPF) uses CBMS for the federal Medicaid and the Children’s Basic Health Plan (CBHP) programs. For Fiscal Year 2023, the Governor’s Office of Information Technology (OIT) contracted with independent auditors (service auditors) to perform an evaluation of the Department, HCPF, and OIT’s internal controls for CBMS. For these types of evaluations, the service auditors follow the guidance issued by the American Institute of Certified Public Accountants (AICPA), Statement on Standards for Attestation Engagements (SSAE), within AT-C Section 320, and issue System and Organization Controls (SOC) reports at the conclusion of the evaluation. One type of SOC report—a SOC 1, Type II (SOC 1) report—provides the service auditor’s opinion on the service organization’s internal controls, specifically as to whether the internal controls are suitably designed, implemented, and operating effectively for a specified period. The Fiscal Year 2023 CBMS SOC 1 report covers the period of July 1, 2022 through June 30, 2023.

The Department, HCPF, and OIT can use the CBMS SOC 1 report to obtain assurance that CBMS’s internal controls are in place and working effectively in relation to the related federal programs administered through CBMS. If the SOC 1 report has issues noted, then the departments and office can assess how to address the issues. In addition, when service auditors provide a SOC 1 report with a modified opinion—which indicates that the service auditor has identified internal controls that fail to meet the standard upon which they are being measured or the service auditor was unable to obtain sufficient and appropriate evidence—the Department and HCPF should determine if actions to mitigate the increased risk to their federal programs and related internal control and compliance considerations are necessary.

In April 2023, the Department created a Business Innovation, Technology & Security (BITS) Division within the Department to help manage CBMS. The BITS Division is a new technology management division that works with OIT and vendors to ensure proper management of technology projects and assets. In 2023, the BITS Division took on much of the CBMS management through a joint-agency effort between the Department, HCPF, and OIT. This project was called the “CBMS Realignment” and it shifted centralized OIT staff to the Department and HCPF in an effort to bring CBMS management closer to the programs and the constituents they serve.

What was the purpose of our audit work and what work was performed?

The purpose of our audit work was to determine whether the Department and HCPF had effective internal controls in place related to their federal programs and CBMS for Fiscal Year 2023. Specifically, we requested a copy of the Fiscal Year 2023 CBMS SOC 1 report. We also inquired with the Department and HCPF on the timeline related to the receipt of the report.

How were the results of the audit work measured?

We measured the results of our audit work against the following requirements:

Federal regulation [2 CFR 200.303] requires the non-federal entity, in this instance the Department and HCPF, to establish and maintain effective internal controls over the federal award that provides reasonable assurance that the non-federal entity is managing the federal award in compliance with federal statutes, regulations, and the terms and conditions of the federal award.

According to the OSC’s policy, Internal Control System, the OSC and state departments must use the Standards for Internal Control in the Federal Government (Green Book), published by the U.S. Government Accountability Office, as their framework for their systems of internal control. Green Book Paragraph OV4.01, Service Organizations, states that management retains responsibility for the performance of processes assigned to service organizations. Furthermore, the Green Book specifies that management needs to understand the internal controls that each service organization has designed, implemented, and operates, as well as how each service organization’s internal control system impacts the Department’s internal control systems. Additionally, the Green Book states the following:

• Principle 3.06 states that, to achieve the entity’s objectives, management should assign responsibility and delegate authority to key roles throughout the entity.

• Principle 10.13 states that management should ensure duties are segregated in relation to authority and operation activities, to reduce the risk of overriding existing or established controls and preventing abuse, through potential collusion, in the internal control system.

• Principle 14.3 states that management should communicate quality information down and across reporting lines to enable personnel to perform key roles in achieving objectives, addressing risks, and supporting the internal control system. In these communications, management assigns the internal control responsibilities for key roles.

The CBMS SOC 1 report should be received by the Department, HCPF, and OIT no later than the end of October of each year—or within 4 months of the end of the fiscal year, as identified by industry best practices. This ensures that timely information is provided to the reviewed agency about the system being reviewed on the internal controls in place during the prior fiscal year.

What problem did the audit work identify?

The Department, HCPF, and OIT did not receive the CBMS SOC 1 report for the July 1, 2022 through June 30, 2023 period by October 2023. Rather, the Department received the report on January 26, 2024, 86 days after the end of October. Historically, OIT received this report between September and October each fiscal year and then provided the report to the Department and HCPF.

Why did this problem occur?

The Fiscal Year 2023 CBMS SOC 1 report was late due to the realignment of the CBMS OIT team, which was previously in charge of obtaining the CBMS SOC 1 report. According to the Department, when the CBMS OIT team was transitioned to the Department and HCPF during Fiscal Year 2023, there were coordination issues between the Department, HCPF, and the service auditor regarding the performance of the CBMS SOC 1 audit. In addition, the service auditor identified exceptions that the Department and HCPF were required to respond to prior to issuance of the CBMS SOC 1 report. With the recent changes, the Department, HCPF, and OIT do not have an interagency agreement in place to properly delineate responsibilities for CBMS, including SOC 1 audit oversight and the responsibilities associated with that audit.

Why does this problem matter?

The Department and HCPF are responsible for ensuring they have effective internal controls over their federal programs. By not establishing interagency agreements between the Department, HCPF, and OIT—not having clear roles and responsibilities outlined—the Department and HCPF could miss major CBMS management responsibilities, such as obtaining the CBMS SOC 1 reports in a timely manner. Further, the Department and HCPF have been unable to review the CBMS SOC 1 report for updates to compensating user entity controls and determine if there was a modified opinion in the report and, if so, take action to correct the identified issues.

Recommendation 2023-063

The Department of Human Services (Department) should improve its internal controls over the Colorado Benefits Management System (CBMS) by establishing the roles and responsibilities for the Department through interagency agreements with the Governor’s Office of Information Technology and Department of Health Care Policy and Financing.

Response Department of Human Services

Agree Implementation Date: September 2024

The Department will be working with HCPF and OIT on a Delegation of Authority per C.R.S. 24-37.5-105.4 which will serve in the same capacity as an IA. The Delegation of Authority will outline the roles and responsibilities of each party/agency are in place prior to the start of the yearly SOC audit. In addition, the CBMS Team (CDHS BITS) will be working to hire a resource to fill a new position that will help facilitate the coordination of the yearly SOC audit. The new role will serve as the main point of contact for the SOC auditors to gather support requests in a timely manner and ensure the timeline is on track, while escalating to management at State CBMS, HCPF, vendors and OIT as needed. This position will also work with the CDHS Internal Audit Division to document an internal control process to ensure proper alignment with all internal and external stakeholders. The CBMS Team and SOC auditors will agree to a timeline that will meet the industry standards best practices of delivering a final report within four months of the end of each fiscal year. The timeline will include a review of the draft report for not only the CBMS Team but also CDHS, HCPF and OIT.

Finding 2024-046 Compliance with Special Tests and Provisions for Unemployment Insurance

Employer Experience Rating

The Department’s UI Division (Division) is responsible for the administration and monitoring of Colorado’s UI programs, including the collection of unemployment premiums from employers, the payment of UI benefits to claimants, and the performance of audits and investigations of premiums and benefits paid to ensure the payments were appropriate. Employer-paid premiums are the primary source of funding for UI benefits.

Federal regulations [26 U.S.C. § 3301] outline the process the Division must use to determine a new employer’s initial UI premium rate that is applied to the employers’ total annual wages to calculate its UI premiums, as well as the process the Division must use to make subsequent changes to the employer’s rate over time. New employers begin at a standard rate depending on their type of business activity. This initial rate will subsequently change based upon the amount of UI benefits that are paid to the employer’s former employees—UI claimants—by the Department and subsequently charged to the employer’s account. Thus, the more charges against the account, the higher the employer’s rate; and similarly, the fewer charges against the account, the lower the employer’s rate. This is referred to as the “employer experience rating.” The purpose of the ratings process is to ensure an equitable distribution of costs of the UI program among the employers. Annually, the Division multiplies this calculated rate by the employer’s total wages to determine the amount of premiums that the employer is required to pay. For example, the Division calculates the employer’s rate for Calendar Year 2025 during Fiscal Year 2024, using Fiscal Year 2024 wage information. According to Division staff, they switched from using their prior UI system, CATS, to MyUI+, the Department’s new UI system, for the first time in Fiscal Year 2023 to calculate the Calendar Year 2024 rates.

The rate for employers (who are not a new employer) is primarily a function of three components:

• Premiums Paid: All contributions made by the employer over the time the employer is paying premiums into the UI program.

• Benefits Charged: All benefits charged to the employer in total during the time period the employer has paid premiums into the UI program.

• Average Annual Payroll: The average annual wages the employer reported during the previous three state fiscal years (July-June). Wages are reported by employers through MyUI+.

The Division uses MyUI+ to calculate each employer’s “Percent of Excess,” which determines the rate assigned to employers and is calculated using the formula noted in the following example: See Schedule of Finding and Questioned Costs for chart/table.

If the Division calculates a higher Percent of Excess for an employer, a lower rate is assigned to the employer, and if the Division calculates a lower Percent of Excess (including negative excess), then a higher rate is assigned to the employer.

According to information provided by the Department, the Department calculated Calendar Year 2024 UI premium rates for 221,271 employers during Fiscal Year 2023. What was the purpose of our audit work and what work was performed?

The purpose of our audit work was to review the Division’s internal controls over and the calculation of the UI employer experience rate to determine whether MyUI+ is calculating the rate correctly, and whether the Department was in compliance with federal regulations related to the UI employer experience rating during Fiscal Year 2024.

As part of our audit work, we met with the Division to review a sample of one employer to gain an understanding of the process for calculating an employer rate, and determine whether MyUI+ calculated the Calendar Year 2024 employer rates correctly during Fiscal Year 2023.

How were the results of the audit work measured?

We measured the results of our audit against the following:

• Federal regulations require that the Division use an experience rating system when calculating employer UI premium rates if permitted by state law. Specifically, 26 United States Code 3303(a)(1), Conditions of Additional Allowance, states that a “taxpayer shall be allowed an additional credit with respect to any reduced rate of contributions permitted by a State law, only if the Secretary of Labor finds that under such law no reduced rate of contributions to a pooled fund or to a partially pooled account is permitted to a person (or group of persons) having individuals in his (or their) employ except on the basis of his (or their) experience with respect to unemployment or other factors bearing a direct relation to unemployment risk during not less than the 3 consecutive years immediately preceding the computation date.”

• Section 8-76-102.5(3)(a), C.R.S., states that “the total of an employer’s premiums paid, designated, and deposited into the unemployment compensation fund on the employer’s behalf on or before thirty-one days immediately after the computation date and the total benefits that were chargeable to the employer's account and were paid before the computation date, with respect to weeks, or any established payroll period of unemployment, beginning before the computation date, is used to compute the employer’s premium rate for the following calendar year.” This statutory section also defines Percent of Excess as the percentage resulting from dividing the excess of premiums paid over benefits charged by the average chargeable payroll, computed to the nearest one percent.

• Standards for Internal Control in the Federal Government (Green Book), published by the U.S. Government Accountability Office, states in Principle 3.09, Documentation of Internal Control System, and 12.02, Documentation of Responsibilities through Policies, that management should develop and maintain documentation of its internal control system and document in policies the internal control responsibilities of the organization. Principles 11.06 and 11.07, Design Appropriate Types of Control Activities, states that management should design appropriate types of control activities in the entity’s information system, including information system general controls that facilitate the proper operation of the entity’s systems.

What problem did the audit work identify?

Based on our audit testwork, we determined that MyUI+ did not calculate the employer rate correctly for the employer we reviewed. Specifically, for the one employer we reviewed, MyUI+ calculated the rate as 3.635 percent instead of the correct rate of 2.545 percent; this rate error resulted in the employer’s premiums being calculated as $1,640 instead of the correct amount of $1,148. After additional inquiry, the Department indicated that they identified approximately 30,000 employers whose Calendar Year 2024 rates were calculated incorrectly by MyUI+, which resulted in employers overpaying approximately $5.0 million in premiums. As of the end of our audit, the Department had not communicated the error to the employers or repaid any employer overpayments. The Department indicated that the error primarily resulted in employer premium overpayments, but in some cases it could have resulted in employer premium underpayments.

Why did this problem occur?

According to the Department, the issue identified through our testing occurred due to a system issue in MyUI+. Specifically, Department staff indicated that a programming error in MyUI+ resulted in MyUI+ calculating the Average Annual Payroll incorrectly for some employers, which ultimately affected the employer rate. In addition, Division staff indicated that they have not drafted updated policies and procedures for calculating rates in MyUI+, so staff did not attempt to recalculate any employer rates and did not, therefore, identify the programming error.

Why does this problem matter?

These problems matter because the Department improperly calculated an employer’s rate, which primarily resulted in the employers overpaying their UI premiums for 2024. Ultimately, the Department is out of compliance with federal regulations and penalizing employers unfairly if the rate is too high, or giving them an undeserved benefit if it is too low.

See Schedule of Finding and Questioned Costs for chart/table.

Recommendation 2024-046

The Department of Labor and Employment should ensure that the Unemployment Insurance Division staff take steps to resolve the MyUI+ system programming issue identified in our audit that affected employer unemployment rates and premium payments. This should include identifying all of the employers affected by the issue, making the necessary adjustments to their current and prior rates and calculated premiums, and refunding or collecting any overpayments and underpayments, respectively, as applicable.

Response Department of Labor and Employment

Agree Implementation Date: December 2024

The Department of Labor and Employment has ensured that the Unemployment Division staff has taken all necessary steps to resolve the MyUI+ system programming issue identified in the audit that affected employer unemployment rates and premium payments. The Division identified all of the employers affected, immediately made the necessary adjustments to their rates, recalculated premiums, and established credits or adjusted amounts owed for all totals as a result of these updates as applicable.

This has been facilitated by providing a credit for any overpayments, which the employer may elect to have refunded or applied to future premiums due. Employers who have any balance attributed to unpaid premiums from previous years have had the credit applied to those outstanding balances. All changes and corrections were implemented as of December 23, 2024. The defect will have no impact on rates or calculations for 2025 and beyond.

Finding 2024-047 MyUI+ — IT Governance and Information Security

Government Auditing Standards allow for information that is considered sensitive in nature, such as detailed information related to information technology system security, to be issued through a separate “classified or limited use” report because of the potential damage that could be caused by the misuse of this information. We consider the specific technical details of this finding, along with the response, to be sensitive in nature and not appropriate for public disclosure. Therefore, the details of the following finding and response have been provided to the Department in a separate, confidential memorandum.

The Department administers the federal UI program, and the Department relies on the IT system, MyUI+, to aid with determining applicants’ eligibility for the program and to provide information necessary to meet federal reporting requirements. The Department is the business owner and works with the Governor’s Office of Information Technology (OIT) and its external IT service provider to manage MyUI+.

The MyUI+ system determines UI eligibility determinations and calculates UI payments to eligible recipients. According to Department staff, starting in Fiscal Year 2023, MyUI+ provided data necessary for federal reporting to the U.S. Department of Labor for the UI program. The Department stated that, in October 2024, to modernize its Colorado Automated Tax System (CATS), which was its system used to track and report unemployment premium payments made by employers, it updated MyUI+ and added this functionality that was previously within CATS.

In order for the Department to achieve its objectives and respond to risks, including those related to the federal programs it administers, management should establish a strong framework of internal controls that also address information system controls. Specifically, information system controls typically start with management documenting IT policies that address IT general control responsibilities and procedures that document the more granular details on how to implement Department policies. These IT general control policies and procedures should include those policies and procedures that are specific to information security. Once policies and procedures have been formalized and communicated to responsible staff, specific internal control activities can be implemented and operationalized.

What was the purpose of our audit work and what work was performed?

The purpose of our Fiscal Year 2024 audit work was to determine whether the Department implemented two of our Fiscal Year 2023 recommendations: (1) Recommendation 2023-073 relating to MyUI+, and (2) Recommendation 2023-028, relating to CATS. Specifically, at that time, we recommended that the Department should:

For Recommendation 2023-073, improve its overall IT governance and information security IT general controls, and work with its IT service providers, as applicable, for the MyUI+ system by:

• Recommendation Part A—Formalizing and communicating to Department staff and the Department’s IT service providers’ IT policies that comply with the business owner requirements listed within the OIT’s March 2022 Colorado Information Security Policies (Security Policies). As an option, the Department could formally adopt the October 2021 Security Policies, identify any gaps between the October 2021 and March 2022 versions, and then formalize and communicate policies that address the identified gaps.

• Recommendation Part B—Formalizing and communicating IT procedures to provide guidance to Department staff and the Department’s IT service providers performing IT general control activities that further address the IT policies formalized in recommendation Part A. The formalization and communication should include an organizationally defined, periodic review process of OIT’s Security Policies to ensure the Department’s IT policies, procedures, and rules are updated accordingly to align with the most current version of the Security Policies.

• Recommendation Part C—Formalizing a vendor management process that ensures the Department’s IT service providers are held accountable to contract provisions requiring compliance with Colorado Information Security Policies and IT policies and procedures formalized in recommendation Parts A and B. This should include a review of the Department’s current external IT service providers’ contracts and a determination of whether amendments to those contracts are necessary, based on the formalization of recommendation Parts A and B.

• Implementing recommendation Part D as noted in the confidential finding.

For Recommendation 2023-028, reprioritize staff, as applicable, to improve information security controls over CATS by:

• Implementing recommendation Part E as noted in the confidential finding.

• Implementing recommendation Part F as noted in the confidential finding.

Our audit work was performed through inquiries of Department management and staff and review of the supporting documentation.

What problems did the audit work identify and how were the results of the audit work measured?

During Fiscal Year 2024, we found that the Department did not fully implement our prior audit recommendations for MyUI+.

For Recommendation 2023-073, we noted the following for each recommendation:

• Recommendation Part A—Although the Department formally adopted OIT’s Security Policies as the Department’s IT policy framework and communicated the adoption to Department staff, this communication did not extend to or include its IT service providers.

• Recommendation Part B—Although the Department provided certain MyUI+ access control procedures, the Department stated that it had not yet formalized or drafted other standard operating procedures for MyUI+ to ensure alignment with the formally adopted IT policies noted in recommendation Part A. Also, although the Department drafted a review process for updating all IT policies, it did not formalize this or specify the frequency of the review.

The Green Book states in Principle 3.09, Documentation of Internal Control System, and 12.02, Documentation of Responsibilities through Policies, that management should develop and maintain documentation of its internal control system and document in policies the internal control responsibilities of the organization. Principles 11.06 and 11.07, Design Appropriate Types of Control Activities, states that management should design appropriate types of control activities in the entity’s information system, including information system general controls that facilitate the proper operation of the entity’s systems.

Security Policies that are developed, published, and required to be followed by the Department and its external IT service providers state within the Policy section and the General Responsibilities section, specifically 8.3.1 and 8.3.2 for business owners, that all agencies, except for the institutions of higher education and the general assembly, including the Department, each as the business owner, must implement governance principles, which would include IT policies and procedures, for promoting data quality and integrity for their systems, and they are responsible for following and adhering to all identified business owner requirements.

• Recommendation Part C—Although the Department formalized a vendor management process to ensure Department staff hold the Department’s IT service providers accountable to contract provisions requiring compliance with Security Policies and IT policies and procedures formalized in recommendation Parts A and B, the Department had not formalized procedures around contract reviews to determine whether amendments to those contracts are necessary. In addition, and as stated above in recommendation Part A, the Department also did not communicate the IT policy framework adoption to its IT service providers. Security Policies state that IT service providers—which are defined as OIT and/or external service providers—must follow the Security Policy requirements.

Exhibit C, Section 1.C.vi. (Information Technology Provisions, Protection of System Data) of the Department’s contract with the MyUI+ IT service provider stating that the contractor shall comply with all rules, policies, procedures, and standards issued by the Governor’s Office of Information Technology.

The Green Book states in Paragraph OV4.01, Service Organizations, that management retains responsibility for the performance of processes assigned to service organizations. Further, Principle 15.03, Communication with External Parties states, that management communicates quality information externally so that external parties, such as contractors or service providers, help the Department achieve its objectives and address related risks.

• Recommendation Part D—The Department did not fully implement the prior audit recommendation.

We measured the results of our work against Security Policies and the IRS’s Publication 1075, Tax Information Security Guidelines for Federal, State and Local Agencies November Revision.

For Recommendation 2023-028, we noted the following for each recommendation:

• Recommendation Part E—Although the Department and its external IT service provider had partially implemented the prior audit recommendation for MyUI+, no documentation was provided to verify that the Department and its external IT service provider formalized certain procedures associated with the confidential finding.

The Green Book states in Principles 11.06 and 11.07, Design Appropriate Types of Control Activities, that management should design appropriate types of control activities in the entity’s information system, including information system general controls that facilitate the proper operation of the entity’s systems.

Security Policies that are developed, published, and required to be followed by the Department and its external IT service providers state within the Policy section and the General Responsibilities section, specifically 8.3.1 and 8.3.2 for business owners, that all agencies, except for the institutions of higher education and the general assembly, including the Department, each as the business owner, must implement governance principles, which would include IT procedures, for promoting data quality and integrity for their systems, and they are responsible for following and adhering to all identified business owner requirements.

• Recommendation Part F—We found through our audit work on Recommendation 2023-073A-D and 2023-028E above that these prior recommendations were not fully implemented because the Department failed to fully comply with Security Policies and Publication 1075.

Why did these problems occur?

Department staff stated that they continue to work to implement prior audit Recommendation 2023-073. However, the Department did not provide specific reasons for why the prior audit recommendation has not been implemented for the second consecutive year, as the recommendation dates back to Fiscal Year 2022.

Department staff reported that the prior audit Recommendation 2023-028 is no longer valid because the Department misinterpreted our recommendations.

Why do these problems matter?

The lack of established IT policies and procedures make it difficult for Department management to measure and hold staff accountable to management’s expectations, as well as ensuring risks are addressed and overall objectives and missions are fulfilled. In turn, without policies and procedures, staff may not perform processes and controls in a consistent manner. In addition, without holding vendors accountable and ensuring that strong security controls are designed, implemented, and operating effectively, the risk of unauthorized access increases and ultimately, could impact data reliability of the data stored and processed within MyUI+. See Schedule of Findings and Questioned Costs for chart/table.

Recommendation 2024-047

The Department of Labor and Employment (Department) should improve its overall IT governance and information security IT general controls, and work with its IT service providers, as applicable, for the MyUI+ information system by:

A. Formalizing and communicating to the Department’s IT service providers the adoption of the Governor’s Office of Information Technology’s (OIT) Colorado Information Security Policies (Security Policies).

B. Continuing to formalize and communicate IT procedures to provide guidance to Department staff and the Department’s IT service providers performing IT general control activities that further address the IT policies formalized in recommendation Part A. The formalization and communication should include an organizationally defined, periodic review process of OIT’s Security Policies to ensure the Department’s IT policies, procedures, and rules are updated accordingly to align with the most current version of the Security Policies. In addition, the Department should work with its external IT service provider to formalize procedures as noted in recommendation Part B of the confidential finding for MyUI+.

C. Formalizing within the Department’s vendor management process a review of the Department’s current external IT service providers’ contracts and a process to determine whether amendments to those contracts are necessary, based on the formalization of recommendation Parts A and B.

D. Implementing recommendation Part D as noted in the confidential finding.

E. Accurately interpreting audit recommendations to ensure that management addresses them and the associated IT risks appropriately, in accordance with expectations and risk tolerance.

Response Department of Labor and Employment

A. Agree Implementation Date: March 2025

The Department agrees and will formally document/memorialize our processes and protocols to ensure the Department’s IT service providers are formally communicated the current Department IT policies and when the Department updates its IT policies, based on notifications from the Governor’s Office of Information Technology that Colorado Information Security Policies have been revised and published.

B. Agree Implementation Date: June 2025

The Department agrees and will formalize and communicate to Department staff the Department’s draft IT policy and procedures review process to ensure it defines that the review will occur on an annual basis and that the Department’s IT policies, procedures, and rules are updated accordingly to align with the most current version of the Colorado Information Security Policies. In addition, the Department will continue to formalize and communicate with Department staff and its IT service providers the IT procedures for MyUI+ that further implement Department IT policies, which will also include working with the MyUI+ IT service provider to formalize procedures noted in the confidential finding.

C. Agree Implementation Date: June 2025

The Department agrees and will formalize within our vendor management process a review of our current vendors/IT service providers’ contracts and determining whether amendments to those contracts are necessary, based on the formalization of recommendation Parts A and B.

D. Agree Implementation Date: June 2025

The Department agrees and will implement the recommendation as noted in the confidential finding.

E. Agree Implementation Date: June 2025

The Department agrees. The Department will ensure audit recommendations are accurately interpreted to ensure that management addresses them and the associated IT risks appropriately, in accordance with expectations and risk tolerance.

Finding 2024-048 Connecting Colorado—IT Governance and Information Security

Government Auditing Standards allow for information that is considered sensitive in nature, such as detailed information related to information technology system security, to be issued through a separate “classified or limited use” report because of the potential damage that could be caused by the misuse of this information. We consider the specific technical details of this finding, along with the response, to be sensitive in nature and not appropriate for public disclosure. Therefore, the details of the following finding and response have been provided to the Department in a separate, confidential memorandum.

The Department administers the federal Employment Service Cluster programs, and the Department relies on its IT system, Connecting Colorado, to aid with determining applicants’ eligibility for the program, and to provide information necessary to meet federal reporting requirements. The Department is the business owner and works with OIT and an external IT service provider to manage Connecting Colorado.

Connecting Colorado is the Department’s workforce case management, labor exchange, and federal reporting system that supports the Employment Service Cluster program. The system provides services for job seekers and businesses, as well as provides all required federal reporting to the U.S. Department of Labor, for the Employment Service Cluster programs.

In order for the Department to achieve its objectives and respond to risks, including those related to the federal programs it administers, management should establish a strong framework of internal controls that also address information system controls. Specifically, information system controls typically start with management documenting IT policies that address IT general control responsibilities and procedures that document the more granular details on how to implement Department policies. These IT general control policies and procedures should include those policies and procedures that are specific to information security. Once policies and procedures have been formalized and communicated to responsible staff, specific internal control activities can be implemented and operationalized.

What was the purpose of our audit work and what work was performed?

The purpose of our Fiscal Year 2024 audit work was to determine whether the Department implemented our Fiscal Year 2023 recommendations for Connecting Colorado. Specifically, at that time, we recommended that the Department should improve its overall IT governance and information security IT general controls, and work with its IT service provider for the Connecting Colorado system by:

• Recommendation Part A—Formalizing and communicating to Department staff and the Department’s IT service providers’ IT policies that comply with the business owner requirements listed within the OIT’s March 2022 Colorado Information Security Policies (Security Policies). As an option, the Department could formally adopt the October 2021 Security Policies, identify any gaps between the October 2021 and March 2022 versions, and then formalize and communicate policies that address the identified gaps.

• Recommendation Part B—Formalizing and communicating IT procedures to provide guidance to Department staff and the Department’s IT service providers performing IT general control activities that further address the IT policies formalized in recommendation Part A. The formalization and communication should include an organizationally defined, periodic review process of OIT’s Security Policies to ensure the Department’s IT policies, procedures, and rules are updated accordingly to align with the most current version of the Security Policies.

• Recommendation Part C—Formalizing a vendor management process that ensures the Department’s IT service providers are held accountable to contract provisions requiring compliance with Security Policies and IT policies and procedures formalized in recommendation Parts A and B. This should include a review of the Department’s current external IT service providers’ contracts and a determination of whether amendments to those contracts are necessary, based on the formalization of recommendation Parts A and B.

• Recommendation Part E—Implementing recommendation Part E as noted in the confidential finding.

Our audit work was performed through inquiries of Department management and staff and review of the supporting documentation.

What problems did the audit work identify and how were the results of the audit work measured?

During Fiscal Year 2024, we found that the Department did not fully implement our prior audit recommendations for Connecting Colorado. Specifically, we noted the following for each recommendation:

• Recommendation Part A—Although the Department formally adopted OIT’s Security Policies as the Department’s IT policy framework and communicated the adoption to Department staff, this communication did not extend to or include its Connecting Colorado IT service provider.

• Recommendation Part B—The Department stated that it had not yet formalized or drafted standard operating procedures for Connecting Colorado to ensure alignment with the formally adopted IT policies noted in recommendation Part A. Also, although the Department drafted a review process for updating all IT policies, it did not formalize this or specify the frequency of the review.

The Green Book states in Principle 3.09, Documentation of Internal Control System, and 12.02, Documentation of Responsibilities through Policies, that management should develop and maintain documentation of its internal control system and document in policies the internal control responsibilities of the organization. Principles 11.06 and 11.07, Design Appropriate Types of Control Activities, states that management should design appropriate types of control activities in the entity’s information system, including information system general controls that facilitate the proper operation of the entity’s systems.

Security Policies that are developed, published, and required to be followed by the Department and its external IT service providers state within the Policy section and the General Responsibilities section, specifically 8.3.1 and 8.3.2 for business owners, that all agencies, except for the institutions of higher education and the general assembly, including the Department, each as the business owner, must implement governance principles, which would include IT policies and procedures, for promoting data quality and integrity for their systems, and they are responsible for following and adhering to all identified business owner requirements.

• Recommendation Part C—Although the Department formalized a vendor management process to ensure Department staff hold the Department’s IT service providers accountable to contract provisions requiring compliance with Security Policies and IT policies and procedures formalized in recommendation Parts A and B, the Department had not formalized procedures around contract reviews to determine whether amendments to those contracts are necessary. In addition, and as stated above in recommendation Part A, the Department also did not communicate the IT policy framework adoption to its IT service providers.

Security Policies state that IT service providers—which are defined as OIT and/or external service providers—must follow the Security Policy requirements.

Section C.iii. (Legal Authority – Contractor Signatory, Information Technology Specific) of the Department’s contract with the Connecting Colorado IT service provider stating that the contractor warrants that it will at all times comply with all Security Policies.

The Green Book states in Paragraph OV4.01, Service Organizations, that management retains responsibility for the performance of processes assigned to service organizations. Further, Principle 15.03, Communication with External Parties states, that management communicates quality information externally so that external parties, such as contractors or service providers, help the Department achieve its objectives and address related risks.

• Recommendation Part E—The Department did not fully implement the prior year recommendation.

We measured our audit work against Security Policies.

Why did these problems occur?

Department staff stated that they continue to work to implement prior audit recommendations. However, the Department did not provide specific reasons for why the prior audit recommendation has not been implemented for the second consecutive year, as the recommendation dates back to Fiscal Year 2022.

Why do these problems matter?

The lack of established IT policies and procedures make it difficult for Department management to measure and hold staff accountable to management’s expectations, as well as ensuring risks are addressed and overall objectives and missions are fulfilled. In turn, without policies and procedures, staff may not perform processes and controls in a consistent manner. In addition, without holding vendors accountable and ensuring that strong security controls are designed, implemented, and operating effectively, the risk of unauthorized access increases and ultimately, could impact data reliability of the data stored and processed within Connecting Colorado.

See Schedule of Finding and Questioned Costs for chart/table.

Recommendation 2024-048

The Department of Labor and Employment (Department) should improve its overall IT governance and information security IT general controls, and work with its IT service provider, as applicable, for the Connecting Colorado information system by:

A. Formalizing and communicating to the Department’s IT service providers the adoption of the Governor’s Office of Information Technology’s (OIT) Colorado Information Security Policies (Security Policies).

B. Continuing to formalize and communicate IT procedures to provide guidance to Department staff and the Department’s IT service providers performing IT general control activities that further address the IT policies formalized in recommendation Part A. The formalization and communication should include an organizationally defined, periodic review process of OIT’s Security Policies to ensure the Department’s IT policies, procedures, and rules are updated accordingly to align with the most current version of the Security Policies.

C. Formalizing within the Department’s vendor management process a review of the Department’s current external IT service providers’ contracts and a process to determine whether amendments to those contracts are necessary, based on the formalization of recommendation Parts A and B.

D. Implementing recommendation Part D as noted within the confidential finding.

Response Department of Labor and Employment

A. Agree Implementation Date: March 2025

The Department agrees and will formally document/memorialize our processes and protocols to ensure the Department’s IT service providers are formally communicated the current Department IT policies and when the Department updates its IT policies, based on notifications from the Governor’s Office of Information Technology that Colorado Information Security Policies have been revised and published.

B. Agree Implementation Date: June 2025

The Department agrees and will formalize and communicate to Department staff the Department’s draft IT policy and procedures review process to ensure the process defines that the review will occur on an annual basis and that the Department’s IT policies, procedures, and rules are updated accordingly to align with the most current version of the Colorado Information Security Policies. In addition, the Department will continue to formalize and communicate with Department staff and its IT service providers the IT procedures for Connecting Colorado that further implement the Department’s IT policies.

C. Agree Implementation Date: June 2025

The Department agrees and will formalize within our vendor management process a review of our current vendors/IT service providers’ contracts and determining whether amendments to those contracts are necessary, based on the formalization of recommendation Parts A and B.

D. Agree Implementation Date: June 2025

The Department agrees and will implement the recommendation as noted in the confidential finding.

The following finding and recommendation relating to an internal control deficiency classified as a Material Weakness was communicated to the Department of Labor and Employment (Department) in the previous year and has not been remediated as of June 30, 2024 because the original implementation date provided by the Department was in a subsequent fiscal year. This complete finding and recommendation can be found within the original report and the complete recommendation can be found within Section IV: Prior Audit Recommendations of this report.

Finding 2023-071 Rehabilitation Services – Vocational Rehabilitation Grants to States—Federal Reporting

The Department is responsible for administering the federal Rehabilitation Services -Vocational Rehabilitation Grants to States (VR) program [ALN 84.126]. The program’s overall purpose is to assist individuals whose disabilities result in barriers to employment with attaining and maintaining employment. At any of the 25 field and satellite offices located throughout the State, rehabilitation counselors work with individuals to assess their needs and identify appropriate vocational rehabilitation services.

The Department’s Division of Vocational Rehabilitation (Division) is responsible for completing the RSA-17, Vocational Rehabilitation Financial Report, a quarterly, federally-required report for the VR program for all VR grants open during the fiscal year. It is also responsible for the data used to complete the reports and ensuring the reports are accurate, complete, and submitted to the federal government by the required deadline. The Department’s Finance Office provides the Division with reports from CORE and creates a workbook with the applicable financial information that the Division uses to complete the reports. Division staff run reports from its electronic case management system, the Accessible Web-Based Activity and Reporting Environment (AWARE)— the system Division program staff use to track expenditures—and use some of this information to help complete the reports. The Department had three open grants during Fiscal Year 2023 and was, therefore, required to submit one quarterly report for each grant for as long as the grant was open during the year, resulting in a total of 8 reports submitted during the fiscal year. During Fiscal Year 2023, the Department expended approximately $51.4 million for the VR program.

What was the purpose of our audit work and what work was performed?

The purpose of our audit work was to determine whether the Division had adequate internal controls in place over and complied with federal reporting requirements for the VR program during Fiscal Year 2023.

As part of our audit work, we gained an understanding of the Division’s procedures that were in place during Fiscal Year 2023 to prepare the federal reports. In addition, we reviewed four RSA-17 reports—two related to the quarter ended September 30, 2022 and two related to the quarter ended June 30, 2023—submitted to the federal government for Fiscal Year 2023 to ensure they were accurate, complete, and submitted by the required deadline. We also requested the Division’s policies and procedures related to RSA-17 report completion, as well as the supporting documentation for the reports we selected for testing.

How were the results of the audit work measured?

We measured the results of our audit against the following:

In accordance with federal regulation [2 CFR 200.303(a)], the Department, as a recipient of federal funds, must establish and maintain effective internal controls over its federal awards that provide reasonable assurance that the Department is managing its federal grants in compliance with federal statutes, regulations, and terms and conditions of the federal award.

In accordance with the Office of the State Controller’s policy, Internal Control System, state agencies shall use the Standards for Internal Control in the Federal Government (Green Book), published by the U.S. Government Accountability Office, as its framework for its system of internal control. Green Book, Paragraph OV4.08, Documentation Requirements, states that documentation is required for the effective design, implementation, and operating effectiveness of an entity’s internal control system. Green Book Paragraph 12.02, Documentation of Responsibilities through Policies, specifically indicates that management should document in their policies the internal control responsibilities of the organization.

The federal Rehabilitation Services Administration provides instructions for completing the RSA-17, as well as a template. The template provided in the instructions requires the Division to select the method of accounting used to prepare the reports, and requires the Division to maintain supporting documentation to substantiate the data reported in the report. The instructions also state that the Division is responsible for having internal controls necessary to ensure the reports are accurate and reliable.

What problems did the audit work identify?

We identified at least one issue with all four (100 percent) of the RSA-17 reports we tested. For example, the Division could not provide documentation to support information for a total of over $25 million in expenditures reported by the Division. Specifically, we found the following:

• Reports for the quarter ended September 30, 2022:

o For one report, the Division could not provide documentation to support information on the following two lines of the report:

 Administrative Expenditures—$21.5 million  American Job Center Infrastructure Expenditures—$467,083

o In the other report, the Division could not provide documentation to support a $3.1 million amount noted for the American Job Center Infrastructure Expenditures line on the report.

• Reports for the quarter ended June 30, 2023:

o In one report, the Division could not provide documentation for $7,315 of the $8.6 million reported in the Administrative Expenditures line. Additionally, it did not include $913,166 in expenditures from the month of June and, therefore, underreported, the following lines:

 Administrative Expenditures - Reported—The Division reported $8.6 million instead of the correct amount of $9.5 million.

 Expenditures incurred for the Provision of Pre-Employment Transition Services by Agency Staff Only - Reported—The Division reported $96,903 instead of the correct amount of $115,511.

o In the other report, the Division could not provide documentation for $22,707 of the $8.5 million reported in the Administrative Expenditures line.

Why did these problems occur?

The Division did not have sufficient internal controls in place to ensure that its federal RSA-17 reports were accurate and complete, and that the associated documentation was maintained during Fiscal Year 2023. Although the Division has a procedure document that provides instructions on how to complete the federal reports, the procedures do not include a requirement to reconcile information that Division program staff obtains from AWARE to CORE to ensure the expenditures agree in both systems and that any differences are identified and corrected, as appropriate. Additionally, the procedures do not include a requirement for a supervisory review of these reports prior to submitting them to the federal government. Some of the errors we identified were due to staff inputting the wrong information into the reports, which a review could have caught and corrected prior to submitting the report to the federal government.

Why do these problems matter?

Strong internal controls over federal reporting, including documented policies with adequate supervisory review, are necessary to ensure that the Department is in compliance with federal reporting requirements. Errors in the federal reports could cause report users to rely on incorrect information. This could have a negative impact on the Department’s future federal program funding.

Recommendation 2023-071

The Department of Labor and Employment’s (Department) Division of Vocational Rehabilitation (Division) should strengthen its internal controls over, and ensure compliance with, federal reporting for the Rehabilitation Services-Vocational Rehabilitation Grants to States program by developing, documenting, and implementing policies for completing its federal reports. These policies should require the Division to reconcile the expenditure information it uses from the Accessible Web-Based Activity and Reporting Environment (AWARE) system to the Colorado Operations Resource Engine (CORE) it receives from the Department’s Finance Section, and to ensure that a supervisory review occurs prior to submitting the reports to the federal government.

Response Department of Labor and Employment

Agree Implementation Date: October 2024

DVR is committed to collaborating with CDLE Finance to develop clear roles and responsibilities associated with the completion and submission of the RSA-17 report and further to develop the internal controls necessary to ensure the reports are compliant with all requirements, by developing, formally documenting, and implementing policies for completing its federal reports. These policies will require the Department to reconcile the expenditure information it uses from the Accessible Web-Based Activity and Reporting Environment (AWARE) system to the Colorado Operations Resource Engine (CORE), and will ensure that a supervisory review occurs prior to submitting the reports to the federal government.

Finding 2024-050 Compliance with Reporting for Section 8 Housing Choice Vouchers and Mainstream Vouchers

The Department is responsible for administering two programs as part of the Housing Voucher Cluster program (Program): Section 8 Housing Choice Vouchers [ALN 14.871] and Mainstream Vouchers [ALN 14.879]. The Department receives advance payments annually from the federal government for the Program to provide tenant-based subsidies for rent paid by low-income households. The Department pays a housing subsidy directly to a landlord on behalf of the Program’s participants. During Fiscal Year 2024, the Department expended approximately $97.9 million for the Program—$89.9 million for Section 8 Housing Choice Vouchers and $8.0 million for Mainstream Vouchers.

The Department submits financial information (financial report), audited and unaudited, prepared in accordance with Generally Accepted Accounting Principles (GAAP), electronically to Housing and Urban Development (HUD) through the Financial Assessment Sub-System (FASS-PH) on an annual basis. The FASS-PH system is one of HUD’s main monitoring and oversight systems for the Program.

What was the purpose of our audit work and what work was performed?

The purpose of our audit work was to determine whether the Department had effective internal controls over, and complied with, federal regulations for the Program’s financial reporting during Fiscal Year 2024.

As part of our audit work, we reviewed policies and procedures, and obtained the financial report (and supporting documentation for the financial report) that the Department submitted for Fiscal Year 2024. We tested the financial report to determine whether the Department submitted the financial report in a timely manner and in accordance with federal regulations.

How were the results of the audit work measured?

We measured the results of our audit work against the following requirements:

• Federal regulations [24 CFR 902.33(c)] require the Department to submit unaudited financial information to HUD annually, no later than 2 months after the Department’s fiscal year end, with no penalty applying until the 16th day of the third month after the Department’s fiscal year end. For the Department, the due date for the Fiscal Year 2024 unaudited financial information was August 31, 2024.

• Federal regulations [2 CFR 200.303] require the non-federal entity—in this instance the Department—to establish and maintain effective internal controls over the federal award that provides reasonable assurance that the non-federal entity is managing the federal award in compliance with federal statutes, regulations, and the terms and conditions of the federal award.

What problem did the audit work identify?

Based on our audit work, we determined that the Department was not in compliance with certain Fiscal Year 2024 federal reporting requirements. Specifically, the Department did not submit the required unaudited financial report to HUD until December 10, 2024—101 days after the due date.

Why did this problem occur?

The problem occurred because the Department does not have adequate internal controls over financial reporting for the Program. Specifically, the Department experienced turnover in some key accounting positions and did not cross-train other employees on how to complete the financial report. Additionally, the Department did not have documented policies and procedures to provide adequate guidance to Department staff for completing the financial report, along with submitting it on time to HUD.

Why does this problem matter?

By failing to properly submit federal reports to HUD in a timely manner, the Department may receive less federal funding for the Program. See Schedule of Finding and Questioned Costs for chart/table.

Recommendation 2024-050

The Department of Local Affairs (Department) should strengthen its internal controls over the Housing Voucher Cluster Program (Program) to ensure it complies with federal regulations and submits the Program’s financial report to the federal Department of Housing and Urban Development by the federally established due date by:

A. Creating, documenting, and implementing policies and procedures to provide adequate guidance to Department staff for completing the Program’s financial report.

B. Cross-training Department personnel on the completion of the financial report so that, in the event of staff turnover, controls will continue to operate as designed.

Response Department of Local Affairs

A. Agree Implementation Date: June 2025

The Department will ensure it complies with federal regulations by creating, documenting and implementing policies and procedures to provide adequate guidance to Department staff for completing the Program’s financial report.

B. Agree Implementation Date: June 2025

The Department will cross-train Department personnel on the completion of the financial report so that, in the event of staff turnover, controls will continue to operate as designed.

Findings 2024-051 and 2024-052 Compliance with Activities Allowed or Unallowed and Allowable Costs/Cost Principles for Disaster Grants

Following a presidential declaration of a major disaster or an emergency, the Federal Emergency Management Agency (FEMA) within the Department of Homeland Security, awards grants to assist state, local, tribal, and territorial governments (SLTT) and certain private nonprofit (PNP) entities to respond to and recover from disasters. The mission of FEMA’s Disaster Grants program is to provide assistance to SLTT governments and certain types of PNP organizations so that communities can quickly respond to and recover from major disasters or emergencies declared by the President. Through the Disaster Grants program, FEMA provides supplemental federal grant assistance for debris removal, emergency protective measures, and the restoration of disaster-damaged, publicly-owned facilities and specific facilities of certain PNP organizations. The Disaster Grants program also encourages protection of these damaged facilities from future incidents by providing assistance for hazard mitigation measures. FEMA provides this assistance based on authority in statutes, executive orders, regulations, and policies. The federal statute that authorizes FEMA to provide assistance via the Disaster Grants is the Robert T. Stafford Disaster Relief and Emergency Assistance Act, as Amended (Stafford Act), Title 42 of the United States Code (U.S.C.) § 5121 et seq.

For Fiscal Year 2024, the Department received funding through the following Disaster Grants federal awards:

• FEMA-4145-DR for the 2013 Severe Storms, Flooding, Landslides, and Mudslides • FEMA-4429-DR-CO for the 2015 Severe Storms, Tornadoes, Flooding, Landslides and Mudslides • FEMA-4498-DR for the COVID-19 incident • FEMA-4581-DR for the 2020 Wildfires incident • FEMA-4634-DR for the 2021 Wildfires and Straight-Line Winds incident • FEMA-4731 DR for the 2023 Severe Storms, Flooding and Tornadoes

The Department’s FEMA Disaster Grants program awards are on a reimbursement basis, which means the Department requests reimbursement from FEMA for approved allowable costs, even some of those that are passed on to other state agencies or departments. The Department’s accounting staff is responsible for all of the Department’s financial accounting and reporting, including the accurate and timely entry of financial transactions into the Colorado Operations Resource Engine (CORE), the State’s accounting system. The Department is also required to prepare its financial transactions in accordance with Generally Accepted Accounting Principles (GAAP). The Office of the State Controller (OSC) uses the financial transactions in CORE to prepare the State’s financial statements, which are also required to be prepared in accordance with GAAP. The Governmental Accounting Standards Board (GASB) establishes GAAP for state and local government entities through the issuance of GASB statements and authoritative accounting guidance such as GASB implementation guides, that the Department and the OSC must comply with when preparing financial transactions and statements.

The OSC has also established guidelines that require the Department to report its financial activities through forms, or exhibits, submitted to the OSC for inclusion in the State’s financial statements. The OSC collects the information from state departments and institutions of higher education through submitted exhibits to assist in its preparation of the State’s financial statements, required note disclosures, and the Schedule of Expenditures of Federal Awards (SEFA). The State is required to comply with the reporting requirements of Title 2 U.S. Code of Federal Regulations Part 200, Uniform Administrative Requirements, Cost Principles, and Audit Requirements for Federal Awards (Uniform Guidance) for the State’s SEFA. The federal Office of Management and Budget’s (OMB) Compliance Supplement is part of Uniform Guidance and provides some additional information required to be included on the SEFA. For SEFA reporting, the OSC requires that state departments and institutions of higher education prepare and submit an Exhibit K1, Schedule of Federal Assistance, after each fiscal year end to provide information on their federal expenditures for the OSC’s preparation of the State’s SEFA. The OSC specifies that expenditures of federal funds that are received by one state agency and passed on to another state agency for spending should typically be reported on the first department’s Exhibit K1. For example, the Department is required to report federal expenditures of FEMA Disaster Grants program funds that were passed by the Department to the Department of Public Health and Environment (CDPHE); this includes any expenditures that have been made by CDPHE but have not yet been reimbursed by the Department.

The Department’s FEMA Disaster Grants program awards included funding for the purpose of responding to the COVID-19 pandemic. A portion of expenditures recognized by the Department under this award in Fiscal Year 2024 were for expenditures incurred by CDPHE for responding to the COVID-19 pandemic. CDPHE submits FEMA Disaster Grants program expenditures information to the Department through a request for reimbursement, and the Department has policies and procedures to verify that CDPHE complied with all applicable rules and regulations and followed the scope of work, before it disburses reimbursement payments to CDPHE.

The point in time from when FEMA approves a project to when CDPHE requests reimbursement from the Department for CDPHE’s allowable expenditures may cross fiscal years, and during that time CDPHE may revise its previous specific identification of FEMA Disaster Grants program expenditures. Reasons for revising allowable expenditures may include not meeting FEMA’s specific documentation requirements or identifying additional allowable costs that were not previously identified. Therefore, it is important for both the Department and CDPHE to have processes in place to ensure that expenditures are reported in CORE and on the Department’s Exhibit K1 in the correct amount and year.

For Fiscal Year 2024, CDPHE provided the Department with transactional detail of cumulative-to-date FEMA Disaster Grants program expenditures that CDPHE incurred during prior fiscal years, as well as the current fiscal year, that had not yet been submitted for reimbursement through an interdepartmental transaction. Prior to Fiscal Year 2024, CDPHE only provided the Department summary-level detail of cumulative-to-date FEMA Disaster Grants program allowable expenditures that CDPHE incurred during prior fiscal years.

Department staff reviewed the transactional detail of cumulative-to-date FEMA Disaster Grants program expenditures that were incurred by CDPHE. Based on the June 30, 2024 inception-to-date transactional detail provided by CDPHE for unreimbursed FEMA Disaster Grants expenditures, the Department recognized an interdepartmental payable to CDPHE in CORE, along with the corresponding federal receivable. Additionally, the Department recognized the change in the CDPHE accrual from the prior fiscal year end—net of current year reimbursements to CPDHE—in CORE as federal expenditures and federal revenues for Fiscal Year 2024; specifically, the Department recorded $11.2 million in total Fiscal Year 2024 FEMA Disaster Grants program expenditures incurred and revenues earned by CDPHE. Overall, the change in the CDPHE accrual from the prior year end, represented a decrease of $90.2 million in expenditures and revenues, net of current year reimbursements to CDPHE of $101.4 million.

Ultimately, the Department is responsible for the appropriate review and approval of all federal FEMA expenditures within FEMA’s grant tracking software, EMGrants, and for appropriately reporting the FEMA Disaster Grants program expenditures on the Exhibit K1.

For Fiscal Year 2024, the Department reported $194.2 million in total FEMA Disaster Grants program expenditures. Of this amount, as noted above, $11.2 million (6 percent) of those program expenditures reported by the Department represented CDPHE’s FEMA Disaster Grants program expenditures during Fiscal Year 2024.

What was the purpose of our audit work and what work was performed?

The purpose of the audit work was to determine whether the Department complied with the FEMA Disaster Grants program requirements for incurring and recognizing allowable activities and allowable costs, and whether the Department had proper internal controls in place over the FEMA Disaster Grants program during Fiscal Year 2024. In addition, the purpose of our audit work was to review the Department’s internal controls over accounting for, and financial reporting of, the FEMA Disaster Grants program activities in CORE and the Department’s Exhibit K1, along with determining whether the Department complied with applicable accounting standards during Fiscal Year 2024.

Another purpose of our audit work was to determine whether the Department implemented our Fiscal Year 2023 audit recommendation to develop, document, and implement policies and procedures requiring Department staff to obtain and maintain sufficiently-detailed supporting documentation from CDPHE for CDPHE’s expenditure accrual of FEMA’s Disaster Grants program funds recorded by the Department—as well as requiring that Department staff have a monitoring and review process in place over CDPHE’s Disaster Grants program federal expenditures that are reported on the Exhibit K1. The Department planned to implement these recommendations by September 2024.

Further, the purpose of our audit work was to determine whether CDPHE implemented our Fiscal Year 2023 audit recommendation to ensure all Disaster Grants program expenditures are properly supported with appropriate documentation, and to expand CDPHE’s existing policies and procedures that staff must follow when reporting fiscal year Disaster Grants program expenditures to the Department—which the Department reports on the Department’s Exhibit K1 and reconciling interdepartmental reimbursements. Lastly, we recommended that CDPHE provide training to its staff responsible for the Disaster Grants program on the updated policies and procedures. CDPHE planned to implement these recommendations by June 2024.

As part of our audit work, we tested the Department’s and CDPHE’s progress on implementing our prior audit recommendations by reviewing their updated policies and procedures and training performed. Additionally, we obtained an understanding of the Department’s internal controls, including policies and procedures, related to account balances, financial processes, and fiscal year-end close processes for the Disaster Grants program. Specifically, we performed the following:

• Inquired of the Department to gain an understanding of its process for recognizing and reporting expenditures on its Exhibit K1, including the recognition of the FEMA Disaster Grants program expenditures incurred by CDPHE.

• Inquired of the Department personnel regarding their processes for determining allowability of the FEMA Disaster Grants program expenditures.

• Obtained and analyzed the Department’s summary-level expenditure transactions recorded in CORE that represented CDPHE’s expenditures of FEMA Disaster Grants program’s pass-through expenditures from the Department during the fiscal year, which totaled $11.2 million.

• Requested that the Department provide transactional level detail to support the $11.2 million in Fiscal Year 2024 FEMA Disaster Grants program’s pass-through expenditures at CDPHE that were reported by the Department on its Exhibit K1. In addition, we inquired whether and how the Department reconciled the Fiscal Year 2024 transactional data to CDPHE data to determine whether CDPHE FEMA Disaster Grants program expenditures were recognized for the proper amount and in the proper fiscal year on the Department’s Exhibit K1.

• Selected a sample of 70 of the Department’s FEMA Disaster Grants program expenditures, excluding CDPHE expenditures, totaling approximately $104.4 million, that the Department reported were incurred during Fiscal Year 2024, to test the Department’s internal controls and compliance. We performed testing on the 70 expenditures to determine whether the expenditures were made in accordance with FEMA’s Disaster Grants program requirements.

How were the results of the audit work measured?

We measured the results of our audit work against the following requirements:

• The OSC’s Fiscal Procedures Manual, Chapter 1, Section 3.3, State of Colorado Accounting Organization Objectives, states that one of the objectives of the State of Colorado reporting includes “maintaining accounting records in accordance with Generally Accepted Accounting Principles (GAAP) and in compliance with Governmental Accounting Standards Board (GASB) pronouncements.”

• State Fiscal Rule 1-1 (6.5), Internal Controls, requires that state agencies “implement internal accounting and administrative controls that reasonably ensure that financial transactions are accurate, reliable, conform to the Fiscal Rules, and reflect the underlying realities of the accounting transaction (substance rather than form).” For example, internal accounting and administrative controls include periodic staff training on fiscal year-end accounting processes, development of procedures, and implementation of new governmental accounting standards.

• The OSC has adopted the Standards for Internal Control in the Federal Government (Green Book), published by the U.S. Government Accountability Office, as the State’s standard for internal controls, which all state agencies must follow. Green Book, Paragraph OV2.14, Roles in an Internal Control System, states that management is responsible for designing an internal control system which includes controls over the preparation of financial reporting in accordance with professional standards and applicable laws and regulations.

• Federal regulations [2 CFR 200.303] require the Department to establish and maintain effective internal controls over federal awards that provide reasonable assurance that the Department is managing its federal awards in compliance with federal statutes, regulations, and the terms and conditions of the federal award.

• Federal regulations [2 CFR 200.334] require the Department to keep all financial records and supporting documentation pertinent to a federal award for a minimum period of 3 years from the date of submission of the final expenditures report.

• Federal regulations [2 CFR 200.403(g)] require that costs be adequately documented.

• The 2024 OMB Compliance Supplement requires FEMA Disaster Grants program expenditures to be reported on the SEFA when (1) FEMA has approved the project and (2) eligible expenditures have been incurred.

What problems did the audit work identify? Based on our audit work, we determined that the Department and CDPHE did not fully implement our Fiscal Year 2023 recommendations by their planned implementation dates of June 2024 and September 2024. While the Department and CDPHE improved their processes for reconciling the June 2024 interdepartmental accrual for cumulative to date Disaster Grants program federal expenditures, we determined that the Department and CDPHE did not comply with applicable state and federal regulations during Fiscal Year 2024. Specifically,

• The Department could not provide sufficient supporting documentation for $11.1 million of the $11.2 million (99 percent) in FEMA Disaster Grants program fund expenditures that it reported on its Exhibit K1 that represented CDPHE expenditures during the fiscal year. Department staff indicated that CDPHE did not provide the Department with adequate transactional detail to support CDPHE’s pass-through expenditures incurred for the program for Fiscal Year 2024. As a result, the Department relied on other data, including the amount of the total change in the interdepartmental payable to CDPHE for program expenditures and current year reimbursements to CDPHE, as the basis for its Exhibit K1 reporting.

• Additionally, we identified an issue with 1 of the 70 (1 percent) expenditures reported on the Department’s Exhibit K1 that we selected for testing. Specifically, the Department incorrectly recorded and paid a federal expenditure in the amount of $1,488,695 instead of the correct amount of $1,448,695. As a result of the overpayment, the Department also overstated the total FEMA Disaster Grants program expenditures on its Exhibit K1 and was required to adjust this total from $194,279,466 to $194,239,466, which resulted in known questioned costs of $40,000. The Department corrected the error after we notified them of the issue we identified.

Why did these problems occur?

These problems occurred because the Department did not fully implement our prior audit recommendations. The Department and CDPHE were unable to sufficiently reconcile and verify CDPHE’s Fiscal Year 2024 federal expenditures because of the length of time that the grant has been effective and insufficient financial records from prior fiscal years that were not available. Rather, the Department and CDPHE placed more reliance on reconciling the current year reimbursements and the June 30, 2024 inception-to-date unreimbursed expenditures. The Department did enhance its communication with CDPHE surrounding the necessary detail for the year-end accrual reconciliation as of June 30, 2024; however, these additional communications did not sufficiently address the proper recording and reporting of Fiscal Year 2024 CDPHE FEMA Disaster Grants program expenditures on the Department’s Exhibit K1.

We also found that while CDPHE developed and implemented procedures and provided training to its staff, those procedures did not sufficiently address the proper reconciliation of Fiscal Year 2024 CDPHE FEMA Disaster Grants program expenditures. CDPHE staff stated that they experienced turnover during the fiscal year, which resulted in the inability for CDPHE staff to properly identify individual transactions that made up the prior fiscal year’s—Fiscal Year 2023’s—unreimbursed expenditures. As a result of not being able to identify individual transactions that made up the prior Fiscal Year 2023’s unreimbursed expenditures, CDPHE staff were unable to identify Fiscal Year 2024 expenditures because they could not determine whether any of the reimbursements received in Fiscal Year 2024 were for expenditures included in the prior fiscal-year accrual, whether any prior fiscal year accrued expenditures were reclassified to a non-FEMA Disaster Grant program expenditure, or whether any prior fiscal year expenditures were identified as being eligible for the FEMA Disaster Grant program in the current fiscal year.

Additionally, the Department did not reconcile the Fiscal Year 2024 CDPHE requests for reimbursement of the FEMA Disaster Grants program’s expenditures against transactions that were included in Fiscal Year 2023’s or other prior year’s expenditures to ensure the expenditures were reported in the appropriate fiscal year. As a result of the lack of reconciliation of current year expenditures, we were unable to determine the full extent to which the Department’s FEMA Disaster Grants program expenditures in CORE or on the Exhibit K1 ultimately were overstated or understated.

Lastly, the overpayment of expenditures was the result of a data entry error by the Department’s staff when processing the payment.

Why do these problems matter?

Without adequate internal controls in place over compliance with the FEMA Disaster Grants program requirements—including an appropriate reconciliation and review of allowable expenditures—the Department and CDPHE could be out of compliance with federal allowable cost requirements, which may result in the federal oversight agency relying on incorrect data reported in the State’s SEFA.

Further, failure to properly reconcile and report expenditures on the Department’s Exhibit K1, if uncorrected, could cause the State’s SEFA to be inaccurate and the Department to be out of compliance with federal reporting requirements.

Lastly, federal funds that are misapplied or used for unallowable purposes could be subject to repayment by the Department to the federal granting agency.

See Schedule of Finding and Questioned Costs for chart/table.

Recommendation 2024-051

The Department of Public Safety (Department) should strengthen its internal controls over the Federal Emergency Management Agency (FEMA) Disaster Grants program funds, including financial accounting and reporting on its annual Exhibit K1, Schedule of Federal Assistance, by:

A. Continuing to develop, document, and implement policies and procedures to require that Department staff obtain and maintain sufficiently-detailed supporting documentation from the Department of Public Health and Environment (CDPHE) for CDPHE’s expenditure of FEMA’s Disaster Grants program funds by fiscal year recorded by the Department and perform reconciliations of the information to underlying transactional data on a go-forward basis. This should include requiring that Department staff complete a reconciliation on at least an annual basis of detailed amounts of interagency expenditures reported on the Exhibit K1 for the fiscal year, including expenditures incurred by CDPHE but not yet reimbursed by the Department as of fiscal year end; reimbursement amounts requested by CDPHE from the Department for the FEMA Disaster Grants program during the year; and reimbursement payments made by the Department to CDPHE during the year. The Department should also resolve any reconciling differences prior to submitting the Exhibit K1 to the Office of the State Controller.

B. Continuing to develop, document, and implement policies and procedures to require that Department staff have a monitoring and review process in place over CDPHE’s Disaster Grants program federal expenditures that are reported on the Exhibit K1 in order to verify that expenditures are reported in the proper period and incurred under an approved project, and that expenditures are allowable under the federal program.

C. Sufficiently reviewing supporting documentation when approving transactions for payment to ensure the review identifies any data entry errors.

Response Department of Public Safety

A. Agree Implementation Date: June 2025

We have developed procedures requiring adequate and detailed support be received before recording interagency accruals. We will continue to apply those procedures and will continue to reconcile any new interagency expenditures prior to reporting on the K1.

B. Agree Implementation Date: June 2025

We have developed procedures to requiring adequate and detailed support is received before recording interagency accruals. We will continue to apply those procedures and will continue to review expenditures to ensure they are reported in the proper period on the K1. We will review a sample of accrual expenditure details to verify expenditures are allowable under the federal program.

C. Agree Implementation Date: June 2025

We will work with staff to remind them the importance of thorough reviews to ensure transactional accuracy. We will ensure desk procedures include adequate review steps.

Recommendation 2024-052

The Colorado Department of Public Health and Environment (CDPHE) should improve its internal controls over Federal Emergency Management Agency (FEMA) Disaster Grants program expenditures and ensure that all FEMA Disaster Grants program expenditures reported to the Department of Public Safety for reporting on the Department of Public Safety’s Exhibit K1, Schedule of Federal Assistance, are accurately supported by continuing to develop, document, and implement policies and procedures to require that CDPHE staff obtain and maintain sufficiently-detailed supporting documentation for CDPHE’s expenditure of FEMA’s Disaster Grants program funds by fiscal year and perform reconciliations of the information to underlying transactional data on a go-forward basis. This should include requiring that CDPHE staff complete a full reconciliation on at least an annual basis of detailed amounts reported as FEMA Disaster Grants program expenditures for the fiscal year, including expenditures incurred but not yet reimbursed by the Department of Public Safety as of fiscal year end; reimbursement amounts requested by CDPHE from the Department of Public Safety for the FEMA Disaster Grants program during the year; and reimbursement payments received by the CDPHE from the Department of Public Safety during the year. CDPHE should also resolve any reconciling differences prior to reporting CDPHE FEMA Disaster Grants program expenditures to the Department of Public Safety.

Response Department of Public Health and Environment

Partially Agree Implementation Date: September 2025

CDPHE fully implemented the FY23 audit recommendation as written and updated our processes in conjunction with CDPS to ensure proper documentation was obtained for all claims in FY24. CDPHE and CDPS met regularly through FY24 to discuss these updates and verified every invoice processed with the applicable backup. CDPHE does not charge or draw any funds from CDPS until approval is received regarding FEMA eligibility. Copies of these approvals are included every time CDPHE draws funds from CDPS.

The FY23 audit finding was related to the CDPHE year-end estimate to CDPS since CDPHE was not able to provide all needed supporting documentation to fully justify it. For FY24, instead of using an estimate, we based the FY24 accruals on approvals that were not paid during FY24, so were able to tie this out completely.

For actual reimbursement FY24 requests, we tied out all expenses related to each reimbursement request. The procedure documentation was updated to reflect these new processes. Going forward, we are continuing to follow the same updated procedures to ensure that future reimbursement requests are accurate and have appropriate documentation attached. CDPHE verified that the amount listed was only reported on the CDPS K1 and not on both agencies K1s.

To reflect the new addition on the FY24 recommendation, CDPHE has updated our procedures to add the full fiscal year reconciliation at the end of each fiscal year for all federal expenses, including expenditures incurred but not yet reimbursed by CDPS as of fiscal year-end, reimbursement requested by CDPHE from CDPS, reimbursements received by CDPHE during the fiscal year, and a resolution for any reconciling differences.

Auditor’s Addendum

As noted in the finding, we found that CDPHE did not fully implement the Fiscal Year 2023 recommendation and could not provide sufficient support for $11.1 million of the Fiscal Year 2024 FEMA Disaster Grant expenditures reported on the Department of Public Safety’s Exhibit K1. CDPHE should ensure it maintains complete documentation for its FEMA Disaster Grant expenditures and that it completes a reconciliation on an annual basis of the detailed amounts reported as FEMA Disaster Grants program expenditures for the fiscal year.

During Fiscal Year 2024, we conducted audit work that resulted in a finding and recommendation addressed jointly to the Department and the Department of Public Safety related to internal controls over the Department of Public Safety’s Federal Emergency Management Agency (FEMA) Disaster Grants program. Expenditures for this program are partially comprised of Department expenditures that are submitted to the Department of Public Safety through interdepartmental transactions and requests for reimbursement. This finding and recommendation, and the responses of these agencies, are included within the Department of Public Safety’s chapter within Section III: Federal Awards Findings of this report. See Recommendation 2024-052.

This recommendation is classified as a Material Weakness.

Findings 2024-051 and 2024-052 Compliance with Activities Allowed or Unallowed and Allowable Costs/Cost Principles for Disaster Grants

Following a presidential declaration of a major disaster or an emergency, the Federal Emergency Management Agency (FEMA) within the Department of Homeland Security, awards grants to assist state, local, tribal, and territorial governments (SLTT) and certain private nonprofit (PNP) entities to respond to and recover from disasters. The mission of FEMA’s Disaster Grants program is to provide assistance to SLTT governments and certain types of PNP organizations so that communities can quickly respond to and recover from major disasters or emergencies declared by the President. Through the Disaster Grants program, FEMA provides supplemental federal grant assistance for debris removal, emergency protective measures, and the restoration of disaster-damaged, publicly-owned facilities and specific facilities of certain PNP organizations. The Disaster Grants program also encourages protection of these damaged facilities from future incidents by providing assistance for hazard mitigation measures. FEMA provides this assistance based on authority in statutes, executive orders, regulations, and policies. The federal statute that authorizes FEMA to provide assistance via the Disaster Grants is the Robert T. Stafford Disaster Relief and Emergency Assistance Act, as Amended (Stafford Act), Title 42 of the United States Code (U.S.C.) § 5121 et seq.

For Fiscal Year 2024, the Department received funding through the following Disaster Grants federal awards:

• FEMA-4145-DR for the 2013 Severe Storms, Flooding, Landslides, and Mudslides • FEMA-4429-DR-CO for the 2015 Severe Storms, Tornadoes, Flooding, Landslides and Mudslides • FEMA-4498-DR for the COVID-19 incident • FEMA-4581-DR for the 2020 Wildfires incident • FEMA-4634-DR for the 2021 Wildfires and Straight-Line Winds incident • FEMA-4731 DR for the 2023 Severe Storms, Flooding and Tornadoes

The Department’s FEMA Disaster Grants program awards are on a reimbursement basis, which means the Department requests reimbursement from FEMA for approved allowable costs, even some of those that are passed on to other state agencies or departments. The Department’s accounting staff is responsible for all of the Department’s financial accounting and reporting, including the accurate and timely entry of financial transactions into the Colorado Operations Resource Engine (CORE), the State’s accounting system. The Department is also required to prepare its financial transactions in accordance with Generally Accepted Accounting Principles (GAAP). The Office of the State Controller (OSC) uses the financial transactions in CORE to prepare the State’s financial statements, which are also required to be prepared in accordance with GAAP. The Governmental Accounting Standards Board (GASB) establishes GAAP for state and local government entities through the issuance of GASB statements and authoritative accounting guidance such as GASB implementation guides, that the Department and the OSC must comply with when preparing financial transactions and statements.

The OSC has also established guidelines that require the Department to report its financial activities through forms, or exhibits, submitted to the OSC for inclusion in the State’s financial statements. The OSC collects the information from state departments and institutions of higher education through submitted exhibits to assist in its preparation of the State’s financial statements, required note disclosures, and the Schedule of Expenditures of Federal Awards (SEFA). The State is required to comply with the reporting requirements of Title 2 U.S. Code of Federal Regulations Part 200, Uniform Administrative Requirements, Cost Principles, and Audit Requirements for Federal Awards (Uniform Guidance) for the State’s SEFA. The federal Office of Management and Budget’s (OMB) Compliance Supplement is part of Uniform Guidance and provides some additional information required to be included on the SEFA. For SEFA reporting, the OSC requires that state departments and institutions of higher education prepare and submit an Exhibit K1, Schedule of Federal Assistance, after each fiscal year end to provide information on their federal expenditures for the OSC’s preparation of the State’s SEFA. The OSC specifies that expenditures of federal funds that are received by one state agency and passed on to another state agency for spending should typically be reported on the first department’s Exhibit K1. For example, the Department is required to report federal expenditures of FEMA Disaster Grants program funds that were passed by the Department to the Department of Public Health and Environment (CDPHE); this includes any expenditures that have been made by CDPHE but have not yet been reimbursed by the Department.

The Department’s FEMA Disaster Grants program awards included funding for the purpose of responding to the COVID-19 pandemic. A portion of expenditures recognized by the Department under this award in Fiscal Year 2024 were for expenditures incurred by CDPHE for responding to the COVID-19 pandemic. CDPHE submits FEMA Disaster Grants program expenditures information to the Department through a request for reimbursement, and the Department has policies and procedures to verify that CDPHE complied with all applicable rules and regulations and followed the scope of work, before it disburses reimbursement payments to CDPHE.

The point in time from when FEMA approves a project to when CDPHE requests reimbursement from the Department for CDPHE’s allowable expenditures may cross fiscal years, and during that time CDPHE may revise its previous specific identification of FEMA Disaster Grants program expenditures. Reasons for revising allowable expenditures may include not meeting FEMA’s specific documentation requirements or identifying additional allowable costs that were not previously identified. Therefore, it is important for both the Department and CDPHE to have processes in place to ensure that expenditures are reported in CORE and on the Department’s Exhibit K1 in the correct amount and year.

For Fiscal Year 2024, CDPHE provided the Department with transactional detail of cumulative-to-date FEMA Disaster Grants program expenditures that CDPHE incurred during prior fiscal years, as well as the current fiscal year, that had not yet been submitted for reimbursement through an interdepartmental transaction. Prior to Fiscal Year 2024, CDPHE only provided the Department summary-level detail of cumulative-to-date FEMA Disaster Grants program allowable expenditures that CDPHE incurred during prior fiscal years.

Department staff reviewed the transactional detail of cumulative-to-date FEMA Disaster Grants program expenditures that were incurred by CDPHE. Based on the June 30, 2024 inception-to-date transactional detail provided by CDPHE for unreimbursed FEMA Disaster Grants expenditures, the Department recognized an interdepartmental payable to CDPHE in CORE, along with the corresponding federal receivable. Additionally, the Department recognized the change in the CDPHE accrual from the prior fiscal year end—net of current year reimbursements to CPDHE—in CORE as federal expenditures and federal revenues for Fiscal Year 2024; specifically, the Department recorded $11.2 million in total Fiscal Year 2024 FEMA Disaster Grants program expenditures incurred and revenues earned by CDPHE. Overall, the change in the CDPHE accrual from the prior year end, represented a decrease of $90.2 million in expenditures and revenues, net of current year reimbursements to CDPHE of $101.4 million.

Ultimately, the Department is responsible for the appropriate review and approval of all federal FEMA expenditures within FEMA’s grant tracking software, EMGrants, and for appropriately reporting the FEMA Disaster Grants program expenditures on the Exhibit K1.

For Fiscal Year 2024, the Department reported $194.2 million in total FEMA Disaster Grants program expenditures. Of this amount, as noted above, $11.2 million (6 percent) of those program expenditures reported by the Department represented CDPHE’s FEMA Disaster Grants program expenditures during Fiscal Year 2024.

What was the purpose of our audit work and what work was performed?

The purpose of the audit work was to determine whether the Department complied with the FEMA Disaster Grants program requirements for incurring and recognizing allowable activities and allowable costs, and whether the Department had proper internal controls in place over the FEMA Disaster Grants program during Fiscal Year 2024. In addition, the purpose of our audit work was to review the Department’s internal controls over accounting for, and financial reporting of, the FEMA Disaster Grants program activities in CORE and the Department’s Exhibit K1, along with determining whether the Department complied with applicable accounting standards during Fiscal Year 2024.

Another purpose of our audit work was to determine whether the Department implemented our Fiscal Year 2023 audit recommendation to develop, document, and implement policies and procedures requiring Department staff to obtain and maintain sufficiently-detailed supporting documentation from CDPHE for CDPHE’s expenditure accrual of FEMA’s Disaster Grants program funds recorded by the Department—as well as requiring that Department staff have a monitoring and review process in place over CDPHE’s Disaster Grants program federal expenditures that are reported on the Exhibit K1. The Department planned to implement these recommendations by September 2024.

Further, the purpose of our audit work was to determine whether CDPHE implemented our Fiscal Year 2023 audit recommendation to ensure all Disaster Grants program expenditures are properly supported with appropriate documentation, and to expand CDPHE’s existing policies and procedures that staff must follow when reporting fiscal year Disaster Grants program expenditures to the Department—which the Department reports on the Department’s Exhibit K1 and reconciling interdepartmental reimbursements. Lastly, we recommended that CDPHE provide training to its staff responsible for the Disaster Grants program on the updated policies and procedures. CDPHE planned to implement these recommendations by June 2024.

As part of our audit work, we tested the Department’s and CDPHE’s progress on implementing our prior audit recommendations by reviewing their updated policies and procedures and training performed. Additionally, we obtained an understanding of the Department’s internal controls, including policies and procedures, related to account balances, financial processes, and fiscal year-end close processes for the Disaster Grants program. Specifically, we performed the following:

• Inquired of the Department to gain an understanding of its process for recognizing and reporting expenditures on its Exhibit K1, including the recognition of the FEMA Disaster Grants program expenditures incurred by CDPHE.

• Inquired of the Department personnel regarding their processes for determining allowability of the FEMA Disaster Grants program expenditures.

• Obtained and analyzed the Department’s summary-level expenditure transactions recorded in CORE that represented CDPHE’s expenditures of FEMA Disaster Grants program’s pass-through expenditures from the Department during the fiscal year, which totaled $11.2 million.

• Requested that the Department provide transactional level detail to support the $11.2 million in Fiscal Year 2024 FEMA Disaster Grants program’s pass-through expenditures at CDPHE that were reported by the Department on its Exhibit K1. In addition, we inquired whether and how the Department reconciled the Fiscal Year 2024 transactional data to CDPHE data to determine whether CDPHE FEMA Disaster Grants program expenditures were recognized for the proper amount and in the proper fiscal year on the Department’s Exhibit K1.

• Selected a sample of 70 of the Department’s FEMA Disaster Grants program expenditures, excluding CDPHE expenditures, totaling approximately $104.4 million, that the Department reported were incurred during Fiscal Year 2024, to test the Department’s internal controls and compliance. We performed testing on the 70 expenditures to determine whether the expenditures were made in accordance with FEMA’s Disaster Grants program requirements.

How were the results of the audit work measured?

We measured the results of our audit work against the following requirements:

• The OSC’s Fiscal Procedures Manual, Chapter 1, Section 3.3, State of Colorado Accounting Organization Objectives, states that one of the objectives of the State of Colorado reporting includes “maintaining accounting records in accordance with Generally Accepted Accounting Principles (GAAP) and in compliance with Governmental Accounting Standards Board (GASB) pronouncements.”

• State Fiscal Rule 1-1 (6.5), Internal Controls, requires that state agencies “implement internal accounting and administrative controls that reasonably ensure that financial transactions are accurate, reliable, conform to the Fiscal Rules, and reflect the underlying realities of the accounting transaction (substance rather than form).” For example, internal accounting and administrative controls include periodic staff training on fiscal year-end accounting processes, development of procedures, and implementation of new governmental accounting standards.

• The OSC has adopted the Standards for Internal Control in the Federal Government (Green Book), published by the U.S. Government Accountability Office, as the State’s standard for internal controls, which all state agencies must follow. Green Book, Paragraph OV2.14, Roles in an Internal Control System, states that management is responsible for designing an internal control system which includes controls over the preparation of financial reporting in accordance with professional standards and applicable laws and regulations.

• Federal regulations [2 CFR 200.303] require the Department to establish and maintain effective internal controls over federal awards that provide reasonable assurance that the Department is managing its federal awards in compliance with federal statutes, regulations, and the terms and conditions of the federal award.

• Federal regulations [2 CFR 200.334] require the Department to keep all financial records and supporting documentation pertinent to a federal award for a minimum period of 3 years from the date of submission of the final expenditures report.

• Federal regulations [2 CFR 200.403(g)] require that costs be adequately documented.

• The 2024 OMB Compliance Supplement requires FEMA Disaster Grants program expenditures to be reported on the SEFA when (1) FEMA has approved the project and (2) eligible expenditures have been incurred.

What problems did the audit work identify? Based on our audit work, we determined that the Department and CDPHE did not fully implement our Fiscal Year 2023 recommendations by their planned implementation dates of June 2024 and September 2024. While the Department and CDPHE improved their processes for reconciling the June 2024 interdepartmental accrual for cumulative to date Disaster Grants program federal expenditures, we determined that the Department and CDPHE did not comply with applicable state and federal regulations during Fiscal Year 2024. Specifically,

• The Department could not provide sufficient supporting documentation for $11.1 million of the $11.2 million (99 percent) in FEMA Disaster Grants program fund expenditures that it reported on its Exhibit K1 that represented CDPHE expenditures during the fiscal year. Department staff indicated that CDPHE did not provide the Department with adequate transactional detail to support CDPHE’s pass-through expenditures incurred for the program for Fiscal Year 2024. As a result, the Department relied on other data, including the amount of the total change in the interdepartmental payable to CDPHE for program expenditures and current year reimbursements to CDPHE, as the basis for its Exhibit K1 reporting.

• Additionally, we identified an issue with 1 of the 70 (1 percent) expenditures reported on the Department’s Exhibit K1 that we selected for testing. Specifically, the Department incorrectly recorded and paid a federal expenditure in the amount of $1,488,695 instead of the correct amount of $1,448,695. As a result of the overpayment, the Department also overstated the total FEMA Disaster Grants program expenditures on its Exhibit K1 and was required to adjust this total from $194,279,466 to $194,239,466, which resulted in known questioned costs of $40,000. The Department corrected the error after we notified them of the issue we identified.

Why did these problems occur?

These problems occurred because the Department did not fully implement our prior audit recommendations. The Department and CDPHE were unable to sufficiently reconcile and verify CDPHE’s Fiscal Year 2024 federal expenditures because of the length of time that the grant has been effective and insufficient financial records from prior fiscal years that were not available. Rather, the Department and CDPHE placed more reliance on reconciling the current year reimbursements and the June 30, 2024 inception-to-date unreimbursed expenditures. The Department did enhance its communication with CDPHE surrounding the necessary detail for the year-end accrual reconciliation as of June 30, 2024; however, these additional communications did not sufficiently address the proper recording and reporting of Fiscal Year 2024 CDPHE FEMA Disaster Grants program expenditures on the Department’s Exhibit K1.

We also found that while CDPHE developed and implemented procedures and provided training to its staff, those procedures did not sufficiently address the proper reconciliation of Fiscal Year 2024 CDPHE FEMA Disaster Grants program expenditures. CDPHE staff stated that they experienced turnover during the fiscal year, which resulted in the inability for CDPHE staff to properly identify individual transactions that made up the prior fiscal year’s—Fiscal Year 2023’s—unreimbursed expenditures. As a result of not being able to identify individual transactions that made up the prior Fiscal Year 2023’s unreimbursed expenditures, CDPHE staff were unable to identify Fiscal Year 2024 expenditures because they could not determine whether any of the reimbursements received in Fiscal Year 2024 were for expenditures included in the prior fiscal-year accrual, whether any prior fiscal year accrued expenditures were reclassified to a non-FEMA Disaster Grant program expenditure, or whether any prior fiscal year expenditures were identified as being eligible for the FEMA Disaster Grant program in the current fiscal year.

Additionally, the Department did not reconcile the Fiscal Year 2024 CDPHE requests for reimbursement of the FEMA Disaster Grants program’s expenditures against transactions that were included in Fiscal Year 2023’s or other prior year’s expenditures to ensure the expenditures were reported in the appropriate fiscal year. As a result of the lack of reconciliation of current year expenditures, we were unable to determine the full extent to which the Department’s FEMA Disaster Grants program expenditures in CORE or on the Exhibit K1 ultimately were overstated or understated.

Lastly, the overpayment of expenditures was the result of a data entry error by the Department’s staff when processing the payment.

Why do these problems matter?

Without adequate internal controls in place over compliance with the FEMA Disaster Grants program requirements—including an appropriate reconciliation and review of allowable expenditures—the Department and CDPHE could be out of compliance with federal allowable cost requirements, which may result in the federal oversight agency relying on incorrect data reported in the State’s SEFA.

Further, failure to properly reconcile and report expenditures on the Department’s Exhibit K1, if uncorrected, could cause the State’s SEFA to be inaccurate and the Department to be out of compliance with federal reporting requirements.

Lastly, federal funds that are misapplied or used for unallowable purposes could be subject to repayment by the Department to the federal granting agency.

See Schedule of Finding and Questioned Costs for chart/table.

Recommendation 2024-051

The Department of Public Safety (Department) should strengthen its internal controls over the Federal Emergency Management Agency (FEMA) Disaster Grants program funds, including financial accounting and reporting on its annual Exhibit K1, Schedule of Federal Assistance, by:

A. Continuing to develop, document, and implement policies and procedures to require that Department staff obtain and maintain sufficiently-detailed supporting documentation from the Department of Public Health and Environment (CDPHE) for CDPHE’s expenditure of FEMA’s Disaster Grants program funds by fiscal year recorded by the Department and perform reconciliations of the information to underlying transactional data on a go-forward basis. This should include requiring that Department staff complete a reconciliation on at least an annual basis of detailed amounts of interagency expenditures reported on the Exhibit K1 for the fiscal year, including expenditures incurred by CDPHE but not yet reimbursed by the Department as of fiscal year end; reimbursement amounts requested by CDPHE from the Department for the FEMA Disaster Grants program during the year; and reimbursement payments made by the Department to CDPHE during the year. The Department should also resolve any reconciling differences prior to submitting the Exhibit K1 to the Office of the State Controller.

B. Continuing to develop, document, and implement policies and procedures to require that Department staff have a monitoring and review process in place over CDPHE’s Disaster Grants program federal expenditures that are reported on the Exhibit K1 in order to verify that expenditures are reported in the proper period and incurred under an approved project, and that expenditures are allowable under the federal program.

C. Sufficiently reviewing supporting documentation when approving transactions for payment to ensure the review identifies any data entry errors.

Response Department of Public Safety

A. Agree Implementation Date: June 2025

We have developed procedures requiring adequate and detailed support be received before recording interagency accruals. We will continue to apply those procedures and will continue to reconcile any new interagency expenditures prior to reporting on the K1.

B. Agree Implementation Date: June 2025

We have developed procedures to requiring adequate and detailed support is received before recording interagency accruals. We will continue to apply those procedures and will continue to review expenditures to ensure they are reported in the proper period on the K1. We will review a sample of accrual expenditure details to verify expenditures are allowable under the federal program.

C. Agree Implementation Date: June 2025

We will work with staff to remind them the importance of thorough reviews to ensure transactional accuracy. We will ensure desk procedures include adequate review steps.

Recommendation 2024-052

The Colorado Department of Public Health and Environment (CDPHE) should improve its internal controls over Federal Emergency Management Agency (FEMA) Disaster Grants program expenditures and ensure that all FEMA Disaster Grants program expenditures reported to the Department of Public Safety for reporting on the Department of Public Safety’s Exhibit K1, Schedule of Federal Assistance, are accurately supported by continuing to develop, document, and implement policies and procedures to require that CDPHE staff obtain and maintain sufficiently-detailed supporting documentation for CDPHE’s expenditure of FEMA’s Disaster Grants program funds by fiscal year and perform reconciliations of the information to underlying transactional data on a go-forward basis. This should include requiring that CDPHE staff complete a full reconciliation on at least an annual basis of detailed amounts reported as FEMA Disaster Grants program expenditures for the fiscal year, including expenditures incurred but not yet reimbursed by the Department of Public Safety as of fiscal year end; reimbursement amounts requested by CDPHE from the Department of Public Safety for the FEMA Disaster Grants program during the year; and reimbursement payments received by the CDPHE from the Department of Public Safety during the year. CDPHE should also resolve any reconciling differences prior to reporting CDPHE FEMA Disaster Grants program expenditures to the Department of Public Safety.

Response Department of Public Health and Environment

Partially Agree Implementation Date: September 2025

CDPHE fully implemented the FY23 audit recommendation as written and updated our processes in conjunction with CDPS to ensure proper documentation was obtained for all claims in FY24. CDPHE and CDPS met regularly through FY24 to discuss these updates and verified every invoice processed with the applicable backup. CDPHE does not charge or draw any funds from CDPS until approval is received regarding FEMA eligibility. Copies of these approvals are included every time CDPHE draws funds from CDPS.

The FY23 audit finding was related to the CDPHE year-end estimate to CDPS since CDPHE was not able to provide all needed supporting documentation to fully justify it. For FY24, instead of using an estimate, we based the FY24 accruals on approvals that were not paid during FY24, so were able to tie this out completely.

For actual reimbursement FY24 requests, we tied out all expenses related to each reimbursement request. The procedure documentation was updated to reflect these new processes. Going forward, we are continuing to follow the same updated procedures to ensure that future reimbursement requests are accurate and have appropriate documentation attached. CDPHE verified that the amount listed was only reported on the CDPS K1 and not on both agencies K1s.

To reflect the new addition on the FY24 recommendation, CDPHE has updated our procedures to add the full fiscal year reconciliation at the end of each fiscal year for all federal expenses, including expenditures incurred but not yet reimbursed by CDPS as of fiscal year-end, reimbursement requested by CDPHE from CDPS, reimbursements received by CDPHE during the fiscal year, and a resolution for any reconciling differences.

Auditor’s Addendum

As noted in the finding, we found that CDPHE did not fully implement the Fiscal Year 2023 recommendation and could not provide sufficient support for $11.1 million of the Fiscal Year 2024 FEMA Disaster Grant expenditures reported on the Department of Public Safety’s Exhibit K1. CDPHE should ensure it maintains complete documentation for its FEMA Disaster Grant expenditures and that it completes a reconciliation on an annual basis of the detailed amounts reported as FEMA Disaster Grants program expenditures for the fiscal year.

Finding 2024-053 Compliance with Reporting for Disaster Grants

Following a presidential declaration of a major disaster or an emergency, FEMA awards grants to assist SLTTs and certain PNP entities to respond to and recover from disasters.

The Department receives FEMA grant awards and is required to follow reporting requirements as specifically identified in the various grant award agreements. The Department allocates funds received from these federal awards to subrecipients (local governments or PNPs) and the Department is responsible for the reporting of the payments made to its subrecipients.

The Department is required to comply with the Federal Funding Accountability and Transparency Act of 2006 (Transparency Act or FFATA) for its Disaster Grants. The Transparency Act was created to empower Americans with the ability to hold the government accountable for each spending decision and, as a result, to reduce wasteful spending by the government. The Transparency Act requires the federal government to make certain information on federal awards, including information about amounts passed through to subrecipients, available to the public.

The Department is required to report information about subgrants, or subawards, given to other governments or to nonprofit organizations, also referred to as subrecipients. Federal regulations [2 CFR 200.1] define a subaward as an award provided by a pass-through entity, in this case the Department, to an entity to carry out part of a federal grant award received by the pass-through entity. A subrecipient is defined in federal regulations [2 CFR 200.1] as “an entity, usually but not limited to non-Federal entities, that receives a subaward from a pass-through entity to carry out part of a federal award; but does not include an individual that is a beneficiary of such award. A subrecipient may also be a recipient of other Federal awards directly from a federal awarding agency.”

The Department is required to submit FFATA information through the FFATA Subaward Reporting System (FSRS). Once the Department submits a report to FSRS, the public can view information from the report, including the subrecipient’s name, subaward identification number, subaward obligation/action date, subaward amount, federal awarding agency and subagency, the Department’s name, and the Department’s grant award identification number. The necessary information to support the required FFATA reporting elements is retained in the Department’s grants management information system, EMGrants.

In Fiscal Year 2024, the Department made 75 subawards that were subject to FFATA reporting, which totaled $78.0 million to 32 subrecipients for its Disaster Grants. As a result, the Department was required to submit 75 FFATA reports for its Disaster Grants for Fiscal Year 2024.

What was the purpose of our audit work and what work was performed?

The purpose of the audit work was to determine whether the Department had adequate internal controls over, and complied with, reporting requirements for its federal Disaster Grants for Fiscal Year 2024. In addition, the purpose of our audit work was to determine whether the information in these reports was accurate and complete, and submitted in accordance with federal regulations. Another purpose of the audit work was to determine whether the Department implemented our Fiscal Year 2023 audit recommendation to develop, document, and implement policies and procedures for timely reporting within FSRS. The Department planned to implement this recommendation by June 2024.

As part of our audit work, we requested the Department’s policies and procedures over FFATA reporting, and a list of all subawards made by the Department during Fiscal Year 2024. From the listing of 75 FFATA subawards, we selected a sample of 15 Disaster Grants subawards and requested verification that the Department submitted FFATA information through the FSRS for Fiscal Year 2024 to determine if the Department submitted FFATA information as required, and whether the information reported contained accurate and complete information.

How were the results of the audit work measured?

We measured the results of our audit work against the following requirements:

• Federal regulations [2 CFR 200.303] require the Department to establish and maintain effective internal controls over federal awards that provide reasonable assurance that the Department is managing its federal awards in compliance with federal statutes, regulations, and the terms and conditions of the federal award.

• Federal regulations [2 CFR 200.334] require the Department to keep all financial records and supporting documentation pertinent to a federal award for a minimum period of 3 years from the date of submission of the final expenditures report.

• Federal regulations [2 CFR 170.330.1(a)] require the Department to report subawards of $30,000 or more to FSRS by the end of the month following the month in which the award was made. For example, the Department would have to submit a FFATA report to FSRS in May 2024 if an award or supplemental award equal to or greater than $30,000 was made in April 2024.

What problems did the audit work identify? Based on the testwork performed, we identified that the Department did not implement the Fiscal Year 2023 recommendation by its planned implementation date of June 2024 and did not comply with FFATA reporting requirements during Fiscal Year 2024. Specifically, the Department did not report approximately $16.3 million in subawards issued during Fiscal Year 2024 or $55.1 million in subawards issued in prior years that it had failed to report. The following table summarizes the results of our testing and groups each exception within the following categories: subaward not reported, report not timely, subaward amount incorrect, and subaward missing key elements. See Schedule of Finding and Questioned Costs for chart/table.

Why did these problems occur?

The Department did not have adequate internal controls over federal reporting requirements in place for its Disaster Grants during Fiscal Year 2024. Specifically, the Department failed to file FFATA reports for its Disaster Grants because, while it drafted policies and procedures for FFATA reporting during Fiscal Year 2024, it had not finalized the policies and procedures by fiscal year end and specifically, the policies and procedures did not designate responsibilities over FSRS reporting between fiscal staff and program staff. Further, the Department has been unsuccessful at obtaining a report from EMGrants with all of the required FFATA reporting elements that is in an appropriate format that allows the Department to submit bulk data, consisting of data that includes information such as subrecipient’s name, subaward identification number, subaward obligation/action date, subaward amount, federal awarding agency and subagency, and the Department’s grant award identification number, of all subawards issued to FSRS.

Why do these problems matter?

By failing to properly report FFATA subawards through FSRS, the Department is out of compliance with federal reporting requirements, risks federal sanctions, and does not meet the federal intent of transparency for federal program spending. See Schedule of Finding and Questioned Costs for chart/table.

Recommendation 2024-053

The Department of Public Safety (Department) should improve its internal controls over, and ensure it complies with, federal reporting requirements for its Disaster Grants – Public Assistance (Presidentially Declared Disasters) (Disaster Grants) by:

A. Continuing to develop and implement policies and procedures to ensure that staff, as applicable, are aware of, and comply with, requirements under the Federal Funding Accountability and Transparency Act of 2006 (FFATA) for its Disaster Grants. This should include improving the Department’s process for determining the timing of reporting within the FFATA Subaward Reporting System and appropriately allocating staff resources for FFATA reporting responsibilities.

B. Creating a report in EMGrants, the Department’s grants management system, that contains all of the required FFTAA reporting elements, or identifying an alternate method that allows the Department to submit data to the Federal Funding Accountability and Transparency Act Subaward Reporting System (FSRS).

C. Submitting all required reports to FSRS that have yet to be filed, or obtaining documented approval from the federal government waiving this requirement for past due reports.

Response Department of Public Safety

A. Agree Implementation Date: June 2025

The Department’s Division of Homeland Security & Emergency Management’s (DHSEM) has implemented FFATA reporting for our awards going forward and continues to work on past due reporting. However, the Federal Government has announced that the current reporting website (FSRS) will be decommissioned and a new process will be created through SAM.GOV. The change of systems will require a rewrite to our procedures and a review of the resources committed to the effort.

B. Agree Implementation Date: June 2025

DHSEM will continue to work with our vendor (CIVIX) to create a report in EMGrants that works for our state. However, if it becomes apparent that EMGrants cannot offer a timely solution, we will implement other methods to ensure all reporting requirements are met.

C. Agree Implementation Date: June 2025

DHSEM has implemented FFATA reporting for our awards going forward and continues to work on past due reporting. If this is possible we will do so, however, as FSRS is being decommissioned, we may not have the ability to file past reports.

Finding 2024-054 Compliance with Subrecipient Monitoring for Disaster Grants

The Disaster Grants program is based on a partnership between FEMA; the recipient, which in these instances is the Department; and, as applicable, the subrecipient (local governments or PNPs). FEMA is responsible for managing the program, approving grants, and providing technical assistance to the SLTT. The Department, as a recipient of Disaster Grants program funds, is responsible for providing technical advice and assistance to eligible subrecipients, providing support for damage survey activities, ensuring that all potential applicants are aware of funding assistance available, and submitting documents necessary for grant awards.

A subrecipient is defined in federal regulations [2 CFR 200.1] as, “an entity, usually but not limited to non-Federal entities, that receives a subaward from a pass-through entity to carry out part of a federal award; but does not include an individual that is a beneficiary of such award. A subrecipient may also be a recipient of other Federal awards directly from a federal awarding agency.” Federal regulations [2 CFR 200.1] define a subaward as an award provided by a pass-through entity (such as the Department) to an entity (subrecipient) to carry out part of a federal grant award received by the pass-through entity. The subrecipient is expected to request assistance, as needed; identify the damaged facilities; provide information to support its funding requests; maintain accurate documentation; and perform other work, as necessary.

As part of its subrecipient monitoring process, the Department should complete an annual risk assessment to determine the extent of its subrecipient monitoring. The risk assessment should include considerations of financial risk factors, such as financial implications of operational and compliance failures; operational risk factors, such as risks resulting from inadequate internal controls; and compliance risks, such as violations with laws, regulations, and internal policies. In addition, the Department should be using monitoring tools to track the status of whether the subrecipient had an audit, if applicable, and whether that audit has been reviewed and management decisions issued, if applicable.

During Fiscal Year 2024, the Department passed approximately $180.2 million to 61 subrecipients for responses to various disasters covered by the Department’s Disaster Grants. In addition, the Department reported that it approved 103 new subawards during Fiscal Year 2024. In total, the Department reported that it had approximately 137 total subrecipients, including 76 subrecipients who did not receive funding passed through from the Department during Fiscal Year 2024; many of these subrecipients had multiple open projects that had been completed but were awaiting final approval and close out from FEMA.

What was the purpose of our audit work and what work was performed?

The purpose of the audit work was to determine whether the Department had adequate internal controls in place over, and complied with, subrecipient monitoring requirements over the federal Disaster Grants program during Fiscal Year 2024. Another purpose of the audit work was to determine whether the Department implemented our Fiscal Year 2023 audit recommendation to update the Department’s current policies to address considerations specific to all subrecipients with open subawards in the subrecipients’ risk assessments, and to update the subrecipient monitoring policy to be in compliance with federal regulations requiring management decisions to be issued within 6 months of acceptance of the subrecipient’s audit report by the Federal Audit Clearinghouse. The Department planned to implement these recommendations by June 2024. Further, we also recommended that the Department review all subrecipients’ Single Audit reports, as required, which the Department planned to implement by March 2024.

As part of our audit work, we tested 28 of 137 (20 percent) of the Department’s subrecipients who received approximately $57.2 million of Disaster Grant funding during Fiscal Year 2024 to determine whether the Department performed risk assessments on the subrecipients, as required by federal regulations. We also requested the Department’s annual Risk Assessment package to determine whether the subrecipients’ risk assessments were appropriate and in accordance with federal regulations, and to determine whether the Department completed its onsite monitoring for those subrecipients that met the risk criteria for onsite monitoring.

In addition, we performed testwork to determine whether the Department obtained the subrecipients’ Single Audit reports, and issued a management decision, if applicable.

How were the results of the audit work measured?

We measured the results of our audit work against the following requirements:

• Federal regulations [2 CFR 200.303] require the Department, as a federal award recipient, to establish and maintain effective internal controls over the federal award that provides reasonable assurance that it is managing the federal award in compliance with federal statutes, regulations, and the terms and conditions of the award.

• Federal regulations [2 CFR 200.332] require the Department to evaluate each subrecipient’s risk of noncompliance with federal statutes, regulations and the terms and conditions of the subaward for purposes of determining the appropriate subrecipient monitoring. Additionally, it requires the Department to verify that every subrecipient is audited as required by 2 CFR 200, Subpart F, and to consider whether the results of the subrecipient’s audits indicate conditions that necessitate adjustment to the pass-through entity’s—in this case, the Department’s—own records.

• The Department’s Division of Homeland Security & Emergency Management’s (DHSEM) Subrecipient Monitoring policy states that it “…will perform an annual evaluation of Subrecipients’ risks prior to the start of each State fiscal year, analyzing active awards and assessing Subrecipients for the upcoming year to determine the financial status of each Subrecipient and which subrecipients will receive on-site monitoring.” The policy further goes on to indicate that each subrecipient will receive an overall risk score based on the quantitative and qualitative dated used for the assessment inputs.

• The DHSEM Subrecipient Monitoring policy also states that “DHSEM will perform reviews of single audit results for Subrecipients who have expended Federal grant funds in excess of $750,000 of which some portion is passed through DHSEM.”

• Federal regulations [2 CFR 200.329] stipulate that the Department is responsible for oversight of the operations of the federal award supported activities. The regulations further say that the “non-federal entity” must monitor its activities under federal awards to assure compliance with applicable federal requirements and performance expectations are being achieved.

What problems did the audit work identify? Based on our audit work, we determined that the Department did not fully implement our Fiscal Year 2023 recommendation by its planned implementation dates of March 2024 and June 2024. The Department updated its policies by the stated implementation date of June 2024, completed its Fiscal Year 2024 subrecipient risk assessments in July 2023 to determine which subrecipients it would monitor during Fiscal Year 2024; however, we determined the Department did not comply with federal regulations related to subrecipient monitoring during Fiscal Year 2024. Specifically, we identified issues with 23 of the 28 (82 percent) subrecipients we tested, as follows:

• The Department did not document risk assessments for 23 of the subrecipients we selected for testing. Specifically, the Department did not document risk assessments for the following Disaster Grant subrecipients:

o 7 subrecipients of the 2013 Floods incident (FEMA-4145-DR) o 12 subrecipients for the COVID-19 incident (FEMA-4498-DR) o 4 subrecipients for other small projects

The Department subsequently provided its reasons for why these subrecipients were deemed to have low to no subrecipient risk based on the nature of the specific FEMA subawards, such as that the projects were complete but waiting on final FEMA approval or had undergone a detailed approval process by FEMA prior to funds being obligated; however, the specific risk assessment for these subrecipients were not documented.

Because of the risk assessment omissions that we identified in our sample, we expanded our testing to the Department’s full population of 61 subrecipients that received payments from the Department during Fiscal Year 2024. We determined that, in total, 51 of the 61 (84 percent) subrecipients did not have a risk assessment documented. These subrecipients accounted for approximately $92.2 million of the total $180.2 million (51 percent) of the total payments made by the Department to subrecipients during the current year.

• The Department did not monitor whether 7 of the 28 (25 percent) subrecipients we tested were required to have a Single Audit, and if applicable, review the subrecipient’s Single Audit report and issue a management decision on findings.

Why did these problems occur?

The Department did not implement its written policies to address requirements for documenting risk assessments until the end of the fiscal year, or June 30, 2024. As a result, the Department did not have adequate internal controls in place during the fiscal year to ensure it complied with subrecipient requirements or that staff followed the Department’s own policies during Fiscal Year 2024. Specifically:

• Department staff followed the Department’s former policies for documenting subrecipient risk assessments, which allowed staff to choose to not document formal risk assessments for subrecipients they deemed as having little risk of noncompliance based on reporting that had occurred up until that point in time. As a result, Department staff indicated that they excluded subawards related to the 2013 floods incident, 2015 floods incident, COVID-19 incident, small awards, and awards written at 100 percent.

• The Department designated a staff to obtain and review Single Audit reports for all of its subrecipients; however, the Department did not allocate sufficient resources to ensure its staff were able to catch up on their reviews of previously unreviewed Single Audit reports during Fiscal Year 2024.

Why do these problems matter?

The issues we found are important because of the following:

• By failing to properly document assessed risk of subrecipients, the Department is out of compliance with federal requirements and with its policy to assess risk for each subrecipient. This could result in the Department not timely identifying risks for subrecipients and modifying the extent of its monitoring activities to ensure the subrecipient has proper accountability and resources to be able to meet the program requirements.

• By failing to verify that all subrecipients are audited as required by 2 CFR 200, Subpart F, the Department is out of compliance with federal requirements and its internal policies. This could result in the Department not timely identifying enforcement actions that may be needed against noncompliant subrecipients and then making revisions, as applicable, to the monitoring risk assessment for the subrecipient. See Schedule of Finding and Questioned Costs for chart/table.

Recommendation 2024-054

The Department of Public Safety (Department) should strengthen its internal controls over, and ensure it complies with, federal Disaster Grants – Public Assistance (Presidentially Declared Disasters) program requirements for subrecipient monitoring by:

A. Following its current policy to address considerations specific to subrecipients with open subawards that were waiting final approval or had undergone a detailed approval by the Federal Emergency Management Agency (FEMA) prior to funds being obligated.

B. Allocating sufficient staff resources to review subrecipient Single Audit reports to ensure the Department is in compliance with the Department’s policy and federal regulations to review all subrecipients’ Single Audit reports timely. Response Department of Public Safety

A. Agree Implementation Date: June 2025

The Department’s Division of Homeland Security & Emergency Management’s (DHSEM) will continue to follow the Policy and Procedure that was approved in June 2024. When this recommendation from the Fiscal Year 2023 audit was implemented, the new procedures were applied to those in-progress grants for that are effective for Fiscal Year 2025. At the time we agreed to implement, the Fiscal Year 2024 risk assessment was already completed. Our response of implemented is based on applying the updated risk assessment to the Fiscal Year 2025 awards.

B. Agree Implementation Date: June 2025

DHSEM will allocate an individual to assist with reviewing the Single Audits per the Subrecipient Policy and Procedure.

Finding 2024-055 Compliance with Period of Performance for the Highway Safety Cluster

The objective of the Highway Traffic Safety Grant Programs (Highway Safety Cluster) is to provide a coordinated, national highway safety program to reduce traffic crashes, deaths, injuries, and property damage.

During Fiscal Year 2024, the Department received a total of $11,697,388 in federal Highway Safety Cluster [ALNs 20.600, 20.616] grants with a period of performance beginning October 1, 2023 and ending September 30, 2027.

In order to ensure that federal funds are used only during the authorized period of performance, the Department requires a minimum of two different reviews and approvals of the costs. Costs are reviewed and entered into SAP, the Department’s enterprise resource planning system, by grant coordinators then reviewed and approved by the Department’s Headquarters (HQ) Business Office staff and/or HQ personnel. The costs are then interfaced with the Colorado Operations Resource Engine (CORE), the State’s accounting system. Grant coordinators providing first-level review, Regional Business Office staff, and Department HQ staff are all expected to be knowledgeable in allowable costs requirements for the Highway Safety Cluster.

What was the purpose of our audit work and what work was performed?

The purpose of our audit work was to determine whether the Department had adequate internal controls related to period of performance requirements for the Highway Safety Cluster, and whether the Department complied with period of performance requirements by recording Highway Safety Cluster expenditures appropriately during the approved budget period of the Highway Safety Cluster’s period of performance during Fiscal Year 2024.

To determine whether costs were charged only during the authorized period of performance, we sampled from a population of all costs recorded during the beginning (first 30 calendar days) of the period of performance of these grants, or between October 1 and October 30, 2023. Twenty-one transactions were subject to sampling, totaling $7,423. We randomly selected six transactions charged to the grant between October 1 and October 30, 2023. We reviewed supporting documentation provided by the Department to support the date the expense was incurred and evidence of internal controls related to approval of the expense.

How were the results of the audit work measured?

Our audit work was designed to measure the Department’s compliance with the following requirements:

• Federal regulations [2 CFR sections 200.308, 200.309, and 200.403(h)] state that a non-federal entity—in this case the Department—may charge only allowable costs incurred during the approved budget period of a federal award’s period of performance and any costs incurred before the federal awarding agency made the federal award that were authorized by the federal awarding agency. A period of performance may contain one or more budget periods.

• The Department’s internal control procedures require that all federal grant expenditures must have adequate supporting documentation, such as an invoice, purchase order, or reimbursement request, included with the transaction and that the supporting documentation must be reviewed for allowability under the applicable federal grant program by at least two individuals.

What problem did the audit work identify?

We determined that the Department did not fully comply with the period of performance requirements for the Highway Safety Cluster. Based on our audit testwork, we found that the Department recorded 4 of 6 transactions selected for testing (67 percent) outside the period of performance, ranging from 1 day to 23 days prior to October 1, 2023, the start of the period of performance. This resulted in questioned costs totaling $4,367.

Why did this problem occur?

The Department’s procedures and internal controls were not operating effectively to ensure that expenditures charged to the program were incurred within the award’s period of performance. The Department’s preparers and reviewers of the costs charged to the grant neglected to ensure that the costs being charged were incurred during the allowable award period. Department personnel did not appear to be aware of the period of performance compliance requirements.

Why does this problem matter?

By failing to properly record expenditures to the program within the award’s period of performance, resulting in expenditures being charged that were outside the allowable period of performance, the Department is out of compliance with federal period of performance requirements. Costs could be deemed unallowable by the awarding agency and funds may be required to be returned by the State. See Schedule of Finding and Questioned Costs for chart/table.

Recommendation 2024-055

The Department of Transportation (Department) should ensure that it complies with federal Highway Safety Cluster grant period of performance requirements by: A. Enforcing its existing policies and procedures that require that grant expenditures be allowable, and that two individuals review the related supporting documentation for compliance with grant requirements. This should include monitoring to ensure that Department personnel performing the reviews review the related supporting documentation for incurred dates in order to verify that expenditures comply with the applicable award period of performance; adjustments should be made for any expenditures charged to an award outside the proper period of performance.

B. Providing additional training to Department personnel on period of performance compliance requirements, as deemed necessary.

Response Department of Transportation

A. Agree Implementation Date: June 2025

The Department agrees with the recommendation. The Center for Accounting (CFA) and Office of Transportation Safety (OTS) will coordinate on implementation. The Department will review the current process and consider if any updates are needed to ensure supporting documentation is reviewed and compliance with grant requirements is verified prior to payment. This will include assessing the need for increased monitoring and review to ensure the initial program review is III-4 [the auditor] complete and accurate. The Department will also review, assess, and, where necessary, update existing policies and procedures related to payment processing.

B. Agree Implementation Date: June 2025

The Department agrees with the recommendation. The Center for Accounting (CFA) and Office of Transportation Safety (OTS) will coordinate on implementation. The Department will assess, and update as necessary, training for staff responsible for reviewing and approving invoices for the Highway Safety Cluster grants, with a focus on period of performance.

Finding 2024-056 Compliance with Reporting for the Highway Safety Cluster

FFATA

The Federal Funding Accountability and Transparency Act (Transparency Act or FFATA) was created to empower Americans with the ability to hold the government accountable for each spending decision and, as a result, to reduce wasteful spending by the government. The Transparency Act requires the federal government to make certain information on federal awards available to the public; in order to obtain this information, the federal government has established federal reporting requirements for states and other governments who expend federal funds. The Department is required to report information about subgrants, or subawards, of federal grants that it gives to other governments or to nonprofit organizations (also referred to as subrecipients). Federal regulation [2 CFR 200.1] defines a subaward as an award provided by a pass-through entity—in this case the Department—to an entity to carry out part of a federal grant award received by the pass-through entity. A subrecipient is defined in federal regulation [2 CFR 200.1] as “an entity, usually but not limited to non-Federal entities, that receives a subaward from a pass-through entity to carry out part of a federal award; but does not include an individual that is a beneficiary of such award. A subrecipient may also be a recipient of other Federal awards directly from a federal awarding agency.”

The Department is required to file FFATA reports through the FFATA Subaward Reporting System (FSRS). Once the Department submits a report to FSRS, the public can view certain information from the report, including the subrecipient’s name, subaward identification number, subaward obligation/action date, subaward amount, federal awarding agency and subagency, the Department’s name, and the Department’s grant award identification number. Information submitted via the FSRS is made publicly available at https://www.usaspending.gov/search.

The Department’s required FFATA reports for Fiscal Year 2024 included information on the federal Highway Safety Cluster, specifically the State and Community Highway Safety grant [ALN 20.600] and National Priority Safety Programs [ALN 20.616]. FFATA reporting was required because the Department passed through funds in excess of $30,000 to one or more subrecipients for each of the two programs. The Department made 955 payments to subrecipients, totaling $5,669,865 during Fiscal Year 2024 for which FFATA reporting applies.

What was the purpose of our audit work and what work was performed?

The purpose of our audit work was to determine whether the Department had adequate internal controls over and complied with FFATA reporting requirements for the Highway Safety Cluster during Fiscal Year 2024.

As part of our audit work, we selected 40 subrecipient transactions totaling $540,050 and requested copies of the related FFATA reports that were uploaded to the FSRS system. We compared the amounts and dates reported by the Department for subawards in FSRS to the underlying support provided by the Department. In addition, we performed testwork to determine whether the Department submitted the FFATA reports within the month following the month the subaward was made, as required by federal regulations.

How were the results of the audit work measured?

We measured the results of our audit work against the following:

• Federal regulations [2 CFR 170] specify that direct recipients of federal grants are required to report subawards of $30,000 or more to FSRS by the end of the month following the month in which the award was made. For example, the Department would have to submit a FFATA report to FSRS in May 2024 if an award or supplemental award equal to or greater than $30,000 was made in April 2024.

• Federal regulations [2 CFR 200.303] require the non-federal entity—in this instance the Department—to establish and maintain effective internal controls over the federal award that provides reasonable assurance that the non-federal entity is managing the federal award in compliance with federal statutes, regulations, and the terms and conditions of the federal award.

• Federal regulation [2 CFR 200.332 (a)(1)] states that the Department’s subawards must clearly identify certain information, including but not limited to, the unique entity identifier, the Assistance Listing Number (ALN), the Federal Award Date, and the Federal Award Identification Number (FAIN).

What problems did the audit work identify?

Based on our audit work, we determined the Department did not report its subawards in FSRS for the Highway Safety Cluster accurately. We identified issues with 40 of the 40 subrecipient transactions (100 percent) we tested, as follows:

• 22 instances in which the Department did not have accurate documentation to support amounts reported in FSRS. Of these 22 instances, there were 12 instances where the Department reported amounts in FSRS that did not tie back to the Department’s subaward documentation. In 1 of these 12 instances, the Department did not have an amendment to the subaward agreement to support the amount reported, and the Department did not have a reconciliation to support the amount reported in FSRS.

• 10 instances in which the Department did not have evidence the subaward was filed in FSRS.

• 19 instances in which the Department did not report the subawards in FSRS within the required federal timeline. Specifically, the Department reported 5 subawards 1 day late, 2 subawards 335 days late, 2 subawards 366 days late, and it failed to report 10 subawards at all.

• 31 instances in which the Department’s subaward date reported in FSRS did not match the date of the Department’s subaward. • 1 instance in which the Department inaccurately reported 1 subaward in FSRS as 2 separate awards.

• For all 40 reports, the Department did not have formal evidence of review and approval prior to the FFATA report submission.

In addition to the issues noted previously, the Department did not have a comprehensive list of subaward agreements and amendments to subaward agreements for Fiscal Year 2024. This resulted in the Department not having a complete population of agreements that the Department was required to file in FSRS for Fiscal Year 2024.

The following table summarizes the results of our testing and groups each issue noted into the following categories: subaward not reported, report not timely, subaward amount incorrect, and subaward missing key elements. See Schedule of Finding and Questioned Costs for chart/table.

Why did these problems occur?

The Department did not have adequate internal controls—including documented policies and procedures—in place during Fiscal Year 2024 related to FFATA reporting for the Highway Safety Cluster that ensures reporting occurs as required for subawards of $30,000 or more in FSRS by the end of the month following the month the subawards are made and that evidence is maintained to demonstrate when the reports were submitted. Specifically, the Department does not have policies and procedures for FFATA reporting that include requirements for the method in which Department staff must track funds passed to subrecipients, reconciliation procedures to identify subawards that need to be reported each month, reconciliation of amounts reported in the FSRS to amounts on subawards, if different, and evidence of review and approval. In addition, the Department did not have a reconciliation with supporting schedules to support amounts reported in FSRS. Further, the Department did not have documentation showing where the amounts reported in FSRS were compiled from, since the amounts did not agree to the subaward documents.

The Department also did not have a control in place, such as a reconciliation or review process, to identify subawards that went unreported during the fiscal year and did not have a process to compile a comprehensive list of subawards and amendments that the Department awarded during the fiscal year.

Why do these problems matter?

By failing to properly report FFATA subawards through FSRS, the Department is out of compliance with federal reporting requirements and risks federal sanctions. In addition, the Department fails to meet the federal intent of transparency for federal program spending. See Schedule of Finding and Questioned Costs for chart/table.

Recommendation 2024-056

The Department of Transportation (Department) should strengthen its internal controls over and ensure it complies with requirements under the Federal Funding Accountability and Transparency Act (FFATA) reporting for the Highway Safety Cluster by:

A. Developing and implementing policies and procedures for FFATA reporting to include requirements for the method in which Department staff must track funds passed to subrecipients, reconciliation procedures to identify subawards that need to be reported each month, reconciliation of amounts reported in the Federal Funding Accountability and Transparency Act Subaward Reporting System (FSRS) to amounts on subawards, if different, and evidence of review and approval. The reconciliation procedures should include maintenance of supporting schedules to support amounts reported in FSRS.

B. Ensuring that reporting occurs as required for subawards of $30,000 or more in FSRS by the end of the month following the month the subawards are made and maintaining evidence to demonstrate when the reports were submitted. C. Creating a listing of all subawards by program that are awarded during the fiscal year, so that a complete population can be determined for Single Audit purposes and for the Department to accurately track the status of subawards made to subrecipients. This listing should also include any subaward amendments.

Response Department of Transportation

A. Agree Implementation Date: June 2025

The Department agrees with the recommendation. The Center for Accounting (CFA) and Office of Transportation Safety (OTS) will coordinate on implementation. The Department will review, assess, and, where necessary, update existing policies and procedures on FFATA reporting. This will include new procedures to review and verify reporting data provided by the OTS prior to submission in the Federal Funding Accountability and Transparency Act Subaward Reporting System (FSRS), as well as new procedures relating to the maintenance of supporting schedules. This process will be moving to a new federal system, SAM.gov in the Spring of 2025. The CFA will also work with the OTS to implement improvements to the tracking system for highway safety funds and subawards while ensuring evidence of review and approval.

B. Agree Implementation Date: June 2025

The Department agrees with the recommendation. The Center for Accounting (CFA) and Office of Transportation Safety (OTS) will coordinate on implementation. The Department will review, assess, and, where necessary, update existing procedures for FFATA reporting relating to the requirement that state sub awards for $30,000+ be submitted within 30 days of committed budget. This will include ensuring that the confirmation date is documented. This process will be a coordinated effort between the OTS and the CAF. The coordination will include a shared google sheet. The OTS will update monthly and the CFA will review and submit new sub awards in FFATA for alignment.

C. Agree Implementation Date: June 2025

The Department agrees with the recommendation. The Center for Accounting (CFA) and Office of Transportation Safety (OTS) will coordinate on implementation. The Department will review, assess, and, where necessary, update existing procedures relating to the tracking of subawards made to subrecipients and their status. OTS will modify their listings of subawards by program to include all amendments and new subawards and update it monthly. CFA will review the listing to ensure the accuracy of reporting submittals. The listing of subawards will be reconciled monthly. In addition, the FSRS system for FFATA reporting will be replaced with SAM.gov in Spring 2025. The new system includes improvements which will allow for more accurate tracking, and modifications to prior entries to support reconciliation which the prior system did not.

Finding 2024-057 Compliance with Activities Allowed or Unallowed and Allowable Costs/Cost Principles for Formula Grants for Rural Areas and Tribal Transit Program

The objectives of the federal Formula Grants for Rural Areas and Tribal Transit Program (Program) [ALN 20.509] are to initiate, improve, or continue public transportation service in rural areas by providing financial assistance for operating expenses, planning, and administrative expenses; and the acquisition, construction, and improvement of facilities and equipment. The Program is authorized by 49 U.S. Code Section 5311; specifically, 49 U.S. Code Section 5311(f) provides for the support of rural intercity bus service.

As a grant recipient of funds under the Program, the Department is responsible for monitoring Program costs and activities for allowability, specifically to ensure that costs incurred and activities funded by the Program are permitted under the Program’s federal regulations and the Department’s grant agreements for the Program. The Program’s allowable activities, as identified in the U.S. Code, generally include the following:

• Local transportation service in a rural area.

• Support of intercity bus transportation.

• Coordination of public transportation with transportation service assisted by other U.S. government sources.

• Planning activities for the needs of rural areas, operating costs of equipment and facilities for the use in rural areas public transportation, and rural areas public transportation capital projects.

• Job access and reverse commute projects, and the acquisition of public transportation services, including service agreements with private providers of public transportation.

• Training, technical assistance, research, and related support services for providers of rural public transit and related services.

The Department receives federal grant funds directly from the federal government for the Program and then subgrants, or passes through, a portion of the funds to cities and counties and other organizations that are considered to be either a subrecipient or vendor. A subrecipient is a non-federal entity that expends federal awards received from a pass-through entity to carry out a federal program, but does not include an individual that is a beneficiary receiving direct payments from such a program. A vendor, or contractor, is a dealer, distributor, merchant, or other seller providing goods or services that are required to conduct a federal program; these goods or services may be for an organization’s own use or for the use of beneficiaries of the federal program.

The Department has established controls that require management and/or supervisory level approvals on all invoices before they are paid. The Department’s project managers and business management review invoices and reimbursement requests to ensure expenditures are allowable. The Division of Transit and Rail within the Department is responsible for reviewing all invoices associated with the Program. For the Fiscal Year 2024, the Program had general disbursement expenditures of $554,550, which was made up of 87 transactions, and subrecipient expenditures of $23,075,270, which was made up of 1,061 subrecipient transactions. General disbursement transactions include payments or costs incurred for the Program that do not meet the definition of any of the other cost categories, such as equipment and real property purchases, loan distributions, indirect costs, payments to program participants, or subrecipient payments.

What was the purpose of our audit work and what work was performed?

The purpose of our audit work was to determine whether the Department had adequate internal controls over federal allowable activities and allowable cost requirements for the Program, and to determine whether the Department complied with the federal requirements during Fiscal Year 2024.

As part of our audit work, we randomly selected 40 cash disbursements, which included 11 general disbursement transactions and 29 subrecipient transactions. We reviewed the related supporting documentation provided by the Department for allowability and evidence of internal controls related to expenditure approvals.

How were the results of the audit work measured?

We measured the results of our audit work against the following requirements:

• Federal regulation [2 CFR 200.303] states that the Department must “establish, document, and maintain effective internal control over the Federal award that provides reasonable assurance that the recipient or subrecipient is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award.”

• Federal regulation [2 CFR 200.403] requires that costs under federal awards must be necessary, reasonable, and allocable, conform to limitations, be consistent with policies, receive consistent treatment, adhere to Generally Accepted Accounting Principles, not be used for cost sharing of other programs, and be adequately documented.

• The Department’s internal control procedures require that all federal grant expenditures must have adequate supporting documentation, such as an invoice or purchase order, included with the transaction and the supporting documentation must be reviewed for allowability under the applicable federal grant program by two individuals. Subrecipients must submit a reimbursement request and supporting documentation, such as invoices, purchase orders, and internal accounting documents. Two Department personnel are required to review and approve the reimbursement requests and supporting documents before the reimbursement is paid.

What problems did the audit work identify?

Based on our audit testwork, we determined the Department did not ensure that costs charged to the grant were allowable. Specifically, we identified errors in 2 of the 40 samples (5 percent) selected as discussed in the following section:

• In 1 of 40 cash disbursements selected for testing (3 percent), we found that the Department did not pay a vendor’s monthly invoice in a timely manner and ultimately made an erroneous duplicate payment to the vendor. Specifically, after the Department failed to initially pay the vendor invoice totaling $3,012, the vendor submitted an invoice in the following month that included the current and prior months’ unpaid expenses. The Department then inappropriately paid the vendor for the amounts listed on both invoices. This resulted in a net overpayment and questioned costs of $3,012.

• In 1 of 40 cash disbursements selected for testing (3 percent), we found that the Department made a payment to a subrecipient before it received adequate supporting documentation for the amount requested. Specifically, the Department did not receive proof of purchase or backup for $15,549 in purchased transit service expenses. This resulted in questioned costs of $15,549.

Why did these problems occur?

The Department’s internal controls were not sufficient to ensure that invoices were reviewed for appropriate supporting documentation and approved prior to issuance of the related payment. In addition, the overpayment of expenses occurred in part due to the Department’s failure to pay the vendor invoice in a timely manner; the Department’s policies in place did not provide proper guidance to staff for how to treat payment of invoices that were late or when an invoice received included unpaid charges from a prior invoice and time period. Additionally, the Department’s review process did not properly identify the overpayment or the lack of supporting documentation.

Why do these problems matter?

As the Department is responsible for ensuring that all expenditures charged to the Program are appropriately supported, it is essential for the Department to ensure that all expenditures charged to the Program have the appropriate supporting documents and that payments are accurately calculated based on invoices received. The overpayment of expenses and improper payment of unsupported subrecipient payments resulted in unallowable costs being charged to the Program. Ultimately, the federal government may disallow federal funds for inappropriate payments, including overpayments, and the Department would be required to bear the cost of these errors. See Schedule of Finding and Questioned Costs for chart/table.

Recommendation 2024-057

The Department of Transportation (Department) should improve its internal controls for the Formula Grants for Rural Areas and Tribal Transit Program (Program) to ensure that costs charged to this Program are allowable. This should include:

A. Implementing policies and procedures regarding the Program’s payment processing to ensure that, prior to charging expenditures to the Program, the expenditures and any related invoices are reviewed for appropriateness and adequate supporting documentation. In circumstances where such supporting documentation is missing, payment should not be made.

B. Ensuring staff are appropriately trained to follow current procedures to ensure the Department pays the current balance of monthly invoices and not any prior amounts. Response Department of Transportation

A. Agree Implementation Date: June 2025

The Department agrees with the recommendation. The Center for Accounting (CFA) and the Division of Transit and Rail (DTR) will coordinate on implementation. The Department will review, assess, and, where necessary, update existing policies and procedures related to payment processing, with a specific focus on transit payments. Additionally, the Department will also assess the need for additional training and/or other resources (i.e. review checklists) to improve compliance with payment processing policies and procedures. The CFA and the Headquarters Business Office will provide guidance and training to appropriate staff, including the DTR Operations Team to ensure that current invoices are being paid and if proper supporting documentation is not submitted the payment will not be made.

B. Agree Implementation Date: June 2024

The Department agrees with the recommendation and will review, assess, and update, where necessary, existing policies and procedures related to payment processing to improve duplicate payment controls. The Center for Accounting and the Headquarters Business Office will provide guidance and training to appropriate staff, including the DTR Operations Team. Current controls on duplicate payments include a review of the invoice number and amounts compared to prior payments in the system to verify that the payment has not already been made. The CFA and the Headquarters Business Office will provide guidance and training to the responsible staff members to follow the current desk procedure specifically on paying the current invoice. Additionally, the department utilizes the Diligent platform of analytics to identify potential duplicate payments and to prevent fraud. The duplicate payment analytic identifies possible duplicates to the same vendor for the same amount. Any identified duplicates are reported to the Director of Accounting and Controller for further investigation. These items are investigated on a monthly basis and handled accordingly.

Finding 2024-058 Compliance with Subrecipient Monitoring for the Formula Grants for Rural Areas and Tribal Transit Program, Highway Safety Cluster, and SLFRF

The Department receives federal grant funds directly from the federal government for the Formula Grants for Rural Areas and Tribal Transit Program, Highway Safety Cluster, and the Coronavirus State and Local Fiscal Recovery Funds (SLFRF) program and then subgrants, or passes through, a portion of the funds to cities and counties and other organizations that are considered to be either a subrecipient or a contractor.

For Fiscal Year 2024, the Department had the following transactions that were subject to subrecipient monitoring testing:

• Formula Grants for Rural Areas and Tribal Transit Program – 783 subrecipient transactions totaling $23,075,270.

• Highway Safety Cluster – 829 subrecipient transactions totaling $5,669,865.

• SLFRF – 232 subrecipient transactions totaling $38,321,493.

For the SLFRF program, Intergovernmental Agreements are executed between the Department and subrecipients to communicate all relevant federal award information. For both the Formula Grants for Rural Areas and Tribal Transit Program and Highway Safety Cluster, Subaward Agreements (subawards) are executed between the Department and subrecipients to communicate all relevant federal award information. Intergovernmental Agreements and subawards are signed by authorized State personnel, generally the State Controller and the Department’s Chief Engineer. The Department includes a “Subrecipient Risk Assessment” tool with its Intergovernmental Agreements or subawards, which must be completed by Department staff prior to making the award. The Department’s subrecipient monitoring procedures are dependent on the assessed risk level noted in the Subrecipient Risk Assessment tool.

Federal regulations [2 CFR Part 200 Section F] state that a non-federal entity that expends $1,000,000 or more in federal awards during the non-federal entity’s fiscal year must have a Single Audit conducted in accordance with 2 CFR 200.514. The Department’s Internal Audit Division staff tracks and receives Single Audit reports from its subrecipients. As part of the Department’s monitoring procedures, the Internal Audit Division personnel complete a “Single Audit Report Review Summary” form to show they reviewed the subrecipient’s Single Audit report, summarized any findings, and concluded on any risks presented to the Department and any related future actions to be taken. The form is signed by a Department preparer and a Department reviewer. For those subrecipients not required to file a Single Audit, an “Audit Division Single Audit Certification Form” must still be submitted by the subrecipients to the Department. These forms note that the entity was exempt from a Single Audit.

What was the purpose of our audit work and what work was performed?

The purpose of our audit work was to determine if the Department complied with federal requirements for subrecipient monitoring during Fiscal Year 2024 for the Formula Grants for Rural Areas and Tribal Transit Program, Highway Safety Cluster, and the SLFRF program and to determine whether the Department had adequate internal controls over subrecipient monitoring.

As part of our audit work, we reviewed the Department’s internal controls over compliance for subrecipient monitoring and tested the Department’s compliance with federal subrecipient monitoring requirements. Specifically, we performed the following testwork related to each of the following federal programs:

• Formula Grants for Rural Areas and Tribal Transit Program—We selected and reviewed a random sample of 40 subrecipient payment transactions. We reviewed subawards, amendments, and other supporting documentation provided by the Department.

• Highway Safety Cluster—We selected and reviewed a random sample of 40 subrecipient payment transactions. We reviewed subawards, amendments, and other supporting documentation provided by the Department.

• SLFRF—We selected and reviewed a random sample of 29 subrecipient payment transactions. We reviewed Intergovernmental Agreements, amendments, and other supporting documentation provided by the Department.

How were the results of the audit work measured?

Our audit work was designed to measure the Department’s compliance with the following criteria:

• Federal regulation [2 CFR 200.303] states that the Department, as a federal grant recipient, must “establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award.”

• Federal regulation [2 CFR 200.332 (a)(1)] states that the Department’s subawards must clearly identify certain information, including but not limited to, the ALN, the Federal Award Date, and the FAIN.

• Federal regulation [2 CFR 200.331] states that a pass-through entity, in this case the Department, must make case-by-case determinations as to whether each agreement it makes for the disbursement of federal program funds represents a payment of funds to a subrecipient or a contractor, depending on the role the entity plays.

What problems did the audit work identify?

We determined that the Department did not fully comply with subrecipient monitoring requirements during Fiscal Year 2024. Specifically, we noted the following:

• Formula Grants for Rural Areas and Tribal Transit Program

o For 10 of 40 (25 percent) subrecipient payment transactions selected for testing, we determined the subaward documents did not contain the federal award date in the subaward agreement, as required. The 10 transactions totaled $7,432,248 in subrecipient awards.

• Highway Safety Cluster

o For 1 of 40 (3 percent) subrecipient payment transactions selected for testing, we determined that the subrecipient should have been classified as a contractor, not a subrecipient. The transaction totaled $75,325. The Department had not made an adjusting entry in CORE to reclassify the transaction and correct this error by the end of our audit testwork.

o For 5 of 40 (13 percent) subrecipient payment transactions selected for testing, we determined the subaward documents did not contain the federal award date in the subaward agreement. The 5 transactions totaled $25,100 in subrecipient awards.

• SLFRF

o For 2 of 29 (7 percent) subrecipient payment transactions selected for testing, we determined that the Intergovernmental Agreement did not include the FAIN and Federal Award Dates. The 2 transactions totaled $3,277,779 in subrecipient awards.

o For 1 of 29 (3 percent) subrecipient payment transactions selected for testing, we determined the transaction did not include the ALN. This transaction totaled $1,851,279 in subrecipient awards.

Why did these problems occur?

The Department’s procedures and internal controls were not sufficient to ensure that Intergovernmental Agreements and subawards included all the required information to be included in the subaward, and internal controls did not prevent or detect errors. Department staff were not aware that this information was needed for the subaward to be in compliance with federal regulations. In some situations, the FAIN was only provided to the Department from the U.S. Department of Transportation subsequent to when the subaward was made. In these instances, the Department was not aware that they were required to provide the FAIN to their subrecipients once it was determined by the U.S. Department of Transportation.

The Department’s procedures and internal controls were not sufficient to ensure that payments were properly classified as general disbursements or subrecipient payments, and internal controls did not prevent or detect errors. Department staff lacked the appropriate knowledge of the difference in contractors and subrecipients to ensure the proper classification of expenditures. The Department’s reviewers did not complete a sufficient review of the expense classifications to be able to identify the misclassification and propose a subsequent correction.

Why do these problems matter?

Based on the issues we identified, the Department is out of compliance with federal subrecipient requirements and could face sanctions or other penalties. In addition, by failing to properly report the required federal grant award information at the time of subaward issuance, subrecipients may be uninformed about what funding the subaward related to. This could result in misclassification of subaward information on the subrecipients’ Schedules of Expenditures of Federal Awards (SEFA) and the subrecipient may not know what federal requirements they need to follow as part of receiving the federal award funds. The Department’s improper classification of expenses as general disbursements versus subrecipient payments could lead to misstatements in the amounts reported on the SEFA, both for the State as a whole and at the subrecipient level. See Schedule of Findings and Questioned Costs for chart/table.

Recommendation 2024-058

The Department of Transportation (Department) should strengthen its internal controls over and ensure that it complies with federal subrecipient monitoring requirements for the Formula Grants for Rural Areas and Tribal Transit Program, the Highway Safety Cluster, and the Coronavirus State and Local Fiscal Recovery Funds. Specifically, the Department should ensure that all required information is included in subawards or intergovernmental agreements or provide amendments to the subawards or intergovernmental once the Department receives the necessary information from the federal government, and that Department staff are sufficiently aware of the difference in subrecipients and contractors and properly classify general disbursements versus subrecipient payments.

Response Department of Transportation

Agree Implementation Date: June 2026

Department will strengthen controls to ensure that the required award information is provided, once available. Certain information such as Federal Award Identification Number and Federal Transit Administration and National Highway Traffic Safety Administration award date are not available at the time of contracting CDOT is working on a process to provide this information, once it is available in a publicly available format on CDOT’s website or on a subrecipient facing grant management site. We will add a note to the contract explaining where the information will be posted on our site when it becomes available. The Department will also identify staff requiring additional training on classification and coding for contractors vs. subrecipients.

The following finding and recommendation relating to an internal control deficiency classified as a Material Weakness was communicated to Treasury in the previous year and has not been remediated as of June 30, 2024 because the original implementation dates provided by Treasury were in a subsequent fiscal year. This complete finding and recommendation can be found within the original report and the complete recommendation can be found within Section IV: Prior Audit Recommendations of this report.

Finding 2023-081 Minerals Leasing Act—Subrecipient Monitoring

In 1920, the U.S. Congress passed the Minerals Leasing Act. This Act directs the federal Office of Natural Resources Revenue (ONRR) within the U.S. Department of the Interior to share 50 percent of mineral leasing revenue received by the ONRR with states that generate mineral lease revenue. Mineral lease revenue results from payments made to the federal government by companies that lease federal land for the right to extract minerals from that land. According to the Act, revenue is to be used by states as each individual state’s legislature directs, giving priority to those sections of the state that are socially or economically impacted by the extraction of minerals.

For Colorado, ONRR distributes Minerals Leasing Act Program (Program) funds to Treasury, which passes through Program funds to the Department of Local Affairs (DOLA), the Department of Natural Resources (DNR), the Department of Higher Education (DHE), and the Department of Education (DOE), as prescribed by Section 34-63-102, C.R.S. In turn, DOLA passes the majority of the Program funds it receives to local governments impacted by mineral leasing, such as cities and counties. These local governments may use Program funds for “…planning; construction and maintenance of public facilities; and provision of public services.”

During Fiscal Year 2023, ONRR distributed approximately $173.0 million in Program revenue to Treasury. Treasury passed all of the Program funds to DOLA, DNR, DHE, and DOE. DOLA then passed approximately $68.9 million of the $72.3 million in Program funds it received to local government subrecipients. DOLA retained the remaining $3.4 million in Program funds to cover administrative costs. DNR, DOE, and DHE spent the Program funds at the state level and did not pass any of the funds through to subrecipients.

What was the purpose of our audit work and what work was performed?

The purpose of the audit work was to determine whether Treasury had adequate internal controls in place over, and complied with, federal subrecipient monitoring and reporting requirements for the Program during Fiscal Year 2023.

As part of our testing, we reviewed Treasury’s progress in implementing our Fiscal Year 2022 audit recommendation related to subrecipient monitoring and reporting requirements for the Program. During that audit, we found that Treasury did not communicate, or ensure that DOLA communicated, the required award information and applicable federal compliance requirements to all Program subrecipients in accordance with federal regulations. As a result of our testwork, we recommended that Treasury strengthen its internal controls to ensure that it complies with federal requirements for subrecipient monitoring for the Program by developing an effective monitoring process to ensure that required federal award information is communicated to Program subrecipients, including the Assistance Listing Number, program name, and dollar amount made available to subrecipients, and the related federal requirements.

As part of our testing, we conducted interviews with Treasury staff regarding its process over the monitoring of Program funds during Fiscal Year 2023.

How were the results of the audit work measured?

We measured the results of our audit work against the following requirements:

Federal regulations [2 CFR 200.303] require that Treasury, as a federal grant recipient, establish and maintain effective internal controls over federal awards that provide reasonable assurance that awards are being managed in compliance with federal statutes, regulation, and the terms and conditions of the federal award.

The Minerals Leasing Act of 1920, as amended in 1976, states that Program funds should be provided to those subdivisions socially or economically impacted by the development of minerals leased for planning, construction, and maintenance of public facilities.

Federal regulations [2 CFR 200.331] require a pass-through entity to make case-by-case determinations regarding whether each agreement it makes for the disbursement of federal program funds casts the party receiving the funds in the role of a subrecipient or a contractor. A subrecipient is a non-federal entity that expends federal awards received from a pass-through entity to carry out a federal program, but does not include an individual that is a beneficiary receiving direct payments from such a program. A contractor is a dealer, distributor, merchant, or other seller providing goods or services that are required to conduct a federal program; these goods or services may be for an organization’s own use or for the use of beneficiaries of the federal program. The following paragraphs detail requirements for subrecipients.

Federal regulations [2 CFR 200.332 (a)(1)(2) and (3)] require that Treasury, as the primary recipient of Program funds, ensure that every pass-through of federal funds it makes clearly identify all requirements that Treasury imposed on the subrecipient so that the federal award is used in accordance with federal statutes, regulations, and the terms and conditions of the award, as well as specify any additional requirements that Treasury imposes on the subrecipient in order for Treasury to meet its own responsibility for the federal award (e.g., financial, performance, and special reports). In addition, regulations require that Treasury, ensure that every subaward it makes is clearly identified to the subrecipient as a subaward, and that Treasury, or DOLA, provides specific information about the Program to the subrecipients, including, but not limited to, the following:

• Assistance Listing Number

• Name of the program, name of the federal awarding agency, and name of the department awarding the Program funds

• Contact information for Treasury

• Dollar amount made available to the subrecipient

• Reporting requirements

Federal regulation [2 CFR 200.332(b)] requires that Treasury, as the primary recipient of Program funds, ensure DOLA staff conducts risk assessments for each subrecipient’s risk of noncompliance with federal statutes, regulations, and the terms and conditions of the subaward. In addition, the Treasury should ensure that DOLA staff use the risk assessments to determine the appropriate level of subrecipient monitoring that DOLA staff should perform on each subrecipient. Specifically, federal regulations [2 CFR 200.332(d)-(e)] require that Treasury, as the primary recipient of Program funds, ensure that DOLA staff monitor the subrecipient activities as necessary to ensure that the subaward is used for authorized purposes, complies with the terms and conditions of the subaward, and achieves performance goals. Monitoring must include:

• Reviewing financial performance reports.

• Following up and ensuring the subrecipient takes timely and appropriate action on all deficiencies pertaining to the federal award.

• Issuing a management decision for audit findings pertaining to the federal award provided to the subrecipient from the pass-through entity, as required by 2 CFR 200.521.

The State and any local governments receiving federal funds are required to present a Schedule of Expenditures of Federal Awards (SEFA) in accordance with the requirements of Title 2 U.S. Code of Federal Regulations Part 200, Uniform Administrative Requirements, Cost Principles, and Audit Requirements for Federal Awards (Uniform Guidance). Federal regulations [2 CFR 200.501(b)] specifically require that the SEFA include information on each federal award expended during the year, including the total amount provided to subrecipients from each federal award. Any non-federal entity that expends $750,000 or more in total federal awards during the entity’s fiscal year must undergo a Single Audit or program-specific audit for that year. Federal regulation [2 CFR 200.332(f)] require that Treasury, as the primary recipient of the Program funds, ensure or communicate to DOLA that any non-state subrecipients receiving federal funds from the State during a given fiscal year report the funds on their respective SEFA and, if applicable, undergo a Single Audit.

The Exhibit K1, Schedule of Federal Assistance, is used by the State’s departments and institutions of higher education to report federal expenditure information to the Office of the State Controller (OSC) to aid the OSC in preparing the State’s SEFA. The instructions state that the OSC relies on the accuracy of amounts and other information reported on the various Exhibits in preparing the SEFA each year.

What problems did the audit work identify?

We found that Treasury did not implement our prior audit recommendation related to federal subrecipient monitoring for the Program during Fiscal Year 2023. Specifically, we identified the following:

• Treasury reported that DOLA did not perform a subrecipient versus contractor determination to ensure proper compliance with the subaward requirement and reporting of information to Treasury for its federal reporting.

• Treasury did not communicate, or ensure that DOLA communicated, the required award information and applicable federal compliance requirements to all Program subrecipients in accordance with federal regulations. In response to our prior audit recommendation, Treasury staff reported that they continue working with DOLA to ensure that required information is communicated to all subrecipients in compliance with state and federal regulations. In addition, Treasury reported that they are working with the Attorney General’s Office toward the implementation of an interagency agreement that will establish expectations for DOLA. However, as of the end of the fiscal year, this interagency agreement was not signed or in place.

• Treasury did not ensure that DOLA performed risk assessments for each subrecipient’s risk of noncompliance with federal statutes, regulations, and the terms and conditions of the subaward. In addition, Treasury did not ensure that DOLA used the risk assessments to determine the appropriate level of subrecipient monitoring on each subrecipient.

• Treasury did not have a process in place to ensure that DOLA monitors the activities of the subrecipient as necessary to ensure that the subaward is used for authorized purposes, complies with the terms and conditions of the subaward, and achieves performance goals.

• Further, Treasury, as the primary recipient of Program funds, did not ensure that it or DOLA communicated and followed up with any non-state subrecipients receiving federal funds from the State during Fiscal Year 2023 to ensure the subrecipients reported the funds on their respective SEFAs and, if applicable, underwent a Single Audit.

Why did these problems occur?

Overall, Treasury did not have adequate internal controls in place during Fiscal Year 2023 to ensure that it complied with federal subrecipient monitoring requirements for the Program. Specifically, Treasury staff indicated that DOLA determined during Fiscal Year 2023 that it does not have any Program subrecipients, but Treasury did not obtain and review any subrecipient versus contractor determinations from DOLA to verify the appropriateness of the determinations. Alternatively, Treasury did not perform its own assessment of subrecipient versus contractor status for the Program payments or obtain clarification from the Attorney General, as necessary, regarding the determination. Treasury also did not have a monitoring process in place to ensure that either Treasury or DOLA staff communicated required federal award information and related federal reporting requirements to all subrecipients of Program funds—including a communication that any subrecipients receiving Program funds from the State during Fiscal Year 2023 were required to report the funds on their respective SEFAs and, if applicable, undergo a Single Audit. In addition, Treasury did not ensure that DOLA performed risk assessments for each subrecipient’s risk of noncompliance with federal statutes, regulations, and the terms and conditions of the subaward. Neither Treasury or DOLA monitored the activities of the subrecipients, as necessary, to ensure that the subawards are used for authorized purposes, comply with the terms and conditions of the subawards, and achieve performance goals.

Why do these problems matter?

The subrecipient versus contractor determinations help Treasury or DOLA to assess specific federal requirements that have to be followed, and ensure the proper reporting on Treasury’s Exhibit K1. Because the OSC uses the Exhibit K1 to prepare the State’s SEFA, errors on the Exhibit K1 can lead to the SEFA being misstated and the Department reporting erroneous information to the federal government. This is particularly important given the large amount of federal funds that Treasury pays annually to its subrecipients. By continuing to fail to fulfill the Program’s subrecipient monitoring requirements, Treasury, and the State as a whole, are out of compliance with the provisions of Program awards. Ultimately, insufficient monitoring of Program subrecipients could result in future federal funding being reduced. If Treasury does not appropriately communicate SEFA reporting requirements to other state agencies and non-state subrecipients in the future, it could result in local governments not undergoing Single Audits, as required. Further, without evaluating its subrecipients’ risks of noncompliance and using the results of that assessment to target monitoring of higher-risk entities, Treasury does not have assurance that it appropriately monitors its subrecipients and identifies issues.

Recommendation 2023-081

The Department of Treasury (Treasury) should strengthen its internal controls related to, and ensure it complies with, federal requirements for subrecipient monitoring and reporting for the Minerals Leasing Act Program (Program) by:

A. Requiring other State agencies, including the Department of Local Affairs, to whom Treasury subgrants Program funds, to perform subrecipient versus contractor determinations to identify Program subrecipients and to perform appropriate subrecipient monitoring procedures. As needed, this should include obtaining clarification from the Attorney General as to whether parties to whom Treasury or its subgrantor state agencies send Program funds are subrecipients or vendors.

B. Ensuring that it reports Program funds properly on its Exhibit K1, Schedule of Federal Assistance, including that expenditures are accurately presented as direct or pass-through subrecipient expenditures.

C. Developing effective processes to ensure that required federal award information, including the Assistance Listing Number, federal program name, and dollar amount, are made available to the subrecipient, the related federal requirements are communicated to Program subrecipients, and the subrecipients report the funds on their respective annual Schedule of Expenditures of Federal Awards and, if applicable, undergo a Single Audit. This should include communicating all requirements imposed by the grantor agency on the subrecipient so Program funds are used in accordance with federal statutes, regulations, and the terms and conditions of the subaward, and that Treasury meets its own responsibility for the federal award.

D. Developing an effective monitoring process to ensure risk assessments of subrecipients and monitoring of subrecipients are performed.

Response Department of the Treasury

A. Agree Implementation Date: December 2026

Treasury has been working with the Department of Local Affairs (DOLA) on a pilot program for monitoring and compliance of fund recipients and was in the process of instituting an Interagency Agreement with DOLA on this matter. Treasury will pursue further guidance from the Attorney General's office on federal rules interpretation regarding subrecipients. Treasury plans to continue to work with DOLA to aid in determining what financial resources and FTE may be necessary to ensure monitoring and compliance is successful.

B. Agree Implementation Date: December 2026

The Department will seek guidance from the Attorney General's Office regarding federal rules interpretation to ensure distributions are properly identified. DOLA distributes the funds once received from Treasury, and therefore Treasury will work with DOLA as well to ensure there is agreement on subrecipient identification.

C. and D. Agree Implementation Date: December 2026

As discussed in the Department response to Item A above, Treasury has been in the process of creating an Interagency Agreement with DOLA regarding compliance and monitoring of fund recipients. The Department will rely on guidance on this matter from the Attorney General, which is already in process. Additionally, the Department hopes to work in partnership with DOLA to determine what financial resources are necessary - and to be supportive of such a request - to implement a monitoring and compliance system, as the Attorney General's office may recommend.

Finding 2023-049 Federal Funding Accountability and Transparency Act

The federal Child Care and Development Fund Cluster (CCDF) [ALN 93.575, Child Care and Development Block Grant; and ALN 93.596, Child Care Mandatory and Matching Funds of the Child Care and Development Fund] provides financial assistance to states to increase the availability, affordability, and quality of child care services for low-income families in which the parents or adult caretakers of the children are working, or attending training or educational programs. In Colorado, this program is referred to as the Colorado Child Care Assistance Program (CCCAP). The Department is responsible for overseeing CCCAP and ensuring that it complies with the program’s requirements. CCCAP is administered at the local level by the county departments of human/social services, and the Department is responsible for monitoring the counties’ administration of CCCAP.

The Department is required to comply with the Federal Funding Accountability and Transparency Act of 2006 (Transparency Act or FFATA) for CCDF. The Transparency Act was created to empower Americans with the ability to hold the government accountable for each spending decision and, as a result, to reduce wasteful spending by the government. The Transparency Act requires the federal government to make certain information on federal awards available to the public.

In accordance with the Transparency Act, the Department is required to report information about subgrants, or subawards, given to other governments or to nonprofit organizations, also referred to as subrecipients. Federal regulations [2 CFR 200.1] define a subaward as an award provided by a pass-through entity, in this case the Department, to an entity to carry out part of a federal grant award received by the pass-through entity. A subrecipient is defined in federal regulations [2 CFR 200.1] as “an entity, usually but not limited to non-Federal entities, that receives a subaward from a pass-through entity to carry out part of a federal award; but does not include an individual that is a beneficiary of such award. A subrecipient may also be a recipient of other Federal awards directly from a federal awarding agency.” In Fiscal Year 2023, the Department submitted 19 FFATA reports, totaling approximately $15.7 million for 15 subrecipients for the Child Care and Development Block Grant [ALN 93.575].

The Department is required to submit FFATA information through the Federal Funding Accountability and Transparency Act Subaward Reporting System (FSRS). Once the Department submits a report to FSRS, the public can view information from the report, including the subrecipient’s name, subaward identification number, subaward obligation/action date, subaward amount, federal awarding agency and subagency, the Department’s name, and the Department’s grant award identification number.

What was the purpose of our audit work and what work was performed?

The purpose of our audit work was to determine whether the Department had adequate internal controls over and complied with FFATA reporting requirements for the CCDF during Fiscal Year 2023.

As part of our audit work, we requested the Department’s policies and procedures over FFATA reporting, the 19 FFATA reports submitted by the Department in Fiscal Year 2023, supporting documentation for the reports, and a list of all subawards made by the Department during Fiscal Year 2023.

How were the results of the audit work measured?

We measured the results of our audit work against the following:

In accordance with federal regulation [2 CFR 170.330.l(a)], the Department is required to report subawards of $30,000 or more to FSRS by the end of the month following the month in which the award was made. For example, the Department would have to submit a FFATA report to FSRS in May 2023 if an award or supplemental award equal to or greater than $30,000 was made in April 2023.

Federal regulation [2 CFR 200.303] requires the non-federal entity—in this instance the Department—to establish and maintain effective internal controls over the federal award that provides reasonable assurance that the non-federal entity is managing the federal award in compliance with federal statutes, regulations, and the terms and conditions of the federal award.

What problem did the audit work identify?

Based on our audit work, the Department did not provide us with the subawards it awarded to its subrecipients, and we could not determine if the Department submitted all of the reports required for CCDF for Fiscal Year 2023. Additionally, while the Department provided supporting spreadsheets for the reports submitted, including dates each report was submitted, the Department did not provide evidence of that date, such as a screen shot in FSRS, or any other evidence to show, that the reports they did submit were made in a timely manner and in accordance with federal regulations. The following table summarizes the results of our testing and groups each exception within the following categories: subaward not reported, report not timely, subaward amount incorrect, and subaward missing key elements.

Why did this problem occur?

CCDF was previously administered by the Department of Human Services (DHS), and this is the first year that the Department was in charge of the program. According to the Department, DHS performed FFATA reporting for Fiscal Year 2023 for CCDF, and the Department could not obtain the subaward documents made to the subrecipients from DHS or evidence that the reports were submitted on time. CCDF staff reported that they are working to implement effective internal controls, including policies and procedures to ensure they maintain the appropriate documentation, to ensure compliance with FFATA requirements.

Why does this problem matter?

By failing to obtain and maintain appropriate documentation, the Department cannot demonstrate that it complied with federal requirements to properly report subawards to FSRS, and, therefore, risks federal sanctions. In addition, it fails to meet the federal intent of transparency for federal program spending.

Recommendation 2023-049

The Department of Early Childhood (Department) should implement internal controls for the Child Care and Development Fund Cluster by developing policies and procedures to ensure that it complies with requirements under the Federal Funding Accountability and Transparency Act. These procedures should include requirements to maintain supporting documentation, including evidence of timely submission and subaward documentation for awards made to subrecipients, as required.

Response Department of Early Childhood

Agree Implementation Date: March 2024

The Department of Early Childhood agrees with this recommendation. HB 21-1304, created the new state Department of Early Childhood beginning July 1, 2022. Previously, programs and services related to early childhood were primarily located in the Colorado Department of Human Services. The Department of Early Childhood has been transitioning out of the Colorado Department of Human Services and the operational support inter-agency agreement requiring CDHS to provide administrative support for CDEC, including Federal Funding Accountability and Transparency Act (FFATA) reporting, ended 12/31/23. CDEC is currently developing and implementing procedures to validate financial data used to compile FFATA reporting, this process will include steps to resolve identified discrepancies quickly to ensure that reports are submitted timely as required.

Finding 2023-050 Colorado Child Care Assistance Program

The Department is responsible for monitoring each county’s administration of CCCAP. County caseworkers enter a CCCAP adult caretaker’s application information, including household employment and income, household size, and the names and number of children needing care, into the Department’s Child Care Automated Tracking System (CHATS). CHATS aggregates the information for the county caseworker to determine whether an adult caretaker applying for benefits will be eligible for CCCAP assistance. For example, the adult caretaker’s household income must not exceed 85 percent of the State’s median household income. CHATS uses the household income and the household size entered by the county caseworker to calculate the copayment amount, or parent fee, the household must pay per month for child care services. CHATS then generates a letter that must be sent by the county caseworker to the household that summarizes the information and must be verified by the adult caretaker.

In addition to families that apply for child care assistance, CCCAP also provides child care benefits for children in protective services and for families in the Temporary Assistance for Needy Families, or Colorado Works, program. Children in protective services have been placed by the county departments of human/social services in a foster care home. The Colorado Works program provides assistance to families in need by providing benefits to help families become self-sufficient.

During Fiscal Year 2023, the Department provided approximately $133.2 million in child care benefits through CCCAP for 24,592 children.

What was the purpose of our audit work and what work was performed?

The purpose of the audit work was to determine whether the Department had adequate internal controls over CCCAP enrollment processing and to determine whether the Department complied with federal and state CCCAP requirements during Fiscal Year 2023.

During our audit, we reviewed the Department’s internal controls over CCCAP that were in place during Fiscal Year 2023. In addition, we performed testing of a sample of 60 children who were deemed eligible for child care services through CCCAP and received $348,581 in CCCAP benefits during Fiscal Year 2023 to determine whether the children’s eligibility was correctly determined. Our testing included reviewing the supporting documentation and the case files for each sample, along with determining the accuracy of data entered into CHATS. We performed testwork to determine whether the county caseworkers obtained and maintained the required documents supporting the eligibility determinations and annual redeterminations in the case files and determined eligibility in a timely manner.

How were the results of the audit work measured?

We measured the results of our audit work against the following:

• According to federal regulation [45 CFR 98.11], the Department “has broad authority to administer the program through other governmental or non-governmental agencies”, such as county departments of human/social services. In addition, the regulation states that the Department “shall retain overall responsibility for the administration of the program” including monitoring programs and services, and ensuring that the departments of human/social services “operate according to the rules established for the program.”

• State regulation [8 CCR 1403-1, 3.103.YYY] defines a parent fee or copayment as the “household’s contribution to the total cost of child care paid directly to the child care provider(s) prior to any state/county child care funds being expended.”

• State regulation [8 CCR 1403-01, 3.124.A] states that “parent fees are based on gross countable income for the child care household compared to the household size, taking the number of children in care into account.”

What problems did the audit work identify?

We found that the Department did not fully comply with federal and state CCCAP requirements during Fiscal Year 2023. Specifically, we identified errors in 2 of the 60 case files (3 percent) that we tested, resulting in a total of $1,543 in known questioned costs. Specifically, we identified the following:

In two cases, the caseworker incorrectly entered information into CHATS when determining eligibility, which resulted in the adult caretakers being charged an incorrect parent fee. In one case, the caseworker entered the adult caretaker’s income incorrectly as $2,125 instead of the correct amount of $2,215, which caused the parent fee to be incorrectly calculated as $848 instead of the correct amount of $879. In the other case, the caseworker incorrectly entered the number of hours worked by the adult caretaker when calculating the caretaker’s income, which resulted in the income being incorrectly calculated as $1,974 instead of the correct amount of $3,637, which caused the parent fee to be incorrectly calculated as $352 instead of the correct amount of $551. Because parent fees are required to be paid before CCCAP benefits are paid, the errors in these two case files resulted in $1,543 in known questioned costs.

Why did these problems occur?

The Department lacked sufficient internal controls to ensure compliance with federal and state requirements for CCCAP during Fiscal Year 2023. The program was previously administered by the DHS, and this is the first year that the Department was in charge of the program. Program staff reported that they are working to implement effective internal controls, including policies and procedures requiring that Department CCCAP staff adequately monitor the county departments of human/social services to ensure the counties are conducting a secondary review over child care case files.

Why do these problems matter?

It is essential for the Department to ensure that child care eligibility is properly determined in accordance with state and federal regulations. Inaccurate processing of case file information for eligibility determination can result in counties improperly granting CCCAP benefits to ineligible individuals, denying benefits to eligible individuals who rely on those benefits in order to work and provide for their families, or assessing an incorrect parent fee. The federal government can disallow the payment of federal funds for program expenditures that do not adhere to regulations, which would require the State to use General Funds to cover the expenditures.

Recommendation 2023-050

The Department of Early Childhood (Department) should strengthen its internal controls over, and ensure it complies with, requirements for the federal Child Care and Development Fund Cluster grant by monitoring the county departments of human/social services to ensure they are performing supervisory and/or secondary reviews over case files after eligibility is determined in order to ensure eligibility is appropriately determined and that parent fees are accurate, and to address the issues identified in the audit.

Response Department of Early Childhood

Agree Implementation Date: December 2024

In December 2023, CCCAP automated case reviews in CHATS and required counties to submit reviews monthly. The results of the reviews are included in the performance monitoring process. The information gathered from the reviews will be used to target policy and system improvements and identify future training needs. Policy and system improvements to identify future training needs will be completed by December 2024.

Finding 2023-051 Federal Funding Accountability and Transparency Act

The Federal Funding Accountability and Transparency Act (Transparency Act or FFATA) was created to empower Americans with the ability to hold the government accountable for each spending decision and, as a result, to reduce wasteful spending by the government. The Transparency Act requires the federal government to make certain information on federal awards available to the public. In order to obtain this information, grant recipients are required to provide certain information to the federal government. For example, the federal Department of Education (DOE) requires the Department to report information about subgrants, or subawards, it gives to other governments or to nonprofit organizations (also referred to as subrecipients) from the DOE grants it receives. Federal regulations [2 CFR 200.1] define a subaward as an award provided by a pass-through entity, in this case the Department, to an entity to carry out part of a Federal grant award received by the pass-through entity. The Department is specifically required to file FFATA reports through the FFATA Subaward Reporting System (FSRS). Once the Department submits a report to FSRS, the public can view certain information from the report, including the subrecipient’s name, subaward identification number, subaward obligation/action date, subaward amount, federal awarding agency and subagency, the Department’s name, and the Department’s grant award identification number.

The Department is required to file a FFATA report in the following circumstances:

• If the initial award is equal to or more than $30,000;

• If subsequent grant modifications result in a total award equal to or more than $30,000;

• If the initial award is equal to or more than $30,000, but funding is subsequently de-obligated such that the total award amount falls below $30,000.

The Department’s required FFATA reports for Fiscal Year 2023 included information on the COVID-19 Education Stabilization Fund (ESF) [ALN 84.425], specifically the Elementary and Secondary School Emergency Relief (ESSER) Fund [ALN 84.425D] and the American Rescue Plan ― Elementary and Secondary School Emergency Relief (ARP ESSER) [ALN 84.425U]. FFATA reporting was required for the Department because the Department passed through funds to one or more subrecipients for both programs in excess of $30,000.

The Department is required to report the subaward information in FSRS no later than the end of the month following the month in which the award was made. According to the Department, during Fiscal Year 2023, it was required to submit 562 FFATA reports for ESF.

What was the purpose of our audit work and what work was performed?

The purpose of the audit work was to determine whether the Department had adequate internal controls over FFATA reporting during Fiscal Year 2023 and whether the information in the Department’s submitted FFATA reports was accurate and submitted in a timely manner. Another purpose of the audit work was to follow up on our Fiscal Year 2022 audit recommendation to improve the Department’s process for determining the timing of reporting within FSRS, and, additionally, to continue developing and implementing FFATA reconciliation procedures to identify subawards that went unreported during the fiscal year. The Department planned to implement this recommendation by December 2022.

During the Fiscal Year 2023 audit, we requested a list of all ESF subawards the Department made during Fiscal Year 2023. We then selected a sample of 25 ESF subawards and requested copies of the FFATA reports that the Department uploaded to the FSRS system. The full FFATA reports are only accessible by the Department and are not fully viewable on FSRS.

Once the Department provided copies of the uploaded reports, we then reviewed the FFATA reports within FSRS for each subaward selected for testing to determine if the FFATA report was made in a timely manner in accordance with federal regulations.

How were the results of the audit work measured?

We measured the results of our audit work against the following requirements:

In accordance with federal regulations [2 CFR 170], direct recipients of federal grants are required to report subawards of $30,000 or more to FSRS by the end of the month following the month in which the award was made. For example, the Department would have to submit a FFATA report to FSRS in May 2023 if an award or supplemental award equal to or greater than $30,000 was made in April 2023.

Federal regulations [2 CFR 200.303] require the non-federal entity—in this instance the Department—to establish and maintain effective internal controls over the federal award that provides reasonable assurance that the non-federal entity is managing the federal award in compliance with federal statutes, regulations, and the terms and conditions of the federal award.

What problem did the audit work identify?

Based on our audit work, we determined that the Department partially implemented the Fiscal Year 2022 recommendation by its planned implementation date of December 2022. While the Department improved its process for determining the timing of reporting within FSRS, for the Fiscal Year 2023 sample we tested, we determined that the Department was late in reporting 11 of 25 ESF subawards (44 percent) by approximately 2 to 7 months. Collectively, these subawards totaled about $160.3 million for Fiscal Year 2023. The following table summarizes the results of our testing.

Why did this problem occur?

During part of Fiscal Year 2023, the Department did not have a control, such as a reconciliation, to help identify subawards that went unreported during the fiscal year. Further, when attempted submissions resulted in errors, the Department did not have a process in place to document the failed submission attempt.

Why does this problem matter?

By failing to properly report FFATA subawards through FSRS, the Department is out of compliance with federal reporting requirements and risks federal sanctions. In addition, the Department fails to meet the federal intent of transparency for federal program spending.

Recommendation 2023-051

The Department of Education should strengthen its internal controls over and ensure it complies with requirements under the Federal Funding Accountability and Transparency Act reporting for the COVID-19 Education Stabilization Fund by:

A. Continuing to develop and implement reconciliation procedures to identify subawards that need to be reported each month.

B. Developing procedures for documenting submission attempts that were unsuccessful and documenting any and all resubmission attempts until final acceptance is achieved.

Response Department of Education

A. Agree Implementation Date: August 2023

The process improvement was implemented in January 2023. As such, there was ‘catch up’ to be completed over the following months as we re-reconciled all of our federal awards against our allocation database and USASpend.gov. This represents a portion of the uncompliant reports. The other portion would be made up of several awardees whose profiles in FSRS would not accept any uploaded allocations. As of August 30, 2023, the reconciliation process is occurring much more consistently, on a monthly basis.

B. Agree Implementation Date: August 2023

It is worth noting that in FY22 and into FY23 the General Services Administration (GSA) made changes to the congressional district field in the FFATA upload process, which did finally allow some of the these that errored out, to finally post. In addition, some of these that we were able to finally post, as a result of our reconciliation, would only be accepted through the FSRS system if they were keyed individually, creating a tremendous burden. Currently, we have a process in place to save ‘error’ files when this occurs, as evidence of the timely submission, although failing in FSRS through no fault of our own.

The following finding and recommendation relating to an internal control deficiency classified as a Significant Deficiency was communicated to the Office of the Governor’s Office of Information Technology (OIT) in the previous year and has not been remediated as of June 30, 2023 because the original implementation date provided by OIT was in a subsequent fiscal year. This complete finding and recommendation can be found within the original report and the complete recommendation can be found within Section IV: Prior Audit Recommendations of this report.

Findings 2022-080 through 2022-084 Department of Human Services—Foster Care Program

The [the auditor] conducted the Fiscal Year 2022 audit work that resulted in findings and recommendations addressed to the Department related to the Foster Care Title IV-E program. These findings and recommendations, and the responses, are included in the Department of Human Services – Foster Care Program chapter at III-125 within this section of the report. See Recommendations 2022-080 through 2022-084.

These recommendations are classified as Material Weaknesses and Significant Deficiencies.

The following findings and recommendations relating to internal control deficiencies classified as Material Weaknesses were communicated to the Department in the previous year and have not been remediated as of June 30, 2022 because the original implementation dates provided by the Department were in a subsequent fiscal year. These complete findings and recommendations can be found within the original report and the complete recommendations can be found within Section IV: Prior Audit Recommendations of this report.

Findings 2022-083 and 2022-084 Trails—Information Security

Government Auditing Standards allow for information that is considered sensitive in nature, such as detailed information related to information technology system security, to be issued through a separate “classified or limited use” report because of the potential damage that could be caused by the misuse of this information. We consider the specific technical details of this finding, along with the responses, to be sensitive in nature and not appropriate for public disclosure. Therefore, the details of the following finding and responses have been provided to the Department and OIT in a separate, confidential memorandum.

The Department utilizes Trails, its statewide automated child welfare information system, to aid in administering a number of federally-funded child welfare programs, including the Program. Trails went live in 2001 and, in Fiscal Year 2017, the Department and the Governor’s Office of Information Technology (OIT) began a multi-phase and multi-year modernization project that continued during Fiscal Year 2022.

The Department is the business owner and is responsible for designing information security processes for the Trails application. To meet management’s IT expectations, the role of Trails Security Administrator was established to conduct Trails application access management procedures.

OIT, as the IT service provider, works closely with the Department and is also responsible for conducting certain access management procedures. What was the purpose of our audit work and what work was performed?

The purpose of our Fiscal Year 2022 audit work was to determine whether the Department and OIT designed effective procedures for and configured Trails to address risks associated with information security. Our audit work was performed through interviews conducted of Department and OIT staff and reviewing supporting documentation.

How were the results of the audit work measured?

We measured the results of our audit work using the following criteria:

• Colorado Information Security Policies (Security Policies), which are developed and published by OIT.

• Standards for Internal Control in the Federal Government (Green Book) published by the U.S. Government Accountability Office (GAO).

What problems did the audit work identify?

Based on our Fiscal Year 2022 audit work, we identified problems with information security, access management, IT general controls for Trails at both the Department and OIT.

Why did these problems occur?

Department staff did not provide explanations for why the identified access management problems occurred. OIT staff provided an explanation for one of the identified access management problems, but not all of the problems.

Why do these problems matter?

When access management IT general controls are lacking, management cannot ensure their expectations and the entity’s objectives are being met, that risks are responded to appropriately, and that a strong system of internal control is established, which increases the risk of unauthorized access and can impact the confidentiality, integrity, and availability of Trails.

Recommendation 2022-084 Governor’s Office of Information Technology

The Governor’s Office of Information Technology should improve access management IT general controls over Trails, its statewide automated child welfare information system, by:

A. Implementing the recommendation noted in Part A of the confidential finding. B. Implementing the recommendation noted in Part B of the confidential finding. C. Implementing the recommendation noted in Part C of the confidential finding.

Response Governor’s Office of Information Technology

A. Agree Implementation Date: June 2024

OIT will work on implementing recommendations for Part A.

B. Agree Implementation Date: December 2023

OIT will work to implement the recommendation in Part B.

C. Agree Implementation Date: December 2023

OIT will work to implement the recommendations in Part C.

Finding 2023-053 Medicaid Controls Over Eligibility Determinations

The Department is responsible for ensuring that all expenditures under Medicaid are appropriate, and that the State complies with federal and state program requirements. In Colorado, the responsibility for determining recipient eligibility for Medicaid program benefits is shared between local counties, designated Medical Assistance eligibility sites (MA sites), and the State. For Medicaid, individuals and families apply for benefits at their local county departments of human/social services, designated MA sites, or online through the Program Eligibility and Application Kit (PEAK) system. Local counties and MA sites are responsible for administering the benefits application process, entering the required data for eligibility determination into the Colorado Benefits Management System (CBMS), and approving or denying an applicant’s eligibility. An eligible beneficiary’s income and countable resources cannot exceed a limit set by federal and state regulations. CBMS has a system check to mark eligibility as “fail” if the applicant’s reported income exceeds the limit. The CBMS eligibility data feeds into the Colorado interChange system (Colorado interChange), which pays providers for the services that they provide to Medicaid beneficiaries.

If the application is complete, the caseworker enters the information into CBMS, at which point CBMS determines the applicant’s eligibility based on the information entered. If the application is incomplete, a caseworker is responsible for contacting the individual to assist with completing their application.

The Department is responsible for supervising and monitoring the local counties’ and MA sites’ administration of Medicaid eligibility determinations. The Department is also responsible for ensuring that only eligible providers receive reimbursement for their costs of providing allowable services on behalf of eligible individuals.

What was the purpose of our audit work and what work was performed?

The purpose of our audit work was to review the Department’s internal controls over the Medicaid eligibility determination process, as well as to determine whether the Department complied with applicable federal and state Medicaid eligibility requirements during Fiscal Year 2023.

During our audit, we reviewed the Department’s Medicaid eligibility internal controls in place during Fiscal Year 2023. In addition, we performed testing on a random non-statistical sample of 60 beneficiaries to determine if they were properly determined eligible and receiving Medicaid benefits during Fiscal Year 2023. The Department operated under the continuous enrollment condition from July 1, 2022 to March 31, 2023, or 75 percent of the fiscal year. We obtained a listing of 106,314 beneficiaries who were determined to be newly eligible and who had a payment made on their behalf to a Medicaid provider during this period. We noted approximately 63 percent of all beneficiaries that received benefits during Fiscal Year 2023 had claims during the first 3 quarters of the fiscal year. From that listing we selected 38 beneficiaries (63 percent of the total sample) to determine whether those individuals’ Medicaid eligibility determination was appropriate.

The Department started its unwinding process in April 2023 and continued the process through June 2023 (25 percent of the fiscal year). We obtained a list of 62,296 beneficiaries whose eligibility was reviewed as part of the Department’s renewal unwinding process and who had a payment made on their behalf to a Medicaid provider during this period. We noted approximately 37 percent of all beneficiaries that received benefits during Fiscal Year 2023 had claims during the last quarter of the fiscal year. From that list, we selected 22 beneficiaries (37 percent of the total sample), to determine whether those individuals’ Medicaid eligibility determination was appropriate.

Our testing included reviewing supporting documentation, including case files, information in CBMS data fields related to eligibility determination/redetermination, and Medicaid payment information in Colorado interChange. We performed testwork to determine whether the Department ensured that local county and MA site caseworkers obtained and maintained the required documents supporting eligibility determinations in the case files, correctly entered eligibility data into CBMS, and determined eligibility in a timely manner.

Additionally, we reviewed the Department’s progress in implementing our Fiscal Year 2020 audit recommendation related to Medicaid eligibility. During the prior audit, we recommended the Department strengthen its internal controls over Medicaid by providing adequate training to caseworkers to ensure they properly determine eligibility when processing beneficiary applications.

What problems did the audit work identify and how were the results measured?

We identified at least 1 error in 3 of the 60 Medicaid case files tested (5 percent). These errors resulted in a total of $95 in known questioned costs for Fiscal Year 2023, as shown below.

Details of Errors Identified. Specifically, we found the following:

• Timely Processing. In one case, the caseworker processed the application in 73 days, or 28 days after the required time frame of 45 days. No questioned costs were identified in this instance because the beneficiary was appropriately approved for benefits.

o State regulation [10 CCR 2505-10, 8.100.3.D.] notes that eligibility sites shall process an application for benefits within 90 days for persons who require a disability determination, and 45 days for all other applications.

• Incorrect Income Threshold. In one case, CBMS used the incorrect income threshold for the beneficiary’s eligibility determination. Specifically, CBMS used the income standard that was effective for Fiscal Year 2022 instead of the updated Fiscal Year 2023 income standard. The beneficiary’s income was less than the correct income threshold and, therefore, this error did not result in questioned costs.

o Federal regulation [42 USC 1395w-114] requires an individual to meet income limits in order to receive Medicaid benefits.

• Missing Case File Documentation. In one case, we determined the case file did not have the documentation necessary to support the Medicaid eligibility determination, as required by federal and state regulations. Specifically, the case file was missing a copy of the beneficiary’s birth certificate, or other evidence that the individual was a qualified non-citizen when processing the application. This resulted in known questioned costs of $95.

o Federal regulation [42 CFR 435.914] requires the Department to obtain and maintain documentation to support each beneficiary’s Medicaid eligibility determination.

o State regulation [10 CCR 2505-10, 8.100.3.G.1.g] requires all individuals who apply for Medicaid to be either a citizen of the United States or its Territories, or be a qualified non-citizen. Citizenship or nationality along with identity status must be verified unless satisfactory documentary evidence has already been provided.

Why did these problems occur?

We determined that the Department did not fully implement our prior audit recommendation related to ensuring caseworkers determine eligibility appropriately and in accordance with federal and state regulations. Specifically, caseworkers did not process applications timely, use the correct income thresholds to determine eligibility, and ensure that the required documentation to support eligibility was maintained within the case file.

Why do these problems matter?

As the state Medicaid agency, it is essential for the Department to ensure that Medicaid eligibility determinations are made appropriately and in accordance with federal and state regulations. This includes ensuring that inaccurate processing of information used to determine Medicaid eligibility does not result in Medicaid benefits being provided to, and paid on behalf of, ineligible individuals, or that eligible individuals are denied benefits. Ultimately, the federal government may disallow federal funds for Medicaid program expenditures that do not adhere to regulations, and the State would be required to bear the cost of these errors.

Recommendation 2023-053

The Department of Health Care Policy and Financing should strengthen its internal controls over Medicaid eligibility to ensure compliance with federal and state regulations by addressing the issues identified in the audit. This should include ensuring that local counties and Medical Assistance site caseworkers are appropriately trained and are held to required timelines for processing beneficiary applications, using the correct income thresholds to determine eligibility, and maintaining the required documentation to support eligibility in the case file.

Response Department of Health Care Policy and Financing

Agree Implementation Date: January 2025

The Department recognizes that the training already exists so the Department will work with the individual eligibility sites to develop a Corrective Action plan for timelines for processing beneficiary applications, using the correct income thresholds to determine eligibility, and maintaining the required documentation to support eligibility in the case file.

Finding 2023-054 Children’s Basic Health Plan Controls Over Eligibility Determinations

The Department is responsible for ensuring that all federal CBHP expenditures are appropriate, and that the State complies with federal and state program requirements. In Colorado, the responsibility for determining recipient eligibility for CBHP program benefits is shared between local counties, designated MA sites, and the State. For CBHP, individuals and families apply for benefits in person at their local county departments of human/social services and designated MA sites, or online through the PEAK system. When applying in person, the local counties and MA sites are responsible for administering the benefits application process, entering the required data for eligibility determination into CBMS, and approving or denying applicants’ eligibility. The CBMS eligibility data feeds into Colorado interChange, which pays providers for the services that they provide to CBHP beneficiaries. Once eligibility is determined, the county or MA site is responsible for maintaining records on each applicant in a case file, and then retaining those case files for the periods required by federal and state laws. The Department provides eligibility staff copies of all policy and operational training documents and guides for reference. These documents are meant to provide staff with consistent and accurate program information, and are posted online for all county and MA sites to use.

For CBHP, the Department contracts with managed-care entities, which are groups or organizations of medical service providers that serve CBHP beneficiaries, to provide capitation payments to CBHP providers. Capitation payments are lump-sum monthly payments made to managed care entities, which contract with providers for services. These capitation payments are paid regardless of whether the providers serve beneficiaries during the month or not. Colorado interChange is programmed to pay capitation payments only on behalf of beneficiaries that are deemed eligible in Colorado interChange, based on eligibility information received from CBMS and requirements specified in federal and state regulations.

During the COVID-19 PHE, the State was required to maintain continuous enrollment for CBHP- eligible beneficiaries enrolled as of March 1, 2020. The CCA—enacted December 2022 and taking effect April 1, 2023—ended the continuous enrollment condition on March 31, 2023, which meant the State could begin the unwinding process, returning to normal eligibility and enrollment operations.

What was the purpose of our audit work and what work was performed?

The purpose of our audit work was to review the Department’s internal controls over the CBHP eligibility determination process as well as to determine whether the Department complied with applicable federal and state CBHP eligibility requirements during Fiscal Year 2023. During our audit, we reviewed the Department’s CBHP eligibility internal controls in place during Fiscal Year 2023. In addition, we performed testing on a random, non-statistical sample of 60 beneficiaries to determine if they were properly determined eligible and received CBHP benefits during Fiscal Year 2023. The Department operated under the continuous enrollment condition from July 1, 2022 to March 31, 2023, or 75 percent of the fiscal year. We obtained a list from the Department of 7,978 beneficiaries who were determined to be newly-eligible for CBHP during this period and who had a capitation payment made on their behalf to a CBHP provider between July 1, 2022 and March 31, 2023. From that listing we selected 45 beneficiaries (75 percent of the total sample) to determine whether those individuals’ CBHP eligibility determination was appropriate.

The Department started its unwinding process in April 2023 and continued the process through June 2023 (25 percent of the fiscal year). We obtained a list of 3,006 existing CBHP beneficiaries whose eligibility was reviewed as part of the Department’s renewal unwinding process and who had a capitation payment made on their behalf to a CBHP provider between April 1, 2023 and June 30, 2023. From that list, we selected 15 beneficiaries (25 percent of the total sample)—whose eligibility was ultimately reapproved during the renewal unwinding process—to determine whether those individuals’ CBHP eligibility determination or redetermination was appropriate.

Our testing included reviewing supporting documentation, including case files, information in CBMS data fields related to eligibility determination/redetermination, and CBHP payment information in Colorado interChange. We performed testwork to determine whether the Department ensured that local county and MA site caseworkers obtained and maintained the required documents supporting eligibility determinations in the case files, correctly entered eligibility data into CBMS, and determined eligibility in a timely manner.

Additionally, we reviewed the Department’s progress in implementing our prior audit recommendation related to CBHP eligibility. During our Fiscal Year 2020 audit, we reported that the Department lacked sufficient internal controls to ensure that it complied with federal and state eligibility requirements. At that time, we recommended that the Department strengthen its internal controls over CBHP by providing adequate training to caseworkers to ensure they properly determine eligibility when processing beneficiary applications.

What problems did the audit work identify and how were the results measured?

We identified at least 1 error in 6 of the 60 CBHP case files tested (10 percent). These errors resulted in a total of $7,912 in known questioned costs for Fiscal Year 2023. Specifically, we found the following:

• Timely Processing. In 3 cases, the caseworkers did not process the application within the 45-day requirement. One case was processed 48 days late, one case was 34 days late, and the third case was 4 days late. No questioned costs were identified in these instances because the beneficiaries were appropriately approved for benefits.

o State regulation [10 CCR 2505-3, 170.4] notes that eligibility sites shall make an eligibility determination within 45 days from the date of the application.

• Ineligible for Program. In two cases, beneficiaries with third-party health insurance at the time of application were not determined ineligible, as required. This error resulted in known questioned costs of $6,361.

o State regulation [10 CCR 2505-3, 120.1.A] notes that in order to be eligible for the CBHP program, an eligible person shall not be covered under a group health plan or under health insurance coverage, excluding coverage under the Consolidated Omnibus Budget Reconciliation Act (COBRA).

• Missing Case Documentation. One case file was missing documentation necessary to support the CBHP eligibility determination, as required by federal and state regulations. Specifically, the case file was missing support for the applicant’s income. This error resulted in known questioned costs of $1,551.

o Federal regulation [42 CFR 457.965] notes the state must include in each applicant’s record facts to support the State’s determination of the applicant’s eligibility for the Children’s Health Insurance Program.

o State regulation [10 CCR 2505-3, 110.1] requires all individuals who apply for CBHP to have a household income not exceeding 260 percent of the Federal Poverty Level, adjusted for household size.

Why did these problems occur?

We determined that the Department did not fully implement our prior audit recommendation related to ensuring caseworkers determine eligibility appropriately and in accordance with federal and state regulations. Specifically, caseworkers did not process applications timely, confirm that applicants were not covered under other health insurance, and ensure that the required eligibility documentation was maintained within the case file.

Why do these problems matter?

As the State department responsible for ensuring that all expenditures under CBHP are appropriate, it is essential for the Department to ensure that eligibility determinations are made appropriately and in accordance with federal and state regulations. This includes ensuring that processing of information used to determine CBHP eligibility does not result in CBHP benefits being provided to, and paid on behalf of, ineligible individuals, or eligible individuals being denied benefits. Ultimately, the federal government may disallow federal funds for CBHP program expenditures that do not adhere to regulations, and the State would be required to bear the cost of these errors.

Recommendation 2023-054

The Department of Health Care Policy and Financing should strengthen its internal controls over Children’s Basic Health Plan eligibility to ensure compliance with federal and state regulations by addressing the issues identified in the audit. This should include ensuring that local counties and Medical Assistance site caseworkers are appropriately trained and are held to required timelines for processing beneficiary applications, eligibility requirements related to applicants that have other health insurance, and requirements for maintaining the required documentation to support eligibility in the case file.

Response Department of Health Care Policy and Financing

Agree Implementation Date: January 2025

The Department recognizes that the training already exists so the Department will work with the individual eligibility sites to develop a Corrective Action plan for timelines for processing beneficiary applications, eligibility requirements related to applicants that have other health insurance, and requirements for maintaining the required documentation to support eligibility in the case file.

Finding 2023-055 Medicaid Eligibility—Social Security Numbers Associated with Multiple State IDs

Each beneficiary’s Medicaid application must contain specific information, including the beneficiary’s Social Security Number (SSN), a copy of their birth certificate, and support for their income in order for a caseworker to determine their Medicaid eligibility. The local counties and MA sites are responsible for administering the benefits application process, including entering the required data for eligibility determination into CBMS and approving or denying an applicant’s eligibility. CBMS is a shared eligibility system between the Department and the Department of Human Services.

As each beneficiary has one SSN, similarly, the State Identification Module (SIDMOD)—managed by the Governor’s Office of Information Technology (OIT)—assigns a unique State ID for each beneficiary. CBMS interfaces with Colorado interChange on a daily basis to update eligibility information, such as a beneficiary’s eligibility status or termination of benefits. Colorado interChange uses this information to process and pay claims for services provided to eligible Medicaid beneficiaries. When a medical provider submits a claim to the Department, Colorado interChange checks the State ID and the date of birth, but not the SSN, submitted with the claim against the beneficiary’s information on file. If the State ID and the date of birth match an eligible beneficiary within Colorado interChange and the claim is otherwise appropriate, then the claim will be processed and paid through the system. The Department requires local counties or MA site caseworkers to call the OIT Service Desk to obtain approval for changing or updating a SSN in CBMS.

What was the purpose of our audit work and what work was performed?

The purpose of the audit work was to determine whether the Department made claims payments on behalf of beneficiaries with the same SSN but different State IDs, including determining the Department’s progress in implementing our Fiscal Year 2021 audit recommendation related to this area. At that time, we recommended the Department ensure only eligible beneficiaries receive Medicaid benefits by monitoring and correcting any instances of multiple State IDs associated with the same SSN. Specifically, we recommended the Department improve its internal controls in this area by continuing to develop a report that can be used to identify SSNs associated with multiple State IDs, and then establishing and implementing written policies and procedures to outline how the Department will use the report to effectively monitor and correct those discrepancies.

As part of our testing, we reviewed the Department’s Medicaid eligibility internal controls in place during Fiscal Year 2023. We requested a list of all Medicaid claims that were submitted by providers and paid by the Department for the fiscal year, including the beneficiaries’ names, SSNs, and State IDs. The Department provided a list that included approximately 1.4 million beneficiaries who received benefits during the fiscal year. We analyzed this listing to identify any beneficiaries whose SSN was linked to more than one State ID, and to determine if any claims payments were made on behalf of those beneficiaries for Fiscal Year 2023.

How were the results of the audit work measured?

Federal regulation [42 CFR 435.910] states that the Department must require, as a condition of eligibility, that each individual (including children) seeking Medicaid services furnish a SSN. Federal regulation [42 CFR 435.914] further requires that the Department obtain and maintain documentation to support each beneficiary’s Medicaid eligibility determination.

Federal regulation [42 CFR 447.56(e)(2)] states that federal funding will not be provided for payments made by the Department to providers for services provided on behalf of individuals who are not eligible for Medicaid. Further, the Department is required by federal regulations to repay the federal government the federal share of any overpayments within 1 year. Specifically, pursuant to 1903(d)(2)(C) of the Social Security Act [42 U.S.C. 1396b], states have up to 1 year from the date of the overpayment discovery to recover or attempt to recover the overpayment before the federal share must be refunded to CMS, regardless of whether recovery is made from the provider.

According to federal regulation [45 CFR 75.303(a)], the Department, as a recipient of federal funds, must establish and maintain effective internal controls over its federal awards that provide reasonable assurance that the Department is managing its federal grants in compliance with federal statutes, regulations, and the award terms and conditions. These internal controls should be in compliance with guidance in Standards for Internal Control in the Federal Government (Green Book), published by the U.S. Government Accountability Office. Under Paragraph 16.01 of the Green Book, the Department should establish and operate monitoring activities for its internal control system and evaluate the results. Monitoring activities include reviewing reports, performing reconciliations, and observing operations.

What problem did the audit work identify?

We determined that the Department has not fully implemented the prior audit recommendation to improve its internal controls over Medicaid eligibility to ensure it is monitoring and correcting any instances of multiple State IDs associated with the same SSN. During our testing, we identified 200 unique SSNs that each appeared to be inappropriately associated with two State IDs; in total, the 200 SSNs were tied to 400 State IDs. This could indicate that the Department determined eligibility without a beneficiary furnishing the correct SSN. Specifically, we found the following:

• 108 SSNs were tied to 2 separate State IDs (representing 216 potential beneficiaries) that appeared to be for different people based on the names and/or dates of birth. These could represent invalid claims payments on behalf of ineligible beneficiaries.

• 92 SSNs were tied to two separate State IDs (representing 184 potential beneficiaries) that had the same name and date of birth. These SSNs could be valid, but with more than 1 State ID, a provider could submit and have a claim paid for the same services under both State IDs.

We did not identify any instances of individual SSNs being tied to more than 2 State IDs.

These issues affected a total of 400 Medicaid State IDs that had not been corrected as of June 30, 2023, and represented a total of $71,441 Medicaid claims paid through Colorado interChange for Fiscal Year 2023.

We selected a random, non-statistical sample of 12 SSN pairs (24 different State IDs) identified in our testing, representing $6,050 in Medicaid claims, and provided the sample to the Department to research. The Department determined, and we confirmed, that as of the end of our audit in December 2023, payments made for 9 of the 12 SSN pairs were made on behalf of eligible beneficiaries. Of the 9 pairs, 4 had instances where an individual had incorrect information entered into CBMS. The remaining 5 SSN pairs each represented a single beneficiary, but with 2 separate Medicaid IDs that need to be merged within CBMS so that each beneficiary only has one unique Medicaid ID. In total, these 9 sample pairs represented $2,224 of the $6,050 sample.

The other 3 SSN pairs in our sample, totaling $3,826, had at least 1 instance of a SSN not being verified when input into CBMS; therefore, we consider these amounts to be known questioned costs. Of these costs, $2,105 were paid with federal grant funds.

We were unable to determine whether the payments in the remaining 188 SSNs that were each tied to 2 State IDs were made on behalf of eligible Medicaid beneficiaries; therefore, we consider the entire $65,391 in Medicaid claims payments to be likely questioned costs. Of these costs, $36,604 were paid with federal grant funds.

The breakdown of costs we questioned are shown in the following table:

A questioned cost, as defined in federal regulations [45 CFR 75.2 Uniform Administrative Requirements, Cost Principles, and Audit Requirements for HHS Awards] (Uniform Guidance), is “a cost that is questioned by the auditor … (1) Which resulted from a violation or possible violation of a statute, regulation, or the terms and conditions of a Federal award, including for funds used to match Federal funds; [or] (2) Where the costs, at the time of the audit, are not supported by adequate documentation….” We have identified these questioned costs as “known questioned costs” that are further defined in Uniform Guidance [45 CFR 75.516] as questioned costs that are specifically identified by the auditor.

Why did this problem occur?

The Department did not have adequate internal controls in place to prevent or detect and correct all instances of multiple State IDs associated with a single SSN in Colorado interChange and, as a result, could not ensure only eligible beneficiaries received Medicaid services. In addition, we determined that the Department did not fully implement our prior audit recommendation related to developing a report to identify single SSNs associated with multiple State IDs, and establishing and implementing written policies and procedures outlining how the Department will use the report to effectively monitor and correct SSN and State ID discrepancies. Specifically, the Department deployed a dashboard report in April 2023, but it did not provide enough detail for caseworkers to be able to effectively monitor and correct SSN and State ID discrepancies. In addition, Department staff reported they have not yet finalized written guidance on how to use the dashboard report at either the Department or county and MA-site level to identify and resolve discrepancies.

Why does this problem matter?

Failing to institute appropriate controls over the processing of Medicaid eligibility can result in the counties and MA sites granting Medicaid benefits to ineligible individuals. As the state Medicaid agency, it is essential for the Department to ensure that Medicaid benefits are paid only for eligible beneficiaries. This includes ensuring that the Department has sufficient internal controls to address risks related to instances in which multiple State IDs are associated with a single SSN. For example, without adequate controls in place to prevent multiple State IDs from being created or to identify and correct these instances, providers could erroneously or fraudulently submit duplicate claims under these State IDs for the same services, resulting in improper payments. Ultimately, the federal government may disallow federal funds for Medicaid program expenditures that do not adhere to regulations, and the State would be required to bear the cost of these errors.

Recommendation 2023-055

The Department of Health Care Policy and Financing (Department) should improve its internal controls over Colorado’s Medicaid Program eligibility by:

A. Researching the remaining questioned claims payments that were identified during our audit to determine whether the local counties or Medical Assistance (MA) sites had a valid Social Security Number (SSN) when determining eligibility, if payments were appropriate—in accordance with federal regulation at the time the payments were made—and repaying the federal government for any payments made to providers on behalf of ineligible beneficiaries in accordance with federal regulations.

B. Continuing to develop a report to identify instances of single SSNs associated with multiple State IDs that, once complete, can be used to monitor that caseworkers are addressing any identified discrepancies in a timely manner.

C. Continuing to establish and implement written policies and procedures outlining how the Department and MA sites will use the report to effectively monitor and correct SSN and State ID discrepancies. The Department’s policies and procedures should include information on the report itself, such as the frequency and timing of when Department staff should generate and review the report, how to monitor caseworkers to ensure that discrepancies are being identified and corrected in a timely manner, and how to identify when additional training may be needed for local counties and MA sites; the MA site policies and procedures should include information on how to read and use the report to identify and correct discrepancies.

Response Department of Health Care Policy and Financing

A. Partially Agree Implementation Date: December 2024

The Department implemented Social Security number (SSN) discrepancy reports within the Monitoring Dashboards in April 2023. The Department will develop and implement policies and procedures outlining how the report will be used to effectively monitor, research, and correct SSN and State ID discrepancies. Once that work is complete, the Department will send updated written guidance to our county and medical assistance sites on how to use system edits, reports, and dashboards to resolve duplicate SSN's with an implementation date of December 2024.

Further, the Department cannot recover any payments from providers since this issue is not related to services provided. When a provider checks a member's eligibility on the day of service and finds the member eligible through the Department’s system, that provider is guaranteed payment if they render an authorized service.

Auditor’s Addendum

The Department is responsible for ensuring that only eligible beneficiaries receive Medicaid benefits by monitoring and correcting any instances of multiple State IDs associated with the same SSN. According to federal regulation [42 CFR 431.958], any payment to an ineligible beneficiary is considered an improper payment, which is any payment that should not have been made or that was made in an incorrect amount, and must be repaid to the federal government within 1 year. Eligibility errors include ineligible individuals who were authorized as eligible when they received services [42 CFR 431.960d(2)(i)].

B. Agree Implementation Date: December 2024

The Department implemented Social Security number (SSN) discrepancy reports within the Monitoring Dashboards in April 2023. The Department will develop and implement policies and procedures outlining how the report will be used to effectively monitor, research, and correct SSN and State ID discrepancies. Once that work is complete, the Department will send updated written guidance to our county and medical assistance sites on how to use system edits, reports, and dashboards to resolve duplicate SSN's with an implementation date of December 2024.

C. Agree Implementation Date: December 2024

The Department implemented Social Security number (SSN) discrepancy reports within the Monitoring Dashboards in April 2023. The Department will develop and implement policies and procedures outlining how the report will be used to effectively monitor, research, and correct SSN and State ID discrepancies. The Department will issue guidance such as the frequency and timing of when Department staff should generate and review the report, how to monitor caseworkers to ensure that discrepancies are being identified and corrected in a timely manner, how to identify when additional training may be needed for local counties and MA sites and information on how to read and use the report and identify and correct discrepancies. Once that work is complete, the Department will send updated written guidance to our county and medical assistance sites on how to use system edits, reports, and dashboards to resolve duplicate SSN's with an implementation date of December 2024.

Finding 2023-056 Presumptive Eligibility for Medicaid and CBHP

Colorado’s Medicaid and CBHP presumptive eligibility program is designed to provide eligible individuals—such as children under the age of 19 and pregnant people—immediate, temporary medical coverage of up to 45 days while they wait for caseworkers to process their regular Medicaid or CBHP application and determine their eligibility status. Although there are fewer eligibility requirements for presumptive eligibility in comparison with regular Medicaid or CBHP coverage, beneficiaries must submit a Medical Assistance application and appear eligible to receive temporary benefits while a caseworker is processing their application.

The Department works with clinics, health care centers, and community resource centers that are certified as presumptive eligibility sites (PE Site) to help manage the application process for individuals needing access to immediate temporary medical coverage. To be certified as a PE Site, the entity must be an existing provider, or have an affiliation with an existing provider, and complete the Presumptive Eligibility General Information Form (Form), which serves as the entity’s application to become a PE Site. Once an entity completes and submits a Form, Department staff review and either approve or deny the application. Final notice of acceptance or denial as an approved PE Site is then sent to the contact person listed on the Form.

The PE Site is in charge of helping individuals complete an application and ensuring that only people meeting the basic eligibility criteria are enrolled in presumptive eligibility programs. The process of enrolling an applicant into a presumptive eligibility program begins when a caseworker at a PE Site collects the minimum information needed to determine presumptive eligibility, including the applicant’s name, age, residency, citizenship, and income. The caseworker enters this information into CBMS, which is used to assist the caseworker in determining whether the applicant is eligible to receive Medicaid or CBHP temporary benefits. If the applicant is deemed presumptively eligible, then CBMS feeds relevant data to Colorado interChange, which issues payments to CBHP and Medicaid providers on behalf of these beneficiaries. If the applicant’s reported information is not in compliance with federal and state requirements, CBMS is programmed to deny the eligibility and mark the applicant’s eligibility as “fail” within CBMS. As a result, the applicant would not be eligible for the payment of services to providers on their behalf through Colorado interChange. Once an applicant’s presumptive eligibility has been determined, the PE Site is required to submit the application along with a transmittal form detailing the beneficiary’s reported information to the appropriate local county or designated MA site within 5 business days, at which point the county or MA site would complete the application process to determine regular (i.e., not presumptive) eligibility for Medicaid or CBHP benefits. The county or MA site must then make a final eligibility determination within 45 days of the application date. Once the applicant is enrolled in the regular Medicaid or CBHP program, the individual’s presumptive eligibility benefits should end.

All PE Sites must be certified by the Department to make presumptive eligibility determinations. PE Sites must also recertify with the Department every 2 years to maintain their active status as a certified PE Site. As part of the recertification process, Department staff will audit 5 percent of the applications the PE Site processed during the previous year to confirm that the applicant’s information was correctly entered into CBMS and that the PE Site followed the appropriate guidance when making presumptive eligibility decisions. If the PE Site fails the audit, the Department requires PE Site staff to undergo customized Department training for the areas they failed within 6 months of the review. As of June 30, 2023, there were 50 certified PE Sites. During Fiscal Year 2023, 17 of those PE Sites determined presumptive eligibility for 531 Medicaid cases and 155 CBHP cases.

What was the purpose of our audit work and what work was performed?

The purpose of our audit work was to review the Department’s internal controls over the processing of presumptive eligibility for Medicaid and CBHP programs, as well as to determine whether the Department complied with the applicable federal and state requirements for Fiscal Year 2023. Additionally, we reviewed the Department’s progress in implementing our prior audit recommendation related to internal controls over presumptive eligibility. Specifically, during the Fiscal Year 2020 audit, we identified problems with the Department’s compliance with applicable federal and state requirements, and recommended that the Department strengthen its internal controls over Medicaid and CBHP presumptive eligibility by developing and implementing (1) a tracking mechanism for monitoring PE Sites; (2) written policies and procedures detailing the requirements for completion of PE Site reviews, timely training for PE Site staff, and timely recertification of PE Sites; and (3) resolving CBMS programming and system issues to appropriately terminate presumptive eligibility when the beneficiaries are enrolled in the regular Medicaid or CBHP program and ensuring CBMS displays consistent applicant information between various screens. As part of our Fiscal Year 2023 audit, we reviewed the Department’s tracking mechanism for monitoring PE Sites, as well as the Department’s updated policies and procedures for completion of PE Site reviews, training for PE Site staff, and timely recertification of PE Sites. In addition, we inquired with the Department about the CBMS programming issues identified during the audit. Department staff reported they implemented changes within CBMS that would address the programming and system issues identified.

As part of our Fiscal Year 2023 audit, we made inquiries with Department staff regarding the policies and procedures for applying to be a PE Site, recertification requirements, and Department site monitoring. During our internal controls testing, we reviewed a listing of all 50 PE Sites and noted that 40 sites were due for recertification in Fiscal Year 2023. We selected six PE Sites that were due for recertification and performed testing to determine whether the sites were appropriately recertified by the Department by performing the following procedures:

• We confirmed that the Department had performed the recertification and reviewed the related case file support for all 6 PE Sites in our sample. • We noted that 4 of 6 PE Sites tested passed their recertification. We reviewed the Department’s case file support and confirmed the sites were appropriately recertified and mailed recertification letters from the Department.

• The eligibility status for the remaining two PE Sites in our sample was terminated by the Department as part of its recertification review. One site did not complete the required paperwork for the recertification and the other did not have a need to provide PE Site services anymore. We reviewed Department correspondence to these sites to confirm the Department notified them that their PE Site status was terminated.

In addition, we randomly selected a sample of 40 Medicaid and 37 CBHP cases for individuals who were deemed presumptively eligible at a PE Site during Fiscal Year 2023 to determine whether the Department complied with federal Medicaid and CBHP presumptive eligibility requirements. Our testing included reviewing the related supporting case file documentation, as well as the CBMS data fields related to presumptive eligibility determinations and payment information in Colorado interChange.

The Department’s process for presumptive eligibility determinations is the same for both Medicaid and CBHP and, therefore, our testing was used to determine compliance for both programs.

What problems did the audit work identify and how were the results measured?

We found that the Department did not fully comply with federal and state regulations regarding Medicaid and CBHP presumptive eligibility requirements during Fiscal Year 2023. Overall, we identified 8 instances of non-compliance with federal and state regulations over presumptive eligibility requirements at 4 separate PE Sites. Specifically, we identified the following:

• Untimely End of Presumptive Eligibility. In 4 of 40 Medicaid (10 percent) and 3 of 37 CBHP cases (8 percent), we found that the Department did not properly end presumptive eligibility within CBMS as required by the federal regulation. In these cases, the beneficiary’s presumptive eligibility did not end until between 6 and 31 days after the beneficiary was determined to be eligible for regular Medicaid and CBHP benefits.

Federal regulation [42 CFR 435.1101)] states that presumptive eligibility should end the day on which a decision is made on the application for Medical Assistance or the last day of the month following the month in which the determination of presumptive eligibility was made.

• Timeliness of Transmittal Letters. In 1 of 40 Medicaid cases (3 percent), we found that the PE Site determining eligibility did not notify the county within five business days that the applicant was

presumptively eligible, as required by state regulation. In this case, notification was made 1 day late.

State regulation [10 CCR 2505-10, 8.100.4.F.4)] states that the presumptive eligibility sites are required to notify the local county within 5 business days that the client is presumptively eligible.

Why did these problems occur?

We determined that the Department’s changes to CBMS to address the programing and system issues identified in our prior audit recommendation did not appropriately terminate beneficiaries’ presumptive eligibility when the beneficiary is enrolled in the regular Medicaid or CBHP program. In addition, the Department lacked sufficient internal controls to ensure that it complied with federal and state presumptive eligibility requirements during Fiscal Year 2023. Specifically, the Department did not adequately train PE Site staff on presumptive eligibility requirements and, as a result, they did not properly end presumptive eligibility and process transmittal letters in a timely manner.

Why do these problems matter?

As the State’s medical assistance agency, it is essential for the Department to ensure that PE Sites’ eligibility determinations are made appropriately and in accordance with federal and state regulations. This includes ensuring that presumptive eligibility determinations are made correctly and do not result in Medicaid or CBHP benefits being provided to, and paid on behalf of, ineligible individuals. Ultimately, the federal government can disallow federal funds for program expenditures that do not adhere to regulations, and the State would be required to bear the cost of these errors.

Recommendation 2023-056

The Department of Health Care Policy and Financing (Department) should strengthen its internal controls over Colorado’s Medicaid Program (Medicaid) and the Children’s Basic Health Plan (CBHP) presumptive eligibility by:

A. Resolving Colorado Benefits Management System (CBMS) programming and system issues to appropriately terminate applicants’ presumptive eligibility when the beneficiaries are enrolled in the regular Medicaid or CBHP.

B. Providing training to presumptive eligibility site staff to emphasize issues that were identified during our audit or that the Department identifies during its ongoing monitoring, including the importance of properly ending presumptive eligibility benefits when the beneficiary is determined to be ineligible for Medicaid and CBHP benefits and processing applications timely.

Response Department of Health Care Policy and Financing

A. Agree Implementation Date: July 2023

The Colorado Benefits Management System (CBMS) programming and system discrepancies to appropriately terminate applicants’ presumptive eligibility when the beneficiaries are enrolled in the regular Medicaid or Children’s Basic Health Plan program was corrected with a data fix in July 2023. The Department found after further research that it is permissible for Presumptive Eligibility Medical Spans and Medical Assistance Medical spans to overlap as these are two separate High level Program groups. Department staff will continue to monitor for future discrepancies.

B. Agree Implementation Date: August 2024

The Department will continue to train presumptive eligibility site staff on the errors identified during this audit including processing applications timely, and those errors that the Department identifies during ongoing monitoring. The Colorado Benefits Management System (CBMS) automatically populates benefit end dates when the Eligibility site worker authorizes the Medicaid and CBHP benefits. The Department staff will continue to monitor for these discrepancies and work with the individual Eligibility sites on their application processing timeliness.

Finding 2023-057 Payments for Non-Emergent Medical Transportation Claims

Non-emergent medical transportation (NEMT) is a federally-required Medicaid benefit intended to provide recipients prompt, efficient, and medically-necessary transportation services to and from their Medicaid medical services [Section 42 USC 1396a(a)]. NEMT cannot be used as a convenience to the recipient, such as for a trip to a grocery store, or be used by non-recipients unless they are an escort for a recipient who is a child or an at-risk adult [10 CCR 2505-10 8.014.5.D.1]. NEMT is available to all individuals enrolled in Medicaid.

Federal law allows states to provide NEMT services through state-designated entities, such as contracted brokers, as long as the brokers provide cost-effective administration and delivery of services for Medicaid recipients [Section 42 USC 1396a(a)(70)]. Brokers are generally responsible for verifying recipient eligibility for NEMT services, scheduling recipient transportation with ride providers, paying the providers for services, submitting Medicaid claims to the Department through Colorado interChange to cover the cost of services, and retaining supporting documentation for each Medicaid claim. Over the years, NEMT services in Colorado have been brokered in the following ways:

• Prior to July 2020. For 55 counties, various county offices brokered NEMT services for Medicaid recipients. In the remaining nine counties, the Department contracted with IntelliRide to serve as the broker for NEMT services in those areas. IntelliRide is a division of TransDev North America and manages NEMT, demand response transportation, and paratransit programs across the country.

• July 1, 2020 to August 31, 2021. For all 64 counties, the Department contracted with IntelliRide to be the broker for NEMT services; however, our 2021 audits found that the Department also paid about $3.5 million in NEMT claims directly to 66 providers who brokered their own services during the prior audit review period of July 2020 through February 2021.

• September 1, 2021 to Present. The Department returned to having 55 counties broker NEMT services in their areas, and contracting with IntelliRide to serve as the NEMT broker in the remaining nine counties. For rides brokered by IntelliRide, providers upload trip information into IntelliRide’s EcoLane transportation scheduling system, which maintains information on recipients’ requests for rides; the names of the recipient and driver; and trip information, such as the trip date, scheduled pick-up time, and destination.

In our Fiscal Year 2021 Statewide audit and 2021 NEMT performance audit, we identified $291,597 in known questioned costs and about $5.2 million in likely questioned costs related to NEMT services that did not comply with federal and state Medicaid requirements. We recommended that the Department investigate each questioned claim to recover any payments determined to be inappropriate, and repay the federal portion, as appropriate. Federal regulations define known questioned costs as questioned costs that are specifically identified by the auditor and define likely questioned costs as the auditor’s best estimate of total questioned costs [45 CFR 75.516]. Known and likely questioned costs should be investigated by the Department, inappropriate payments should be recovered, and those payments should be repaid to the federal government as appropriate; Medicaid overpayments are recoverable regardless of whether they occurred due to an error by the Department, entity acting on behalf of the Department, or a provider [Section 25.5-4-301(2), C.R.S.]. We also recommended that the Department implement controls to ensure taxi claims are paid in accordance with established requirements and rates. The Department agreed to implement these audit recommendations by December 2022.

What was the purpose of our audit work and what work was performed?

The purpose of our audit work was to review the Department’s implementation of the Fiscal Year 2021 audit recommendations to (1) investigate the known and likely questioned costs identified by the audits, recover inappropriate payments, and repay the federal portion, as appropriate, and (2) implement controls to ensure taxi claims are paid in accordance with established requirements and rates. We reviewed documentation of the Department’s efforts to investigate and recover the known questioned costs identified in the prior audits, and repay the federal portion of the claims. We interviewed Department staff to understand the extent to which steps had been taken to investigate, recover, and repay the likely questioned costs identified. We reviewed Department documentation and interviewed Department staff to understand the internal controls that were implemented to help ensure taxi claims are paid in line with requirements and rates. We also reviewed Department documentation and online information about NEMT fraud schemes that the Department identified starting in Summer 2023.

How were the results of the audit work measured?

The Department must investigate questioned costs related to NEMT claims, recover inappropriate payments, and repay the federal portion, as appropriate. According to federal regulation [45 CFR 75.303(a)], the Department, as a recipient of federal funds, must establish and maintain effective internal controls that provide reasonable assurance that the Department is managing federal funds in compliance with federal statutes, regulations, and federal program terms and conditions. A questioned cost is defined in Uniform Guidance [45 CFR 75.2] as “a cost that is questioned by the auditor … (1) Which resulted from a violation or possible violation of a statute, regulation, or the terms and conditions of a Federal award, including for funds used to match Federal funds; [or] (2) Where the costs, at the time of the audit, are not supported by adequate documentation.…” Questioned costs can result in the misappropriation of federal and state funds. Section 25.5-4-301(2), C.R.S., states that any overpayments of claims to providers are recoverable. These overpayments “are recoverable regardless of whether the overpayment is the result of an error by the state department, a county department of human or social services, an entity acting on behalf of either department, or by the provider or any agent of the provider....” According to federal law, states have up to 1 year from the date of discovery of the overpayment to recover or attempt to recover the overpayment before the federal share (also known as Federal Financial Participation or FFP) must be refunded to CMS, regardless of whether a recovery is made from the provider [42 USC 1396b].

The Department must have internal controls to pay claims based on accurate service rates and trip mileage. The Public Utilities Commission (PUC) sets the rate for each permitted taxi provider, which is generally based on trip mileage. According to the Department’s NEMT Billing Manual and rate schedule for 2021, taxi claims should have been paid at the rate set by the PUC.

What problems did the audit work identify?

The Department has not investigated and recovered as appropriate, the $5.2 million in likely questioned costs related to NEMT claims, or repaid the federal portion. Based on our testwork, we determined that the Department has not fully implemented the Statewide audit and performance audit recommendations from 2021 because it has not investigated the about $5.2 million in likely questioned costs identified by the audits, or attempted to recover and repay the federal portion of those questioned costs. As of June 30, 2023, the Department had investigated and recovered the $291,597 in known questioned costs and repaid the federal portion. In addition, the Department has not fully implemented internal controls to help ensure taxi claims are paid appropriately.

The issues we identified in our 2021 Statewide and performance audits, which resulted in the likely questioned costs between July 2020 and February 2021(the prior audit period), are summarized below:

• About $4.8 million paid for taxi claims without mileage. For 29,049 taxi claims totaling $4,763,071, the Department paid the claims without ensuring taxi providers were paid at their PUC approved per-mile rate, as required by the Department’s NEMT Billing Manual and rate schedule. These claims were submitted directly to the Department by 10 PUC-permitted taxi providers. For example, the Department paid $4,000 to one taxi provider for what appeared to be four 400-mile one-way trips that were given to one recipient within a single day, which did not appear possible and was not paid based on taxi rates. The Department only required taxi providers to submit claims showing only the number of one-way trips driven, not the mileage, and paid the claims as long as they were not more than $1,000 per one-way trip. As a result, the Department lacked internal controls to ensure taxi claims were paid at the correct rates. After the 2021 audits, the Department lowered the maximum per one-way taxi trip within Colorado interChange from $1,000 to $500, but the Department did not implement other internal controls to ensure taxi providers are paid based on their PUC-approved per-mile rates.

• $409,575 paid for taxi claims for providers not permitted as taxis. For 3,284 NEMT claims for taxi services from eight providers, the providers were not permitted by the PUC to operate as taxis, as required by the NEMT Billing Manual and rate schedule. For example, one provider was paid for an NEMT taxi claim for $5,875 for 12 trips, or $490 per trip. Since these providers were not permitted as taxis, they did not have PUC-set taxi rates, so we could not determine how much these providers should have been paid. After the 2021 audits, the Department implemented an internal control to help ensure providers submitting NEMT taxi claims are permitted to operate as taxis.

• $4,718 paid for trips that may not have been to attend medical services. Our 2021 audits found that 13 of a sample of 22 NEMT claims (59 percent) for trips in December 2020 had no medical claims for dates corresponding to the NEMT trips, and 6 of these 13 claims were for recipients who had both Medicaid and other types of medical insurance, such as Medicare. Department staff told us that it was possible that medical providers had not yet submitted medical claims yet, and that the six recipients may have used NEMT trips to access medical services but those services were paid by other insurance, as allowed by state regulations [10 CCR 2505-10 8.014.5.B.2]. Therefore, we could not determine whether the NEMT trips associated with the 13 claims had been for recipients to attend medical services. After the 2021 audits, the Department implemented an internal control to help ensure NEMT services are used to attend medical appointments.

• $3,598 paid for trips that may not have been completed. For 61 of the 362,110 paid claims in the 2021 OSA audit timeframe, the scheduled trips were not marked as complete in IntelliRide’s EcoLane transportation scheduling system, so we could not determine whether they had been completed. After the 2021 audits, the Department worked with IntelliRide to help ensure its system began maintaining complete information on rides.

The Department is currently in the process of investigating NEMT fraud schemes. According to the Department, in Summer 2023 it uncovered an “unprecedented fraud scheme” occurring in the NEMT benefit, affecting “tens of thousands” of NEMT claims. For example, the Department identified an increase in suspicious NEMT billings and program violations, such as recipients receiving inappropriately long trips.

The Department informed the OSA that, as of October 2023, it had issued 50 cease and desist letters to NEMT providers, placed 390 providers on pre-payment review, sent letters to providers with concerns of fraudulent behavior and steps taken, placed a moratorium on new NEMT provider applications—with approval of CMS—and, as a result, denied 632 NEMT provider applications. The Department told us that in addition to fraud schemes among NEMT providers, it is analyzing whether similar issues are occurring in different Medicaid provider types. The Department also informed the OSA that it is working with a number of entities, such as the Colorado Attorney General’s Office and its Medicaid Fraud Control Unit, the Colorado Department of Public Safety, county departments of human services, IntelliRide, CMS, the Office of the Inspector General, the Federal Bureau of Investigations, and other states experiencing NEMT fraud. The Department has posted alerts on its NEMT website to inform Medicaid members of potentially fraudulent NEMT practices.

Why did these problems occur?

The Department lacked sufficient internal controls to investigate questioned costs and to detect improper claims, payments, and provider applications. The Department did not investigate the $5.2 million in likely questioned costs identified by our 2021 audits by December 2022, as it stated it would do within its responses to the prior audit recommendation, demonstrating that the Department did not have sufficient processes in place to implement the recommendation in a timely manner. The Department also reported to us that due to the recent detection of fraud schemes by NEMT providers, the Department does not “have the resources to investigate the likely questioned costs identified in the report” and “is currently unable to follow through on the previous agreement.” The Department stated that once it completes activities related to the recently detected NEMT fraud schemes, it “will go back and review post-payment, if resources allow” that “may include the likely questioned costs.” The Department’s process will need to include implementing internal controls to ensure taxi providers are paid based on their PUC-approved per-mile rates.

Regarding the recent surge in NEMT fraud, the Department indicated that it has developed stronger internal controls to process applications from those seeking to provide NEMT services and to manage billing practices. For example, according to the Department, it is “updating [its NEMT] provider credentialing and billing processes” and conducting reviews to determine whether services and billing are in compliance with federal and state law. The Department stated that if its reviews reveal evidence of non-compliance or intentional fraud, the Department “will initiate additional actions, including but not limited to, referrals to law enforcement.” In the event that the Department identifies improper or overpayments to NEMT providers, it will need to recover those payments and repay the federal portion.

Why do these problems matter?

For the approximately $5.2 million in likely questioned costs identified in our 2021 Statewide and performance audits, the Department paid the NEMT claims, yet there was no supporting documentation or data from IntelliRide, ride providers, or the Department to substantiate that the costs of the claims were accurate, or that the rides complied with federal and state requirements. As such, there was a significant risk of misappropriation of federal and state funds by providers and/or recipients. While we did not identify confirmed fraud by providers or recipients at that time, due to the lack of supporting documentation for these claims, the problems identified by the prior audits demonstrate a potential waste of public funds and abuse of the Medicaid program.

When the Department does not have sufficient internal controls in place to take timely action to investigate questionable claims, this can result in misuse of federal and state Medicaid funds. If the Department had started the recommended investigation in 2021 and completed it by the end of 2022, it may have been able to identify aspects of the NEMT provider fraud scheme and improper payments sooner than Summer 2023.

Recommendation 2023-057

The Department of Health Care Policy and Financing (Department) should comply with federal and state requirements for administering the non-emergent medical transportation (NEMT) benefit, and for paying Colorado Medicaid Program claims by:

A. Investigating the payments that the OSA’s 2021 Statewide and performance audits identified that resulted in likely questioned costs, recover inappropriate payments identified, and repay the federal portion, as appropriate. This process should include implementing internal controls to ensure taxi providers are paid based on their PUC-approved per-mile rates.

B. Continuing to investigate the overpayments and inappropriate payments that the Department identifies through its fraud investigations and that result in known or likely questioned costs, recover inappropriate payments identified, and repay the federal portion, as appropriate.

Response Department of Health Care Policy and Financing

A. Partially Agree Implementation Date: August 2024

HCPF disagrees with the likely questioned costs identified and that it should review these claims. Because supporting documents were not available, the OSA had nothing to review for these claims and so determined that they were likely questioned costs. Of the claims the OSA had documentation to review, though, the documentation supported the claim and so the Department believes it is likely the missing documentation would support the claims as well. HCPF isn’t required to have the documentation up front, and it is the normal practice to pay claims and require the providers maintain the documentation, so this standard process should not create a presumption that the payments were in error. To review all these claims, HCPF would have to request each record from the provider, and the average review of an NEMT claim once the records have been received takes 15-30 minutes, so it would take an estimated 7,262.25-14,524.5 hours to review 29,049 claims. HCPF does it have existing resources to complete this review. HPCF agrees to review the claims where the OSA reviewed the records and determined that the claims were not paid properly. If an overpayment is identified, FFP will be returned as appropriate. We expect this project to be completed by 8/31/24.

HCPF agrees with the taxi rate problem and is implementing internal controls to ensure taxi providers are paid appropriately by discontinuing the specific rate for taxi services and replacing it with the generic mileage rate. This will prevent inaccurate payments. HCPF is no longer required to pay taxi providers the rate stipulated by their individual PUC rate. We expect this project to be completed by 7/31/24.

Auditor’s Addendum

As noted in the audit finding, the Department, its NEMT contractor (IntelliRide), and ride providers did not have data or documentation to support $5.2 million in paid claims for NEMT services, as required. These unsupported payments resulted in likely questioned costs that the Department should investigate, in order to recover inappropriate payments and repay the federal portion, as appropriate. Further, the Department's response describing the audit work and results is incorrect. During the audit, the OSA reviewed all data and documentation that the Department, its NEMT contractor, and ride providers provided to the OSA, and identified $291,597 in known questioned costs for 4,503 claims because the amounts paid were not supported or the claims did not comply with federal or state requirements. For an additional about 29,100 NEMT claims totaling $5.2 million, audit analysis determined that the paid claims appeared noncompliant, and the Department reported that neither it, nor its NEMT contractor or ride providers, could provide support for these claims, which resulted in the likely questioned costs. In 2021 and 2022, the Department agreed that the lack of documentation to support the paid claims was a problem, and agreed to investigate. B. Partially Agree Implementation Date: July 2024

As the Department previously responded to the OSA, the Department will continue to investigate NEMT billing and payments through pre-payment reviews and suspected fraud investigations, and it will further revise rules and policy as needed in order to avoid improper claims payments and to ensure there are improved controls over the NEMT program.

The Department has returned the FFP on the known questioned costs. As to the likely questioned costs, as mentioned in Part A, the Department cannot review every claim, however as previously stated the Department plans to conduct post-payment reviews on identified providers and service types that are suspected of having a high risk of improper payments, if resources allow, which may include reviewing claims identified by the OSA as likely questioned costs. Should the department identify an overpayment during said reviews, the department will return the FPP.

Auditor’s Addendum

As noted in the audit finding, the Department has reported a recent surge in NEMT fraud that the Department is investigating. In the event that the Department's investigations identify improper payments or overpayments that result in additional known or likely questioned costs besides those identified by the prior audit, the Department will need to recover those payments and repay the federal portion, as appropriate.

Finding 2023-058 and 2023-059 Higher Education Emergency Relief Fund (HEERF) Allowable Costs and Activities Compliance

The Coronavirus Aid, Relief, and Economic Security Act (CARES Act) was signed into law on March 27, 2020 and appropriated federal funds to provide economic aid to the American people negatively impacted by the COVID-19 pandemic. As part of the CARES Act, funds were given to the System under the Higher Education Emergency Relief Fund (HEERF) Program. The Coronavirus Response and Relief Supplemental Appropriations Act, 2021 (CRRSAA), was signed into law on December 27, 2020, and authorized additional funding under the HEERF program (HEERF II). Finally, the American Rescue Plan Act of 2021 (ARP), enacted on March 11, 2021, authorized a third round of funding (HEERF III) in order for higher education institutions to serve students and ensure learning continues during the COVID-19 pandemic. The HEERF Program is one of the subprograms of the federal Education Stabilization Fund [Assistance Listing No. 84.425]. The HEERF program contains two portions: the Student Aid portion [Assistance Listing No. 84.425E] and the Institutional portion, which is made up of the following:

• HEERF Institutional Aid Portion [Assistance Listing No. 84.425F]; • HEERF Minority Serving Institutions [Assistance Listing No. 84.425L]; • HEERF Strengthening Institutions Program [Assistance Listing No. 84.425M]; • Institutional Resilience and Expanded Postsecondary Opportunity [Assistance Listing No. 84.425P]; • HEERF Supplemental Assistance to Institutions of Higher Education program [Assistance Listing No. 84.425S].

Since April 2020, the System has been awarded a total of approximately $255.6 million in HEERF funding. From inception through June 30, 2023, the System spent a total of approximately $106.5 million for the HEERF program Student Aid portion and $148.9 million for the HEERF Institutional portion. During Fiscal Year 2023, the System spent $8.6 million for the Student Aid portion and $35.0 million for the Institutional portion. The System reports that it will spend the remaining amount of funding during Fiscal Year 2024.

The Department of Education (ED) provided institutions of higher education significant flexibilities in how the HEERF funding could be spent. ED issued guidance in the form of “Frequently Asked Questions” (FAQ) which describe the specifics of how the funds could be use and what types of costs are allowable under the program. The FAQ allows for the following types of expenditures to be applied to the Institutional portion:

• Indirect Costs. Indirect costs are general management costs (i.e., activities for the direction and control of the organization as a whole). General management costs consist of costs for administrative activities necessary for the general operation of the agency, such as accounting, budgeting, payroll preparation, personnel services, purchasing, and centralized data processing. Conversely, direct costs are costs that provide measurable, direct benefits to a particular program or grant. Indirect costs are charged to a grant via the use of an indirect cost rate, which is the percentage of an organization’s indirect costs to its direct costs and is a standardized method of charging individual programs for their share of indirect costs. The indirect cost rate is established through either a federally negotiated rate or is outlined in the grant agreement. The indirect cost rate agreement establishes the base of direct costs that the indirect rate is to be applied.

• Lost Revenue. Lost revenue refers to those revenues an institution of higher education otherwise expected but that were reduced or eliminated as a result of the COVID-19 pandemic. As such, lost revenues can only be estimated. Sources of lost revenue reimbursable under the program include both academic and auxiliary sources. ED provided guidelines and criteria around how institutions should calculate their estimated lost revenue. The FAQs do not specify how institutions are required to calculate their lost revenue. Accordingly, per the FAQ, institutions have flexibility to reasonably calculate their estimated lost revenue. Example baselines that an institution could use include:

o A year-over-year comparison using the prior year; o A semester-over-semester comparison using the prior year semester (fall 2019 compared to fall 2020 or summer term 2019 compared to summer term 2020); o A comparison using a 3- or 5-year combined average revenue as baseline revenue; o A comparison to previously budgeted revenue or projected revenue for the period; or o A comparison with a baseline year of a fiscal year prior to the March 13, 2020 national emergency declaration, such as the fiscal year from July 1, 2018 – June 30, 2019.

What was the purpose of our audit work and what work was performed?

The purpose of the audit work was to determine whether the System had effective internal controls in place over, and complied with, federal allowable activities and allowable cost requirements for the HEERF grant during Fiscal Year 2023. In total, the System charged $42.7 million through 6,254 transactions to the HEERF grant during Fiscal Year 2023.

As part of our audit work, we tested a random sample of 44 expenditure transactions charged to the HEERF program across eight schools totaling $15.2 million to determine whether the costs were allowable under the HEERF program and whether they complied with federal regulations. Specifically, we tested these transactions to determine whether the System used the proper indirect cost rate and whether it only applied the indirect cost rate to the direct cost base listed in the indirect cost rate agreement. In addition, we performed testing to determine whether the estimated lost revenues were calculated within the guidelines established by ED. How were the results of the audit work measured?

We measured the results of our audit work against the following requirements:

• Federal regulation [2 CFR 200.303] states that the System’s campuses, as federal grant recipients, must “establish and maintain effective internal controls over the Federal awards that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulation, and the terms and conditions of the Federal award.”

• The System’s internal control procedure requires that all federal grant expenditures must have adequate supporting documentation, such as an invoice and/or packing slip, included with the transaction and the supporting documentation must be reviewed for appropriateness and allowability under the applicable federal grant program by two individuals.

• The HEERF Lost Revenue Frequently Asked Questions (FAQ) published on March 19, 2021 established how lost revenues are to be calculated. Specifically, FAQ 9 states that, consistent with the cost principles of the Uniform Guidance (2 CFR part 200 subpart E), the calculation of lost revenues must:

o Be accorded consistent treatment (e.g., if using the institution’s fiscal year as a baseline, the institution must estimate lost revenue over the course of a fiscal year);

o Measure the amount of baseline revenue and lost revenue consistently (e.g., an apples-to-apples comparison);

o Be consistent with policies and procedures that apply uniformly to federally-financed and other activities of the institution;

o Not include the estimated amount of lost revenue for the HEERF programs in the calculation of lost revenue for another Federal program, such as the CARES Act Provider Relief Fund (i.e., no double-dipping); and

o Not include any refunds previously provided to students in the institution’s estimate of lost revenue.

• Within the Higher Education Emergency Relief Fund III Frequently Asked Questions published on May 11, 2021, FAQ 43 stated that indirect costs may be charged only to Institutional Portion awards, both new and supplemental, and may not be charged to any student grant awards because the student allocation represents an amount of funds that must be distributed to students. The allowed indirect cost rate will be the on-campus rate specified in an institution’s

negotiated indirect cost rate agreement or, if an institution does not have a current negotiated indirect cost rate with its cognizant agency, it may use the de minimis rate of 10 percent as allowed by the Uniform Guidance.

o Community College of Aurora (CCA) has an indirect cost rate agreement which allows an indirect cost rate of 25 percent to be applied to a base of direct salaries and wages including fringe benefits.

What problems did the audit work identify?

We identified two transactions out of the 44 expenditure transactions tested (5 percent) that did not meet the requirements of the HEERF grant. Specifically, we identified the following:

• The Community College of Aurora (CCA) incorrectly applied its 25 percent indirect cost rate to its total operating costs of $431,633, rather than applying it only to the $254,807 salaries and benefits portion of its operating costs, as required by its indirect cost rate agreement. Therefore, CCA incorrectly recorded $107,908 as indirect costs to its HEERF grant, rather than $63,701. This resulted in a total of $44,207 in questioned costs.

• Pueblo Community College (PCC) incorrectly calculated lost revenue associated with tuition. Specifically, PCC used the incorrect baseline of full-time-equivalent students to calculate lost revenue, which was inconsistent with PCC’s previous use of total tuition revenue as a baseline in its lost revenue calculation. Due to the error, PCC incorrectly calculated a lost revenue amount of $1,351,850 rather than $1,256,818. This error was caught by internal audit in a subsequent review of the HEERF program, but the error was not corrected by PCC until Fiscal Year 2024. This resulted in a total of $95,032 in questioned costs.

Why did these problems occur?

CCA and PCC did not have adequate internal controls over federal allowable activities and allowable cost requirements for the HEERF grant during Fiscal Year 2023 and did not perform an adequate review of the costs charged to the program. Specifically:

• CCA did not adequately review transactions charged to the grant to ensure that the indirect cost rate was only applied to salaries and benefits as defined in its indirect cost rate agreement.

• PCC did not adequately review the lost revenue calculation to ensure that the correct baseline for the calculation was used for Fiscal Year 2023.

Why do these problems matter?

CCA’s and PCC’s failure to ensure compliance with federal requirements for the HEERF program could result in disallowed costs and federal sanctions, including the termination of the federal program.

Recommendation 2023-058

The Community College of Aurora (CCA) should strengthen its internal controls over, and ensure it complies with, the Higher Education Emergency Relief Fund (HEERF) program requirements by performing adequate reviews over costs charged to the HEERF grant to ensure it applies the indirect cost rate only to salaries and benefits, as defined in its federal indirect cost rate agreement.

Response Community College of Aurora

Agree Implementation Date: November 2023

An adjusting entry was made to the grant in September 2023 to reduce costs incurred of $44,206.68, thus reducing the subsequent drawdown of grant funds by $44,206.68. CCA will ensure the Grant Director will review charges to this award and all our federal grants before each draw or at least on a quarterly basis. The review will be discussed with the Controller for additional assurance of propriety of allowability and accuracy of the calculations.

Finding 2023-058 and 2023-059 Higher Education Emergency Relief Fund (HEERF) Allowable Costs and Activities Compliance

The Coronavirus Aid, Relief, and Economic Security Act (CARES Act) was signed into law on March 27, 2020 and appropriated federal funds to provide economic aid to the American people negatively impacted by the COVID-19 pandemic. As part of the CARES Act, funds were given to the System under the Higher Education Emergency Relief Fund (HEERF) Program. The Coronavirus Response and Relief Supplemental Appropriations Act, 2021 (CRRSAA), was signed into law on December 27, 2020, and authorized additional funding under the HEERF program (HEERF II). Finally, the American Rescue Plan Act of 2021 (ARP), enacted on March 11, 2021, authorized a third round of funding (HEERF III) in order for higher education institutions to serve students and ensure learning continues during the COVID-19 pandemic. The HEERF Program is one of the subprograms of the federal Education Stabilization Fund [Assistance Listing No. 84.425]. The HEERF program contains two portions: the Student Aid portion [Assistance Listing No. 84.425E] and the Institutional portion, which is made up of the following:

• HEERF Institutional Aid Portion [Assistance Listing No. 84.425F]; • HEERF Minority Serving Institutions [Assistance Listing No. 84.425L]; • HEERF Strengthening Institutions Program [Assistance Listing No. 84.425M]; • Institutional Resilience and Expanded Postsecondary Opportunity [Assistance Listing No. 84.425P]; • HEERF Supplemental Assistance to Institutions of Higher Education program [Assistance Listing No. 84.425S].

Since April 2020, the System has been awarded a total of approximately $255.6 million in HEERF funding. From inception through June 30, 2023, the System spent a total of approximately $106.5 million for the HEERF program Student Aid portion and $148.9 million for the HEERF Institutional portion. During Fiscal Year 2023, the System spent $8.6 million for the Student Aid portion and $35.0 million for the Institutional portion. The System reports that it will spend the remaining amount of funding during Fiscal Year 2024.

The Department of Education (ED) provided institutions of higher education significant flexibilities in how the HEERF funding could be spent. ED issued guidance in the form of “Frequently Asked Questions” (FAQ) which describe the specifics of how the funds could be use and what types of costs are allowable under the program. The FAQ allows for the following types of expenditures to be applied to the Institutional portion:

• Indirect Costs. Indirect costs are general management costs (i.e., activities for the direction and control of the organization as a whole). General management costs consist of costs for administrative activities necessary for the general operation of the agency, such as accounting, budgeting, payroll preparation, personnel services, purchasing, and centralized data processing. Conversely, direct costs are costs that provide measurable, direct benefits to a particular program or grant. Indirect costs are charged to a grant via the use of an indirect cost rate, which is the percentage of an organization’s indirect costs to its direct costs and is a standardized method of charging individual programs for their share of indirect costs. The indirect cost rate is established through either a federally negotiated rate or is outlined in the grant agreement. The indirect cost rate agreement establishes the base of direct costs that the indirect rate is to be applied.

• Lost Revenue. Lost revenue refers to those revenues an institution of higher education otherwise expected but that were reduced or eliminated as a result of the COVID-19 pandemic. As such, lost revenues can only be estimated. Sources of lost revenue reimbursable under the program include both academic and auxiliary sources. ED provided guidelines and criteria around how institutions should calculate their estimated lost revenue. The FAQs do not specify how institutions are required to calculate their lost revenue. Accordingly, per the FAQ, institutions have flexibility to reasonably calculate their estimated lost revenue. Example baselines that an institution could use include:

o A year-over-year comparison using the prior year; o A semester-over-semester comparison using the prior year semester (fall 2019 compared to fall 2020 or summer term 2019 compared to summer term 2020); o A comparison using a 3- or 5-year combined average revenue as baseline revenue; o A comparison to previously budgeted revenue or projected revenue for the period; or o A comparison with a baseline year of a fiscal year prior to the March 13, 2020 national emergency declaration, such as the fiscal year from July 1, 2018 – June 30, 2019.

What was the purpose of our audit work and what work was performed?

The purpose of the audit work was to determine whether the System had effective internal controls in place over, and complied with, federal allowable activities and allowable cost requirements for the HEERF grant during Fiscal Year 2023. In total, the System charged $42.7 million through 6,254 transactions to the HEERF grant during Fiscal Year 2023.

As part of our audit work, we tested a random sample of 44 expenditure transactions charged to the HEERF program across eight schools totaling $15.2 million to determine whether the costs were allowable under the HEERF program and whether they complied with federal regulations. Specifically, we tested these transactions to determine whether the System used the proper indirect cost rate and whether it only applied the indirect cost rate to the direct cost base listed in the indirect cost rate agreement. In addition, we performed testing to determine whether the estimated lost revenues were calculated within the guidelines established by ED. How were the results of the audit work measured?

We measured the results of our audit work against the following requirements:

• Federal regulation [2 CFR 200.303] states that the System’s campuses, as federal grant recipients, must “establish and maintain effective internal controls over the Federal awards that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulation, and the terms and conditions of the Federal award.”

• The System’s internal control procedure requires that all federal grant expenditures must have adequate supporting documentation, such as an invoice and/or packing slip, included with the transaction and the supporting documentation must be reviewed for appropriateness and allowability under the applicable federal grant program by two individuals.

• The HEERF Lost Revenue Frequently Asked Questions (FAQ) published on March 19, 2021 established how lost revenues are to be calculated. Specifically, FAQ 9 states that, consistent with the cost principles of the Uniform Guidance (2 CFR part 200 subpart E), the calculation of lost revenues must:

o Be accorded consistent treatment (e.g., if using the institution’s fiscal year as a baseline, the institution must estimate lost revenue over the course of a fiscal year);

o Measure the amount of baseline revenue and lost revenue consistently (e.g., an apples-to-apples comparison);

o Be consistent with policies and procedures that apply uniformly to federally-financed and other activities of the institution;

o Not include the estimated amount of lost revenue for the HEERF programs in the calculation of lost revenue for another Federal program, such as the CARES Act Provider Relief Fund (i.e., no double-dipping); and

o Not include any refunds previously provided to students in the institution’s estimate of lost revenue.

• Within the Higher Education Emergency Relief Fund III Frequently Asked Questions published on May 11, 2021, FAQ 43 stated that indirect costs may be charged only to Institutional Portion awards, both new and supplemental, and may not be charged to any student grant awards because the student allocation represents an amount of funds that must be distributed to students. The allowed indirect cost rate will be the on-campus rate specified in an institution’s

negotiated indirect cost rate agreement or, if an institution does not have a current negotiated indirect cost rate with its cognizant agency, it may use the de minimis rate of 10 percent as allowed by the Uniform Guidance.

o Community College of Aurora (CCA) has an indirect cost rate agreement which allows an indirect cost rate of 25 percent to be applied to a base of direct salaries and wages including fringe benefits.

What problems did the audit work identify?

We identified two transactions out of the 44 expenditure transactions tested (5 percent) that did not meet the requirements of the HEERF grant. Specifically, we identified the following:

• The Community College of Aurora (CCA) incorrectly applied its 25 percent indirect cost rate to its total operating costs of $431,633, rather than applying it only to the $254,807 salaries and benefits portion of its operating costs, as required by its indirect cost rate agreement. Therefore, CCA incorrectly recorded $107,908 as indirect costs to its HEERF grant, rather than $63,701. This resulted in a total of $44,207 in questioned costs.

• Pueblo Community College (PCC) incorrectly calculated lost revenue associated with tuition. Specifically, PCC used the incorrect baseline of full-time-equivalent students to calculate lost revenue, which was inconsistent with PCC’s previous use of total tuition revenue as a baseline in its lost revenue calculation. Due to the error, PCC incorrectly calculated a lost revenue amount of $1,351,850 rather than $1,256,818. This error was caught by internal audit in a subsequent review of the HEERF program, but the error was not corrected by PCC until Fiscal Year 2024. This resulted in a total of $95,032 in questioned costs.

Why did these problems occur?

CCA and PCC did not have adequate internal controls over federal allowable activities and allowable cost requirements for the HEERF grant during Fiscal Year 2023 and did not perform an adequate review of the costs charged to the program. Specifically:

• CCA did not adequately review transactions charged to the grant to ensure that the indirect cost rate was only applied to salaries and benefits as defined in its indirect cost rate agreement.

• PCC did not adequately review the lost revenue calculation to ensure that the correct baseline for the calculation was used for Fiscal Year 2023.

Why do these problems matter?

CCA’s and PCC’s failure to ensure compliance with federal requirements for the HEERF program could result in disallowed costs and federal sanctions, including the termination of the federal program.

Recommendation 2023-059

Pueblo Community College (PCC) should strengthen its internal controls over, and ensure it complies with, the Higher Education Emergency Relief Fund (HEERF) program requirements by performing adequate reviews over its lost revenue calculations to ensure it uses the appropriate base in all future calculations.

Response Pueblo Community College

Agree Implementation Date: June 2024

The Vice President of Finance and Administration will review all HEERF revenue recovery entries for propriety in methodology and accuracy. The Fiscal Year 2023 calculation that was overstated was revised in Fiscal Year 2024, and the federal draw will be reduced for the correction prior to June 30, 2024.

Finding 2023-060 Higher Education Emergency Relief Fund (HEERF) Suspension and Debarment Compliance

The Coronavirus Aid, Relief, and Economic Security Act (CARES Act) was signed into law on March 27, 2020 and appropriated federal funds to provide economic aid to the American people negatively impacted by the COVID-19 pandemic. As part of the CARES Act, funds were given to the System under the Higher Education Emergency Relief Fund (HEERF) Program. The Coronavirus Response and Relief Supplemental Appropriations Act, 2021 (CRRSAA), was signed into law on December 27, 2020, and authorized additional funding under the HEERF program (HEERF II). Finally, the American Rescue Plan Act of 2021 (ARP), enacted on March 11, 2021, authorized a third round of funding (HEERF III) in order for higher education institutions to serve students and ensure learning continues during the COVID-19 pandemic. The HEERF Program is one of the subprograms of the federal Education Stabilization Fund [Assistance Listing No. 84.425]. The HEERF program contains two portions: the Student Aid portion [Assistance Listing No. 84.425E] and the Institutional portion, which is made up of the following:

• HEERF Institutional Aid Portion [Assistance Listing No. 84.425F]; • HEERF Minority Serving Institutions [Assistance Listing No. 84.425L]; • HEERF Strengthening Institutions Program [Assistance Listing No. 84.425M]; • Institutional Resilience and Expanded Postsecondary Opportunity [Assistance Listing No. 84.425P]; • HEERF Supplemental Assistance to Institutions of Higher Education program [Assistance Listing No. 84.425S].

Since April 2020, the System has been awarded a total of approximately $255.6 million in HEERF funding. From inception through June 30, 2023, the System spent a total of approximately $106.5 million for the HEERF program Student Aid portion and $148.9 million for the HEERF Institutional portion. During Fiscal Year 2023, the System spent $8.6 million for the Student Aid portion and $35.0 million for the Institutional portion; of this amount, $10.4 million represented the System’s procurement for goods and services. The System reports that it will spend the remaining amount of funding during Fiscal Year 2024.

Each of the System’s 13 campuses separately signed an agreement titled the “Certification and Agreement” with the U.S. Department of Education (ED) to indicate each campus’ acceptance of the HEERF funding and the applicable terms and requirements. Under federal suspension and debarment regulations, non-federal entities, including the System and its campuses, are prohibited from contracting with or making subawards under “covered transactions” to parties that are suspended or debarred from doing business with the federal government. “Covered transactions” include those procurement contracts for goods and services awarded under a grant or cooperative agreement. In order to comply with federal suspension and debarment requirements, the campuses can perform a search in the federal System of Award Management (SAM) website, which tracks the entities that the federal government has determined are ineligible to receive federal funding; collect a certification from the entity; or add a clause or condition to the entity’s contract.

What was the purpose of our audit work and what work was performed?

The purpose of the audit work was to determine whether the System’s campuses had effective internal controls in place over, and complied with, federal suspension and debarment requirements for the HEERF grant during Fiscal Year 2023. The System had 120 HEERF-related covered transactions totaling $10.4 million.

As part of our audit work, we reviewed the campuses’ internal controls over the HEERF grant suspension and debarment requirements. In addition, we tested a sample of 40 covered transactions totaling $8.1 million of the campuses’ HEERF-related covered transactions, to determine whether the campuses’ contractors were suspended, debarred, or otherwise excluded from participating in the contract by the federal government, through verification on the SAM website exclusions listing or certification obtained from the entity.

How were the results of the audit work measured?

We measured the results of our audit work against the following requirements:

• Federal regulation [2 CFR 180.300] requires that when a non-federal entity enters into a covered transaction with another entity, the non-federal entity must verify that the person or entity they intend to do business with is not excluded or disqualified from receiving federal funds. This can be done by: (1) checking the SAM exclusions, (2) collecting a certification from that entity, or (3) adding a clause or condition to the covered transaction with that entity.

• Federal regulation [2 CFR 200.303] states that the System and its campuses, as recipients of federal funds, must establish and maintain effective internal control over their federal awards that provides reasonable assurance that the System’s campuses are managing the federal awards in compliance with federal statutes, regulations, and the award terms and conditions.

What problem did the audit work identify?

We identified errors in 9 of the 40 transactions tested (23 percent). Specifically, we identified the following:

Community College of Denver (CCD), Front Range Community College (FRCC) and Pikes Peak State College (PPSC) could not provide documentation to support that suspension and debarment verification procedures were performed. We confirmed through additional audit work that none of the vendors were suspended or debarred; as a result, we determined that these errors did not result in questioned costs.

Why did this problem occur?

CCD, FRCC, and PPSC did not have documented policies and procedures for complying with suspension and debarment requirements. Specifically, they did not have a policy stating how they would comply with suspension and debarment requirements. Further, CCD, FRCC, and PPSC experienced staff turnover in key positions, and existing employees could not locate documentation that staff checked the SAM exclusion website, or that they obtained certification from their contracted entities.

Why does this problem matter?

CCD, FRCC, and PPSC’s failure to perform procedures to ensure an entity is not suspended or debarred could result in the System paying funds to an entity that is disallowed from receiving such funds, thereby exposing the State to increased business risk and potential federal disallowances.

Recommendation 2023-060

Community College of Denver (CCD), Front Range Community College (FRCC) and Pikes Peak State College (PPSC) should strengthen their internal controls over and ensure they comply with suspension and debarment requirements for the Higher Education Emergency Relief Fund (HEERF) grant by:

A. Developing, documenting, and implementing a policy to comply with suspension and debarment using one of the three allowable methods: (1) checking the federal System of Award Management (SAM) website exclusions, (2) collecting a certification from that entity, or (3) adding a clause or condition to the covered transaction with that entity.

B. Providing training and cross-training to existing employees over the new policies and procedures to reduce impacts of turnover.

Response Community College of Denver

Agree Implementation Date: December 2023

A. CCD will implement the following controls for monitoring the spending of the federal funds. 1) The Purchasing Coordinator will verify vendor suspension and debarment on the sam.gov website for purchases above $5,000. 2) Purchasing will attach the System of Award Management (SAM) verification to the purchase requisition packet of every requisition related to a grant fund. 3) Purchasing will ensure to include the grants manager as they send the purchase requisition for authorizing signatures, and 4) the Grants Manager will review the supporting documentation and confirm that the suspension/disbarment screenshot is included with the federal purchases.

B. The Contracts and Procurement Manager and the Budget Director who supervises the purchasing will provide training to the purchasing staff and the grants personnel: Grants Manager, Sr. Grants Accountant and a Grant Accountant. The Controller will ensure that new policies and procedures are shared with the purchasing and grants staff, and new employees in those roles are trained accordingly.

Response Front Range Community College

Agree Implementation Date: December 2023

A. FRCC will implement the following controls for expending of federal funds. 1) When a purchase order greater than $25,000 is submitted, the grant accountant will cross check the vendor to the debarment list prior to approving the purchase order. The grant accountant will save a screenshot of the debarment check for documentation purposes. 2) During month end, the grant accountant will review all expenditures of federal funds greater than $25,000 and ensure that a debarment check has been completed and documentation has been maintained.

B. Controller will review and train the Grant accountants (2), Grant Senior accountant (1) on the new policy and procedures.

Response Pikes Peak State College

Agree Implementation Date: December 2023

A. Regarding expenditures of federal funds at PPSC, Procurement Office will follow established internal guidelines regarding suspension and debarment regulations by checking the federal System of Award Management (SAM) website and documenting results with a screenshot. An additional step will be added to the current process, with Procurement staff verifying expenditures of federal funds through a review of federal grants and approved delegations. Controller will maintain a list of current federal grants and provide to Procurement Office.

B. Director of Procurement and Contracts will provide training to Procurement Office staff and grant personnel on the new process step. Also, Controller will incorporate suspension and debarment requirements into training with grant personnel.

Finding 2023-061 Federal Funding Accountability and Transparency Act Reporting

The Federal Funding Accountability and Transparency Act (Transparency Act) was created to empower Americans with the ability to hold the government accountable for each spending decision and, as a result, to reduce wasteful spending by the government. The Transparency Act requires the federal government to make certain information on federal awards available to the public. The Department is required to report information about subgrants, or subawards, given to other governments or to nonprofit organizations (also referred to as subrecipients). Federal regulation [2 CFR 200.1] defines a subaward as an award provided by a pass-through entity, in this case the Department, to an entity to carry out part of a federal grant award received by the pass-through entity. A subrecipient is defined in federal regulation [2 CFR 200.1] as “an entity, usually but not limited to non-Federal entities, that receives a subaward from a pass-through entity to carry out part of a federal award; but does not include an individual that is a beneficiary of such award. A subrecipient may also be a recipient of other Federal awards directly from a federal awarding agency.”

The Department is required to file Transparency Act reports—also known as FFATA reports—through the Federal Funding Accountability and Transparency Act Subaward Reporting System (FSRS). Once the Department submits a report to FSRS, the public can view certain information from the report, including the subrecipient’s name, subaward identification number, subaward obligation/action date, subaward amount, federal awarding agency and subagency, the Department’s name, and the Department’s grant award identification number. Information submitted via the FSRS is made publicly available at https://www.usaspending.gov/search.

The Department’s required FFATA reports for Fiscal Year 2023 included information on the TANF [ALN 93.558]; Refugee [ALN 93.566]; LIHEAP [ALN 93.568]; and Substance Abuse [ALN 93.959] programs. FFATA reporting was required because the Department passed through funds to one or more subrecipients for each of the four programs in excess of $30,000, as follows: TANF funds to one subrecipient, Refugee funds to 27 subrecipients, LIHEAP funds to one subrecipient, and Substance Abuse funds to 21 subrecipients for Fiscal Year 2023.

What was the purpose of our audit work and what work was performed?

The purpose of our audit work was to evaluate the Department’s internal controls over the Transparency Act reporting and to determine whether the Department correctly and timely reported its subawards to the FSRS during Fiscal Year 2023.

We compared amounts reported by the Department for subawards in FSRS to the underlying financial records reported in the Colorado Operations Resource Engine (CORE), the State’s accounting system, for the TANF, Refugee, LIHEAP, and Substance Abuse programs and inquired about any differences. We reviewed the Department’s subawards and related federal expenditures in Fiscal Year 2023 to determine if the Department reported Transparency Act information through FSRS within the month following the month the subaward was made, as required. In addition, we made inquiries of Department staff regarding its internal control processes related to FFATA reporting, including supervisory reviews.

We reviewed the following number of subrecipient samples within each program for their internal control over compliance and compliance with FFATA reporting standards: TANF had one sample, Refugee had seven samples, LIHEAP had one sample, and Substance Abuse had 13 samples. We reviewed the FFATA reports within FSRS for each subrecipient selected for testing to determine if the FFATA report was made timely in accordance with federal regulations and contained all of the required key data elements.

How were the results of the audit work measured?

In accordance with federal regulation [2 CFR 170], direct recipients of grants are required to report subawards of $30,000 or more to FSRS by the end of the month following the month in which the award was made. If the Department makes additional subawards greater than or equal to $30,000 under that same subaward at a later date or makes a supplemental award that increases an existing award to greater than or equal to $30,000, it must file additional FFATA reports to reflect the new or amended subaward. If the subaward does not change, no additional reporting is required. The FFATA reports are required to include the following key data elements: subrecipient name, subrecipient DUNS number, amount of subaward, subaward obligation/action date, date of report submission, subaward number, subaward project description, and subrecipient names and compensation of highly compensated officers.

The Department’s FFATA Quick Reference Guide, which it makes available to program staff, requires that program staff report these key data elements to eClearance—a document depository used by the Department—whenever the Department makes a subaward. Program staff are to enter the subaward information into eClearance via an online form called an eForm. Each day, the Department’s accounting manager exports the subaward data that is accumulated in eClearance into a daily report. At the end of the month, the accounting manager combines the daily reports into a monthly summary and compares the monthly summary report to the daily reports to verify the summary report’s accuracy. The accounting manager uses the information summarized within the monthly report to input the required FFATA information into FSRS, which ultimately is submitted as the required monthly FFATA report.

What problems did the audit work identify?

Based on our audit testwork, we determined that the Department did report its subawards in FSRS for all four federal grant programs we tested for Fiscal Year 2023—TANF, Refugee, LIHEAP, and Substance Abuse programs. However, for the four programs, the Department failed to provide evidence showing subawards were reported timely for our samples totaling about $10.9 million (approximately $42,000 for TANF, approximately $419,000 for Refugee, approximately $3.6 million for LIHEAP, and approximately $6.8 million for Substance Abuse). The following tables summarize the results of our testing and groups each exception within the following categories: subaward not reported, timeliness of report unable to be determined, subaward amount incorrect, and subaward missing key elements.

In addition, the Department was unable to provide a complete population of subawards for our testing. Specifically, the Department provided the Fiscal Year 2023 actual payments/expenditures it made to its subrecipients, rather than subawards that it awarded to subrecipients. We, therefore, selected our samples based on actual expenditures rather than subawards made during Fiscal Year 2023. As a result, we were unable to determine if there were subawards made during Fiscal Year 2023 that were not included in our testing population. For instance, if the Department made a subaward in June 2023, but the Department did not make any payments under the subaward that month, then that subaward should have been included in our testing population, but would not have been included. Without a method for identifying subrecipient subawards, the Department will struggle to track the status of the subawards or subrecipients’ compliance with subaward requirements.

Why did these problems occur?

The Department does not have adequate internal controls in place related to FFATA reporting, such as requirements for staff training over Transparency Act reporting and an appropriate supervisory review process to ensure that the Transparency Act reporting is completed in accordance with the instructions included within the Department’s FFATA Quick Reference Guide, and that the reporting is completed in a timely manner. Specifically, because the FFATA reports do not contain a time identifier for when they were submitted and the Department does not have another procedure for documenting when reports are submitted, the Department was unable to demonstrate that its FSRS reporting was completed timely for each subaward. In addition, Department staff indicated that they did not keep a listing of all subawards that were made during Fiscal Year 2023 by program since they were relying on the FSRS reporting to document the population; however, the FSRS reporting does not indicate when a subaward was reported to FSRS. Also, if a subaward was required to be submitted to FSRS, but should have been, it would not be included in the testing population based on exclusion from FSRS.

Why do these problems matter?

By failing to provide evidence of timely subaward reporting through FSRS, the Department is out of compliance with federal reporting requirements and risks federal sanctions. In addition, untimely reporting of the information could be misleading to the public, which fails to meet the federal intent of transparency for federal program spending. By failing to provide a complete population of subawards by program, it is difficult for the auditor to determine if there are additional subawards that should be included in the testing population and subject to sample selection. Further, the Department is not able to accurately track the status of subawards made to subrecipients due to the lack of a complete population of subawards by program.

Recommendation 2023-061

The Department of Human Services (Department) should strengthen its internal controls over the Federal Funding Accountability and Transparency Act reporting and ensure its reporting meets federal requirements by:

A. Ensuring that reporting occurs as required for subawards of $30,000 or more in the Federal Funding Accountability and Transparency Act Subaward Reporting System by the end of the month following the month the subawards are made, and maintaining evidence to demonstrate when the reports were submitted.

B. Creating a listing of all subawards by program that are awarded during the fiscal year, so that a complete population can be determined for single audit purposes and for the Department to accurately track the status of subawards made to subrecipients.

Response Department of Human Services

A. Agree Implementation Date: March 2024

The Department agrees with the recommendation and will ensure monthly reporting of subaward information and will implement a digital signature process to maintain evidence when the reports are submitted.

B. Agree Implementation Date: March 2024

The Department agrees with this recommendation and will implement a system to record the complete population of the original grants awarded to subrecipients.

Finding 2023-062 Internal Controls Over Exhibit K1, Schedule of Federal Assistance

Each year, the Department is required to prepare an “exhibit” containing the Department’s federal expenditures and related reimbursements to aid the Colorado Office of the State Controller (OSC) in the preparation of the State’s Schedule of Expenditures of Federal Awards (SEFA); this exhibit is referred to as the Schedule of Federal Assistance, or Exhibit K1. The Exhibit K1 should include expenditures for grants received directly from the federal government and expended by the Department (direct expenditures), as well as expenditures for federal grants passed through by the Department to other State and/or non-State agencies (subrecipient expenditures). The SEFA is to be presented in accordance with the requirements of Title 2 U.S. Code of Federal Regulations Part 200, Uniform Administrative Requirements, Cost Principles, and Audit Requirements for Federal Awards (Uniform Guidance) to show the State’s expenditures of federal awards during the fiscal year.

A subrecipient is defined in federal regulation [2 CFR 200.1] as “an entity, usually but not limited to non-Federal entities, that receives a subaward from a pass-through entity to carry out part of a federal award; but does not include an individual that is a beneficiary of such award. A subrecipient may also be a recipient of other Federal awards directly from a federal awarding agency.”

Annually, the Department prepares its Exhibit K1 by following a process documented in its program accounting manual. First, program accountants review and analyze information from CORE for the federal Assistance Listing Numbers (ALNs) related to the programs they support. The program accountants complete this review using a CORE report that the Department has created that pulls transaction detail-level data by ALN. Once the reviews and analysis are complete, the program accountants enter the information on the Department’s Exhibit K1 template for the correlating ALN. After the exhibit is prepared, the Department’s program accounting manual requires that it goes through two levels of review for accuracy. Once these reviews are completed, the Department submits the final Exhibit K1 to the OSC.

For Fiscal Year 2023, the Department administered more than 80 federal programs and expended approximately $2.7 billion in federal funds. TANF and Substance Abuse were two of these federal programs administered by the Department during Fiscal Year 2023. The Department reported more than $159.0 million in federal expenditures for the TANF program and approximately $43.4 million in federal expenditures for Substance Abuse in Fiscal Year 2023.

What was the purpose of our audit work and what work was performed?

The purpose of our audit work was to evaluate the Department’s internal controls over the preparation of its Exhibit K1 during Fiscal Year 2023 and to determine whether the Department correctly reported its Fiscal Year 2023 federal grant expenditures to the OSC on its Exhibit K1.

As part of our audit testwork, we compared amounts reported by the Department for direct and subrecipient federal expenditures on its Fiscal Year 2023 Exhibit K1 to the underlying financial records in CORE for the TANF and Substance Abuse federal programs and inquired about any differences. In addition, we made inquiries of Department staff regarding its internal control processes over the Exhibit K1 preparation, including supervisory reviews.

How were the results of the audit work measured?

The OSC is required to present the State’s SEFA in accordance with the federal requirements of the Uniform Guidance to show the State’s expenditures of federal awards during the fiscal year. Federal regulation [2 CFR 200.38(b)] defines a federal award as, “The instrument setting forth the terms and conditions. The instrument is the grant agreement, cooperative agreement, other agreement for assistance…” Federal regulations require that the SEFA must show both total federal awards expended for each individual federal program and the ALN [2 CFR 200.510(b)(3)], and the total amount passed through to subrecipients for each federal program [2 CFR 200.510(b)(4)].

In order to prepare the SEFA, the OSC requires state departments to submit an Exhibit K1 to report expenditures, receipts, and receivables for each federal grant program administered by the Department during the fiscal year. The OSC’s Instructions for Exhibits Preparation include guidelines for completing the Exhibit K1, including defining “direct and indirect expenditures” as “all monetary and non-monetary direct and indirect Federal award expenditures,” and “pass-through expenditures” as “the amount of all monetary and non-monetary Federal award amounts passed through to a subrecipient.”

State Fiscal Rule 1-2, Internal Controls, requires that state departments “implement internal accounting and administrative controls that reasonably ensure that financial transactions are accurate, reliable, conform to state fiscal rules, and reflect the underlying realities of the accounting transaction (substance rather than form).”

What problems did the audit work identify?

Based on our audit work, we determined that for Fiscal Year 2023, the Department misreported federal expenditures for TANF and Substance Abuse programs. Specifically:

• For TANF, $12.2 million of expenditures were incorrectly identified on the Exhibit K1 as indirect and direct expenditures rather than expenditures passed through to subrecipients.

• For the Substance Abuse, $323,000 of expenditures were incorrectly identified on the Exhibit K1 as indirect and direct expenditures rather than expenditures passed through to subrecipients.

The Department correctly reported total expenditures for both the programs. However, for the two programs, the Department misstated the allocation between expenditures passed through to subrecipients and indirect and direct expenditures on the Exhibit K1.

Why did these problems occur?

The Department does not have adequate internal controls, such as an appropriate supervisory review process, in place to ensure that the Exhibit K1 was completed in accordance with the instructions provided by the OSC. In addition, the Exhibit K1 was not reviewed for accuracy and compared to the underlying data. For the TANF program error, the Department did not exclude all revenue codes from the calculation of expenditures passed through to subrecipients. By including revenue codes with credit balances, expenditures passed through to subrecipients were understated. Indirect and direct expenditures were overstated as they are calculated using the difference between total TANF expenditures and the expenditures passed through to subrecipients. For the Substance Abuse error, the Department excluded an appropriation code from the calculation of expenditures passed through to subrecipients, resulting in indirect and direct expenditures being overstated and expenditures passed through to subrecipients being understated. For both programs, the Department did not have an adequate supervisory review process to endure that the analysis and review performed by program accountants was accurate.

Why do these problems matter?

By failing to properly report grant expenditures to the OSC, who ultimately then fails to properly report expenditures to the federal government on the State’s SEFA, the Department is out of compliance with federal and state reporting requirements and risks federal sanctions. In addition, the Department could misstate its federal expenditure results for the fiscal year which results in an incorrect or unreliable picture of the grant’s overall status.

Recommendation 2023-062

The Department of Human Services should strengthen its internal controls over its preparation of its Exhibit K1, Schedule of Federal Assistance, by improving the supervisory review process over the Exhibit K1 to ensure that the individual program analyses are accurate and complete prior to submitting the Exhibit K1 to the Office of the State Controller.

Response Department of Human Services

Agree Implementation Date: September 2024

The Department agrees with the recommendation and will implement a review process to ensure that the Exhibit K1 is accurate and complete.

Finding 2023-063, 2023-064, and 2023-065 Internal Controls Over Colorado Benefits Management System

The Department of Human Services uses the Colorado Benefits Management System (CBMS) for the TANF and SNAP programs. In addition, the Department of Health Care Policy and Financing (HCPF) uses CBMS for the federal Medicaid and the Children’s Basic Health Plan (CBHP) programs. For Fiscal Year 2023, the Governor’s Office of Information Technology (OIT) contracted with independent auditors (service auditors) to perform an evaluation of the Department, HCPF, and OIT’s internal controls for CBMS. For these types of evaluations, the service auditors follow the guidance issued by the American Institute of Certified Public Accountants (AICPA), Statement on Standards for Attestation Engagements (SSAE), within AT-C Section 320, and issue System and Organization Controls (SOC) reports at the conclusion of the evaluation. One type of SOC report—a SOC 1, Type II (SOC 1) report—provides the service auditor’s opinion on the service organization’s internal controls, specifically as to whether the internal controls are suitably designed, implemented, and operating effectively for a specified period. The Fiscal Year 2023 CBMS SOC 1 report covers the period of July 1, 2022 through June 30, 2023.

The Department, HCPF, and OIT can use the CBMS SOC 1 report to obtain assurance that CBMS’s internal controls are in place and working effectively in relation to the related federal programs administered through CBMS. If the SOC 1 report has issues noted, then the departments and office can assess how to address the issues. In addition, when service auditors provide a SOC 1 report with a modified opinion—which indicates that the service auditor has identified internal controls that fail to meet the standard upon which they are being measured or the service auditor was unable to obtain sufficient and appropriate evidence—the Department and HCPF should determine if actions to mitigate the increased risk to their federal programs and related internal control and compliance considerations are necessary.

In April 2023, the Department created a Business Innovation, Technology & Security (BITS) Division within the Department to help manage CBMS. The BITS Division is a new technology management division that works with OIT and vendors to ensure proper management of technology projects and assets. In 2023, the BITS Division took on much of the CBMS management through a joint-agency effort between the Department, HCPF, and OIT. This project was called the “CBMS Realignment” and it shifted centralized OIT staff to the Department and HCPF in an effort to bring CBMS management closer to the programs and the constituents they serve.

What was the purpose of our audit work and what work was performed?

The purpose of our audit work was to determine whether the Department and HCPF had effective internal controls in place related to their federal programs and CBMS for Fiscal Year 2023. Specifically, we requested a copy of the Fiscal Year 2023 CBMS SOC 1 report. We also inquired with the Department and HCPF on the timeline related to the receipt of the report.

How were the results of the audit work measured?

We measured the results of our audit work against the following requirements:

Federal regulation [2 CFR 200.303] requires the non-federal entity, in this instance the Department and HCPF, to establish and maintain effective internal controls over the federal award that provides reasonable assurance that the non-federal entity is managing the federal award in compliance with federal statutes, regulations, and the terms and conditions of the federal award.

According to the OSC’s policy, Internal Control System, the OSC and state departments must use the Standards for Internal Control in the Federal Government (Green Book), published by the U.S. Government Accountability Office, as their framework for their systems of internal control. Green Book Paragraph OV4.01, Service Organizations, states that management retains responsibility for the performance of processes assigned to service organizations. Furthermore, the Green Book specifies that management needs to understand the internal controls that each service organization has designed, implemented, and operates, as well as how each service organization’s internal control system impacts the Department’s internal control systems. Additionally, the Green Book states the following:

• Principle 3.06 states that, to achieve the entity’s objectives, management should assign responsibility and delegate authority to key roles throughout the entity.

• Principle 10.13 states that management should ensure duties are segregated in relation to authority and operation activities, to reduce the risk of overriding existing or established controls and preventing abuse, through potential collusion, in the internal control system.

• Principle 14.3 states that management should communicate quality information down and across reporting lines to enable personnel to perform key roles in achieving objectives, addressing risks, and supporting the internal control system. In these communications, management assigns the internal control responsibilities for key roles.

The CBMS SOC 1 report should be received by the Department, HCPF, and OIT no later than the end of October of each year—or within 4 months of the end of the fiscal year, as identified by industry best practices. This ensures that timely information is provided to the reviewed agency about the system being reviewed on the internal controls in place during the prior fiscal year.

What problem did the audit work identify?

The Department, HCPF, and OIT did not receive the CBMS SOC 1 report for the July 1, 2022 through June 30, 2023 period by October 2023. Rather, the Department received the report on January 26, 2024, 86 days after the end of October. Historically, OIT received this report between September and October each fiscal year and then provided the report to the Department and HCPF.

Why did this problem occur?

The Fiscal Year 2023 CBMS SOC 1 report was late due to the realignment of the CBMS OIT team, which was previously in charge of obtaining the CBMS SOC 1 report. According to the Department, when the CBMS OIT team was transitioned to the Department and HCPF during Fiscal Year 2023, there were coordination issues between the Department, HCPF, and the service auditor regarding the performance of the CBMS SOC 1 audit. In addition, the service auditor identified exceptions that the Department and HCPF were required to respond to prior to issuance of the CBMS SOC 1 report. With the recent changes, the Department, HCPF, and OIT do not have an interagency agreement in place to properly delineate responsibilities for CBMS, including SOC 1 audit oversight and the responsibilities associated with that audit.

Why does this problem matter?

The Department and HCPF are responsible for ensuring they have effective internal controls over their federal programs. By not establishing interagency agreements between the Department, HCPF, and OIT—not having clear roles and responsibilities outlined—the Department and HCPF could miss major CBMS management responsibilities, such as obtaining the CBMS SOC 1 reports in a timely manner. Further, the Department and HCPF have been unable to review the CBMS SOC 1 report for updates to compensating user entity controls and determine if there was a modified opinion in the report and, if so, take action to correct the identified issues.

Recommendation 2023-063

The Department of Human Services (Department) should improve its internal controls over the Colorado Benefits Management System (CBMS) by establishing the roles and responsibilities for the Department through interagency agreements with the Governor’s Office of Information Technology and Department of Health Care Policy and Financing.

Response Department of Human Services

Agree Implementation Date: September 2024

The Department will be working with HCPF and OIT on a Delegation of Authority per C.R.S. 24-37.5-105.4 which will serve in the same capacity as an IA. The Delegation of Authority will outline the roles and responsibilities of each party/agency are in place prior to the start of the yearly SOC audit. In addition, the CBMS Team (CDHS BITS) will be working to hire a resource to fill a new position that will help facilitate the coordination of the yearly SOC audit. The new role will serve as the main point of contact for the SOC auditors to gather support requests in a timely manner and ensure the timeline is on track, while escalating to management at State CBMS, HCPF, vendors and OIT as needed. This position will also work with the CDHS Internal Audit Division to document an internal control process to ensure proper alignment with all internal and external stakeholders. The CBMS Team and SOC auditors will agree to a timeline that will meet the industry standards best practices of delivering a final report within four months of the end of each fiscal year. The timeline will include a review of the draft report for not only the CBMS Team but also CDHS, HCPF and OIT.

Finding 2023-063, 2023-064, and 2023-065 Internal Controls Over Colorado Benefits Management System

The Department of Human Services uses the Colorado Benefits Management System (CBMS) for the TANF and SNAP programs. In addition, the Department of Health Care Policy and Financing (HCPF) uses CBMS for the federal Medicaid and the Children’s Basic Health Plan (CBHP) programs. For Fiscal Year 2023, the Governor’s Office of Information Technology (OIT) contracted with independent auditors (service auditors) to perform an evaluation of the Department, HCPF, and OIT’s internal controls for CBMS. For these types of evaluations, the service auditors follow the guidance issued by the American Institute of Certified Public Accountants (AICPA), Statement on Standards for Attestation Engagements (SSAE), within AT-C Section 320, and issue System and Organization Controls (SOC) reports at the conclusion of the evaluation. One type of SOC report—a SOC 1, Type II (SOC 1) report—provides the service auditor’s opinion on the service organization’s internal controls, specifically as to whether the internal controls are suitably designed, implemented, and operating effectively for a specified period. The Fiscal Year 2023 CBMS SOC 1 report covers the period of July 1, 2022 through June 30, 2023.

The Department, HCPF, and OIT can use the CBMS SOC 1 report to obtain assurance that CBMS’s internal controls are in place and working effectively in relation to the related federal programs administered through CBMS. If the SOC 1 report has issues noted, then the departments and office can assess how to address the issues. In addition, when service auditors provide a SOC 1 report with a modified opinion—which indicates that the service auditor has identified internal controls that fail to meet the standard upon which they are being measured or the service auditor was unable to obtain sufficient and appropriate evidence—the Department and HCPF should determine if actions to mitigate the increased risk to their federal programs and related internal control and compliance considerations are necessary.

In April 2023, the Department created a Business Innovation, Technology & Security (BITS) Division within the Department to help manage CBMS. The BITS Division is a new technology management division that works with OIT and vendors to ensure proper management of technology projects and assets. In 2023, the BITS Division took on much of the CBMS management through a joint-agency effort between the Department, HCPF, and OIT. This project was called the “CBMS Realignment” and it shifted centralized OIT staff to the Department and HCPF in an effort to bring CBMS management closer to the programs and the constituents they serve.

What was the purpose of our audit work and what work was performed?

The purpose of our audit work was to determine whether the Department and HCPF had effective internal controls in place related to their federal programs and CBMS for Fiscal Year 2023. Specifically, we requested a copy of the Fiscal Year 2023 CBMS SOC 1 report. We also inquired with the Department and HCPF on the timeline related to the receipt of the report.

How were the results of the audit work measured?

We measured the results of our audit work against the following requirements:

Federal regulation [2 CFR 200.303] requires the non-federal entity, in this instance the Department and HCPF, to establish and maintain effective internal controls over the federal award that provides reasonable assurance that the non-federal entity is managing the federal award in compliance with federal statutes, regulations, and the terms and conditions of the federal award.

According to the OSC’s policy, Internal Control System, the OSC and state departments must use the Standards for Internal Control in the Federal Government (Green Book), published by the U.S. Government Accountability Office, as their framework for their systems of internal control. Green Book Paragraph OV4.01, Service Organizations, states that management retains responsibility for the performance of processes assigned to service organizations. Furthermore, the Green Book specifies that management needs to understand the internal controls that each service organization has designed, implemented, and operates, as well as how each service organization’s internal control system impacts the Department’s internal control systems. Additionally, the Green Book states the following:

• Principle 3.06 states that, to achieve the entity’s objectives, management should assign responsibility and delegate authority to key roles throughout the entity.

• Principle 10.13 states that management should ensure duties are segregated in relation to authority and operation activities, to reduce the risk of overriding existing or established controls and preventing abuse, through potential collusion, in the internal control system.

• Principle 14.3 states that management should communicate quality information down and across reporting lines to enable personnel to perform key roles in achieving objectives, addressing risks, and supporting the internal control system. In these communications, management assigns the internal control responsibilities for key roles.

The CBMS SOC 1 report should be received by the Department, HCPF, and OIT no later than the end of October of each year—or within 4 months of the end of the fiscal year, as identified by industry best practices. This ensures that timely information is provided to the reviewed agency about the system being reviewed on the internal controls in place during the prior fiscal year.

What problem did the audit work identify?

The Department, HCPF, and OIT did not receive the CBMS SOC 1 report for the July 1, 2022 through June 30, 2023 period by October 2023. Rather, the Department received the report on January 26, 2024, 86 days after the end of October. Historically, OIT received this report between September and October each fiscal year and then provided the report to the Department and HCPF.

Why did this problem occur?

The Fiscal Year 2023 CBMS SOC 1 report was late due to the realignment of the CBMS OIT team, which was previously in charge of obtaining the CBMS SOC 1 report. According to the Department, when the CBMS OIT team was transitioned to the Department and HCPF during Fiscal Year 2023, there were coordination issues between the Department, HCPF, and the service auditor regarding the performance of the CBMS SOC 1 audit. In addition, the service auditor identified exceptions that the Department and HCPF were required to respond to prior to issuance of the CBMS SOC 1 report. With the recent changes, the Department, HCPF, and OIT do not have an interagency agreement in place to properly delineate responsibilities for CBMS, including SOC 1 audit oversight and the responsibilities associated with that audit.

Why does this problem matter?

The Department and HCPF are responsible for ensuring they have effective internal controls over their federal programs. By not establishing interagency agreements between the Department, HCPF, and OIT—not having clear roles and responsibilities outlined—the Department and HCPF could miss major CBMS management responsibilities, such as obtaining the CBMS SOC 1 reports in a timely manner. Further, the Department and HCPF have been unable to review the CBMS SOC 1 report for updates to compensating user entity controls and determine if there was a modified opinion in the report and, if so, take action to correct the identified issues.

Recommendation 2023-064

The Department of Health Care Policy and Financing (HCPF) should improve its internal controls over the Colorado Benefits Management System (CBMS) by establishing the roles and responsibilities for HCPF through interagency agreements with the Governor’s Office of Information Technology and Department of Human Services.

Response Department of Health Care Policy and Financing

Partially Agree Implementation Date: November 2024

HCPF does not agree that the late delivery of the CBMS SOC report justifies this recommendation. As identified in Inter-agency Agreements between OIT and the Department and CDHS and OIT, the SOC report for CBMS compliance was owned by the OIT prior to 2022 and CDHS Product Manager currently. CBMS is a multi-agency system owned by CDHS, HCPF, and OIT and as a result OIT, CDHS, and the Department agreed to Inter-agency agreements specifically identifying OIT as the responsible party for reviewing and complying with CBMS SOC requirements.

However, HCPF does agree that establishing the roles and responsibilities for HCPF, OIT, and CDHS is important to its internal controls over CBMS. HCPF will work with CDHS and OIT to establish, document, and formalize the roles and responsibilities.

Auditor’s Addendum

As discussed in the finding, the Department is responsible for ensuring they have effective internal controls over their federal programs, which includes maintaining responsibility for the performance of processes assigned to service organizations [Green Book Paragraph OV4.01]. By not reviewing the CBMS SOC report until almost 7 months after fiscal year end, the Department was unable to determine if any issues were identified in the report, or if any actions were needed to correct the issues identified.

Finding 2023-063, 2023-064, and 2023-065 Internal Controls Over Colorado Benefits Management System

The Department of Human Services uses the Colorado Benefits Management System (CBMS) for the TANF and SNAP programs. In addition, the Department of Health Care Policy and Financing (HCPF) uses CBMS for the federal Medicaid and the Children’s Basic Health Plan (CBHP) programs. For Fiscal Year 2023, the Governor’s Office of Information Technology (OIT) contracted with independent auditors (service auditors) to perform an evaluation of the Department, HCPF, and OIT’s internal controls for CBMS. For these types of evaluations, the service auditors follow the guidance issued by the American Institute of Certified Public Accountants (AICPA), Statement on Standards for Attestation Engagements (SSAE), within AT-C Section 320, and issue System and Organization Controls (SOC) reports at the conclusion of the evaluation. One type of SOC report—a SOC 1, Type II (SOC 1) report—provides the service auditor’s opinion on the service organization’s internal controls, specifically as to whether the internal controls are suitably designed, implemented, and operating effectively for a specified period. The Fiscal Year 2023 CBMS SOC 1 report covers the period of July 1, 2022 through June 30, 2023.

The Department, HCPF, and OIT can use the CBMS SOC 1 report to obtain assurance that CBMS’s internal controls are in place and working effectively in relation to the related federal programs administered through CBMS. If the SOC 1 report has issues noted, then the departments and office can assess how to address the issues. In addition, when service auditors provide a SOC 1 report with a modified opinion—which indicates that the service auditor has identified internal controls that fail to meet the standard upon which they are being measured or the service auditor was unable to obtain sufficient and appropriate evidence—the Department and HCPF should determine if actions to mitigate the increased risk to their federal programs and related internal control and compliance considerations are necessary.

In April 2023, the Department created a Business Innovation, Technology & Security (BITS) Division within the Department to help manage CBMS. The BITS Division is a new technology management division that works with OIT and vendors to ensure proper management of technology projects and assets. In 2023, the BITS Division took on much of the CBMS management through a joint-agency effort between the Department, HCPF, and OIT. This project was called the “CBMS Realignment” and it shifted centralized OIT staff to the Department and HCPF in an effort to bring CBMS management closer to the programs and the constituents they serve.

What was the purpose of our audit work and what work was performed?

The purpose of our audit work was to determine whether the Department and HCPF had effective internal controls in place related to their federal programs and CBMS for Fiscal Year 2023. Specifically, we requested a copy of the Fiscal Year 2023 CBMS SOC 1 report. We also inquired with the Department and HCPF on the timeline related to the receipt of the report.

How were the results of the audit work measured?

We measured the results of our audit work against the following requirements:

Federal regulation [2 CFR 200.303] requires the non-federal entity, in this instance the Department and HCPF, to establish and maintain effective internal controls over the federal award that provides reasonable assurance that the non-federal entity is managing the federal award in compliance with federal statutes, regulations, and the terms and conditions of the federal award.

According to the OSC’s policy, Internal Control System, the OSC and state departments must use the Standards for Internal Control in the Federal Government (Green Book), published by the U.S. Government Accountability Office, as their framework for their systems of internal control. Green Book Paragraph OV4.01, Service Organizations, states that management retains responsibility for the performance of processes assigned to service organizations. Furthermore, the Green Book specifies that management needs to understand the internal controls that each service organization has designed, implemented, and operates, as well as how each service organization’s internal control system impacts the Department’s internal control systems. Additionally, the Green Book states the following:

• Principle 3.06 states that, to achieve the entity’s objectives, management should assign responsibility and delegate authority to key roles throughout the entity.

• Principle 10.13 states that management should ensure duties are segregated in relation to authority and operation activities, to reduce the risk of overriding existing or established controls and preventing abuse, through potential collusion, in the internal control system.

• Principle 14.3 states that management should communicate quality information down and across reporting lines to enable personnel to perform key roles in achieving objectives, addressing risks, and supporting the internal control system. In these communications, management assigns the internal control responsibilities for key roles.

The CBMS SOC 1 report should be received by the Department, HCPF, and OIT no later than the end of October of each year—or within 4 months of the end of the fiscal year, as identified by industry best practices. This ensures that timely information is provided to the reviewed agency about the system being reviewed on the internal controls in place during the prior fiscal year.

What problem did the audit work identify?

The Department, HCPF, and OIT did not receive the CBMS SOC 1 report for the July 1, 2022 through June 30, 2023 period by October 2023. Rather, the Department received the report on January 26, 2024, 86 days after the end of October. Historically, OIT received this report between September and October each fiscal year and then provided the report to the Department and HCPF.

Why did this problem occur?

The Fiscal Year 2023 CBMS SOC 1 report was late due to the realignment of the CBMS OIT team, which was previously in charge of obtaining the CBMS SOC 1 report. According to the Department, when the CBMS OIT team was transitioned to the Department and HCPF during Fiscal Year 2023, there were coordination issues between the Department, HCPF, and the service auditor regarding the performance of the CBMS SOC 1 audit. In addition, the service auditor identified exceptions that the Department and HCPF were required to respond to prior to issuance of the CBMS SOC 1 report. With the recent changes, the Department, HCPF, and OIT do not have an interagency agreement in place to properly delineate responsibilities for CBMS, including SOC 1 audit oversight and the responsibilities associated with that audit.

Why does this problem matter?

The Department and HCPF are responsible for ensuring they have effective internal controls over their federal programs. By not establishing interagency agreements between the Department, HCPF, and OIT—not having clear roles and responsibilities outlined—the Department and HCPF could miss major CBMS management responsibilities, such as obtaining the CBMS SOC 1 reports in a timely manner. Further, the Department and HCPF have been unable to review the CBMS SOC 1 report for updates to compensating user entity controls and determine if there was a modified opinion in the report and, if so, take action to correct the identified issues.

Recommendation 2023-065

The Governor’s Office of Information Technology (OIT) should improve its internal controls over the Colorado Benefits Management System (CBMS) by establishing the roles and responsibilities for OIT through interagency agreements with the Department of Health Care Policy and Financing and Department of Human Services.

Response Governor’s Office of Information Technology

Agree Implementation Date: June 2024

OIT's roles and responsibilities related to the Colorado Benefits Management System (CBMS) are outlined in statute, C.R.S. 24-37.5-105. The "CBMS realignment" demonstrated OIT's commitment to focus on fulfilling the roles and responsibilities outlined in statute. OIT will work with CDHS and HCPF to reaffirm through interagency agreement that OIT will continue to work in alignment with statute, and its support of the CBMS program does not extend to roles and responsibilities that are outside of OIT's statute like program administration, including program audit and compliance.

The following findings and recommendations relating to internal control deficiencies classified as Material Weaknesses and a Significant Deficiency were communicated to the Department of Human Services (Department) in the previous year and have not been remediated as of June 30, 2023 because the original implementation dates provided by the Department were in a subsequent fiscal year. These complete findings and recommendations can be found within the original report and the complete recommendations can be found within Section IV: Prior Audit Recommendations of this report. Findings 2022-080 through 2022-084 Department of Human Services—Foster Care Program

The [the auditor] conducted the Fiscal Year 2022 audit work that resulted in findings and recommendations addressed to the Department related to the Foster Care Title IV-E program. These findings and recommendations, and the responses, are included in the Department of Human Services – Foster Care Program chapter at III-125 within this section of the report. See Recommendations 2022-080 through 2022-084.

These recommendations are classified as Material Weaknesses and Significant Deficiencies.

The following findings and recommendations relating to internal control deficiencies classified as Material Weaknesses were communicated to the Department in the previous year and have not been remediated as of June 30, 2022 because the original implementation dates provided by the Department were in a subsequent fiscal year. These complete findings and recommendations can be found within the original report and the complete recommendations can be found within Section IV: Prior Audit Recommendations of this report.

Finding 2022-080 Foster Care Controls Over Eligibility Determinations

The Program was enacted under Title IV-E of the Social Security Act and is overseen at the federal level by HHS. The purpose of the Program is to help States provide proper care for eligible children who need placement outside of their homes. A child may be removed from a home either by a court order or a voluntary placement agreement and may be placed with a relative, a foster family home, a residential child care facility, or a group home.

In Colorado, the county departments of human/social services administer the Program, such as determining a child’s eligibility, and the Department supervises and monitors the counties. When a child is removed from the home, the county caseworkers gather necessary information to open a Program case for that child. County caseworkers enter the information on a prescribed form for initial determination and redetermination for the Program, including date of birth, whether the removal was voluntary or court ordered, household demographics, family income, and how the child was deprived of parental support. This information is also entered into the Department’s case management system, Trails, to document the child’s eligibility for the Program.

In Fiscal Year 2022, the Department’s expenditures for the Program were approximately $81.7 million.

What was the purpose of our audit work and what work was performed?

The purpose of the audit work was to review the Department’s internal controls over the Program’s eligibility determination process, as well as to determine whether the Department complied with applicable eligibility determination requirements during Fiscal Year 2022.

We reviewed a sample of 60 Program case files for children who were determined eligible for the Program, and resided with a provider who received payments for providing foster care for the child during Fiscal Year 2022. Our testing included reviewing supporting documentation included in the case files as well as data entered into Trails related to eligibility determinations/redeterminations.

How were the results of the audit work measured?

We applied the following criteria during our testing:

• State regulation [12 CCR 2509-7 7.601.71.A.2] requires the county caseworkers to document eligibility information on the prescribed form. It also requires the county caseworker to ensure that a copy of the signed voluntary placement agreement or court order are in the case file.

• State regulation [12 CCR 2509-7 7.601.71.I.1] requires county caseworkers to determine eligibility for children “entering out-of-home foster care within 45 calendar days of the placement unless good faith efforts have been made and recorded in the child’s record”.

• State regulation [12 CCR 2509-7 7.601.71.I.2] requires the county caseworkers to “redetermine eligibility using the state prescribed form every 12 months from the date the child enters foster care”.

• State regulation [12 CCR 2509-7 7.601.71.K.2] requires county caseworkers to finalize a permanence plan within 12 months of entering the Program, and every 12 months after that while the child is in the Program.

What problems did the audit work identify?

We identified at least one issue in 10 of the 60 case files tested (17 percent). Specifically, we identified the following:

• In one case, the Department provided court orders, however, the court orders were not signed.

• In five cases, the caseworker did not determine eligibility within 45 calendar days as required by state regulation. The caseworker determined eligibility one to 587 days after the 45-day requirement and the case file did not have documentation of good faith efforts to meet the requirement.

• In four cases, the caseworker did not redetermine eligibility within 12 months as required. In these cases, the caseworker redetermined eligibility 4 to 11 months after the 12-month requirement.

• In one case, the caseworker did not ensure reasonable efforts to finalize a permanency plan every 12 months, as required. Specifically, the caseworker obtained a court document that would provide reasonable efforts to finalize a permanency plan required for Fiscal Year 2022 13 months after the previous permanency plan, one month after the required time frame.

Why did these problems occur?

The Department lacked sufficient internal controls to ensure compliance with eligibility requirements for the Program during Fiscal Year 2022. For example, the Department did not provide adequate or effective training to the counties over the requirements of the Program. Specifically, the training provided was only required for new caseworkers and not for all caseworkers that work on the Program, and the Department did not require at least one representative from each county to attend training.

The Department communicated that the counties that administer the Program have experienced significant turnover in caseworker positions; having new, inexperienced county caseworkers determining eligibility for the Foster Care Program further heightens the need for frequent, detailed training and an effective quality review process.  Why do these problems matter?

It is essential for the Department to ensure that a child’s eligibility for the Program is properly determined, documented, and in accordance with state and federal regulations. Furthermore, providing continuous and effective training on eligibility determinations and redetermination, will aid in reducing errors and omissions of required documentation. Inaccurate processing of case file information to determine eligibility can result in counties improperly granting Program benefits to ineligible individuals, or denying benefits to eligible individuals. The federal government can disallow the payment of federal funds for program expenditures that do not adhere to regulations, which would require the State to use General Funds to cover the expenditures.

Recommendation 2022-080

The Department of Human Services should strengthen its internal controls over, and ensure compliance with, the Foster Care Title IV-E program (Program) eligibility requirements by ensuring that county caseworkers are appropriately trained on Program requirements. This should include training all caseworkers that work on the Program at a frequency that ensures that new caseworkers receive comprehensive training within a reasonable timeframe after hire, and requiring that there is at least one representative from each county in attendance for Department-provided training.  Response Department of Human Resources

Agree Implementation Date: June 30, 2024

The Department currently provides quarterly training for both new workers and quarterly meetings. The department will require at least one representative from each county to attend a minimum of one training per fiscal year. New workers will still be required to attend a new worker training prior to gaining access to the IV-E module in Trails.

The following findings and recommendations relating to internal control deficiencies classified as Material Weaknesses and a Significant Deficiency were communicated to the Department of Human Services (Department) in the previous year and have not been remediated as of June 30, 2023 because the original implementation dates provided by the Department were in a subsequent fiscal year. These complete findings and recommendations can be found within the original report and the complete recommendations can be found within Section IV: Prior Audit Recommendations of this report. Findings 2022-080 through 2022-084 Department of Human Services—Foster Care Program

The [the auditor] conducted the Fiscal Year 2022 audit work that resulted in findings and recommendations addressed to the Department related to the Foster Care Title IV-E program. These findings and recommendations, and the responses, are included in the Department of Human Services – Foster Care Program chapter at III-125 within this section of the report. See Recommendations 2022-080 through 2022-084.

These recommendations are classified as Material Weaknesses and Significant Deficiencies.

The following findings and recommendations relating to internal control deficiencies classified as Material Weaknesses were communicated to the Department in the previous year and have not been remediated as of June 30, 2022 because the original implementation dates provided by the Department were in a subsequent fiscal year. These complete findings and recommendations can be found within the original report and the complete recommendations can be found within Section IV: Prior Audit Recommendations of this report.

Finding 2022-081 Federal Funding Accountability and Transparency Act

The Department receives funding from HHS for the Program and then awards this federal funding to Colorado counties for administration of the Program. In other words, the counties receive the Program’s subawards from the Department, which is considered a pass-through-entity in this instance. Federal regulations [2 CFR 200.1] define a subaward as an award provided by a pass-through-entity to another entity to carry out part of a federal grant received by the pass-through-entity. According to the Program’s ALN description at www.sam.gov, this federal funding helps states “provide safe and stable out-of-home care for children under the jurisdiction of the state…until the children are returned home safely, placed with adoptive families, or placed in other planned arrangements permanently. The program provides funds to assist with the costs of foster care maintenance for eligible children; administrative costs to manage the program; and training for public agency staff, foster parents, and eligible professional partner agency staff.”

Because the Department receives federal funding from HHS and passes it through as subawards to 64 Colorado counties, the Department is required to comply with the Federal Funding Accountability and Transparency Act of 2006 (FFATA). FFATA requires the federal government to make certain information on federal awards available to the public via a single, searchable website (www.usaspending.gov). To achieve this objective, FFATA federal regulations [2 CFR 170] require the Department to report information about the Program subawards it makes to subrecipients (i.e., the counties). Federal regulations [2 CFR 200.1] define a subrecipient as “an entity…that receives a subaward from a pass-through-entity to carry out part of a Federal award.”

In Fiscal Year 2022, the Department spent $81.7 million in Program grant funds from HHS and $66.4 million of this was passed through to, and expended by, Colorado’s 64 counties. FFATA federal regulations [2 CFR 170, Appendix A] specifically require the Department to submit Foster Care Program subaward information through the FFATA Subaward Reporting System (FSRS). Once the Department submits a report to FSRS, the public can view information from the report, including the subawardee’s name, subaward number, subaward obligation/action date, and subaward amount.

What was the purpose of our audit work and what work was performed?

The purpose of our audit work was to determine whether the Department had adequate internal controls over and complied with FFATA reporting requirements for the Program during Fiscal Year 2022. As part of our audit work, we requested the Department’s policies and procedures over FFATA reporting and the FFATA reports it submitted for the Program for Fiscal Year 2022.

How were the results of the audit work measured?

In accordance with FFATA regulations [2 CFR 170, Appendix A], the Department is required to report subawards of $30,000 or more to FSRS by the end of the month following the month in which the award was made. For example, the Department would have to submit a FFATA report to FSRS in May 2022 if it made an award or supplemental award equal to or greater than $30,000 in April 2022.

What problem did the audit work identify?

Based on our audit work, we determined that the Department did not comply with FFATA regulations for the Program. Specifically, the Department did not report any foster care subawards in FSRS for Fiscal Year 2022. The following table summarizes the results of our testing.

Why did this problem occur?

The Department stated that it believed the FFATA regulations did not apply to the Program because it is primarily administered by the counties, and therefore, the counties should be considered part of the State for FFATA reporting purposes instead of subrecipients. However, the Department could not provide any information from the federal government to support this conclusion. Because the Program funds are awarded to 64 Colorado counties that are subrecipients, the FFATA regulations specify that the Department “must report each action that equals or exceeds $30,000 in Federal funds for a subaward to a subrecipient.”

Why does this problem matter?

By failing to properly report the Program funding subawards to FSRS, the Department is out of compliance with federal reporting requirements and risks federal sanctions. In addition, by not reporting the relevant information, it is failing to meet the federal intent of transparency for federal program spending.

Recommendation 2022-081

The Department of Human Services (Department) should ensure that it complies with the Federal Funding Accountability and Transparency Act of 2006 (FFATA) for the Department of Health and Human Services’ (HHS) Foster Care Title IV-E program. The Department should work with HHS to obtain documented approval for its current approach. Otherwise, the Department must report its subawards in accordance with FFATA regulations.

Response Department of Human Services

Agree Implementation Date: December 2023

The Department agrees with the recommendation and will work with HHS to determine if the counties should be reported on the FFATA.

The following findings and recommendations relating to internal control deficiencies classified as Material Weaknesses and a Significant Deficiency were communicated to the Department of Human Services (Department) in the previous year and have not been remediated as of June 30, 2023 because the original implementation dates provided by the Department were in a subsequent fiscal year. These complete findings and recommendations can be found within the original report and the complete recommendations can be found within Section IV: Prior Audit Recommendations of this report.

Findings 2022-080 through 2022-084 Department of Human Services—Foster Care Program

The [the auditor] conducted the Fiscal Year 2022 audit work that resulted in findings and recommendations addressed to the Department related to the Foster Care Title IV-E program. These findings and recommendations, and the responses, are included in the Department of Human Services – Foster Care Program chapter at III-125 within this section of the report. See Recommendations 2022-080 through 2022-084.

These recommendations are classified as Material Weaknesses and Significant Deficiencies.

The following findings and recommendations relating to internal control deficiencies classified as Material Weaknesses were communicated to the Department in the previous year and have not been remediated as of June 30, 2022 because the original implementation dates provided by the Department were in a subsequent fiscal year. These complete findings and recommendations can be found within the original report and the complete recommendations can be found within Section IV: Prior Audit Recommendations of this report.

Finding 2022-082 Quarterly Reporting of Foster Care Program Expenditures and Children Assisted

According to the Program’s description at www.sam.gov, this federal funding helps states “provide safe and stable out-of-home care for children under the jurisdiction of the state…until the children are returned home safely, placed with adoptive families, or placed in other planned arrangements permanently. The program provides funds to assist with the costs of foster care maintenance for eligible children; administrative costs to manage the program; and training for public agency staff, foster parents, and eligible professional partner agency staff.”

As part of the terms and conditions of federal funding from HHS’s Foster Care Program, the Department is required to submit quarterly reports called CB-496, Title IV-E Programs Quarterly Financial Report (OMB No. 970-0205) (Report). This Report must include accurate information about the Department’s quarterly foster care expenditures, prior quarter foster care expenditure adjustments, and the average monthly number of children assisted by the State’s foster care program. According to the Report instructions, it is used by HHS to “…award funds, determine allowability of reported expenditures and to provide reports to Congress.”

What was the purpose of our audit work and what work was performed?

The purpose of our audit work was to determine whether the Department had adequate internal controls over and complied with the Program’s Report requirements during State Fiscal Year 2022 (SFY 2022).

As part of our audit work, we requested the Department’s procedures and internal controls for preparing the Report and copies of the four Reports it submitted for the Foster Care Program for SFY 2022. Then, we selected a sample of two quarterly reports for testing (the First Quarter of SFY 2022 and Third Quarter of SFY 2022). This testing included the following procedures: • We obtained the supporting records and recalculated the average monthly number of children assisted, by foster care assistance type, according to HHS’s Report instructions and the Department’s Report procedures.

• We recreated the Reports for current quarter expenditures and prior quarter expenditure adjustments by independently pulling data from the Colorado Operations Resource Engine (CORE), the State’s accounting system, and then following the Department’s Report procedures and HHS’s Report instructions.

How were the results of the audit work measured?

HHS’s Report instructions require the Department to report the average monthly number of children assisted by the Program, by the type of foster care assistance received. The Report instructions also provide details for reporting current quarter expenditures and prior quarter expenditure adjustments by the type of foster care assistance received. For example, foster care assistance expenditures are required to be reported in different lines on the Report for case planning and management, eligibility determinations, legal representation, etc. In addition, these expenditures are also required to be broken out further into those for children who are currently receiving foster care services (i.e., in-placement) and those for children who are candidates to receive foster care services (i.e., pre-placement).

What problems did the audit work identify?

Based on the audit work performed on the First Quarter and Third Quarter Reports we selected for testing, we identified two overall problems in both reports. First, we determined that the Department overstated the average monthly number of children who received legal representation assistance from the Foster Care Program on both of the Reports we tested. This number was overstated on each Report by approximately 200 percent because the Department reported the actual number of children assisted for each quarter (6,188 for the First Quarter; 6,062 for the Third Quarter) instead of the average monthly number of children assisted during each quarter (2,063 for the First Quarter; 2,021 for the Third Quarter) as required by HHS Report instructions. After identifying this error on our selected reports, we also reviewed the Second Quarter and Fourth Quarter SFY 2022 Reports and noted the same error on the Fourth Quarter Report, while the Second Quarter Report failed to identify any number of children receiving legal representation.

Additionally, the Department reported case planning and management expenditures for foster care candidates of $0 on the two reports we tested. However, we determined the Department should have reported $3.3 million on the First Quarter Report and $0.4 million on the Third Quarter Report. The Department incorrectly included foster care candidate case planning and management expenditures within case planning and management expenditures for children currently in the Program rather than as candidates for the Program. Why did these problems occur?

The Department’s internal controls over the Report did not include a process for periodic review, update, and approval of the Department’s Report procedures to ensure they agreed with HHS’s Report instructions and changes in data being reported for the Program. Specifically, the Department’s Report procedures did not address the average monthly number of children who received legal representation assistance, and because of this, the Department did not take the average of the total number of children who received this assistance during the quarters we tested. Instead, the total number for 3 months was reported, which was not in compliance with HHS Report instructions. In addition, the Department’s Report procedures did not adequately reflect the details included in the HHS instructions related to the classification of case management and planning expenditures.

Why do these problems matter?

By failing to prepare accurate Reports for the Program, the Department is out of compliance with federal reporting requirements and risks federal sanctions. In addition, this may also negatively impact HHS’s awarding of Program funds to the State. HHS reported to the Department that they also identified errors in the Reports for the average monthly number of children assisted and have requested that the Department obtain permission from the federal Office of Grants Management to re-open the system that captures these Reports to revise all of the impacted numbers for average monthly number of children assisted.

Recommendation 2022-082

The Department of Human Services (Department) should ensure that it provides accurate CB-496, Title IV-E Programs Quarterly Financial Reports (OMB No. 970-0205) (Report) to the federal Department of Health and Human Services for the Foster Care Title IV-E program. This should include periodically updating its Report procedures to ensure they agree to the federal program reporting requirements.

Response Department of Human Services

Agree Implementation Date: January 1, 2024

The Department will ensure that it provides accurate CB-496, Title IV-E Programs Quarterly Financial Reports (OMB No. 970-0205) by reviewing federal program reporting requirements annually to ensure report procedures align with the requirements.

The following findings and recommendations relating to internal control deficiencies classified as Material Weaknesses and a Significant Deficiency were communicated to the Department of Human Services (Department) in the previous year and have not been remediated as of June 30, 2023 because the original implementation dates provided by the Department were in a subsequent fiscal year. These complete findings and recommendations can be found within the original report and the complete recommendations can be found within Section IV: Prior Audit Recommendations of this report.

Findings 2022-080 through 2022-084 Department of Human Services—Foster Care Program

The [the auditor] conducted the Fiscal Year 2022 audit work that resulted in findings and recommendations addressed to the Department related to the Foster Care Title IV-E program. These findings and recommendations, and the responses, are included in the Department of Human Services – Foster Care Program chapter at III-125 within this section of the report. See Recommendations 2022-080 through 2022-084.

These recommendations are classified as Material Weaknesses and Significant Deficiencies.

The following findings and recommendations relating to internal control deficiencies classified as Material Weaknesses were communicated to the Department in the previous year and have not been remediated as of June 30, 2022 because the original implementation dates provided by the Department were in a subsequent fiscal year. These complete findings and recommendations can be found within the original report and the complete recommendations can be found within Section IV: Prior Audit Recommendations of this report.

Findings 2022-083 and 2022-084 Trails—Information Security

Government Auditing Standards allow for information that is considered sensitive in nature, such as detailed information related to information technology system security, to be issued through a separate “classified or limited use” report because of the potential damage that could be caused by the misuse of this information. We consider the specific technical details of this finding, along with the responses, to be sensitive in nature and not appropriate for public disclosure. Therefore, the details of the following finding and responses have been provided to the Department and OIT in a separate, confidential memorandum.

The Department utilizes Trails, its statewide automated child welfare information system, to aid in administering a number of federally-funded child welfare programs, including the Program. Trails went live in 2001 and, in Fiscal Year 2017, the Department and the Governor’s Office of Information Technology (OIT) began a multi-phase and multi-year modernization project that continued during Fiscal Year 2022.

The Department is the business owner and is responsible for designing information security processes for the Trails application. To meet management’s IT expectations, the role of Trails Security Administrator was established to conduct Trails application access management procedures.

OIT, as the IT service provider, works closely with the Department and is also responsible for conducting certain access management procedures. What was the purpose of our audit work and what work was performed?

The purpose of our Fiscal Year 2022 audit work was to determine whether the Department and OIT designed effective procedures for and configured Trails to address risks associated with information security. Our audit work was performed through interviews conducted of Department and OIT staff and reviewing supporting documentation.

How were the results of the audit work measured?

We measured the results of our audit work using the following criteria:

• Colorado Information Security Policies (Security Policies), which are developed and published by OIT.

• Standards for Internal Control in the Federal Government (Green Book) published by the U.S. Government Accountability Office (GAO).

What problems did the audit work identify?

Based on our Fiscal Year 2022 audit work, we identified problems with information security, access management, IT general controls for Trails at both the Department and OIT.

Why did these problems occur?

Department staff did not provide explanations for why the identified access management problems occurred. OIT staff provided an explanation for one of the identified access management problems, but not all of the problems.

Why do these problems matter?

When access management IT general controls are lacking, management cannot ensure their expectations and the entity’s objectives are being met, that risks are responded to appropriately, and that a strong system of internal control is established, which increases the risk of unauthorized access and can impact the confidentiality, integrity, and availability of Trails.

Recommendation 2022-083 Department of Human Services

The Department of Human Services should improve access management IT general controls over Trails, its statewide automated child welfare information system, by:

A. Implementing the recommendation noted in Part A of the confidential finding. B. Implementing the recommendation noted in Part B of the confidential finding.

Response Department of Human Services

A. Partially Agree Implementation Date: December 2023

The Department will work on implementing recommendations for Part A that it agrees to implement.

Auditor’s Addendum

A confidential auditor’s addendum has been included in the confidential finding to address the Department’s “partially agree” response.

B. Partially Agree Implementation Date: September 2023

The Department will work on implementing recommendations for Part B that it agrees to implement.

Auditor’s Addendum

A confidential auditor’s addendum has been included in the confidential finding to address the Department’s “partially agree” response.

Finding 2023-070 Federal Funding Accountability and Transparency Act

The Department is responsible for administering three programs as part of the Workforce Innovation and Opportunity Act (WIOA) Cluster—WIOA Adult Program [ALN 17.258], WIOA Youth Activities [ALN 17.259], and WIOA Dislocated Worker Formula Grants [ALN 17.278]. The overall purpose of these programs is to help job seekers access employment, education, training, and support services to success in the job market. The Department administers the programs and also passes WIOA Cluster funds through to Colorado counties so they can help provide these services to individuals.

The Department is required to comply with the Federal Funding Accountability and Transparency Act of 2006 (Transparency Act or FFATA) for the WIOA Cluster. The Transparency Act was created to empower Americans with the ability to hold the government accountable for each spending decision and, as a result, to reduce wasteful spending by the government. The Transparency Act requires the federal government to make certain information on federal awards available to the public.

In accordance with the Transparency Act, the Department is required to report information about subgrants, or subawards, given to other governments or to nonprofit organizations, also referred to as subrecipients. Federal regulation [2 CFR 200.1] defines a subaward as an award provided by a pass-through entity, in this case the Department, to an entity to carry out part of a federal grant award received by the pass-through entity. A subrecipient is defined in federal regulation [2 CFR 200.1] as “an entity, usually but not limited to non-Federal entities, that receives a subaward from a pass-through entity to carry out part of a federal award; but does not include an individual that is a beneficiary of such award. A subrecipient may also be a recipient of other Federal awards directly from a federal awarding agency.”

In Fiscal Year 2023, the Department made 18 subawards totaling $26.6 million to 10 subrecipients for the WIOA Cluster, as follows:

• $7.1 million in subawards to 9 subrecipients for WIOA Adult Program,

• $9.4 million in subawards to 9 subrecipients for WIOA Youth Activities,

• $7.3 million in subawards to 9 subrecipients for WIOA Dislocated Worker Formula Grants, and

• $2.8 million in subawards to 9 subrecipients for WIOA Colorado Rural Workforce Consortium

The Department is required to submit FFATA information through the Federal Funding Accountability and Transparency Act Subaward Reporting System (FSRS). Once the Department submits a report to FSRS, the public can view information from the report, including the subrecipient’s name, subaward identification number, subaward obligation/action date, subaward amount, federal awarding agency and subagency, the Department’s name, and the Department’s grant award identification number.

What was the purpose of our audit work and what work was performed?

The purpose of our audit work was to determine whether the Department had adequate internal controls over and complied with FFATA reporting requirements for the WIOA Cluster programs during Fiscal Year 2023.

As part of our audit work, we requested 4 months of FFATA reports for all 10 of the WIOA Cluster’s subrecipients. We compared the amounts reported by the Department for subawards in FSRS to the underlying support provided by the Department, as well as the underlying financial records reported in the Colorado Operations Resource Engine (CORE), the State’s accounting system, and inquired about any differences. In addition, we tested to determine whether the Department submitted the FFATA reports within the month following the month the subaward was made, as required by federal regulations.

We also requested and reviewed the Department’s policies and procedures over FFATA reporting, the FFATA reports submitted by the Department in Fiscal Year 2023, and a list of all subawards made by the Department during Fiscal Year 2023 for the WIOA Cluster.

How were the results of the audit work measured?

In accordance with federal regulation [2 CFR 170.330.l(a)], the Department is required to report subawards of $30,000 or more to FSRS by the end of the month following the month in which the award was made. For example, the Department would have to submit a FFATA report to FSRS in May 2023 if an award or supplemental award equal to or greater than $30,000 was made in April 2023.

What problem did the audit work identify?

Based on our audit work, we determined that the Department did not comply with FFATA reporting requirements for the WIOA Cluster during Fiscal Year 2023. Specifically, we determined that the Department incorrectly reported $8.7 million in subawards to 10 subrecipients, while $7.7 million was not reported timely. The following table summarizes our testing results and groups each exception within the following categories: subaward not reported, report not timely, subaward amount incorrect, and subaward missing key elements.

Why did this problem occur?

The Department did not have adequate internal controls in place to ensure it was in compliance with FFATA requirements. Specifically, the Department did not have sufficient documented policies and procedures that included how it tracked the money it passed to subrecipients. Additionally, the Department did not reconcile the spreadsheet it used to compile the reports in CORE, in order to ensure it accurately represented the WIOA Cluster funds the Department passed to subrecipients.

Why does this problem matter?

By failing to properly report subawards to FSRS, the Department is out of compliance with federal reporting requirements and risks federal sanctions. In addition, it fails to meet the federal intent of transparency for federal program spending.

Recommendation 2023-070

The Department of Labor and Employment (Department) should strengthen its internal controls over and ensure it complies with requirements under Federal Funding Accountability and Transparency Act (FFATA) reporting for the Workforce Innovation and Opportunity Act (WIOA) Cluster by:

A. Updating its policies and procedures for FFATA reporting. These policies and procedures should include requirements for the method in which Department staff must track funds passed to subrecipients.

B. Developing and implementing a reconciliation process between the Department’s spreadsheet it uses to compile the FFATA reports and the Colorado Operations Resource Engine (CORE), the State’s accounting system.

Response Department of Labor and Employment

A. Agree Implementation Date: June 2024

The Colorado Department of Labor and Employment Division of Employment and Training will refine our FFATA procedure to ensure the WIOA sub-award information is reported in the FSRS system within required deadlines. The procedure will include specific steps regarding the tracking of sub-awards and required timelines in which the data will be entered into the system.

B. Agree Implementation Date: June 2024

The Colorado Department of Labor and Employment Division of Employment and Training will develop and implement a reconciliation process that ensures the information tracked in the Notice of Funding Allocation spreadsheet is reconciled with the information entered into CORE so that it will be accurately reported in FSRS.

Finding 2023-071 Rehabilitation Services – Vocational Rehabilitation Grants to States—Federal Reporting

The Department is responsible for administering the federal Rehabilitation Services -Vocational Rehabilitation Grants to States (VR) program [ALN 84.126]. The program’s overall purpose is to assist individuals whose disabilities result in barriers to employment with attaining and maintaining employment. At any of the 25 field and satellite offices located throughout the State, rehabilitation counselors work with individuals to assess their needs and identify appropriate vocational rehabilitation services.

The Department’s Division of Vocational Rehabilitation (Division) is responsible for completing the RSA-17, Vocational Rehabilitation Financial Report, a quarterly, federally-required report for the VR program for all VR grants open during the fiscal year. It is also responsible for the data used to complete the reports and ensuring the reports are accurate, complete, and submitted to the federal government by the required deadline. The Department’s Finance Office provides the Division with reports from CORE and creates a workbook with the applicable financial information that the Division uses to complete the reports. Division staff run reports from its electronic case management system, the Accessible Web-Based Activity and Reporting Environment (AWARE)— the system Division program staff use to track expenditures—and use some of this information to help complete the reports. The Department had three open grants during Fiscal Year 2023 and was, therefore, required to submit one quarterly report for each grant for as long as the grant was open during the year, resulting in a total of 8 reports submitted during the fiscal year. During Fiscal Year 2023, the Department expended approximately $51.4 million for the VR program.

What was the purpose of our audit work and what work was performed?

The purpose of our audit work was to determine whether the Division had adequate internal controls in place over and complied with federal reporting requirements for the VR program during Fiscal Year 2023.

As part of our audit work, we gained an understanding of the Division’s procedures that were in place during Fiscal Year 2023 to prepare the federal reports. In addition, we reviewed four RSA-17 reports—two related to the quarter ended September 30, 2022 and two related to the quarter ended June 30, 2023—submitted to the federal government for Fiscal Year 2023 to ensure they were accurate, complete, and submitted by the required deadline. We also requested the Division’s policies and procedures related to RSA-17 report completion, as well as the supporting documentation for the reports we selected for testing.

How were the results of the audit work measured?

We measured the results of our audit against the following:

In accordance with federal regulation [2 CFR 200.303(a)], the Department, as a recipient of federal funds, must establish and maintain effective internal controls over its federal awards that provide reasonable assurance that the Department is managing its federal grants in compliance with federal statutes, regulations, and terms and conditions of the federal award.

In accordance with the Office of the State Controller’s policy, Internal Control System, state agencies shall use the Standards for Internal Control in the Federal Government (Green Book), published by the U.S. Government Accountability Office, as its framework for its system of internal control. Green Book, Paragraph OV4.08, Documentation Requirements, states that documentation is required for the effective design, implementation, and operating effectiveness of an entity’s internal control system. Green Book Paragraph 12.02, Documentation of Responsibilities through Policies, specifically indicates that management should document in their policies the internal control responsibilities of the organization.

The federal Rehabilitation Services Administration provides instructions for completing the RSA-17, as well as a template. The template provided in the instructions requires the Division to select the method of accounting used to prepare the reports, and requires the Division to maintain supporting documentation to substantiate the data reported in the report. The instructions also state that the Division is responsible for having internal controls necessary to ensure the reports are accurate and reliable.

What problems did the audit work identify?

We identified at least one issue with all four (100 percent) of the RSA-17 reports we tested. For example, the Division could not provide documentation to support information for a total of over $25 million in expenditures reported by the Division. Specifically, we found the following:

• Reports for the quarter ended September 30, 2022:

o For one report, the Division could not provide documentation to support information on the following two lines of the report:

 Administrative Expenditures—$21.5 million  American Job Center Infrastructure Expenditures—$467,083

o In the other report, the Division could not provide documentation to support a $3.1 million amount noted for the American Job Center Infrastructure Expenditures line on the report.

• Reports for the quarter ended June 30, 2023:

o In one report, the Division could not provide documentation for $7,315 of the $8.6 million reported in the Administrative Expenditures line. Additionally, it did not include $913,166 in expenditures from the month of June and, therefore, underreported, the following lines:

 Administrative Expenditures - Reported—The Division reported $8.6 million instead of the correct amount of $9.5 million.

 Expenditures incurred for the Provision of Pre-Employment Transition Services by Agency Staff Only - Reported—The Division reported $96,903 instead of the correct amount of $115,511.

o In the other report, the Division could not provide documentation for $22,707 of the $8.5 million reported in the Administrative Expenditures line.

Why did these problems occur?

The Division did not have sufficient internal controls in place to ensure that its federal RSA-17 reports were accurate and complete, and that the associated documentation was maintained during Fiscal Year 2023. Although the Division has a procedure document that provides instructions on how to complete the federal reports, the procedures do not include a requirement to reconcile information that Division program staff obtains from AWARE to CORE to ensure the expenditures agree in both systems and that any differences are identified and corrected, as appropriate. Additionally, the procedures do not include a requirement for a supervisory review of these reports prior to submitting them to the federal government. Some of the errors we identified were due to staff inputting the wrong information into the reports, which a review could have caught and corrected prior to submitting the report to the federal government.

Why do these problems matter?

Strong internal controls over federal reporting, including documented policies with adequate supervisory review, are necessary to ensure that the Department is in compliance with federal reporting requirements. Errors in the federal reports could cause report users to rely on incorrect information. This could have a negative impact on the Department’s future federal program funding.

Recommendation 2023-071

The Department of Labor and Employment’s (Department) Division of Vocational Rehabilitation (Division) should strengthen its internal controls over, and ensure compliance with, federal reporting for the Rehabilitation Services-Vocational Rehabilitation Grants to States program by developing, documenting, and implementing policies for completing its federal reports. These policies should require the Division to reconcile the expenditure information it uses from the Accessible Web-Based Activity and Reporting Environment (AWARE) system to the Colorado Operations Resource Engine (CORE) it receives from the Department’s Finance Section, and to ensure that a supervisory review occurs prior to submitting the reports to the federal government.

Response Department of Labor and Employment

Agree Implementation Date: October 2024

DVR is committed to collaborating with CDLE Finance to develop clear roles and responsibilities associated with the completion and submission of the RSA-17 report and further to develop the internal controls necessary to ensure the reports are compliant with all requirements, by developing, formally documenting, and implementing policies for completing its federal reports. These policies will require the Department to reconcile the expenditure information it uses from the Accessible Web-Based Activity and Reporting Environment (AWARE) system to the Colorado Operations Resource Engine (CORE), and will ensure that a supervisory review occurs prior to submitting the reports to the federal government.

The following findings and recommendations relating to internal control deficiencies classified as a Material Weakness and a Significant Deficiency were communicated to the Department of Labor and Employment (Department) in the previous year and have not been remediated as of June 30, 2023 because the original implementation dates provided by the Department were in a subsequent fiscal year. These complete findings and recommendations can be found within the original report and the complete recommendation can be found within Section IV: Prior Audit Recommendations of this report.

Finding 2022-070 Unemployment Insurance Program Integrity Fraud Holds

The Department’s UI Division is responsible for the administration and monitoring of Colorado’s UI programs, including the collection of unemployment premiums from employers, the payment of UI benefits to claimants, and the performance of audits and investigations of premiums and benefits to ensure they are properly paid. Employer-paid premiums are the primary source of funding for UI benefits.

When an individual applies for UI benefits, they are called a claimant, and the application is called a claim. Each claimant creates an account in MyUI+, the Department’s unemployment benefit system, in order to apply for unemployment benefits. The Department reviews, or adjudicates, claims to ensure that claimants are eligible and entitled to receive UI benefits. As part of the adjudication process, wage checks for claimants are compared to employer reported wages submitted to the Department on a quarterly basis and the Department sends a notification to all employers that the claimant worked for within the last 18 months to determine the validity and reason for the claimant leaving the workplace. In addition, Department staff indicate that, on a weekly basis, they perform reviews to identify potential issues with a claimant’s ability and availability to work, and to determine whether the claimant is accurately reporting earned income. If information provided by an interested party, such as a former employer, relating to the reason for leaving the workforce does not agree to the claimant information, the Department follows up on the information and issues eligibility determinations, as appropriate. In Fiscal Year 2022, the Department paid $1.1 billion in UI benefits. The Department has processes and systems to detect and prevent identity theft related to UI benefits. For example, when the Department identifies a claim with characteristics that are indicators of fraud, it places a fraud hold (also known as a program integrity hold) on the claimant’s UI claim, which holds the claim for investigation and which prevents any future benefit payments to the claimant until the fraud hold is removed and eligibility is determined. For each fraud hold, the Department has to determine if the identity of the individual filing the claim matches the personally identifiable information used on the claim. Once that is verified, the Department then must verify that the individual did not make any false statements in order to establish program eligibility. The steps that the Department takes to resolve a fraud hold differ depending on the characteristics of the claim that caused the Department to question its legitimacy. If Department staff determine that the fraud hold was not legitimate, the Department clears the hold in MyUI+ and then proceeds with determining if the individual is eligible to receive UI benefits.

The Department uses an automated system, called ID.me, as part of its identity verification process. ID.me is a federally-certified identity provider that assists the Department in verifying claimants’ identity. In some instances, MyUI+ will clear the fraud hold if the claimant passes ID.me and the claim does not need further investigation. In other cases, the Department performs an investigation to determine if the fraud hold is legitimate, or if the hold was placed in error.

According to the information in MyUI+, the Department cleared 54,047 fraud holds during Fiscal Year 2022 – 44,936 were cleared through the ID.me process, and 9,111 were cleared by the Department.

What was the purpose of our audit work and what work was performed?

The purpose of the audit work was to determine whether the Department had adequate internal controls in place over fraud holds during Fiscal Year 2022, including whether only appropriate, authorized individuals cleared the fraud hold from MyUI+, and if the Department had adequate segregation of duties between staff investigating a fraud hold, and staff releasing the hold in MyUI+.

As part of our audit work, we requested the Department’s policies and procedures for their investigation process and documentation used to support the Department’s investigations that resulted in clearing a fraud hold, and inquired how the Department determined who is authorized to release fraud holds from MyUI+. The Department’s documentation included case reports for the investigations and log notes from Salesforce, the Department’s software that is primarily used as a workflow management tool and documentation repository for UI claims requiring an investigation.

We selected a sample of 60 of the 9,111 fraud holds that were cleared by the Department during Fiscal Year 2022 to determine if the Department performed an investigation prior to releasing the fraud hold in MyUI+. In addition, as part of our testing of the sample, we determined that 20 different Department staff cleared the 60 fraud holds in MyUI+; we performed testing to determine if those staff were authorized to clear the holds in MyUI+.

How were the results of the audit work measured?

We measured the results of our audit against the following:

Section 7511, Part V, of the Employment Security Manual (ESM) requires state UI laws to include provisions for such methods of administration as are, within reason, calculated (1) to detect benefits paid through error by the state UI agency or through willful misrepresentation or error by the claimant or others, (2) to deter claimants from obtaining benefits through willful misrepresentation, and (3) to recover benefits overpaid under certain circumstances. These required functions are accomplished through designated staff responsible for promoting and maintaining the integrity of the UI program through prevention, detection, investigations, establishment, and recovery of overpayments. Designated staff also prepare cases for prosecution.

The Department’s UI Investigation Procedures state that if Department staff determine that a fraud hold that they are investigating can be released in MyUI+, Department staff should write an event log note in Salesforce.

Information security is the practice of protecting information by mitigating information risk. ISO 27001 Standard for Information Security Management Systems is the international standard for information security, and its best practice approach helps organizations manage their information security by addressing people, processes, and technology. User-access management has the following objectives:

• Ensure authorized user access • Prevent unauthorized access to information systems

Expanding on the objectives from ISO 27001, a broad set of business-level objectives for user-access management can be defined as follows:

• Allow only authorized users to have access to information and resources • Restrict access to the least privileges required by these authorized users to fulfill their business role

The federal Social Security Act [Section 303(a)(1), SSA], contains a merit-based system requirement for the UI program. Specifically, this section requires that, as a condition of receiving federal UI administrative grants, states must have laws that include “provision for such methods of administration” that includes a merit system. A merit system is defined as the process of promoting and hiring government employees based on their ability to perform a job, rather than on their political connections. As part of this requirement, any position which involves the determination of whether or not a UI claimant will be paid, or which involves determining an employer's liability for contributions, must be “merit staffed.”

According to federal regulations [5 CFR 900.603, Standards For a Merit System of Personnel Administration], “The quality of public service can be improved by the development of systems of personnel administration consistent with such merit principles as -

(a) Recruiting, selecting, and advancing employees on the basis of their relative ability, knowledge, and skills, including open consideration of qualified applicants for initial appointment.

(b) Providing equitable and adequate compensation.

(c) Training employees, as needed, to assure high quality performance.

(d) Retaining employees on the basis of the adequacy of their performance, correcting inadequate performance, and separating employees whose inadequate performance cannot be corrected…”

The U. S. Department of Labor Unemployment Insurance Program Letter (UIPL) No. 12-01, states that only those employees considered as merit-staff can determine whether to pay or deny payment to a claim. Additionally, UIPL No. 12-01 Change 2 states that, “Determinations of overpayments or fraud must be made by merit-staffed employees.”

The Department’s SPP 1053 Code of Conduct, Ethics and Values Policy, Attachment A: Unemployment Insurance Ethics Policy states that employees are not permitted to do the following:

• Investigate or attempt to investigate suspected fraud unless it is within their assigned duties.

• Backdate a claim, transfer claim status retroactively (UI to UCFE, UCX to TRA, etc.), alter information provided by a claimant or employer, or change or defer a UI document due date without valid documentation or approval of the appropriate branch chief or UI Director.

According to federal regulation [45 CFR 75.303(a)], the Department, as a recipient of federal funds, must establish and maintain effective internal controls over its federal awards that provide reasonable assurance that the Department is managing its federal grants in compliance with federal statutes, regulations, and the award terms and conditions. These internal controls should be in compliance with guidance in Standards for Internal Control in the Federal Government (Green Book), published by the U.S. Government Accountability Office. Under Paragraph 10.01 of the Green Book, the Department should design control activities to achieve objectives and respond to risks. Segregation of duties contribute to the design, implementation, and operating effectiveness of control activities. Under Paragraph 10.03 of the Green Book, the Department should divide or segregate key duties and responsibilities among different people to reduce the risk of error, misuse, or fraud. This includes separating the responsibilities for authorizing transactions, processing and recording them, reviewing the transactions, and handling any related assets so that no one individual controls all key aspects of a transaction or event.

What problems did the audit work identify?

The Department did not comply with federal regulations or its own policies and procedures related to the clearing of fraud holds during Fiscal Year 2022. Specifically, we identified issues with 32 of the 60 (53 percent) fraud holds we tested, as follows:

• The Department cleared 12 of the 60 fraud holds tested (20 percent) without performing an investigation or providing evidence of the reasoning used to clear the hold. Specifically, when we asked for investigation documentation for the 12 fraud holds, the Department indicated these were cleared without an investigation, and there were no related log notes in Salesforce, as required.

• For 20 of the 48 cases in our sample (42 percent) for which the Department did conduct an investigation, it did not segregate the duty of investigating the fraud hold and clearing the fraud hold from MyUI+. Specifically, in these cases, only one person conducted the investigation, concluded on the investigation, and cleared the fraud hold in MyUI+.

• One of the 20 Department staff who cleared a portion (5 percent) of the 60 fraud holds we sampled was not authorized to clear fraud holds from MyUI+ because the individual was not considered to be merit-staffed. Further, this unauthorized individual cleared 11 of 12 fraud holds we identified above that did not have an investigation, as required. We also found that this individual cleared an additional 55 fraud holds outside of our sample during Fiscal Year 2022.

Why did these problems occur?

The Department did not have sufficient internal controls in place, including appropriate policies and procedures, to ensure it enforced compliance with federal and Department-level requirements regarding the clearing of UI fraud holds during Fiscal Year 2022, as follows:

• The Department did not ensure that all fraud hold claims cleared in MyUI+ had a related log note in Salesforce that explained the rationale for clearing the hold, or that there was an investigation performed over the fraud hold prior to it being cleared in MyUI+. Specifically, in 11 of the 12 instances, the Department’s controls failed to prevent non-merit staff from using their MyUI+ access inappropriately, and in the other instance, Department controls failed to ensure the UI claim was reviewed by the UI section that reviews fraud holds rather than the UI section that resolves non-fraud UI claims. The Department provided full, rather than read-only access to the non-merit, Executive Director’s Office’s staff member noted in our finding. UI management indicated that they gave the individual full access to MyUI+ during the height of the pandemic with the assumption that the individual would use such access in a read-only manner solely to review claim information for inquiries coming through the Executive Director's Office. According to UI Division leadership, after they identified that the individual had full access during Fiscal Year 2022, they changed the individual’s access to read-only in January 2022.

• The Department lacked policies regarding management override of controls related to the clearing of fraud holds, in order to prevent or appropriately manage those responsibilities. UI staff indicated that in some cases, the non-merit, Executive Director’s Office’s staff member noted in our finding would reach out to other staff within the UI Division to help escalate the MyUI+ fraud hold clearing process. In some of these instances, because of the position of the individual within the Executive Director’s Office, UI staff circumvented the normal escalation process and aided the individual with clearing the fraud hold.

• The Department’s current policies and procedures do not require segregation of duties between those staff who investigate a fraud hold, and those staff who remove the fraud hold in MyUI+.

Why do these problems matter?

Improper segregation of duties, including the separation of responsibilities for both investigating and clearing potential fraud holds, leaves the UI program vulnerable to fraudulent activity. Specifically, fraud risk increases if there is no segregation between the investigation and the actual clearing of the fraud hold from MyUI+ and, as a result, the same staff could inappropriately clear holds and initiate UI payments. Further, a lack of strong checks and balances within the UI program could erode the integrity of the program at large, ultimately negatively impacting public trust.

Strong internal controls related to UI fraud are especially important given the large amount of funds that are paid by the Department for UI claims each year and the significant amount of fraudulent claims that are paid by the Department. For example, the Department recorded an estimated receivable for amounts due back to the Department of $45 million for fraudulently-obtained UI claims at June 30, 2022. Without strengthening its controls over UI claims and fraud holds, there is a risk that a significant amount of UI funds could continue to be paid out each year for fraudulently obtained UI claims.

See Schedule of Findings and Questioned Costs for chart/table

Recommendation 2022-070

The Department of Labor and Employment (Department) should strengthen its internal controls over Unemployment Insurance (UI) program integrity holds by:

A. Ensuring all fraud holds are properly investigated and documented with a log note in Salesforce that explains the rationale for releasing the claim, prior to releasing the claim in MyUI+.

B. Adequately reviewing claims for a fraud indicator to ensure the hold is sent to the appropriate UI section for resolution.

C. Ensuring Department staff are given the appropriate access in MyUI+ to prevent individuals from clearing fraud holds inappropriately and periodically monitoring access to ensure access levels remain appropriate.

D. Instituting policies and procedures over management override of internal controls related to UI claims and providing staff training on those policies and procedures. This should include ensuring that UI staff are aware of the importance of following all procedures related to fraud holds and that any inappropriate requests or pressures are communicated through the appropriate channels.

E. Updating its current policies and procedures to require segregation of duties between the investigation of a fraud hold and the release of a fraud hold in MyUI+ to ensure more than one person is involved in the fraud hold process from beginning to end.

Response Department of Labor and Employment

A. Agree Implementation Date: July 2024

The Department agrees with this finding. The Department is moving all adjudication and investigation of program integrity holds into the MyUI+ system, so there will be one system of record. The Department will ensure that all program integrity holds have all documentation through adjudication and investigation, including log notes. The Department anticipates this to be fully implemented by July 2024.

B. Agree Implementation Date: July 2024

The Department agrees with this finding. The department has modified processes to ensure all holds are only routed to the appropriate team to be adjudicated. In addition the Department is working to have all claims identified as fraud delivered in a workflow process in MyUI+ rather than the various processes in place now. Further the department is working with our MyUI+ system experts to implement new technology to strengthen and streamline the fraud indicator escalation process and systems within MyUI+. In working with our MyUI+ system experts, the Department anticipates this to be fully implemented by July 2024.

C. Agree Implementation Date: July 2024

The Department agrees with this finding. The Department will continue strengthening security in this area and internal procedures to periodically monitor the potential for internal fraud activities. Additionally, the Department will periodically monitor and review My UI+ access levels for appropriateness. In consultation with our MyUI+ systems experts, the Department anticipates this finding to be fully implemented by July 2024.

D. Agree Implementation Date: July 2023

The Department agrees with this finding. The Department will reinforce and strengthen the ethics policies in yearly communication to staff and tighten escalation policies to ensure pressures and inappropriate requests are handled in accordance with guidelines. The Department anticipates this will be completed by July 2023.

E. Disagree

When a PI hold is identified as being highly suspicious for criminally fraudulent activity, it is routed to a specialized unit for review, thereby leaving the standard adjudication process. This is handled by passing the review to the UI Investigations and/or Criminal Enforcement (ICE) unit. The investigator performs their investigation and if no actual fraudulent activity is found they will release the hold.

The UI Division also performs several quality control reviews of claims and claim decisions via Benefits Payment Control (BPC), Benefits Accuracy Measurements (BAM), Benefits Timeliness and Quality (BTQ), and internal Quality Assurance (QA) reviews. Claims are reviewed for such criteria as adequate support documentation, benefit payment accuracy, timely processing, and correct claim decision determination on all program integrity holds.

The Green Book states in Section 10.14, “ If segregation of duties is not practical within an operational process because of limited personnel or other factors, management designs alternative control activities to address the risk of fraud, waste, or abuse in the operational process.” CDLE believes the reviews represent adequate and sufficient compensating controls for the need for segregation of duties on fraud holds. Changing the current process would hinder our ability to deliver UI benefit services timely to our customers and would put us in jeopardy of fulfilling our federal and state payment timeliness requirements.

Auditor’s Addendum

Segregating the duties between investigating and releasing a fraud hold in MyUI+ reduces the risk of an employee inappropriately and potentially fraudulently clearing the hold without conducting a proper investigation. The issues identified in our audit indicate that the Department’s current compensating controls did not identify that a current employee released fraud holds without a proper investigation. The Department should consider updating its procedures and processes to segregate these duties to reduce the risk of this occurring in the future.

The following findings and recommendations relating to internal control deficiencies classified as a Material Weakness and a Significant Deficiency were communicated to the Department of Labor and Employment (Department) in the previous year and have not been remediated as of June 30, 2023 because the original implementation dates provided by the Department were in a subsequent fiscal year. These complete findings and recommendations can be found within the original report and the complete recommendation can be found within Section IV: Prior Audit Recommendations of this report.

Finding 2022-072 MyUI+ and Connecting Colorado—Information Security

Government Auditing Standards allow for information that is considered sensitive in nature, such as detailed information related to information technology system security, to be issued through a separate “classified or limited use” report because of the potential damage that could be caused by the misuse of this information. We consider the specific technical details of this finding, along with the response, to be sensitive in nature and not appropriate for public disclosure. Therefore, the details of the following finding and response have been provided to the Department in a separate, confidential memorandum.

The Department administers the federal Unemployment Insurance and Employment Service Cluster programs, and the Department relies on IT systems to aid with determining applicants’ eligibility for the programs and to provide information necessary to meet federal reporting requirements. For these two programs, the associated systems are MyUI+ and Connecting Colorado. The Department is the business owner and works with the Governor’s Office of Information Technology (OIT) and two different external IT service providers. High level descriptions of the two systems are as follows:

• MyUI+ — The Department’s system for UI eligibility determinations and calculation of UI payments to eligible recipients. According to Department staff, starting in Fiscal Year 2023, MyUI+ will also provide data necessary for federal reporting to the U.S. Department of Labor for the UI program that was previously generated by the Colorado Labor and Employment Accounting Resource system.

• Connecting Colorado — The Department’s workforce case management, labor exchange, and federal reporting system that supports the Employment Service Cluster program. The system provides services for job seekers and businesses, as well as provides all required federal reporting to the U.S. Department of Labor, for the Employment Service Cluster programs.

In order for the Department to achieve its objectives and respond to risks, including those related to the federal programs it administers, management should establish a strong framework of internal controls that also address information system controls. Specifically, information system controls typically start with management documenting IT policies that address IT general control responsibilities and procedures that document the more granular details on how to implement Department policies. These IT general control policies and procedures should include those policies and procedures that are specific to information security. Once policies and procedures have been formalized and communicated to staff responsible, specific internal control activities can be implemented and operationalized.

What was the purpose of our audit work and what work was performed?

The purpose of our Fiscal Year 2022 audit work was to determine whether the Department, OIT, and the Department’s two external IT service providers for MyUI+ and Connecting Colorado had policies and procedures related to information security, designed and implemented for MyUI+ and Connecting Colorado. Our audit work was performed through interviews conducted of Department and OIT staff.

What problems did the audit work identify and how were the results of the audit work measured?

During Fiscal Year 2022, we identified information security problems with the MyUI+ and Connecting Colorado systems. We have grouped these problems first by those common to the two systems and then those unique to each system.

MyUI+ and Connecting Colorado Common Problems

• Policies and procedures were lacking. Department management had not established its expectations through the development and implementation of formalized policies and procedures related to information security general controls for MyUI+ and Connecting Colorado.

o Standards for Internal Control in the Federal Government (Green Book) published by the U.S. Government Accountability Office (GAO) states in Paragraph 3.09, Documentation of Internal Control System, and 12.02, Documentation of Responsibilities through Policies, that management should develop and maintain documentation of its internal control system and document in policies the internal control responsibilities of the organization. Paragraph 11.06 and 11.07, Design Appropriate Types of Control Activities, states that management should design appropriate types of control activities in the entity’s information system, including information system general controls that facilitate the proper operation of the entity’s systems. o Colorado Information Security Policies (Security Policies or CISP) that are developed, published, and required to be followed by the Department and its external IT service providers state within the Policy and the General Responsibilities sections, specifically 8.3.1 and 8.3.2 for Business Owners or the Department, that all agencies, except for the institutions of higher education and the general assembly, as the business owner, must implement governance principles, which would include IT policies and procedures, for promoting data quality and integrity for its systems, as the business owner, and is responsible for following and adhering to all identified business owner requirements, as stated within the Security Policies.

• Vendor oversight was lacking. The Department had not ensured its IT service providers complied with Security Policies.

o Security Policies state that IT service providers—defined as OIT and/or external service providers—must follow the Security Policy requirements, among certain other requirements, as communicated to the Department within the confidential finding.

o Section C.iii. (Legal Authority – Contractor Signatory, Information Technology Specific) of the Department’s contract with the Connecting Colorado IT service provider states: “…the contractor warrants that it will at all times comply with all Security Policies.”

o Exhibit C, Section 1.C.vi. (Information Technology Provisions, Protection of System Data) of the Department’s contract with the MyUI+ IT service provider states: “…the contractor shall comply with all rules, policies, procedures, and standards issued by the Governor’s Office of Information Technology.”

o The Green Book states in Paragraph OV4.01, Service Organizations, that management retains responsibility for the performance of processes assigned to service organizations.

MyUI+ and Connecting Colorado Unique Problems

We also found other problems with access management, unique to each MyUI+ and Connecting Colorado, that lacked compliance with Security Policies, OIT Cyber Policies, and the IRS’s, Publication 1075, Tax Information Security Guidelines for Federal, State, and Local Agencies, November 2021 Revision, and were communicated through the confidential finding.

Why did these problems occur?

Overall, the Department did not have sufficient IT governance and information security internal controls in place, including policies and procedures, to ensure that Department staff and its IT service providers complied with various data security compliance requirements set forth by OIT and the IRS, as well as those internal control principles established within the Green Book’s internal control framework. We discuss other specific causes for the problems we identified below:

MyUI+ and Connecting Colorado

• Policies and procedures were lacking (MyUI+). Department staff stated that they followed and complied with the October 2021 dated Security Policies for the entire fiscal year, as these were more stringent than the March 2022 dated Security Policies. However, the Department did not provide documentation of a formal adoption of the October 2021 dated Security Policies. Staff also stated it maintains informal procedures of how to perform certain access management processes, but no standard operating procedures were in place.

• Policies and procedures were lacking (Connecting Colorado). Department staff had released a program guidance letter that addressed data security and access, but staff acknowledged that these program guidance letters are a guide and not official policy statements. In addition, the program guidance letter provided by Department staff was directed to the workforce centers that are located across the state that provide employment services to eligible beneficiaries and, therefore, did not provide any data security or access policies and procedures for state staff.

• Vendor oversight was lacking. We determined the Department did not have a vendor management process in place to hold its IT service providers accountable for contract provisions that required the IT service providers to comply with Security Policies, as demonstrated by the noncompliance issues we identified. In addition, and based on the March 2022 Security Policies, the Department has not determined whether contract amendments may be necessary with its two external IT service providers.

• Other Access Management Non-Compliance:

o Department staff indicated that in one instance of non-compliance identified, a more efficient process was to not comply with the requirement.

o Department staff stated that the certain access management non-compliance area was set up as it was during the COVID-19 pandemic to help prevent backlogs and issues for users during that time and was not subsequently changed.

o Department staff did not update its rules for Connecting Colorado account management non-compliance area to reflect Security Policy changes. Specifically, we noted that OIT introduced the specific account management requirements in its Security Policies in February 2015, and those requirements remained constant through the March 2022 version; however, Department staff did not have a process in place to ensure periodic reviews of OIT’s Security Policies occurred and Department rules for the workforce centers appropriately aligned with any Security Policy changes. In addition, Department staff did not have a process in place to ensure its external IT service providers were complying with contract provisions to comply with Security Policy requirements.

o Department staff stated they have not found cause to mandate IT service provider actions that are deemed privately owned business methodologies. However, and as noted above, the Department’s contract states that the external IT service provider must comply with OIT’s Security Policies that require specific security safeguards to be implemented by all IT service providers, including the Connecting Colorado external IT service provider.

Why do these problems matter?

The lack of established IT policies and procedures make it difficult for Department management to measure and hold staff accountable to management’s expectations, as well as ensuring risks are addressed and overall objectives and missions are fulfilled. In turn, without policies and procedures, staff may not perform processes and controls in a consistent manner. In addition, without holding vendors accountable and ensuring that strong security measures are designed, implemented, and operating effectively, the risk of unauthorized access increases and ultimately impacts data reliability of the data stored and processed within MyUI+ and Connecting Colorado. Lastly, without having a strong internal control framework in place, management cannot ensure that state and federal funds are being used appropriately, which may impact the Department’s compliance with federal grant requirements and/or the accuracy of the Department’s federal and financial reporting.

See Schedule of Findings and Questioned Costs for chart/table

Recommendation 2022-072

The Department of Labor and Employment (Department) should improve its overall Information Technology (IT) governance and information security IT general controls, and work with its IT service providers, as applicable, for the MyUI+ and Connecting Colorado information systems by:

A. Formalizing and communicating to Department staff and the Department’s IT service providers’ IT policies that comply with the Business Owner requirements listed within the Governor’s Office of Information Technology’s (OIT) March 2022 Colorado Information Security Policies (Security Policies). As an option, the Department could formally adopt the October 2021 Security Policies, identify any gaps between the October 2021 and March 2022 versions, and then formalize and communicate policies that address the identified gaps.

B. Formalizing and communicating IT procedures to provide guidance to Department staff and the Department’s IT service providers performing IT general control activities that further address the IT policies formalized in recommendation Part A. The formalization and communication should include an organizationally defined, periodic review process of OIT’s Security Policies to ensure the Department’s IT policies, procedures, and rules are updated accordingly to align with the most current version of the Security Policies.

C. Formalizing a vendor management process that ensures the Department’s IT service providers are held accountable to contract provisions requiring compliance with Colorado Information Security Policies and IT policies and procedures formalized in recommendation Parts A and B. This should include a review of the Department’s current external IT service providers’ contracts and a determination of whether amendments to those contracts are necessary, based on the formalization of recommendation Parts A and B.

D. Implementing recommendation Part D as noted in the confidential finding.

E. Implementing recommendation Part E as noted in the confidential finding.

Response Department of Labor and Employment

A. Agree Implementation Date: July 2023

The Department will formalize IT security policies and procedures to comply with the Business Owner requirements contained within the Governor's Office of Information Technology's (OIT) March 2022, Colorado Information Security Policies. The Department will further formalize a procedure for product owners to annually review the OIT Colorado Information Security Policies and ensure alignment with the formalized Department IT policies and update any affected formalized IT procedures. The Department will communicate the formalized policies and procedures to Department staff and IT Service Providers, and then any future changes, as deemed necessary.

B. Agree Implementation Date: July 2023

The Department will formalize IT security policies and procedures to comply with the Business Owner requirements contained within the Governor's Office of Information Technology's (OIT) March 2022, Colorado Information Security Policies. The Department will further formalize a procedure for product owners to annually review the OIT Colorado Information Security Policies and ensure alignment with the formalized Department IT policies and update any affected formalized IT procedures. The Department will communicate the formalized policies and procedures to Department staff and IT Service Providers, and then any future changes, as deemed necessary.

C. Agree Implementation Date: December 2023

CDLE agrees with the recommendation and as part of A and B recommendations of this document, the Department will include a requirement from vendors to affirm they have reviewed and will comply with OIT security policies for all new contracts. Furthermore, as the Department becomes aware of changes to OIT Security Policies through its annual review process, these will be communicated to the vendors, and they will be required to reaffirm their compliance with any applicable changes. We will work with our current vendors for MyUI+ and Connecting Colorado to address the compliance issues noted in the audit and ensure they are compliant with OIT Security Policies and IT policies developed in part A and B of this recommendation. If non-compliance is determined to be unavoidable, the Department will file for a security exception with OIT.

D. Agree Implementation Date: June 2023

CDLE agrees with the recommendation and will implement recommendation Part D as noted in the confidential finding.

E. Agree Implementation Date: June 2023

CDLE agrees with the recommendation and will implement recommendation Part E as noted in the confidential finding.

Finding 2023-074 Compliance with Federal Procurement and Suspension and Debarment Requirements

The Department receives federal grant funds from SLFRF and then subgrants, or passes through, a portion of the funds to cities and counties and other organizations that are considered to be either a subrecipient or a contractor.

A subrecipient is a non-federal entity that expends federal awards received from a pass-through entity to carry out a federal program, but does not include an individual that is a beneficiary receiving direct payments from such a program. A contractor is a dealer, distributor, merchant, or other seller providing goods or services that are required to conduct a federal program; these goods or services may be for an organization’s own use or for the use of beneficiaries of the federal program.

Under Uniform Administrative Requirements, Cost Principles, and Audit Requirements for Federal Awards (Uniform Guidance), the Department is required to follow the State’s procurement policies and procedures, unless the procurement requirements are exempted through an Executive Order by the Governor (emergency procurement order). In addition, non-federal entities are prohibited from contracting with or making subawards under “covered transactions” to parties that are suspended or debarred from doing business with the federal government. “Covered transactions” include those procurement contracts for goods and services awarded under a grant or cooperative agreement. In order to comply with federal suspension and debarment requirements, the Department can perform a search in the federal System of Award Management (SAM) website, which tracks the entities that the federal government has determined are ineligible to receive federal funding; collect a certification from the entity; or add a clause or condition to the contract.

During Fiscal Year 2023, the Department expended $59.4 million in SLFRF funds.

What was the purpose of our audit work and what work was performed?

The purpose of the audit work was to determine whether the Department had effective internal controls in place over, and complied with, federal procurement and suspension and debarment requirements for the SLFRF program during Fiscal Year 2023.

As part of our audit work, we reviewed the Department’s internal controls over the SLFRF program’s procurement and suspension and debarment requirements. In addition, we tested a sample of 9 of the 74 (12 percent) SLFRF procurement transactions subject to testing to determine if the Department was in compliance with federal procurement requirements. We also tested 23 of the 174 (13 percent) SLFRF subrecipients and contractors subject to testing for suspension and debarment to determine whether the Department’s subrecipients and contractors were suspended, debarred, or otherwise excluded from participating in the contract by the federal government, through verification on the SAM website’s exclusions listing.

How were the results of the audit work measured?

We measured the results of our audit work against the following requirements:

• Federal regulation [2 CFR 180.220] states that a contract for goods or services is a covered transaction if awarded as a grant or payment for specified use and if the amount of the contract is expected to equal or exceed $25,000. Also, federal regulation [2 CFR 180.300] requires that when a non-federal entity enters into a covered transaction with another entity, the non-federal entity must verify that the person or entity they intend to do business with is not excluded or disqualified from receiving federal funds. This can be done by (1) checking the SAM exclusions, (2) collecting a certification from that entity, or (3) adding a clause or condition to the covered transaction with that entity.

• Federal regulation [2 CFR 200.303] states that the Department, as a recipient of federal funds, must establish and maintain effective internal control over federal awards that provides reasonable assurance that the Department is managing the federal awards in compliance with federal statutes, regulations, and the award terms and conditions, which includes maintaining documentation of its compliance.

• Federal regulation [2 CFR 200.318] states that the Department must document its procurement procedures. The Department utilized State Fiscal Rule 3-1, Commitment Vouchers, as its procurement policy, which requires that a state contract or a purchase order be utilized for services purchased for more than $10,000 but not more than $250,000. A commitment voucher is a “document that authorizes the purchase of goods or services, encumbers the funds, and provides for disbursement of funds.” Examples of a commitment voucher include a purchase order, contract, or grant agreement. The rule also requires that a commitment voucher be executed as soon as possible if any future performance obligations are necessary after disbursements for emergency procurements. An emergency procurement is a procurement authorized by the State when there is a “threat to public health, welfare, or safety under emergency conditions”.

What problems did the audit work identify?

We identified the following:

• The Department could not provide documentation to support that suspension and debarment verification procedures were performed for 1 of the 23 (4 percent) transactions we reviewed. We confirmed through additional audit work that this vendor was not suspended or debarred; as a result, we determined that this error did not result in questioned costs.

• The Department could not provide documentation of a purchase order or a state contract for 1 of the 9 (11 percent) procurement transactions tested. For this transaction, the original contract for $ 1,875,913 was signed in March 2020 and was covered by an emergency procurement order; the contract and emergency procurement order expired June 30, 2022. The Department paid the vendor $184,433 during the year ended June 30, 2023, which was not covered by a contract or the emergency procurement order. This error resulted in questioned costs of $184,433 for the year ended June 30, 2023.

Why did these problems occur?

The Department did not always follow its procurement policies and procedures, which include following the procurement guidelines in the State’s Fiscal Rules. Specifically, for the SLFRF program, as the Department transitioned away from emergency procurement orders, Department staff were not aware of the processes required to be followed for procurement, suspension, and debarment. Further, the Department had staff turnover during Fiscal Year 2023 in the Controller position, which contributed to the issues.  Why do these problems matter?

The Department is required to follow the State’s Fiscal Rules in relation to any procurements of its federal or state programs and be able to provide documentation to demonstrate compliance with these laws. In addition, the Department’s failure to perform procedures to ensure an entity is not suspended or debarred could result in the Department paying funds to an entity that is disallowed from receiving such funds, thereby exposing the State to increased business risk and potential federal disallowances.

Recommendation 2023-074

The Department of Public Health and Environment (Department) should strengthen its internal controls over, and ensure it complies with, COVID-19 – Coronavirus State and Local Fiscal Recovery Funds program requirements related to procurement and suspension and debarment by:

A. Ensuring staff follow the State’s Fiscal Rules over procurement, suspension and debarment, including maintaining supporting documentation to demonstrate how the Department complied with one of the three suspension and debarment options for compliance.

B. Providing training and cross-training to existing employees over procurement, suspension and debarment requirements.

Response Department of Public Health and Environment

A. Agree Implementation Date: June 2024

The Department has already begun development of an improved contracting process for this work. The Department will review and update existing guidance on suspension and debarment review as necessary. The Department has already begun development of an improved contracting process for division staff working with the COVID-19 Coronavirus State and Local Response Funds, which includes the development of program focused guidance. The Department will retrain existing central contract staff that review supporting documentation, emphasizing the need for proper suspension and debarment compliance.

B. Agree Implementation Date: June 2024

The Department has already begun development of an improved contracting process for this work. As part of the new process, new and existing division contract and program staff that work with contracts will be trained on proper documentation to support suspension and debarment compliance. The Department will ensure division staff working with the COVID-19 Coronavirus State and Local Response Funds take existing and any future training on statutory violations, with a focus on commitment vouchers.

Finding 2023-075 Disaster Grants (Presidentially Declared Disasters) Subrecipient Monitoring

Following a presidential declaration of a major disaster or an emergency, the Federal Emergency Management Agency (FEMA) within the U.S. Department of Homeland Security (DHS), awards grants to assist state, local, tribal, and territorial governments (SLTT) and certain private nonprofit (PNP) entities to respond to and recover from disasters.

The mission of FEMA’s Disaster Grants program is to provide assistance to SLTT governments and certain types of PNP organizations so that communities can quickly respond to and recover from major disasters or emergencies declared by the President. Through the Disaster Grants program, FEMA provides supplemental federal grant assistance for debris removal, emergency protective measures, and the restoration of disaster-damaged, publicly-owned facilities and specific facilities of certain PNP organizations. The Disaster Grants program also encourages protection of these damaged facilities from future incidents by providing assistance for hazard mitigation measures. FEMA provides this assistance based on authority in statutes, executive orders, regulations, and policies. The federal statute that authorizes FEMA to provide assistance via the Disaster Grants is the Robert T. Stafford Disaster Relief and Emergency Assistance Act, as Amended (Stafford Act), Title 42 of the United States Code (U.S.C.) § 5121 et seq.

For Fiscal Year 2023, the Department received funding for the following Disaster Grants programs:

• FEMA-4145-DR for the 2013 floods incident • FEMA-4429-DR-CO for the 2015 floods incident • FEMA-4498-DR for the COVID-19 incident • FEMA-4581-DR for the 2020 wildfires incident • FEMA-4634-DR for the 2021 wildfires and straight-line winds incident

The Disaster Grants program is based on a partnership with the recipient, which in these instances is the Department; the subrecipients (local governments or PNPs); and FEMA. FEMA is responsible for managing the program, approving grants, and providing technical assistance to the SLTT and subrecipients. The Department, as the recipient for the Disaster Grants program, is responsible for providing technical advice and assistance to eligible subrecipients, providing support for damage survey activities, ensuring that all potential applicants are aware of funding assistance available, and submitting documents necessary for grant awards. The subrecipient requests assistance, identifies the damaged facilities, provides information to support the request, maintains accurate documentation, and performs necessary work (a recipient can also be a subrecipient).  A subrecipient is defined in federal regulation [2 CFR 200.1] as, “an entity, usually but not limited to non-Federal entities, that receives a subaward from a pass-through entity to carry out part of a federal award; but does not include an individual that is a beneficiary of such award. A subrecipient may also be a recipient of other Federal awards directly from a federal awarding agency.” Federal regulation [2 CFR 200.1] defines a subaward as an award provided by a pass-through entity (such as the Department) to an entity to carry out part of a federal grant award received by the pass-through entity.

As part of its subrecipient monitoring process, the Department should complete an annual risk assessment to determine the extent of its monitoring of its subrecipients. The risk assessment includes considerations of financial risk factors such as financial implications of operational and compliance failures, operational risk factors such as risks resulting from inadequate internal controls, and compliance risks, such as violations with laws, regulations, and internal policies. In addition, the Department should be using monitoring tools to track the status of whether the subrecipient had an audit, if applicable, and whether that audit has been reviewed and management decisions issued, if applicable.

During Fiscal Year 2023, the Department passed approximately $48.4 million to 80 subrecipients for responses to various disasters covered by the Department’s Disaster Grants. In addition, the Department reported that they approved 78 new subawards during Fiscal Year 2023. In total, the Department reported that they had approximately 300 total subrecipients; many of these subrecipients had open projects that had been completed but were awaiting final approval and close out from FEMA.

What was the purpose of our audit work and what work was performed?

The purpose of the audit work was to determine whether the Department had adequate internal controls in place over and complied with subrecipient monitoring requirements over the federal Disaster Grants program for Fiscal Year 2023.

As part of our audit work, we tested 17 of 80 (21 percent) of the Department’s subrecipients who received approximately $4.2 million of Disaster Grant funding during Fiscal Year 2023 to determine whether the Department performed the subrecipient risk assessments required by federal regulations. We also requested the Department’s annual Risk Assessment package to determine whether the subrecipients’ risk assessments were appropriate and in accordance with federal regulations, and to determine whether the Department completed its onsite monitoring for those subrecipients that met the risk criteria for onsite monitoring.

In addition, we performed testwork to determine whether the Department obtained the subrecipients’ single audit reports, and issued a management decision, if applicable. How were the results of the audit work measured?

We measured the results of our audit work against the following requirements:

• Federal regulation [2 CFR 200.303] requires the Department to establish and maintain effective internal controls over the federal award that provide reasonable assurance that the non-federal entity is managing the federal award in compliance with federal statutes, regulations, and the terms and conditions of the federal award.

• Federal regulation [2 CFR 200.332] requires the Department to evaluate each subrecipient’s risk of noncompliance with federal statutes, regulations, and the terms and conditions of the subaward for the purposes of determining the appropriate subrecipient monitoring. Additionally, it requires the non-federal entity to verify that every subrecipient is audited, as required by 2 CFR 200, Subpart F, and to consider whether the results of the subrecipient’s audits indicate conditions that necessitate adjustment to the pass-through entity’s—in this case, the Department’s own records.

• The Division of Homeland Security and Emergency Management’s (DHSEM) Subrecipient Monitoring policy states that “DHSEM will perform an annual evaluation of Subrecipients’ risks prior to the start of each fiscal year, incorporating active awards and Subrecipients for the upcoming year.” The policy further indicates that each subrecipient will receive an overall risk score based on the quantitative and qualitative dated used for the assessment inputs.

• The DHSEM Subrecipient Monitoring policy states that “DHSEM will perform reviews of single audit results for Subrecipients who have expended Federal grant funds in excess of $750,000 of which some portion is passed through DHSEM.” The policy further indicates that “The subrecipients included in a fiscal year are those who have a fiscal year end between 4/1 and 3/31 of the year prior. This is tracked by utilizing the 15-month period DHSEM has to issue a management decision letter (nine months for subrecipient to obtain the audit + six months to review and issue decision).”

• Federal regulation [2 CFR 200.329] stipulates that the Department is responsible for oversight of the operations of the federal award supported activities. The non-federal entity must monitor its activities under federal awards to assure compliance with applicable federal requirements and performance expectations are being achieved.

• Federal regulation [2 CFR 200.521] indicates that the Department must issue a management decision for audit findings that relate to federal awards it makes to subrecipients within 6 months of acceptance of the audit report by the Federal Audit Clearinghouse (FAC).

What problems did the audit work identify? The Department did not comply with federal regulations or its own policies and procedures related to subrecipient monitoring during Fiscal Year 2023. Specifically, we identified issues with 16 of the 17 (94 percent) subrecipients we tested, as follows:

• The Department did not document risk assessments for 16 of the subrecipients selected for testing. Specifically, the Department did not document risk assessments for subrecipients related to the Disaster Grants for the 2013 floods incident (FEMA-4145-DR), the 2015 floods incident (FEMA-4429-DR-CO), small projects, and projects that were written at 100 percent work completed where FEMA had already approved the project worksheet. The Department subsequently provided its reasons for why these subrecipients were deemed to have low to no subrecipient risk based on the nature of the specific FEMA subawards, such as the projects were complete but waiting on final FEMA approval or had undergone a detailed approval process by FEMA prior to funds being obligated; however, the specific risk assessment for these subrecipients was not documented. We quantified the exposure for the lack of risk assessments by reviewing the Department’s listing of amounts paid to subrecipients and cross-referencing the listing to the risk assessments that were performed, noting that 68 of the 80 subrecipients (85 percent) did not have a risk assessment performed. These subrecipients accounted for approximately $15.2 million of the total $48.4 million (31 percent) of the total payments made by the Department to subrecipients during the current year.

• The Department did not monitor whether 12 of the subrecipients were required to have a single audit, and if applicable, review the subrecipient’s single audit report and issue a management decision on findings.

• The Department did not issue a management decision for 1 subrecipient until 8 months after the subrecipient filed its audit with the FAC, or 2 months after the time frame required by federal regulations.

In addition, there was no documented approval for a change in the subrecipient monitoring plan to require performance of a more lenient set of procedures. Specifically, the Department’s original subrecipient monitoring plan specified that site visits would be performed for five specific subrecipients in Fiscal Year 2023; however, the Department indicated that they subsequently amended the subrecipient monitoring plan to revise the specific subrecipients subject to site visits, as well as reduced the total number of subrecipients that would receive site visits to four.

Why did these problems occur?

The Department did not have adequate internal controls in place to ensure it complied with subrecipient requirements or that it followed its own policies during Fiscal Year 2023. Specifically: • The Department indicated that they excluded subawards related to the 2013 floods incident, 2015 floods incident, small awards, and awards written at 100 percent complete because they viewed those arrangements as having little risk of noncompliance based on reporting that occurred up until that point in time, and did not document a risk assessment for each of the individual subrecipients.

• The Department did not comply with its subrecipient monitoring policy or federal regulations, both of which require the Department to perform reviews of single audits for all subrecipients.

• The Department failed to comply with the required timeframes for issuing management decisions because its subrecipient monitoring policy does not align with federal regulations. Specifically, the Department’s subrecipient monitoring policy requires management decisions to be issued within 15 months after the end of each subrecipient’s fiscal year rather than within 6 months of acceptance of the subrecipient’s audit report by the FAC. Additionally, the Department did not have an appropriate mechanism in place to identify, in a timely manner, when a subrecipient submitted an audit to the FAC.

• The Department does not have written policies to address requirements for approval when modifications to the initial subrecipient risk assessment are made.

Why do these problems matter?

The issues we found are important because of the following:

• By failing to properly document assessed risk of subrecipients, the Department is out of compliance with federal requirements and with its policy to assess risk for each subrecipient. This could result in the Department not timely identifying risks for subrecipients and modifying the extent of its monitoring activities to ensure the subrecipient has proper accountability and resources to be able to meet the program requirements.

• By failing to verify that all subrecipients are audited as required by 2 CFR 200, Subpart F, the Department is out of compliance with federal requirements and its internal policies. This could result in the Department not timely identifying enforcement actions that may be needed against noncompliant subrecipients and then making revisions to the monitoring risk assessment for the subrecipient.

• Failing to ensure that subrecipient monitoring policies are in compliance with federal regulations could result in the Department not timely issuing management responses to a subrecipient’s findings. This could also result in the Department not timely identifying enforcement actions that may be needed against noncompliant subrecipients and including revisions to the subrecipient monitoring risk assessment.

Recommendation 2023-075

The Department of Public Safety should strengthen its internal controls over, and ensure it complies with federal Disaster Grants – Public Assistance (Presidentially Declared Disasters) program requirements for subrecipient monitoring by:

A. Updating its current policy to address considerations specific to subrecipients with open subawards that were waiting for final approval or had undergone a detailed approval by the Federal Emergency Management Agency prior to funds being obligated and modifications to the subrecipients risk assessments.

B. Reviewing all subrecipients’ single audit reports.

C. Updating its current subrecipient monitoring policy to be in compliance with federal regulations requiring management decisions to be issued within 6 months of acceptance of the subrecipient’s audit report by the Federal Audit Clearinghouse (FAC), and implementing a mechanism to track when subrecipients submit single audits to the FAC.

Response Department of Public Safety

A. Agree Implementation Date: June 2024

The Department will make sure that all subrecipients have a documented risk assessment, and if any changes to the risk assessment process are made, those will also be documented.

B. Agree Implementation Date: March 2024

There is a requirement is to ensure that all single audit reports are completed by all sub-recipients, and we agree we need to implement this change with the annual Risk Assessment.

C. Agree Implementation Date: June 2024

DHSEM Subrecipient Monitoring team will update their policy to reflect the following: single audits from the Subrecipients must be submitted to the Federal Audit Clearinghouse within the earlier of: 30 calendar days after receipt of the auditor's report(s); or nine months after the end of the audit period, unless a different period is specified in a program-specific audit guide. DHSEM Subrecipient Monitoring team will monitor the FAC for subrecipients recognized on the annual Risk Assessment, review the Single Audit and a management letter will go out within six months of the acceptance date from the FAC.

Finding 2023-076 and 2023-077 Internal Controls Over Exhibit K1 FEMA Disaster Grants Program Reporting, Activities Allowed or Unallowed and Allowable Costs/Cost Principles

The Department’s accounting staff is responsible for all of the Department’s financial accounting and reporting, including the accurate and timely entry of financial transactions into the Colorado Operations Resource Engine (CORE), the State’s accounting system. The Department is also required to prepare its financial transactions in accordance with Generally Accepted Accounting Principles (GAAP). The Office of the State Controller (OSC) uses the financial transactions in CORE to prepare the State’s financial statements, which are also required to be prepared in accordance with GAAP. The Governmental Accounting Standards Board (GASB) establishes GAAP for state and local government entities through the issuance of GASB statements and authoritative accounting guidance such as GASB implementation guides, that the Department and OSC must comply with when preparing financial transactions and statements.

The OSC has also established guidelines that require the Department to report its financial activities through forms, or exhibits, submitted to the OSC for inclusion in the State’s financial statements. The OSC collects the information from state departments through submitted exhibits to assist in its preparation of the State’s financial statements, required note disclosures, and the Schedule of Expenditures of Federal Awards (SEFA). The State is required to comply with the reporting requirements of Title 2 U.S. Code of Federal Regulations Part 200, Uniform Administrative Requirements, Cost Principles, and Audit Requirements for Federal Awards (Uniform Guidance) for the State’s SEFA. The federal Office of Management and Budget’s (OMB) Compliance Supplement is part of Uniform Guidance and provides additional information required to be included on the SEFA. For SEFA reporting, the OSC requires that state departments prepare and submit an Exhibit K1, Schedule of Federal Assistance, after each fiscal year end to provide information on their federal expenditures for the OSC’s preparation of the State’s SEFA. The OSC specifies that expenditures of federal funds that are received by one state agency and passed on to another state agency for spending should be reported on the first department’s Exhibit K1. For example, the Department is required to report federal expenditures of FEMA Disaster Grants program funds that were passed by the Department to the Department of Public Health and Environment (CDPHE); this includes any expenditures that have been made by CDPHE but have not yet been reimbursed by the Department.

The Department’s FEMA Disaster Grants program awards include funding for the purpose of responding to the COVID-19 pandemic. A portion of expenditures recognized by the Department under this award in the current year were for expenditures initially incurred by CDPHE for responding to the COVID-19 pandemic. CDPHE personnel have the option to either submit costs that are classified as “work to be completed” or “work completed” to FEMA directly, and then if FEMA agrees that the costs are allowable, they will obligate additional funding. Then CDPHE submits costs to the Department through a request for reimbursement, and the Department has policies and procedures to verify that CDPHE complied with all applicable rules and regulations and followed the scope of work, prior to disbursing funds to CDPHE. At the end of each fiscal year, CDPHE provides the Department summary-level detail of cumulative-to-date FEMA Disaster Grants program allowable expenditures that CDPHE incurred during prior fiscal years, as well as the current fiscal year, that have not been submitted for reimbursement through an interdepartmental transaction, and the Department in turn, recognizes an interdepartmental payable to CDPHE, along with the corresponding federal expenditures, federal revenues, and a federal receivable for the current fiscal year’s activity. The Department also includes this additional CDPHE-provided expenditure amount in the federal FEMA Disaster Grants program amount it reports on the Exhibit K1 each year. The Department does not complete a detailed review of the allowability of CDPHE’s expenditures until CDPHE submits supporting documentation for allowable expenditures to the Department’s grants management information system—EM Grants. Once CDPHE provides all necessary supporting documentation in EM Grants, the Department reports that it will complete its review of expenditures. After the Department has completed its review, CDPHE submits a request for reimbursement for the approved allowable expenditures. Ultimately, the Department is responsible for appropriate review and approval of all allowable expenditures within EM Grants and for the appropriate reporting of the FEMA Disaster Grants program expenditures on the Exhibit K1.

For Fiscal Year 2023, the Department reported $286.9 million in total FEMA Disaster Grants program expenditures. Of this amount, the Department reported $166.2 million (58 percent) of CDPHE’s Program expenditures during Fiscal Year 2023.

What was the purpose of our audit work and what work was performed?

The purpose of the audit work was to determine whether the Department was in compliance with the FEMA Disaster Grants program requirements for incurring and recognizing allowable activities and allowable costs, and whether proper internal controls were in place over the FEMA Disaster Grants program during Fiscal Year 2023. In addition, the purpose of our audit work was to review the Department’s internal controls over accounting and financial reporting of the FEMA Disaster Grants program activities within the Department’s Exhibit K1, and to determine whether the Department complied with applicable accounting standards during Fiscal Year 2023.

We obtained an understanding of the Department’s internal controls over account balances, financial processes, and fiscal year-end close processes. Specifically, we performed the following:

• Inquired of the Department to gain an understanding of its process for recognizing and reporting expenditures on its Exhibit K1, including the recognition of the FEMA Disaster Grants program expenditures incurred by CDPHE.

• Inquired of the Department and CDPHE personnel regarding their processes for determining allowability of the FEMA Disaster Grants program expenditures, and the associated Fiscal Year to report allowable expenditures in the Department’s and CDPHE’s Exhibit K1.

• Obtained and analyzed the Department’s summary-level expenditure transactions recorded in CORE that represented the FEMA Disaster Grants program’s pass-through expenditures at CDPHE during the fiscal year, totaling $166.2 million, and compared to CDPHE’s CORE transactional data for the FEMA Disaster Grants program’s pass-through expenditures from the Department for Fiscal Year 2023, totaling $137.0 million. In addition, we inquired how the Department reconciled the transactional data to CDPHE data to determine whether CDPHE FEMA Disaster Grants program expenditures were recognized for the proper amount and in the proper fiscal year on the Department’s Exhibit K1.

• Selected a sample of 125 FEMA Disaster Grants program expenditures—totaling approximately $172.7 million—reported as being incurred during Fiscal Year 2023 to test the Department’s internal controls and compliance. Of these expenditures, 64 expenditures were specific to CDPHE’s CORE transaction data of FEMA Disaster Grants program expenditures (related to 17 journal entries) and totaled approximately $92.6 million. We performed testing on the 125 expenditures to determine whether the expenditures were made in accordance with FEMA’s Disaster Grants program requirements.

How were the results of the audit work measured?

We measured the results of our audit work against the following requirements:

• The OSC’s Fiscal Procedures Manual, Chapter 1, Section 3.3, State of Colorado Accounting Organization Objectives, states that one of the objectives of the State of Colorado reporting includes “maintaining accounting records in accordance with Generally Accepted Accounting Principles (GAAP) and in compliance with Governmental Accounting Standards Board (GASB) pronouncements.”

• State Fiscal Rule 1-2 (3.5), Internal Controls, requires that state agencies “implement internal accounting and administrative controls that reasonably ensure that financial transactions are accurate, reliable, conform to the Fiscal Rules, and reflect the underlying realities of the accounting transaction (substance rather than form).” For example, internal accounting and administrative controls include periodic staff training on fiscal year-end accounting processes, development of procedures, and implementation of new governmental accounting standards.

• The OSC has adopted the Standards for Internal Control in the Federal Government (Green Book), published by the U.S. Government Accountability Office, as the State’s standard for internal controls, which all state agencies must follow. Green Book, Paragraph OV2.14, Roles in an Internal Control System, states that management is responsible for designing an internal control system. This should include controls over the preparation of financial reporting in accordance with professional standards and applicable laws and regulations.

• The OSC required departments to submit their Exhibit K1 by September 29, 2023.

• The OSC’s Exhibit Instructions indicated that “When one State department or IHE passes a federal award through to another State department or IHE, a duplication of expenditures will be reported if both entities report the federal award or subaward on their Exhibits. To prevent this duplication in reporting, federal subawards received by a State department or IHE from another State department or IHE must not be reported on the Exhibit. The federal award must only be reported on the Exhibit of the State department or IHE that received the award from an entity external to the state government of Colorado.”  • Federal regulation [2 CFR 200.303] requires the Department to establish and maintain effective internal controls over federal awards that provide reasonable assurance that the Department is managing its federal awards in compliance with federal statutes, regulations, and the terms and conditions of the federal award.

• Federal regulation [2 CFR 200.334] requires the Department to keep all financial records and supporting documentation pertinent to a federal award for a minimum period of 3 years from the date of submission of the final expenditures report.

• Federal regulation [2 CFR 200.403(g)] requires that costs be adequately documented.

• The 2023 OMB Compliance Supplement requires FEMA Disaster Grants program expenditures to be reported on the SEFA when (1) FEMA has approved the project and (2) eligible expenditures have been incurred.

What problems did the audit work identify? As a result of our audit work, we determined that the Department did not have adequate internal controls over financial reporting, and did not comply with applicable accounting standards during Fiscal Year 2023.

Specifically, the Department could not provide sufficient supporting documentation for $29.2 million of the $166.2 million (18 percent) of FEMA Disaster Grants program expenditures reported on its Fiscal Year 2023 Exhibit K1 related to FEMA Disaster Grants program funds expended by another state department—CDPHE. The Department did not properly reconcile summary-level reports received with the interdepartmental transactions to the amounts contained within CDPHE’s supporting transactional detail. We identified that the Department did not obtain detailed supporting documentation from CDPHE of FEMA Disaster Grants program expenditures that supported the interdepartmental payable, which represented cumulative-to-date FEMA Disaster Grants program allowable expenditures that CDPHE had incurred but for which it had not been reimbursed. We determined through follow-up testing of CDPHE’s expenditures of FEMA Disaster Grants program funds passed through from the Department that CDPHE’s records reflected $137.0 million in Fiscal Year 2023 expenditures—$29.2 million less than the Department reported on its Exhibit K1. During our audit and as of the completion of audit procedures, we were unable to obtain underlying support for the $29.2 million difference noted.

Additionally, we identified issues with 28 of the 64 (44 percent) CDPHE pass-through expenditures reported on the Department’s Exhibit K1 that we selected for testing:

• We noted 26 invoices (41 percent) that were posted to CORE and the Department’s Exhibit K1 as Fiscal Year 2023 expenditures, but that had service dates prior to Fiscal Year 2023 totaling $19.9 million. As of the completion of our audit fieldwork, the Department was unable to substantiate whether these costs were included within the prior year’s Exhibit K1. We were also unable to determine whether this $19.9 million in expenditures related to the $29.2 million difference we identified between the Department’s amount reported on the Fiscal Year 2023 Exhibit K1 and CDPHE records.

• One transaction reported on the Department’s Exhibit K1 was a $10,000 estimate that was not adequately supported as of the completion of audit work.

• One invoice totaling $53 was incorrectly coded to the FEMA Disaster Grants program within CORE and the Department’s Exhibit K1.

Further, CDPHE improperly reported $139.3 million on CDPHE’s Exhibit K1 relating to the FEMA Disaster Grants program. These amounts were passed through from the Department to CDPHE and should not be included on CDPHE’s Exhibit K1. After we brought the issue to CDPHE’s attention, they corrected this error by submitting a revised Exhibit K1 to the OSC on January 31, 2024.

Why did these problems occur?

The Department and CDPHE did not have adequate internal controls, including sufficient policies and procedures, in place for Fiscal Year 2023 to ensure accurate and timely accounting and reporting of allowable FEMA Disaster Grants program expenditures on the Exhibit K1.

Overall, the Department did not have a process in place to perform a full reconciliation of amounts reported as FEMA Disaster Grants program expenditures for the fiscal year, including expenditures incurred by CDPHE but not yet reimbursed by the Department as of fiscal year-end; accrual amounts reported by CDPHE from the Department for the FEMA Disaster Grants program during the year; or fiscal period recording of reimbursement payments made by the Department to CDPHE during the year.

The Department stated that it reconciled CDPHE’s FEMA Disaster Grants program expenditures based on the summary-level information provided with CDPHE’s interdepartmental transactions of the FEMA Disaster Grants program expenditures. However, the Department did not have policies and procedures in place requiring that Department staff request, obtain, and review sufficiently-detailed FEMA Disaster Grants program expenditure data from CDPHE to ensure that the interdepartmental transactions were appropriate, and that the Department’s Exhibit K1 reporting was correct when it was submitted to the OSC in September 2023.

Additionally, the Department did not reconcile Fiscal Year 2023 CDPHE requests for reimbursement of the FEMA Disaster Grants program’s expenditures against transactions that were included in Fiscal Year 2022’s expenditures to ensure they were reported in the appropriate fiscal year. As a result of the lack of reconciliation of expenditures incurred, and due to the nature of some expenditures tested related to periods prior to Fiscal Year 2023, we were unable to determine the full extent to which the Department’s Exhibit K1 FEMA Disaster Grants program expenditures ultimately were overstated or understated. Further, we were unable to determine whether CDPHE provided complete supporting documentation to the Department for all underlying costs incurred during Fiscal Year 2023, since the summary-level data utilized by the Department to prepare the Department’s K1 and the transactional level data provided by CDPHE was not reconciled until the end of the audit in January 2024.

As part of the Department’s current process, the Department does not complete a detailed review of CDPHE’s FEMA Disaster Grants program expenditures at the time interdepartmental transactions are submitted by CDPHE, and reported on the Department’s Exhibit K1. Rather, the Department completes a detailed review once CDPHE submits supporting documentation for allowable expenditures into EM Grants. Once CDPHE provides all necessary supporting documentation, the Department will complete its expenditures review. After the Department has completed its review, CDPHE submits a request for reimbursement for the approved allowable expenditures. As a result, any FEMA Disaster Grants program-eligible expenditures that CDPHE identified and reported to the Department as an interdepartmental accrual—but had not yet been reviewed by the Department within EM Grants—did not have a detailed review of allowability completed by the Department at the time the expenditures were reported on the Department’s Exhibit K1.

Additionally, CDPHE did not review and identify the errors we identified in the two transactions where there was an estimated cost that was not adequately supported and one invoice that was incorrectly coded to the FEMA Disaster Grants program. Further, CDPHE was unable to provide a detailed reconciliation to the Department that reconciled summary-level information identified in the interdepartmental accrual to detailed transactions that were incurred. For instance, CDPHE did not reconcile Fiscal Year 2023 CDPHE requests for reimbursement of the FEMA Disaster Grants program’s expenditures against transactions that were included in Fiscal Year 2022’s expenditures to ensure they were reported in the appropriate fiscal year.

At the end of our audit test work in January 2024—nearly 4 months after the Exhibit K1 was due to the OSC—Department staff reported to us that they determined that the CDPHE-run report that was provided to us during the audit as support for the Disaster Grants program expenditures contained budget fiscal-year expenditures rather than fiscal year expenditures. Department staff further reported that, after identifying the fiscal year reporting issue, the Department compared the Exhibit K1 differences that we identified, and determined that the Exhibit K1 was actually understated by $12.0 million, and that they should have reported $178.2 million on the Exhibit K1 for the Disaster Grants program. Because our audit test work was complete, we did not review or test the Department’s comparison or the recalculated documentation provided by the Department.

The current process for accounting and reporting over the FEMA Disaster Grants program did not include adequate communication and coordination between the Department and CDPHE to ensure that amounts were not duplicated by both the Department and CDPHE on each of their Exhibit K1s.

Why do these problems matter?

Without adequate internal controls in place over compliance with the FEMA Disaster Grants program requirements, including an appropriate reconciliation and review of allowable expenditures, the Department and CDPHE could be out of compliance with federal allowable cost requirements, which may result in the federal oversight agency relying on incorrect data reported in the State’s SEFA.

Further, failure to properly reconcile and report expenditures on the Department’s Exhibit K1, if uncorrected, could cause the State’s SEFA to be inaccurate and the Department to be out of compliance with federal reporting requirements.

Lastly, federal funds that are misapplied or used for unallowable purposes could be subject to repayment from the Department to the federal granting agency.

Recommendation 2023-076

The Department of Public Safety (Department) should strengthen its internal controls over the Federal Emergency Management Agency (FEMA) Disaster Grants – Public Assistance (Presidentially Declared Disasters) program funds, including financial accounting and reporting on its annual Exhibit K1, Schedule of Federal Assistance, by:

A. Developing, documenting, and implementing policies and procedures to require that Department staff obtain and maintain sufficiently-detailed supporting documentation from the Department of Public Health and Environment (CDPHE) for CDPHE’s expenditure accrual of FEMA’s Disaster Grants program funds recorded by the Department and perform reconciliations of the information to underlying transactional data. This should include requiring that Department staff complete a full reconciliation on at least an annual basis of detailed amounts reported as FEMA Disaster Grants program expenditures for the fiscal year, including expenditures incurred by CDPHE but not yet reimbursed by the Department as of fiscal year end; reimbursement amounts requested by CDPHE from the Department for the FEMA Disaster Grants program during the year; and reimbursement payments made by the Department to CDPHE during the year and resolve any reconciling differences prior to submitting the Exhibit K1 to the Office of the State Controller.

B. Developing, documenting, and implementing policies and procedures to require that Department staff have a monitoring and review process in place over CDPHE’s Disaster Grants program federal expenditures that are reported on the Exhibit K1 in order to verify that expenditures are reported in the proper period and incurred under an approved project, and that expenditures are allowable under the federal program.

Response Department of Public Safety

A. Agree Implementation Date: September 2024

Policies and procedures have been created requiring sufficient detailed documentation from other agencies for all expenses submitted for reimbursement, including applicable period and allowability of expenses as recorded in EMGrants. We will perform an annual reconciliation of expenditures reported for accruals and reconcile differences when compiling the Exhibit K1.

B. Agree Implementation Date: September 2024

Policies and procedures will be updated to require an annual reconciliation of expenditures reported for interagency accruals. Detailed expenses will also be reconciled with EMGrants for verification of allowability and applicable period as part of compiling the Exhibit K1.

Finding 2023-076 and 2023-077 Internal Controls Over Exhibit K1 FEMA Disaster Grants Program Reporting, Activities Allowed or Unallowed and Allowable Costs/Cost Principles

The Department’s accounting staff is responsible for all of the Department’s financial accounting and reporting, including the accurate and timely entry of financial transactions into the Colorado Operations Resource Engine (CORE), the State’s accounting system. The Department is also required to prepare its financial transactions in accordance with Generally Accepted Accounting Principles (GAAP). The Office of the State Controller (OSC) uses the financial transactions in CORE to prepare the State’s financial statements, which are also required to be prepared in accordance with GAAP. The Governmental Accounting Standards Board (GASB) establishes GAAP for state and local government entities through the issuance of GASB statements and authoritative accounting guidance such as GASB implementation guides, that the Department and OSC must comply with when preparing financial transactions and statements.

The OSC has also established guidelines that require the Department to report its financial activities through forms, or exhibits, submitted to the OSC for inclusion in the State’s financial statements. The OSC collects the information from state departments through submitted exhibits to assist in its preparation of the State’s financial statements, required note disclosures, and the Schedule of Expenditures of Federal Awards (SEFA). The State is required to comply with the reporting requirements of Title 2 U.S. Code of Federal Regulations Part 200, Uniform Administrative Requirements, Cost Principles, and Audit Requirements for Federal Awards (Uniform Guidance) for the State’s SEFA. The federal Office of Management and Budget’s (OMB) Compliance Supplement is part of Uniform Guidance and provides additional information required to be included on the SEFA. For SEFA reporting, the OSC requires that state departments prepare and submit an Exhibit K1, Schedule of Federal Assistance, after each fiscal year end to provide information on their federal expenditures for the OSC’s preparation of the State’s SEFA. The OSC specifies that expenditures of federal funds that are received by one state agency and passed on to another state agency for spending should be reported on the first department’s Exhibit K1. For example, the Department is required to report federal expenditures of FEMA Disaster Grants program funds that were passed by the Department to the Department of Public Health and Environment (CDPHE); this includes any expenditures that have been made by CDPHE but have not yet been reimbursed by the Department.

The Department’s FEMA Disaster Grants program awards include funding for the purpose of responding to the COVID-19 pandemic. A portion of expenditures recognized by the Department under this award in the current year were for expenditures initially incurred by CDPHE for responding to the COVID-19 pandemic. CDPHE personnel have the option to either submit costs that are classified as “work to be completed” or “work completed” to FEMA directly, and then if FEMA agrees that the costs are allowable, they will obligate additional funding. Then CDPHE submits costs to the Department through a request for reimbursement, and the Department has policies and procedures to verify that CDPHE complied with all applicable rules and regulations and followed the scope of work, prior to disbursing funds to CDPHE. At the end of each fiscal year, CDPHE provides the Department summary-level detail of cumulative-to-date FEMA Disaster Grants program allowable expenditures that CDPHE incurred during prior fiscal years, as well as the current fiscal year, that have not been submitted for reimbursement through an interdepartmental transaction, and the Department in turn, recognizes an interdepartmental payable to CDPHE, along with the corresponding federal expenditures, federal revenues, and a federal receivable for the current fiscal year’s activity. The Department also includes this additional CDPHE-provided expenditure amount in the federal FEMA Disaster Grants program amount it reports on the Exhibit K1 each year. The Department does not complete a detailed review of the allowability of CDPHE’s expenditures until CDPHE submits supporting documentation for allowable expenditures to the Department’s grants management information system—EM Grants. Once CDPHE provides all necessary supporting documentation in EM Grants, the Department reports that it will complete its review of expenditures. After the Department has completed its review, CDPHE submits a request for reimbursement for the approved allowable expenditures. Ultimately, the Department is responsible for appropriate review and approval of all allowable expenditures within EM Grants and for the appropriate reporting of the FEMA Disaster Grants program expenditures on the Exhibit K1.

For Fiscal Year 2023, the Department reported $286.9 million in total FEMA Disaster Grants program expenditures. Of this amount, the Department reported $166.2 million (58 percent) of CDPHE’s Program expenditures during Fiscal Year 2023.

What was the purpose of our audit work and what work was performed?

The purpose of the audit work was to determine whether the Department was in compliance with the FEMA Disaster Grants program requirements for incurring and recognizing allowable activities and allowable costs, and whether proper internal controls were in place over the FEMA Disaster Grants program during Fiscal Year 2023. In addition, the purpose of our audit work was to review the Department’s internal controls over accounting and financial reporting of the FEMA Disaster Grants program activities within the Department’s Exhibit K1, and to determine whether the Department complied with applicable accounting standards during Fiscal Year 2023.

We obtained an understanding of the Department’s internal controls over account balances, financial processes, and fiscal year-end close processes. Specifically, we performed the following:

• Inquired of the Department to gain an understanding of its process for recognizing and reporting expenditures on its Exhibit K1, including the recognition of the FEMA Disaster Grants program expenditures incurred by CDPHE.

• Inquired of the Department and CDPHE personnel regarding their processes for determining allowability of the FEMA Disaster Grants program expenditures, and the associated Fiscal Year to report allowable expenditures in the Department’s and CDPHE’s Exhibit K1.

• Obtained and analyzed the Department’s summary-level expenditure transactions recorded in CORE that represented the FEMA Disaster Grants program’s pass-through expenditures at CDPHE during the fiscal year, totaling $166.2 million, and compared to CDPHE’s CORE transactional data for the FEMA Disaster Grants program’s pass-through expenditures from the Department for Fiscal Year 2023, totaling $137.0 million. In addition, we inquired how the Department reconciled the transactional data to CDPHE data to determine whether CDPHE FEMA Disaster Grants program expenditures were recognized for the proper amount and in the proper fiscal year on the Department’s Exhibit K1.

• Selected a sample of 125 FEMA Disaster Grants program expenditures—totaling approximately $172.7 million—reported as being incurred during Fiscal Year 2023 to test the Department’s internal controls and compliance. Of these expenditures, 64 expenditures were specific to CDPHE’s CORE transaction data of FEMA Disaster Grants program expenditures (related to 17 journal entries) and totaled approximately $92.6 million. We performed testing on the 125 expenditures to determine whether the expenditures were made in accordance with FEMA’s Disaster Grants program requirements.

How were the results of the audit work measured?

We measured the results of our audit work against the following requirements:

• The OSC’s Fiscal Procedures Manual, Chapter 1, Section 3.3, State of Colorado Accounting Organization Objectives, states that one of the objectives of the State of Colorado reporting includes “maintaining accounting records in accordance with Generally Accepted Accounting Principles (GAAP) and in compliance with Governmental Accounting Standards Board (GASB) pronouncements.”

• State Fiscal Rule 1-2 (3.5), Internal Controls, requires that state agencies “implement internal accounting and administrative controls that reasonably ensure that financial transactions are accurate, reliable, conform to the Fiscal Rules, and reflect the underlying realities of the accounting transaction (substance rather than form).” For example, internal accounting and administrative controls include periodic staff training on fiscal year-end accounting processes, development of procedures, and implementation of new governmental accounting standards.

• The OSC has adopted the Standards for Internal Control in the Federal Government (Green Book), published by the U.S. Government Accountability Office, as the State’s standard for internal controls, which all state agencies must follow. Green Book, Paragraph OV2.14, Roles in an Internal Control System, states that management is responsible for designing an internal control system. This should include controls over the preparation of financial reporting in accordance with professional standards and applicable laws and regulations.

• The OSC required departments to submit their Exhibit K1 by September 29, 2023.

• The OSC’s Exhibit Instructions indicated that “When one State department or IHE passes a federal award through to another State department or IHE, a duplication of expenditures will be reported if both entities report the federal award or subaward on their Exhibits. To prevent this duplication in reporting, federal subawards received by a State department or IHE from another State department or IHE must not be reported on the Exhibit. The federal award must only be reported on the Exhibit of the State department or IHE that received the award from an entity external to the state government of Colorado.”  • Federal regulation [2 CFR 200.303] requires the Department to establish and maintain effective internal controls over federal awards that provide reasonable assurance that the Department is managing its federal awards in compliance with federal statutes, regulations, and the terms and conditions of the federal award.

• Federal regulation [2 CFR 200.334] requires the Department to keep all financial records and supporting documentation pertinent to a federal award for a minimum period of 3 years from the date of submission of the final expenditures report.

• Federal regulation [2 CFR 200.403(g)] requires that costs be adequately documented.

• The 2023 OMB Compliance Supplement requires FEMA Disaster Grants program expenditures to be reported on the SEFA when (1) FEMA has approved the project and (2) eligible expenditures have been incurred.

What problems did the audit work identify? As a result of our audit work, we determined that the Department did not have adequate internal controls over financial reporting, and did not comply with applicable accounting standards during Fiscal Year 2023.

Specifically, the Department could not provide sufficient supporting documentation for $29.2 million of the $166.2 million (18 percent) of FEMA Disaster Grants program expenditures reported on its Fiscal Year 2023 Exhibit K1 related to FEMA Disaster Grants program funds expended by another state department—CDPHE. The Department did not properly reconcile summary-level reports received with the interdepartmental transactions to the amounts contained within CDPHE’s supporting transactional detail. We identified that the Department did not obtain detailed supporting documentation from CDPHE of FEMA Disaster Grants program expenditures that supported the interdepartmental payable, which represented cumulative-to-date FEMA Disaster Grants program allowable expenditures that CDPHE had incurred but for which it had not been reimbursed. We determined through follow-up testing of CDPHE’s expenditures of FEMA Disaster Grants program funds passed through from the Department that CDPHE’s records reflected $137.0 million in Fiscal Year 2023 expenditures—$29.2 million less than the Department reported on its Exhibit K1. During our audit and as of the completion of audit procedures, we were unable to obtain underlying support for the $29.2 million difference noted.

Additionally, we identified issues with 28 of the 64 (44 percent) CDPHE pass-through expenditures reported on the Department’s Exhibit K1 that we selected for testing:

• We noted 26 invoices (41 percent) that were posted to CORE and the Department’s Exhibit K1 as Fiscal Year 2023 expenditures, but that had service dates prior to Fiscal Year 2023 totaling $19.9 million. As of the completion of our audit fieldwork, the Department was unable to substantiate whether these costs were included within the prior year’s Exhibit K1. We were also unable to determine whether this $19.9 million in expenditures related to the $29.2 million difference we identified between the Department’s amount reported on the Fiscal Year 2023 Exhibit K1 and CDPHE records.

• One transaction reported on the Department’s Exhibit K1 was a $10,000 estimate that was not adequately supported as of the completion of audit work.

• One invoice totaling $53 was incorrectly coded to the FEMA Disaster Grants program within CORE and the Department’s Exhibit K1.

Further, CDPHE improperly reported $139.3 million on CDPHE’s Exhibit K1 relating to the FEMA Disaster Grants program. These amounts were passed through from the Department to CDPHE and should not be included on CDPHE’s Exhibit K1. After we brought the issue to CDPHE’s attention, they corrected this error by submitting a revised Exhibit K1 to the OSC on January 31, 2024.

Why did these problems occur?

The Department and CDPHE did not have adequate internal controls, including sufficient policies and procedures, in place for Fiscal Year 2023 to ensure accurate and timely accounting and reporting of allowable FEMA Disaster Grants program expenditures on the Exhibit K1.

Overall, the Department did not have a process in place to perform a full reconciliation of amounts reported as FEMA Disaster Grants program expenditures for the fiscal year, including expenditures incurred by CDPHE but not yet reimbursed by the Department as of fiscal year-end; accrual amounts reported by CDPHE from the Department for the FEMA Disaster Grants program during the year; or fiscal period recording of reimbursement payments made by the Department to CDPHE during the year.

The Department stated that it reconciled CDPHE’s FEMA Disaster Grants program expenditures based on the summary-level information provided with CDPHE’s interdepartmental transactions of the FEMA Disaster Grants program expenditures. However, the Department did not have policies and procedures in place requiring that Department staff request, obtain, and review sufficiently-detailed FEMA Disaster Grants program expenditure data from CDPHE to ensure that the interdepartmental transactions were appropriate, and that the Department’s Exhibit K1 reporting was correct when it was submitted to the OSC in September 2023.

Additionally, the Department did not reconcile Fiscal Year 2023 CDPHE requests for reimbursement of the FEMA Disaster Grants program’s expenditures against transactions that were included in Fiscal Year 2022’s expenditures to ensure they were reported in the appropriate fiscal year. As a result of the lack of reconciliation of expenditures incurred, and due to the nature of some expenditures tested related to periods prior to Fiscal Year 2023, we were unable to determine the full extent to which the Department’s Exhibit K1 FEMA Disaster Grants program expenditures ultimately were overstated or understated. Further, we were unable to determine whether CDPHE provided complete supporting documentation to the Department for all underlying costs incurred during Fiscal Year 2023, since the summary-level data utilized by the Department to prepare the Department’s K1 and the transactional level data provided by CDPHE was not reconciled until the end of the audit in January 2024.

As part of the Department’s current process, the Department does not complete a detailed review of CDPHE’s FEMA Disaster Grants program expenditures at the time interdepartmental transactions are submitted by CDPHE, and reported on the Department’s Exhibit K1. Rather, the Department completes a detailed review once CDPHE submits supporting documentation for allowable expenditures into EM Grants. Once CDPHE provides all necessary supporting documentation, the Department will complete its expenditures review. After the Department has completed its review, CDPHE submits a request for reimbursement for the approved allowable expenditures. As a result, any FEMA Disaster Grants program-eligible expenditures that CDPHE identified and reported to the Department as an interdepartmental accrual—but had not yet been reviewed by the Department within EM Grants—did not have a detailed review of allowability completed by the Department at the time the expenditures were reported on the Department’s Exhibit K1.

Additionally, CDPHE did not review and identify the errors we identified in the two transactions where there was an estimated cost that was not adequately supported and one invoice that was incorrectly coded to the FEMA Disaster Grants program. Further, CDPHE was unable to provide a detailed reconciliation to the Department that reconciled summary-level information identified in the interdepartmental accrual to detailed transactions that were incurred. For instance, CDPHE did not reconcile Fiscal Year 2023 CDPHE requests for reimbursement of the FEMA Disaster Grants program’s expenditures against transactions that were included in Fiscal Year 2022’s expenditures to ensure they were reported in the appropriate fiscal year.

At the end of our audit test work in January 2024—nearly 4 months after the Exhibit K1 was due to the OSC—Department staff reported to us that they determined that the CDPHE-run report that was provided to us during the audit as support for the Disaster Grants program expenditures contained budget fiscal-year expenditures rather than fiscal year expenditures. Department staff further reported that, after identifying the fiscal year reporting issue, the Department compared the Exhibit K1 differences that we identified, and determined that the Exhibit K1 was actually understated by $12.0 million, and that they should have reported $178.2 million on the Exhibit K1 for the Disaster Grants program. Because our audit test work was complete, we did not review or test the Department’s comparison or the recalculated documentation provided by the Department.

The current process for accounting and reporting over the FEMA Disaster Grants program did not include adequate communication and coordination between the Department and CDPHE to ensure that amounts were not duplicated by both the Department and CDPHE on each of their Exhibit K1s.

Why do these problems matter?

Without adequate internal controls in place over compliance with the FEMA Disaster Grants program requirements, including an appropriate reconciliation and review of allowable expenditures, the Department and CDPHE could be out of compliance with federal allowable cost requirements, which may result in the federal oversight agency relying on incorrect data reported in the State’s SEFA.

Further, failure to properly reconcile and report expenditures on the Department’s Exhibit K1, if uncorrected, could cause the State’s SEFA to be inaccurate and the Department to be out of compliance with federal reporting requirements.

Lastly, federal funds that are misapplied or used for unallowable purposes could be subject to repayment from the Department to the federal granting agency.

Recommendation 2023-077

The Colorado Department of Public Health and Environment (CDPHE) should improve its internal controls over Federal Emergency Management Agency (FEMA) Disaster Grants – Public Assistance (Presidentially Declared Disasters) program expenditures that are submitted to the Department of Public Safety (Department) through interdepartmental transactions and requests for reimbursement by:

A. Ensuring that all Disaster Grants program expenditures are properly supported with appropriate documentation and are reviewed to ensure the expenditures are allowable under the FEMA Disaster Grants program and recorded for the correct fiscal year.

B. Expanding the Department’s existing policies and procedures that outline the process CDPHE staff must follow when reporting fiscal year Disaster Grants program expenditures to the Department for the Exhibit K1, Schedule of Federal Assistance, reporting and for recording and reconciling interdepartmental reimbursements. The policies and procedures should also include required points of communication between staff of the Department and CDPHE to ensure that reported amounts are not duplicated.

C. Providing applicable training to CDPHE staff responsible for Disaster Grants program reporting on the policies and procedures developed and implemented in part B of this finding.

Response Department of Public Health and Environment

A. Partially Agree Implementation Date: June 2024

CDPHE consistently saves every invoice related to requested reimbursement, and the CDPS Office of Grants Management/Preparedness reviews and approves them through the EMGrants system. CDPHE has not charged any expenditures to the CDPS through an interdepartmental charge that were not accompanied by an approved request for reimbursement (RFR). We do not charge or draw down any funds from CDPS until explicit approvals are received regarding FEMA eligibility, as reflected in EMGrants. Copies of the relevant EMGrants RFR approvals are included every time CDPHE draws down funds from CDPS. This process will be written into a procedure to ensure consistency.

FEMA program expenditures will continue to be submitted, reviewed, and approved through the RFR process in EMGrants to determine allowability. Steps will be taken when requesting payment from CDPS to ensure the data is accurate. As a process improvement, these will be included in the procedure document, which will include identifying the Project Worksheet number for each transaction to match the FEMA listing and the applicable fiscal year on all documents. Individual transactions will continue to display this information, and additional backup will be included for adjusting entries.

Auditor’s Addendum

At the time CDPHE submits interdepartmental charges to the Department through the year end interdepartmental payable, CDPHE should ensure that all individual transactions are adequately supported through documentation that supports the allowability of eligible costs under the FEMA Disaster Grants Program, this is in addition to approvals within the RFR process in EMGrants. Oftentimes there is a lag between when expenditures are required to be recognized on the Department of Public Safety’s Exhibit K1 and when the RFR process is completed within EMGrants.

B. Agree Implementation Date: June 2024

CDPHE currently has a written procedure in place to complete Exhibit K1. However, this wasn’t completely followed due to turnover in the CDPHE Controller position during the Fiscal Year transition, as that document was not known to the new Controller. For FY23, CDPHE primarily followed the standard Exhibit Instructions from OSC, which included several pages on the K1. The internal procedure has now been identified and will be updated to incorporate any new OSC instructions for subsequent reporting to ensure CDPHE is maintaining compliance with all requirements. Additionally, the procedure will include steps to verify the K1 with CDPS before it’s submission to ensure that the pass through Disaster Grant expenditures are not included with both agency’s K1’s.

As part of the procedure to be developed in response to part A of this finding, Disaster Grants Program staff will complete a full reconciliation of detailed amounts reported as FEMA Disaster Grants Program expenditures for the fiscal year, including accruals for expenses incurred but not yet reimbursed by CDPHE. CDPHE and CDPS will meet on a regular basis to ensure proper communication between the agencies.

C. Agree Implementation Date: June 2024

To follow up on parts a and b of these recommendations, CDPHE accounting will work with the staff responsible for Disaster Grants Program to document the procedure for requesting reimbursement from CDPS. This training will ensure that transactions are recorded to the proper fiscal year and should simplify the year-end reporting process and reduce the likelihood of repeat errors.

In updating the specific K1 documented procedures, CDPHE accounting will make sure that the written K1 procedures have additional instructions to reflect amounts that are passed through from other state agencies. Those accounting staff responsible for generating the Exhibit K1 will be trained to ensure that interdepartmental charges are appropriate and that the department’s Exhibit K1 report is correct when submitted to the OSC.

Finding 2023-078 Disaster Grants – Public Assistance (Presidentially Declared Disasters) Federal Reporting

The Department receives federal grant awards and is required to follow certain financial, performance, and other reporting requirements as specifically identified in the various grant award agreements. The Department allocates funds received from these federal awards to subrecipients and the Department is responsible for the reporting of the payments made to its subrecipients.

Federal Financial Reporting

The Department is required to submit Federal Financial Status Reports (FFR) quarterly to the FEMA Regional Office for each of its Disaster Grants. The FFRs are a way for the Department to show FEMA, as the granting agency, the status of its grant funds and demonstrate that it is meeting the grant’s cost-sharing requirements. The FFRs provide cumulative-to-date information from project inception through the end of each reporting period. Financial information within the FFRs includes information such as federal cash disbursements from grant inception to the date of the report, total federal funds authorized, federal share of expenditures from grant inception to the date of the report, and recipient share of expenditures from grant inception to the date of the report.

During Fiscal Year 2023, the Department had five outstanding FEMA grant awards and was required to submit 20 quarterly FFRs.

Performance Reporting

The Department is required to submit Large Project Quarterly Progress Reports (QPR) to FEMA on a quarterly basis. The QPRs are a tool for FEMA and the Department to track the progress of Large Projects—defined by FEMA as an individual project with approved estimated, eligible costs of $1,000,000 or greater.

The QPRs include information submitted from the Department’s FEMA subrecipients, such as:

• Subrecipient’s total expenditures from grant inception to report date, • Status of the project(s) (e.g., the percent complete), • Whether the work is complete, and • Projected or actual completion date for the project(s).

The Department must review, verify, and submit the subrecipient’s information on the QPR, and the Department must then, on a quarterly basis, submit the following for each open Large Project:

• Total amount disbursed to the subrecipient from grant inception to report date.

• Whether final payment was made to that specific subrecipient and the subrecipient’s project was ready for closeout.

• Whether extensions to overall project closeout timing were submitted by the State and approved by FEMA.

• Applicable project closeout deadline approved by FEMA.

For Fiscal Year 2023, the Department had five outstanding FEMA grant awards with total federal funds obligated of approximately $2.4 billion, as of June 30, 2023, and was required to submit eight QPRs in accordance with FEMA’s Large Project requirements.

Federal Funding Accountability and Transparency Act

The Department is required to comply with the Federal Funding Accountability and Transparency Act of 2006 (Transparency Act or FFATA) for its Disaster Grants. The Transparency Act was created to empower Americans with the ability to hold the government accountable for each spending decision and, as a result, to reduce wasteful spending by the government. The Transparency Act requires the federal government to make certain information on federal awards available to the public, including information about amounts passed through to subrecipients.

The Department is required to report information about subgrants, or subawards, given to other governments or to nonprofit organizations, also referred to as subrecipients. Federal regulation [2 CFR 200.1] defines a subaward as an award provided by a pass-through entity, in this case the Department, to an entity to carry out part of a Federal grant award received by the pass-through entity. A subrecipient is defined in federal regulation [2 CFR 200.1] as “an entity, usually but not limited to non-Federal entities, that receives a subaward from a pass-through entity to carry out part of a federal award; but does not include an individual that is a beneficiary of such award. A subrecipient may also be a recipient of other Federal awards directly from a federal awarding agency.” In Fiscal Year 2023, the Department made 196 obligating actions totaling $71.3 million to 75 subrecipients for its Disaster Grants.

The Department is required to submit FFATA information through the Federal Funding Accountability and Transparency Act Subaward Reporting System (FSRS). Once the Department submits a report to FSRS, the public can view information from the report, including the subrecipient’s name, subaward identification number, subaward obligation/action date, subaward amount, federal awarding agency and subagency, the Department’s name, and the Department’s grant award identification number.

Accordingly, the Department was required to submit 196 FFATA reports for its Disaster Grants, with net obligating actions of approximately $71.3 million for Fiscal Year 2023.

What was the purpose of our audit work and what work was performed?

The purpose of the audit work was to determine whether the Department had adequate internal controls over and complied with reporting requirements for its federal Disaster Grants for Fiscal Year 2023. In addition, the purpose of our audit work was to determine whether the information in these reports was accurate and complete, and submitted in accordance with federal regulations. As part of our audit work, we requested a listing of all ongoing Disaster Grants, the specific reporting requirements identified either in the grant award agreement or required by federal statute, and performed the following:

• We tested a sample of 8 FFRs submitted to the FEMA Regional Office and selected three key line items within those reports identified as (1) Federal Cash Disbursements, (2) Federal Share of Expenditures, and (3) Recipient Share of Expenditures, and compared these line item amounts to underlying support to determine if the federal financial reports were accurate and complete.

• We tested a sample of 4 QPRs submitted to the FEMA Regional Office to determine if the reports were appropriately completed in accordance with federal regulations. In addition, we selected a total of 60 large projects contained on six of the cumulative from grant inception to date QPR reports to determine whether the amounts reported for Federal Cash Disbursements to date for these large projects was accurate and complete.

• From the listing of 196 FFATA obligating actions, we selected a sample of 26 Disaster Grants subawards and requested copies of the FFATA reports that should have been uploaded to the FSRS system by the Department for Fiscal Year 2023 to determine if the Department uploaded the FFATA reports as required and whether the reports contained accurate and complete information.

How were the results of the audit work measured?

We measured the results of our audit work against the following requirements:

• Federal regulation [2 CFR 200.303] requires the Department to establish and maintain effective internal controls over federal awards, providing reasonable assurance that the Department is managing its federal awards in compliance with federal statutes, regulations, and a federal award’s terms and conditions.

• Federal regulation [2 CFR 200.334] requires the Department to keep all financial records and supporting documentation pertinent to a federal award for a minimum period of 3 years from the submission date of the final expenditures report.

• In accordance with federal regulation [2 CFR 170.330.1(a)], the Department is required to report subawards of $30,000 or more to FSRS by the end of the month following the month in which the award was made. For example, the Department would have to submit a FFATA report to FSRS in May 2023 if an award or supplemental award equal to or greater than $30,000 was made in April 2023.

What problems did the audit work identify? Based on the testwork performed, we identified the following:

• The Department did not accurately report the amount for the Recipient Share of Expenditures on any of the 8 (100 percent) FFRs tested. Specifically, Department staff overreported the amount of the cumulative-to-date recipient share of expenditures as of June 30, 2023 within the 8 FFRs by a total of approximately $26.2 million.

• The Department understated the amount reported as Federal Funds Disbursed for 9 of 60 (15 percent) large projects tested on six QPRs by a total of approximately $8.8 million.

• The Department did not report any Disaster Grant subawards in FSRS for Fiscal Year 2023 and, therefore, did not comply with FFATA reporting requirements. Specifically, the Department did not report approximately $55.1 million in subawards for Fiscal Year 2023. The following table summarizes the results of our testing and groups each exception within the following categories: subaward not reported, report not timely, subaward amount incorrect, and subaward missing key elements.

Why did these problems occur?

The Department did not have adequate internal controls over federal reporting requirements in place for its Disaster Grants during Fiscal Year 2023. Specifically:

• The Department did not adequately review the FFRs and did not identify that the preparer populated the line item for cumulative-to-date recipient share of expenditures based on an incorrect formula, rather than reporting actual recipient share of expenditures as supported in program records.

• The Department did not adequately review the QPRs. Additionally, Department staff did not fully investigate the differences they did identify through their review and reconciliation process and inaccurately identified differences as timing issues.

• The Department failed to file FFATA reports for its Disaster Grants because it does not have documented policies and procedures in place to designate responsibilities over FSRS reporting between fiscal staff and program staff. Further, the Department did not adequately assign resources to ensure FFATA reporting requirements were identified and that reports were submitted.

Why do these problems matter?

By failing to properly report its recipient share of expenditures on the FFRs, and the federal disbursements on the QPRs, the Department is out of compliance with federal reporting requirements which may result in the federal oversight agency for the applicable grants relying on incorrect data. Also, by failing to properly report FFATA subawards through FSRS, the Department is out of compliance with federal reporting requirements, risks federal sanctions, and does not meet the federal intent of transparency for federal program spending. Based on information provided by the Department, it had 196 FFATA obligating actions with a net total of approximately $71.3 million that should have been reported to FSRS during Fiscal Year 2023.

Recommendation 2023-078

The Department of Public Safety (Department) should improve its internal controls over, and ensure it complies with, federal reporting requirements for its Disaster Grants – Public Assistance (Presidentially Declared Disasters) program. This should include:

A. Performing an adequate review over its Federal Financial Status Reports and correcting any identified errors prior to submission.

B. Performing an adequate review over its Large Project Quarterly Progress Reports, and adequately investigating differences identified during its reconciliation process to ensure the reports are supported by program records.

C. Developing, documenting, and implementing policies and procedures to ensure that staff, as applicable, are aware of, and comply with, requirements under the Federal Funding Accountability and Transparency Act of 2006 (FFATA) for its Disaster Grants. This should include improving the Department’s process for determining the timing of reporting within the FFATA Subaward Reporting System. This process should also include appropriately allocating staff resources for FFATA reporting responsibilities.

Response Department of Public Safety

A. Agree Implementation Date: June 2024

The Department has corrected the formula error for the cost share value and created controls to identify and prevent similar errors in the future. This error did not affect the accuracy of any other component of the reporting. The Department has also updated its procedures to include a secondary review process for the reporting.

B. Agree Implementation Date: June 2024

The Department will modify its grant procedure to include reconciliation and investigation requirements.

C. Agree Implementation Date: June 2024

The Department agrees and will update policies and procedures accordingly.

Finding 2023-079 Coronavirus State and Local Fiscal Recovery Funds (SLFRF) Procurement, Suspension and Debarment Compliance

Enacted on March 11, 2021, the American Rescue Plan Act of 2021 (ARPA) authorized the Coronavirus State and Local Fiscal Recovery Funds (SLFRF). Through SLFRF, recipient governments are investing funds to address the unique needs of their local communities and create a stronger national economy by using these essential funds to:

• Fight the pandemic and support families and businesses struggling with its public health and economic impacts.

• Maintain vital public services, even amid declines in revenue resulting from the crisis.

• Build a strong, resilient, and equitable recovery by making investments that support long-term growth and opportunity.

The U.S. Department of the Treasury’s Final Rule describes how recipients may use SLFRF funds to:

1. Respond to the public health emergency with respect to COVID-19 or its negative economic impacts, including by providing assistance to households, small businesses, nonprofits, and impacted industries, such as tourism, travel, and hospitality;

2. Respond to workers performing essential work during the COVID-19 public health emergency by providing premium pay to eligible workers of the recipient that perform essential work or by providing grants to eligible employers that have eligible workers who are performing essential work;

3. Provide government services, to the extent of the reduction in revenue of the eligible entities due to the COVID-19 public health emergency relative to revenues collected in the most recent full fiscal year of the eligible entities prior to the emergency; and

4. Make necessary investments in water, sewer, or broadband infrastructure.

During Fiscal Year 2023, the Department reported federal SLFRF expenditures in the amount of approximately $15.3 million. Of the total federal expenditures, $12.0 million were passed through to subrecipients and the remaining $3.3 million were direct Department expenditures subject to federal procurement, suspension, and debarment regulations.

Federal procurement regulations prohibit non-federal entities, including the Department, from contracting with or making subawards under “covered transactions” to parties that are suspended or debarred from doing business with the federal government. Covered transactions include those procurement contracts for goods and services awarded under a grant or cooperative agreement. In order to comply with federal suspension and debarment requirements, the Department can perform a search in the federal System of Award Management (SAM) website, which tracks the entities that the federal government has determined are ineligible to receive federal funding; collect a certification from the entity; or add a clause or condition to the contract.

During Fiscal Year 2023, the Department paid $3.1 million to 37 vendors that were subject to the suspension and debarment criteria identified above.

What was the purpose of our audit work and what work was performed?

The purpose of the audit work was to determine whether the Department had effective internal controls in place over, and complied with, federal suspension and debarment requirements for the SLFRF grant during Fiscal Year 2023. As part of our audit work, we tested a sample of 6 of the Department’s SLFRF-related 37 vendors, who represented a total of $1.4 million of the Department’s SLFRF expenditures during Fiscal Year 2023, to determine whether the Department complied with requirements to ensure the vendors were not suspended or debarred, or otherwise excluded from participating in the contract by the federal government, through verification on the SAM website exclusions listing.

How were the results of the audit work measured?

We measured the results of our audit work against the following requirements:

• Federal regulation [2 CFR 180.220] states that a contract for goods or services is a covered transaction if awarded as a grant or payment for specified use and if the amount of the contract is expected to equal or exceed $25,000. Further, federal regulation [2 CFR 180.300] requires that when a non-federal entity enters into a covered transaction with another entity, the non-federal entity must verify that the person or entity they intend to do business with is not excluded or disqualified from receiving federal funds. This can be done by (1) checking the SAM exclusions, (2) collecting a certification from that entity, or (3) adding a clause or condition to the covered transaction with that entity.

• Federal regulation [2 CFR 200.303] states that the Department, as the recipient of federal funds, must establish and maintain effective internal control over its federal awards that provides reasonable assurance that the Department is managing the federal awards in compliance with federal statutes, regulations, and the award terms and conditions.

• Federal regulation [2 CFR 200.318] states that the Department must document procurement procedures. The Department utilizes Section 24-101 through 112, C.R.S., as its procurement policy. Specifically, the Procurement Code [R-24-109-105-02c] states that “The Director shall maintain a current list of debarred and suspended persons and shall send lists and updates of it to heads of all purchasing agencies.”

What problem did the audit work identify?

We identified an issue with 1 of the 6 vendors tested (17 percent). The Department could not provide documentation to support that they performed suspension and debarment verification procedures for this vendor prior to paying them with federal funds. Specifically, the Department made payments to this vendor in December 2022, and did not perform a SAM check until after we notified them of the issue in November 2023. They confirmed at that time that the vendor was not suspended or debarred from receiving federal monies.

Why did this problem occur?

The Department did not have adequate internal controls in place to ensure they complied with SLFRF suspension and debarment requirements. Specifically, while the Department’s current process is to follow the State’s policy for federally funded projects, they do not have a process in place to ensure compliance with suspension and debarment requirements when funding changes from state to federal funding. Specifically, the Department initially funded the vendor’s contract with State funds, however, the funding source was subsequently changed to SLFRF monies in the 2022-23 Long Appropriations Bill (HB22-1329), effective July 1, 2022. The change in funding source to federal awards required additional procurement procedures that were missed by the Department and not completed until identified during the audit. The Department’s contract manager was not aware of SLFRF suspension and debarment requirements upon the State’s decision to use the federal funds towards capital construction projects.

Why does this problem matter?

It is important for the Department to ensure that it obtains and maintains appropriate documentation to support procurement decisions, especially when they are the basis for determining the Department’s compliance with specific SLFRF program requirements. In addition, the Department’s failure to perform procedures to ensure an entity is not suspended or debarred could result in the Department paying funds to an entity that is disallowed from receiving such funds, thereby exposing the State to increased business risk and potential federal disallowances.

Recommendation 2023-079

The Department of Public Safety (Department) should strengthen its internal controls to ensure it complies with suspension and debarment requirements for the federal Coronavirus State and Local Fiscal Recovery Funds (SLFRF) program by developing a process to verify that a vendor is not suspended or debarred from receiving federal dollars when, for example, the funding source is moved to federal monies from another source. In addition, the Department should ensure staff is trained on the updated process.

Response Department of Public Safety

Agree Implementation Date: January 2024

This oversight occurred because the funding for some capital construction projects was changed to federal funds (State and Local Recovery Funds). Although this process is followed for federal grants at the Department, federal funding for capital projects is not common, so this requirement was inadvertently overlooked. The Department of Public Safety has implemented a department-wide process for suspension and debarment screening as of January 5, 2024 and training sessions were held in January as well.

Finding 2023-080 Compliance with Federal Subrecipient Monitoring Requirements

The Department receives federal grant funds directly from the federal government for the Highway Program and the Formula Grants Program and then subgrants, or passes through, a portion of the funds to cities and counties and other organizations that are considered to be either a subrecipient or a contractor.

A subrecipient is a non-federal entity that expends federal awards received from a pass-through entity to carry out a federal program, but does not include an individual that is a beneficiary receiving direct payments from such a program. A contractor is a dealer, distributor, merchant, or other seller providing goods or services that are required to conduct a federal program; these goods or services may be for an organization’s own use or for the use of beneficiaries of the federal program. The Department executes an Intergovernmental Agreement (IGA) between the Department and the subrecipient.

Under Uniform Administrative Requirements, Cost Principles, and Audit Requirements for Federal Awards (Uniform Guidance), the Department is responsible for evaluating each subrecipient’s risk of noncompliance with federal statutes, regulations, and the terms and conditions of the subaward, and, ultimately, for ensuring the subrecipient is determined eligible. In some instances, in coordination with the Federal Highway Association, a Metropolitan Planning Organization—rather than the primary recipient, such as the Department—is responsible for performing eligibility determinations. In those instances, the Department does not perform risk-assessments on these contracts and only is responsible for ongoing monitoring.

What was the purpose of our audit work and what work was performed?

The purpose of the audit work was to determine whether the Department had effective internal controls in place over and complied with subrecipient monitoring requirements for the Highway Program and Formula Grants Program during Fiscal Year 2023, and to determine whether the Department had implemented our prior audit recommendations for both the Highway Program and the Formula Grants Program. In our Fiscal Year 2022 audit (for Highway Program) and Fiscal Years 2022, 2021, and 2020 (for Formula Grants Program), we recommended for both programs that the Department update its current subrecipient monitoring and risk assessment policy to clarify the risk assessment process and provide training to staff responsible for subrecipient monitoring activities.

As part of our audit work, we reviewed the Department’s internal controls over compliance for subrecipient monitoring requirements for the Highway Program and the Formula Grants Program, including the Department’s policies and procedures. We tested a random sample of 15 of the Department’s 98 subrecipients (15 percent) for the Highway Program and a random sample of 8 of the Department’s 44 subrecipients (18 percent) for the Formula Grants Program—for which the Department had an IGA in place during Fiscal Year 2023—to determine whether subrecipient monitoring procedures performed by Department staff during the year were compliant with federal regulations. Our testing included evaluating whether the Department performed risk assessments and determined the appropriate level of subrecipient monitoring for the entities, as required by federal Uniform Guidance.

How were the results of the audit work measured?

Our audit work was designed to measure the Department’s compliance with the following criteria:

• Federal regulation [2 CFR 200.303] states that the Department, as a federal grant recipient, must “establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award.”

• Federal regulation [2 CFR 200.332 (a)(1)] states that the Department’s subawards must clearly identify certain information, including but not limited to, the subrecipient’s unique entity identifier (UEI).

• Federal regulation [2 CFR 200.332(b)] states that the Department must evaluate each subrecipient’s risk of noncompliance for purposes of determining the appropriate subrecipient monitoring related to the subaward, which may include various factors.

• Federal regulations [2 CFR 200.332(d) through (f) and 2 CFR 200.521] require the Department to monitor the activities of its subrecipients, as necessary, to ensure that each subaward is used for authorized purposes, the subrecipient complies with the terms and conditions of the subaward, and the subrecipient achieves performance goals. The Department’s monitoring must include:

o Reviewing financial and performance reports submitted by the subrecipient.

o Following up on and ensuring the subrecipient takes timely and appropriate action on all deficiencies pertaining to the federal award.

o Issuing a management decision for audit findings pertaining to the federal award provided to the subrecipient from the pass-through entity.

What problems did the audit work identify?

We determined that the Department did not fully comply with subrecipient monitoring requirements for the Highway Program during Fiscal Year 2023 and did not fully implement our prior audit recommendation. Specifically:

• The Department did not perform a risk assessment for 1 of the 15 subrecipients (6.7 percent) we tested.

• The Department did not include the subrecipient’s unique entity identifier (UEI) number on the IGA, nor did they obtain the number from the subrecipient prior to signing of the IGA, for 1 of the 15 subrecipients (6.7 percent) we tested.

We also determined that, while the Fiscal Year 2023 sample testing revealed no exceptions for the Formula Grants Program, the Department did not fully implement our prior audit recommendation for the Formula Grants Program related to subrecipient monitoring by its planned implementation date of July 2022. When we inquired of the Department about what steps it had taken to implement the recommendation, Department staff indicated that they did not make significant progress on implementing the recommendation to provide training and to update the subrecipient monitoring and risk assessment policy during Fiscal Year 2023.

Why did these problems occur?

While the Department has created a subrecipient monitoring and risk assessment manual, which applies to all federal programs administered by the Department, its manual effective for Fiscal Year 2023—then in the process of being updated—lacks clarity in certain areas, including the following:

• For contracts which extend over multiple fiscal years, the policies do not specify the frequency with which subrecipient risk-assessments should be reviewed or updated.

• The current manual does not include guidance related to the requirement of the UEI being included on the IGA.

Further, while the Department was developing training during Fiscal Year 2023, the Department did not provide sufficiently detailed training to staff during the fiscal year to ensure they were aware of and conducted required subrecipient monitoring responsibilities.

Why do these problems matter?

Performing timely and appropriate subrecipient monitoring provides the Department with a method to ensure its subrecipients are complying with applicable federal grant requirements. By taking appropriate actions based on the results of its subrecipient monitoring activities, the Department can mitigate the risk of providing continuing funding to entities that may not be using funds in accordance with program requirements. Overall, the Department’s failure to comply with federal requirements could result in a loss of funding from the federal government.

Recommendation 2023-080

The Department of Transportation should strengthen internal controls over and ensure that it complies with federal subrecipient monitoring requirements for the Highway Planning and Construction program and the Formula Grants for Rural Areas Program and Tribal Transit Program by:

A. Completing the process of updating its current subrecipient monitoring and risk assessment policy to clarify the frequency in which a risk assessment is required to be completed or updated, and updating the policy to address the nature of the requirement to include the unique entity identifier number on the intergovernmental agreement.

B. Providing training to staff responsible for subrecipient monitoring activities related to the policies updated in Part A of the finding.

Response Department of Transportation

A. Agree Implementation Date: November 2023

A cross functional work-group with representatives from accounting, project support, compliance, engineering contract services, and internal audit have updated the subrecipient monitoring and risk assessment manual. This update was completed on November 30th and it includes the following clarifications:

• The frequency in which risk assessments are required to be completed for contracts that span multiple fiscal years on page 45 of the policy

• Exceptions and when it is acceptable to forgo a risk assessments on page 11 of the policy

• Requirements for the inclusion of a Unique Entity Identifier (UEI) on intergovernmental agreements on page 33 of the policy

B. Agree Implementation Date: November 2023

The cross-functional work-group noted in the prior response provided training to staff responsible for the monitoring activities. Training was provided in November 2023 for all the updates related to the recommendation items in part A of the finding.

Finding 2023-081 Minerals Leasing Act—Subrecipient Monitoring

In 1920, the U.S. Congress passed the Minerals Leasing Act. This Act directs the federal Office of Natural Resources Revenue (ONRR) within the U.S. Department of the Interior to share 50 percent of mineral leasing revenue received by the ONRR with states that generate mineral lease revenue. Mineral lease revenue results from payments made to the federal government by companies that lease federal land for the right to extract minerals from that land. According to the Act, revenue is to be used by states as each individual state’s legislature directs, giving priority to those sections of the state that are socially or economically impacted by the extraction of minerals.

For Colorado, ONRR distributes Minerals Leasing Act Program (Program) funds to Treasury, which passes through Program funds to the Department of Local Affairs (DOLA), the Department of Natural Resources (DNR), the Department of Higher Education (DHE), and the Department of Education (DOE), as prescribed by Section 34-63-102, C.R.S. In turn, DOLA passes the majority of the Program funds it receives to local governments impacted by mineral leasing, such as cities and counties. These local governments may use Program funds for “…planning; construction and maintenance of public facilities; and provision of public services.”

During Fiscal Year 2023, ONRR distributed approximately $173.0 million in Program revenue to Treasury. Treasury passed all of the Program funds to DOLA, DNR, DHE, and DOE. DOLA then passed approximately $68.9 million of the $72.3 million in Program funds it received to local government subrecipients. DOLA retained the remaining $3.4 million in Program funds to cover administrative costs. DNR, DOE, and DHE spent the Program funds at the state level and did not pass any of the funds through to subrecipients.

What was the purpose of our audit work and what work was performed?

The purpose of the audit work was to determine whether Treasury had adequate internal controls in place over, and complied with, federal subrecipient monitoring and reporting requirements for the Program during Fiscal Year 2023.

As part of our testing, we reviewed Treasury’s progress in implementing our Fiscal Year 2022 audit recommendation related to subrecipient monitoring and reporting requirements for the Program. During that audit, we found that Treasury did not communicate, or ensure that DOLA communicated, the required award information and applicable federal compliance requirements to all Program subrecipients in accordance with federal regulations. As a result of our testwork, we recommended that Treasury strengthen its internal controls to ensure that it complies with federal requirements for subrecipient monitoring for the Program by developing an effective monitoring process to ensure that required federal award information is communicated to Program subrecipients, including the Assistance Listing Number, program name, and dollar amount made available to subrecipients, and the related federal requirements.

As part of our testing, we conducted interviews with Treasury staff regarding its process over the monitoring of Program funds during Fiscal Year 2023.

How were the results of the audit work measured?

We measured the results of our audit work against the following requirements:

Federal regulations [2 CFR 200.303] require that Treasury, as a federal grant recipient, establish and maintain effective internal controls over federal awards that provide reasonable assurance that awards are being managed in compliance with federal statutes, regulation, and the terms and conditions of the federal award.

The Minerals Leasing Act of 1920, as amended in 1976, states that Program funds should be provided to those subdivisions socially or economically impacted by the development of minerals leased for planning, construction, and maintenance of public facilities.

Federal regulations [2 CFR 200.331] require a pass-through entity to make case-by-case determinations regarding whether each agreement it makes for the disbursement of federal program funds casts the party receiving the funds in the role of a subrecipient or a contractor. A subrecipient is a non-federal entity that expends federal awards received from a pass-through entity to carry out a federal program, but does not include an individual that is a beneficiary receiving direct payments from such a program. A contractor is a dealer, distributor, merchant, or other seller providing goods or services that are required to conduct a federal program; these goods or services may be for an organization’s own use or for the use of beneficiaries of the federal program. The following paragraphs detail requirements for subrecipients.

Federal regulations [2 CFR 200.332 (a)(1)(2) and (3)] require that Treasury, as the primary recipient of Program funds, ensure that every pass-through of federal funds it makes clearly identify all requirements that Treasury imposed on the subrecipient so that the federal award is used in accordance with federal statutes, regulations, and the terms and conditions of the award, as well as specify any additional requirements that Treasury imposes on the subrecipient in order for Treasury to meet its own responsibility for the federal award (e.g., financial, performance, and special reports). In addition, regulations require that Treasury, ensure that every subaward it makes is clearly identified to the subrecipient as a subaward, and that Treasury, or DOLA, provides specific information about the Program to the subrecipients, including, but not limited to, the following:

• Assistance Listing Number

• Name of the program, name of the federal awarding agency, and name of the department awarding the Program funds

• Contact information for Treasury

• Dollar amount made available to the subrecipient

• Reporting requirements

Federal regulation [2 CFR 200.332(b)] requires that Treasury, as the primary recipient of Program funds, ensure DOLA staff conducts risk assessments for each subrecipient’s risk of noncompliance with federal statutes, regulations, and the terms and conditions of the subaward. In addition, the Treasury should ensure that DOLA staff use the risk assessments to determine the appropriate level of subrecipient monitoring that DOLA staff should perform on each subrecipient. Specifically, federal regulations [2 CFR 200.332(d)-(e)] require that Treasury, as the primary recipient of Program funds, ensure that DOLA staff monitor the subrecipient activities as necessary to ensure that the subaward is used for authorized purposes, complies with the terms and conditions of the subaward, and achieves performance goals. Monitoring must include:

• Reviewing financial performance reports.

• Following up and ensuring the subrecipient takes timely and appropriate action on all deficiencies pertaining to the federal award.

• Issuing a management decision for audit findings pertaining to the federal award provided to the subrecipient from the pass-through entity, as required by 2 CFR 200.521.

The State and any local governments receiving federal funds are required to present a Schedule of Expenditures of Federal Awards (SEFA) in accordance with the requirements of Title 2 U.S. Code of Federal Regulations Part 200, Uniform Administrative Requirements, Cost Principles, and Audit Requirements for Federal Awards (Uniform Guidance). Federal regulations [2 CFR 200.501(b)] specifically require that the SEFA include information on each federal award expended during the year, including the total amount provided to subrecipients from each federal award. Any non-federal entity that expends $750,000 or more in total federal awards during the entity’s fiscal year must undergo a Single Audit or program-specific audit for that year. Federal regulation [2 CFR 200.332(f)] require that Treasury, as the primary recipient of the Program funds, ensure or communicate to DOLA that any non-state subrecipients receiving federal funds from the State during a given fiscal year report the funds on their respective SEFA and, if applicable, undergo a Single Audit.

The Exhibit K1, Schedule of Federal Assistance, is used by the State’s departments and institutions of higher education to report federal expenditure information to the Office of the State Controller (OSC) to aid the OSC in preparing the State’s SEFA. The instructions state that the OSC relies on the accuracy of amounts and other information reported on the various Exhibits in preparing the SEFA each year.

What problems did the audit work identify?

We found that Treasury did not implement our prior audit recommendation related to federal subrecipient monitoring for the Program during Fiscal Year 2023. Specifically, we identified the following:

• Treasury reported that DOLA did not perform a subrecipient versus contractor determination to ensure proper compliance with the subaward requirement and reporting of information to Treasury for its federal reporting.

• Treasury did not communicate, or ensure that DOLA communicated, the required award information and applicable federal compliance requirements to all Program subrecipients in accordance with federal regulations. In response to our prior audit recommendation, Treasury staff reported that they continue working with DOLA to ensure that required information is communicated to all subrecipients in compliance with state and federal regulations. In addition, Treasury reported that they are working with the Attorney General’s Office toward the implementation of an interagency agreement that will establish expectations for DOLA. However, as of the end of the fiscal year, this interagency agreement was not signed or in place.

• Treasury did not ensure that DOLA performed risk assessments for each subrecipient’s risk of noncompliance with federal statutes, regulations, and the terms and conditions of the subaward. In addition, Treasury did not ensure that DOLA used the risk assessments to determine the appropriate level of subrecipient monitoring on each subrecipient.

• Treasury did not have a process in place to ensure that DOLA monitors the activities of the subrecipient as necessary to ensure that the subaward is used for authorized purposes, complies with the terms and conditions of the subaward, and achieves performance goals.

• Further, Treasury, as the primary recipient of Program funds, did not ensure that it or DOLA communicated and followed up with any non-state subrecipients receiving federal funds from the State during Fiscal Year 2023 to ensure the subrecipients reported the funds on their respective SEFAs and, if applicable, underwent a Single Audit.

Why did these problems occur?

Overall, Treasury did not have adequate internal controls in place during Fiscal Year 2023 to ensure that it complied with federal subrecipient monitoring requirements for the Program. Specifically, Treasury staff indicated that DOLA determined during Fiscal Year 2023 that it does not have any Program subrecipients, but Treasury did not obtain and review any subrecipient versus contractor determinations from DOLA to verify the appropriateness of the determinations. Alternatively, Treasury did not perform its own assessment of subrecipient versus contractor status for the Program payments or obtain clarification from the Attorney General, as necessary, regarding the determination. Treasury also did not have a monitoring process in place to ensure that either Treasury or DOLA staff communicated required federal award information and related federal reporting requirements to all subrecipients of Program funds—including a communication that any subrecipients receiving Program funds from the State during Fiscal Year 2023 were required to report the funds on their respective SEFAs and, if applicable, undergo a Single Audit. In addition, Treasury did not ensure that DOLA performed risk assessments for each subrecipient’s risk of noncompliance with federal statutes, regulations, and the terms and conditions of the subaward. Neither Treasury or DOLA monitored the activities of the subrecipients, as necessary, to ensure that the subawards are used for authorized purposes, comply with the terms and conditions of the subawards, and achieve performance goals.

Why do these problems matter?

The subrecipient versus contractor determinations help Treasury or DOLA to assess specific federal requirements that have to be followed, and ensure the proper reporting on Treasury’s Exhibit K1. Because the OSC uses the Exhibit K1 to prepare the State’s SEFA, errors on the Exhibit K1 can lead to the SEFA being misstated and the Department reporting erroneous information to the federal government. This is particularly important given the large amount of federal funds that Treasury pays annually to its subrecipients. By continuing to fail to fulfill the Program’s subrecipient monitoring requirements, Treasury, and the State as a whole, are out of compliance with the provisions of Program awards. Ultimately, insufficient monitoring of Program subrecipients could result in future federal funding being reduced. If Treasury does not appropriately communicate SEFA reporting requirements to other state agencies and non-state subrecipients in the future, it could result in local governments not undergoing Single Audits, as required. Further, without evaluating its subrecipients’ risks of noncompliance and using the results of that assessment to target monitoring of higher-risk entities, Treasury does not have assurance that it appropriately monitors its subrecipients and identifies issues.

Recommendation 2023-081

The Department of Treasury (Treasury) should strengthen its internal controls related to, and ensure it complies with, federal requirements for subrecipient monitoring and reporting for the Minerals Leasing Act Program (Program) by:

A. Requiring other State agencies, including the Department of Local Affairs, to whom Treasury subgrants Program funds, to perform subrecipient versus contractor determinations to identify Program subrecipients and to perform appropriate subrecipient monitoring procedures. As needed, this should include obtaining clarification from the Attorney General as to whether parties to whom Treasury or its subgrantor state agencies send Program funds are subrecipients or vendors.

B. Ensuring that it reports Program funds properly on its Exhibit K1, Schedule of Federal Assistance, including that expenditures are accurately presented as direct or pass-through subrecipient expenditures.

C. Developing effective processes to ensure that required federal award information, including the Assistance Listing Number, federal program name, and dollar amount, are made available to the subrecipient, the related federal requirements are communicated to Program subrecipients, and the subrecipients report the funds on their respective annual Schedule of Expenditures of Federal Awards and, if applicable, undergo a Single Audit. This should include communicating all requirements imposed by the grantor agency on the subrecipient so Program funds are used in accordance with federal statutes, regulations, and the terms and conditions of the subaward, and that Treasury meets its own responsibility for the federal award.

D. Developing an effective monitoring process to ensure risk assessments of subrecipients and monitoring of subrecipients are performed.

Response Department of the Treasury

A. Agree Implementation Date: December 2026

Treasury has been working with the Department of Local Affairs (DOLA) on a pilot program for monitoring and compliance of fund recipients and was in the process of instituting an Interagency Agreement with DOLA on this matter. Treasury will pursue further guidance from the Attorney General's office on federal rules interpretation regarding subrecipients. Treasury plans to continue to work with DOLA to aid in determining what financial resources and FTE may be necessary to ensure monitoring and compliance is successful.

B. Agree Implementation Date: December 2026

The Department will seek guidance from the Attorney General's Office regarding federal rules interpretation to ensure distributions are properly identified. DOLA distributes the funds once received from Treasury, and therefore Treasury will work with DOLA as well to ensure there is agreement on subrecipient identification.

C. and D. Agree Implementation Date: December 2026

As discussed in the Department response to Item A above, Treasury has been in the process of creating an Interagency Agreement with DOLA regarding compliance and monitoring of fund recipients. The Department will rely on guidance on this matter from the Attorney General, which is already in process. Additionally, the Department hopes to work in partnership with DOLA to determine what financial resources are necessary - and to be supportive of such a request - to implement a monitoring and compliance system, as the Attorney General's office may recommend.