REPORT DIGEST DEPARTMENT ON AGING COMPLIANCE EXAMINATION FOR THE TWO YEARS ENDED JUNE 30, 2022 Release Date: May 23, 2023 FINDINGS THIS AUDIT: 27 CATEGORY: NEW -- REPEAT -- TOTAL Category 1: 7 -- 11 -- 18 Category 2: 2 -- 7 -- 9 Category 3: 0 -- 0 -- 0 TOTAL: 9 -- 18 -- 27 FINDINGS LAST AUDIT: 21 Category 1: Findings that are material weaknesses in internal control and/or a qualification on compliance with State laws and regulations (material noncompliance). Category 2: Findings that are significant deficiencies in internal control and noncompliance with State laws and regulations. Category 3: Findings that have no internal control issues but are in noncompliance with State laws and regulations. State of Illinois, Office of the Auditor General FRANK J. MAUTINO, AUDITOR GENERAL To obtain a copy of the Report contact: Office of the Auditor General, Iles Park Plaza, 740 E. Ash Street, Springfield, IL 62703 (217) 782-6046 or TTY (888) 261-2887 This Report Digest and Full Report are also available on the worldwide web at www.auditor.illinois.gov INTRODUCTION Because of the significance and pervasiveness of the findings described within the report, we expressed an adverse opinion on the Department’s compliance with the assertions which comprise a State compliance examination. The Codification of Statements on Standards for Attestation Engagements (AT-C § 205.74) states a practitioner “should express an adverse opinion when the practitioner, having obtained sufficient appropriate evidence, concludes that misstatements, individually or in the aggregate, are both material and pervasive to the subject matter.” SYNOPSIS • (22-01) The Department did not comply with the responsibilities assigned to it pursuant to an Intergovernmental Agreement (IA) with the Department of Healthcare and Family Services (HFS) regarding the administration of the Home and Community Based Services Waiver for Persons who are Elderly (Waiver) under section 1915(c) of the Social Security Act. • (22-05) The Department lacked adequate internal controls and monitoring over eligibility determinations and payments made to service provider agencies (providers) that applied for and received a special hourly rate under the Community Care Program. • (22-07) The Department lacked adequate internal controls over users’ access to its applications and data. FINDINGS, CONCLUSIONS, AND RECOMMENDATIONS FAILURE TO COMPLY WITH IA RESPONSIBILITIES REGARDING THE ADMINISTRATION OF THE HOME AND COMMUNITY BASED SERVICES WAIVERS FOR PERSONS WHO ARE ELDERLY The Department on Aging (Department) did not comply with the responsibilities assigned to it pursuant to an Intergovernmental Agreement (IA) with the Department of Healthcare and Family Services (HFS) regarding the administration of the Home and Community Based Services Waiver for Persons who are Elderly (Waiver) under section 1915(c) of the Social Security Act. The Department and HFS entered into an IA in order to delineate respective roles, responsibilities, resources and financial obligations associated with the administration of services for persons applying to or are currently enrolled in Waiver services provided through the Department’s Community Care Program (CCP). We reviewed the terms of the IA and performed testing over the Department’s assigned responsibilities contained within the IA. The results of our testing noted the Department was not in compliance with responsibilities assigned. Specifically, some of the more important issues we noted were as follows: • Article 2.03b requires the Department to submit to HFS quarterly estimates of claims to be submitted in the next quarter, the current fiscal year, and the next fiscal year. We requested the estimates the Department was required to submit quarterly and determined none were submitted. • Article 2.03d requires the Department to certify that expenditures submitted to HFS have been paid prior to submittal, are not in excess of the Department’s actual cost of the services provided, are in accordance with the principles established in Code of Federal Regulations (2 C.F.R § 200) and the State of Illinois’ State Plan under Title XIX of the Social Security Act (State Plan), and the amounts used as the State’s share of expenses are not federal funds and were not used to match other federal funds. We requested evidence of the Department having provided certifications of expenditures to HFS. The Department provided evidence of having provided certifications of the administrative expenditures incurred, but provided no evidence of having certified the expenditures for direct services provided. • Article 2.03f requires the Department to assure that all participants in the Waiver meet eligibility requirements for the Waiver. We requested evidence of the Department providing such assurances and were informed the Department does not determine eligibility for Waiver services so such assurance cannot be provided. The Department enrolls participants in the State’s CCP and requires financially eligible participants to apply for Medicaid. CCP participants who are Medicaid eligible are Waiver participants. • Article 2.03w requires, subject to the responsibilities of a Managed Care Organization (MCO) for participants enrolled in an MCO, the Department to be responsible through its contracted Care Coordinators (CCs) and/or Care Coordination Units (CCUs) for the performance of the Determination of Eligibility for MCO participants. For Medicaid enrolled CCP participants, the CCs and/or CCUs are responsible for completion of the Comprehensive Care Coordination assessment tool and creation and implementation of a Person-Centered Service Plan (Plan). Further, the Plan is required to be updated annually. We tested a sample of 60 Medicaid enrolled CCP participants who were not MCO participants. We noted: – Four (7%) participants did not have a determination of eligibility or annual Plan of care completed during Fiscal Years 2021 or 2022. – Eight (13%) participants did not have a determination of eligibility or annual Plan of care completed either during Fiscal Year 2021 or 2022. • Article 2.03j requires the Department to correct deficiencies discovered in the course of HFS’ monitoring of the Waiver, including providing technical assistance to Waiver service providers to bring Waiver services into compliance through corrective action, providing ongoing and periodic monitoring of the status of corrective actions to ensure compliance, and submitting corrective action status reports to HFS. We requested the Department provide us with the population of Waiver deficiencies identified by HFS during the examination period. The Department was unable to provide us with the requested population. Due to these conditions, we were unable to conclude the Department’s population records were sufficiently precise and detailed under the Professional Standards promulgated by the American Institute of Certified Public Accountants (AT-C § 205.36). We did not select a sample or perform tests on the records provided. (Finding 1, pages 11-15). We recommended the Department fully comply with the terms of the executed IA. The Department partially concurred with the finding and stated the Department and HFS have established a regular cadence of quarterly meetings and will continue to ensure representatives and/or their authorized designees attend all meetings. In addition, the Department stated it met with HFS on March 22, 2023, to initiate discussions on revising provisions of the IA to reflect current practices while ensuring robust internal controls. INADEATE CONTROLS AND MONITORING OVER ENHANCED RATE PAYMENTS MADE TO COMMUNITY CARE PROGRAM SERVICES PROVIDERS The Department lacked adequate internal controls and monitoring over eligibility determinations and payments made to service provider agencies (providers) that applied for and received a special hourly rate under the Community Care Program. The Illinois Act on Aging (20 ILCS 105/4.02) requires the Department to pay an enhanced rate under the Community Care Program to those in- home providers that offer health insurance coverage as a benefit to their direct service worker employees consistent with the mandates of Public Act 095-0713. For Fiscal Years 2021 and 2022, the enhanced rate was $1.77 per hour. For the two fiscal years under examination, the Department paid all providers a total of $80,500,486 for the enhanced rate payments. During fieldwork, we tested 5 of 14 (36%) providers who were paid an enhanced rate and noted the following: • Three of 5 (60%) providers tested did not, within 6 months after the end of the reporting period, submit a verification from an independent certified public accounting firm of the actual, documented expense for health insurance during Fiscal Year 2021. • Five of 5 (100%) providers tested did not, within 6 months after the end of the reporting period, submit a verification from an independent certified public accounting firm of the actual, documented expense for health insurance during Fiscal Year 2022. • One of 5 (20%) providers tested did not submit a Direct Service Worker Health Insurance Certification (DSWHIC) during Fiscal Year 2021. • Three of 5 (60%) providers tested did not submit a Direct Service Worker Health Insurance Certification (DSWHIC) during Fiscal Year 2022. (Finding 5, pages 27-28). This finding has been reported since 2010. We recommended the Department strengthen controls to ensure that initial and ongoing reviews of eligibility and annual reporting for the enhanced reimbursement rate are conducted and documented in a timely manner, and in accordance with the Illinois Administrative Code. We also recommended the Department obtain reimbursement from providers if determined to be ineligible. The Department concurred with this finding and stated it is currently working with its Human Resource area to hire staff that will strengthen controls, develop proper procedures and trainings for current and new staff to create a cohesive area so that initial and ongoing reviews of eligibility and annual reporting for the enhanced reimbursement rate are conducted and documented in a timely manner, and in accordance with the Illinois Administrative Code. INADEQUATE CONTROLS OF ACCESS TO APPLICATIONS AND DATA The Department lacked adequate internal controls over users’ access to its applications and data. We requested the Department to provide the populations of users to the Facility Case Review, Adult Protective Services Billing, and Critical Event Reporting systems to determine if the users’ access was appropriate. In response to our request the Department provided the populations; however, they did not provide documentation demonstrating the user population for Facility Case Review system was complete and accurate. Due to these conditions, we were unable to conclude the Department’s population records were sufficiently precise and detailed under the Professional Standards promulgated by the American Institute of Certified Public Accountants (AT-C § 205.36) Even given the population limitation noted above, we performed testing of users’ access rights, noting: • Two of 2 (100%) Facility Case Review system users’ access were not appropriate. • Four of 9 (44%) Adult Protective Services Billing system users’ access were not appropriate. • Two of 8 (25%) Critical Event Reporting system users’ access were not appropriate. Further, we noted the Department could not provide the following: • Evidence of security software accounts had been reviewed. • Evidence of periodic user access reviews for the following applications managed by the Department of Innovation and Technology (DoIT): – Central Time and Attendance – E-Time – Central Payroll System – ERP (Finding 7, pages 31-32) We recommended the Department strengthen its controls to ensure complete and accurate user populations, along with supporting documentation, is retained. In addition, we recommended the Department conduct and document periodic reviews of users of its systems to ensure access is appropriate. The Department partially concurred with the finding and stated prior to the transformation to DoIT in April 2022, the Department utilized DoIT’s methodology. The Department further stated it will strengthen internal controls to ensure complete and accurate user populations, along with supporting documentation, and retain documentation of periodic reviews. OTHER FINDINGS The remaining findings pertain to fiscal and administrative responsibilities, statutory mandates, and information technology controls. We will review the Department’s progress towards the implementation of our recommendations in our next State compliance examination. ACCOUNTANT’S OPINION The accountants conducted a State compliance examination of the Department for the two years ended June 30, 2022, as required by the Illinois State Auditing Act. Because of the effect of the noncompliance described in Findings 2022-001 through Finding 2022-027, the accountants stated the Department did not materially comply with the requirements described in the report. This State compliance examination was conducted by Borschnack, Pelletier and Co. JANE CLARK Division Director This report is transmitted in accordance with Section 3-14 of the Illinois State Auditing Act. FRANK J. MAUTINO Auditor General FJM:jv