Internal control weaknesses

Reconciliations of actual costs to vendor payments not performed timely

Fiscal year 2008 beginning balances restated by $78,911,000

Department agrees with auditors

No assurance to prevent errors or irregularities

No third party independent internal control review obtained for 3 of 6 third party service providers

22% of health insurance expenses processed by third party service providers have no internal control review

Department disagrees with auditors

Auditor’s comment

Reports not obtained until after auditors requested them

Incomplete and inaccurate census data provided to actuary

Annual required contribution miscalculated by $33,000,000

Department agrees with auditors

No controls to ensure required contributions were paid

Department accepts responsibility for Fund’s financial statements

Department disagrees with auditors

Auditor’s comment

Interagency agreement to reimburse University of Illinois Hospital

2006 total per diem rate was used during all of 2007

Additional $6,586,337 paid to Hospital due to incorrect per diem rates being used

2007 per diem rates used during 2008

Rates adjusted to facilitate an additional $3 million per a decision by the Office of Management and Budget

Department agrees with auditors

Health care premium rate-setting methodology not adequate

Teacher Retirement System benefit recipients and dependent beneficiaries overcharged a total of $155,529

Community College benefit recipients undercharged a total of $7,946

Department agrees with auditors

Auditor’s comment

FINDINGS, CONCLUSIONS, AND RECOMMENDATIONS

FINANCIAL STATEMENT PREPARATION

The Department did not have adequate controls in place to ensure timely financial information was available for the preparation of the Department’s financial statements.

During the preparation of the Department’s fiscal year 2008 financial statements, the Department identified an adjustment that should have been made to the fiscal year 2006 and 2007 financial statements.

The Department did not perform timely reconciliations of actual costs incurred to vendor payments for the Medicare Part D wrap around benefit program. Reconciliations for 2006 and 2007 were not performed until 2008.

After performing the annual reconciliation for fiscal year 2006 and 2007, the Department determined that they overpaid the vendors for monthly Per Member Per Month premiums totaling $78,911,000 during fiscal year 2006 and 2007. As a result, the Department restated the fiscal year 2008 beginning fund balance of the General Fund with an increase of $30,824,000 and the Other Nonmajor Governmental Funds with an increase of $48,087,000. This restatement also increased the Governmental Activities fiscal year 2008 beginning net asset balance by $78,911,000.

These overpayments should have been reflected in the Department’s financial statements in fiscal year 2006 and 2007 as a receivable and a reduction of expenditures. Since these overpayments were not recognized in the correct accounting period, the Department restated fiscal year 2008 beginning balances. (Finding 1, pages 13-14)

We recommended the Department implement additional internal control procedures to ensure timely financial information is presented during the preparation of the Department’s financial statements.

Department officials concurred with our recommendation and stated that procedures have been developed to more accurately estimate the drug liability reported in the financial statements.

THIRD PARTY INTERNAL CONTROL REVIEWS NOT OBTAINED

The Department did not obtain an independent internal control review (SAS 70 Report) of its third parties involved with the processing of health insurance claims for the Local Government Health Plan, Teachers Retirement Insurance Program, College Insurance Program and State Employees Group Insurance Program. Without a review, the Department did not have assurance that information system controls to prevent errors or irregularities were established.

When a user organization like the Department of Healthcare and Family Services uses service organizations, transactions that affect the Department’s financial statements are subjected to controls that are, at least in part, separate from the Department’s. Consequently, it is good business practice to obtain a report from the service organization’s auditors concerning controls placed in operation and in some cases results of tests concerning operational effectiveness. These types of reports are commonly referred to as SAS 70 Reports.

The Department contracts with six different third party health insurance service providers to process health insurance claims. Each of the health insurance service provider uses their own computer system to process these health insurance claims. During our review of third party health insurance service providers, we noted that the Department did not obtain an independent internal control review for three of the service providers during fiscal year 2008.

Of the health insurance payments made to the six third party health insurance service providers totaling $1,359,026,488 in fiscal year 2008, $297,793,899 (22%) of the health insurance payments were processed under a third party health insurance service provider from which the Department did not obtain an independent internal control review.

The Department stated that they negotiate long term contracts with the parties involved in processing insurance claims for the health care plans. Typical healthcare contracts have five year initial periods and up to five one-year renewal periods. The three contracts cited were initially negotiated with a five-year contract in 2001, for fiscal year 2002 implementation, without a “SAS 70” requirement. The three contracts are currently in one-year renewal periods without a “SAS 70” requirement. The Department previously submitted the relevant portions of the Sarbanes Oxley audit pertaining to internal controls as they relate to the audited financial statements for one of the three contracts. In addition, a 2008 Annual Report with SEC form 10-K and a Financial Statement audit were previously submitted for the remaining two contracts. The Annual Report with SEC form 10-K identified above includes the “Report of Independent Registered Public Accounting Firm.” The vendor of the original contract was acquired October 1, 2007. Prior to this the vendor was a privately held corporation. (Finding 2, pages 15-17)

We recommended the Department require that each third-party health insurance service provider engage independent auditors to perform an annual independent internal control review on the controls placed in operation and the tests of their operating effectiveness.

Department officials disagreed with our finding and recommendation and stated that the majority of these contracts were originally executed prior to industry acceptance of “SAS 70.” The Department also stated that seventy-five percent of the expenditures were processed by vendors who had obtained an independent internal control review. Of the remaining twenty-five percent, over one third of the total was processed by a vendor with an annual report with 10-K filing and independent auditor report.

Department officials continued to state that the Fiscal Year 2010 contracts and renewals for the three vendors not submitting “SAS 70” audits have already been negotiated and several have been signed by the vendors. In order to implement this requirement for those, the Department would have to renegotiate their contracts. Renegotiating those contracts at this date would jeopardize contracts beginning July 1, 2009. Negotiating an additional audit into these renewals would also increase the cost of the contract. The Department will include a “SAS 70” requirement to all future contracts bid with third parties involved with the processing of health insurance claims.

In an auditor’s comment, we noted that we requested all third party internal control reviews from the Department and, for the three contracts noted above, the Department indicated that they relied on “equivalent” reviews for two of the contracts and they did not have a third party internal control review or equivalent review for the other contract.

With regard to one of the contracts that had an equivalent review, the Department provided the auditors with the vendor’s financial statements. The auditors reviewed these financial statements and determined that the financial statements were statutory financial statements that were prepared using accounting practices prescribed or permitted by the Illinois Department of Financial and Professional Regulations. The financial statements did not give an opinion in regard to internal controls.

For the other contract, the Department did provide the auditors with what they called a “Sox Report” (Sarbanes Oxley Report). The documentation that the Department provided was an excel spreadsheet that documented computer controls. This spreadsheet was not accompanied by any type of cover letter or auditor’s report. After the auditors questioned the “Sox Report,” the Department contacted the vendor and the Department was informed that the “Sox Report” is actually part of the vendor’s “SAS 70” Report.

For the third contract, the Department indicated that they provided the auditors with a 2008 Annual Report with SEC Form 10-K. The Department did not have this Annual Report until the auditors asked for the “SAS 70” Reports. The Department could not provide any “equivalent” reviews prior to the 2008 Annual Report.

The Department cannot state to the auditors that they are relying on these "equivalent" reports if they do not obtain them until requested by the auditors. There are clearly no internal controls to obtain and review these reports.

INCOMPLETE AND INACCURATE CENSUS DATA

The Department did not have adequate controls over data provided to the actuary for financial statement valuations.

For the fiscal year 2008 reporting period, the Department implemented Governmental Accounting Standards Board (GASB) Statement Number 45 – Accounting and Financial Reporting by Employers for Postemployment Benefit Plans Other than Pension Plans (GASB Statement 45). Under GASB Statement 45, all plans of state and local government entities that provide other post employment benefits (OPEB) are required to report the cost of these benefits on their financial statements. GASB Statement 45 also requires an actuarial valuation be performed in accordance with the parameters established in the Statement.

The Department provided incomplete and inaccurate census data to the actuary for the State Employees Group Insurance Program necessary to compute the OPEB liability for the year ended June 30, 2008. Updated information was provided to the actuary and revised calculations were made causing the annual required contribution for June 30, 2008 to increase $33,000,000 from $1,743,000,000 to $1,776,000,000. This condition also caused delays in the Department’s financial reporting process. In addition, the actuarial accrued liability as of July 1, 2007 decreased $320,000,000 from $24,210,000,000 to $23,890,000,000. (Finding 3, pages 18-19)

We recommended the Department establish a consistent methodology for accumulating complete data used in preparing financial statements. We further recommended that the Department ensure the methodology facilitates the timely preparation of financial statements.

Department officials agreed with our recommendation and stated that fiscal year 2008 was the first year of implementation of GASB 45 and required working conjunctively with three retirement systems and the actuary. The core data used by the Department was extracted from the State’s Group Membership database, which maintains all participants in the group insurance program. The valuation calculation for the future OPEB liability includes current active members in the group insurance program. Toll Highway employees do not participate in the State’s group insurance program until they are retired and were therefore not included in the initial data submission. This omission resulted in a less than 2% adjustment to the State’s reported annual required contribution. Procedures have been developed to ensure these employees are included in future submissions of actuarial data.

NO CONTROLS OVER COMMUNITY COLLEGE HEALTH INSURANCE SECURITY FUND CONTRIBUTIONS

The State of Illinois did not have sufficient controls to ensure all contributions required by the State Employees Group Insurance Act of 1971 were paid into the Community College Health Insurance Security Fund (Fund).

Revenues deposited into the Fund are for the sole purpose of providing health benefits to Community College retirees and their dependents and associated administrative costs. The Fund is administered jointly by the Department of Central Management Services (DCMS) and the Department of Healthcare and Family Services (HFS). According to the State Employees Group Insurance Act of 1971, the State Universities Retirement Systems (SURS) is required to collect the contributions from community colleges as a service agent to DCMS and promptly deposit such collections into the Fund. HFS has accepted responsibility for preparing the Fund’s financial statements.

During our testing, we determined no State agency is ensuring that the amounts collected from active community college employees and the matching contributions from community colleges are the amounts required to be contributed per the State Employees Group Insurance Act of 1971. (Finding 4, pages 20-22)

We recommended the Department of Healthcare and Family Services ensure adequate controls are designed, implemented and operating effectively to ensure contributions required by the State Employees Group Insurance Act of 1971 are collected and properly accounted for in the Community College Health Insurance Security Fund.

Department officials disagreed with the recommendation and stated that the Department reports on activity associated with the Community College Health Insurance Security Fund, to include deposits of receipts made by the Department of Central Management Services (CMS) and the State University Retirement System (SURS). As part of the Department’s reporting responsibility, Management Representation Letters were obtained from CMS and SURS so that assurances were provided for reporting purposes. The Comptroller’s Office delegated the reporting responsibility to the Department in lieu of reflecting this fund as shared. These letters were also provided to the Auditor General’s Office (OAG).

The Department continued to state that the Department also performed due diligence once the OAG brought this concern to its attention by sampling eight community college payrolls and calculating the .5% required contribution amount. The results of this standard audit confirmation test found that all eight colleges were in compliance with 5 ILCS 375/6.10 and noted no further concerns with the amounts being reported in the Department’s financial statements.

The responsibilities associated with the Group Insurance program that were transferred from CMS to the Department in accordance with Executive Order 2005-3 did not include the depositing of receipts and 5 ILCS 375/6.10 specifically requires SURS to act as a service agent for depositing all community college active employee contributions. The purpose of this split was to transfer “vendor facing” responsibilities to the Department while CMS would retain “member facing” responsibilities. Information on active contributors of SURS and community college boards would be defined as member facing information and would not fall under the purview of the Department’s administrative function. As such, the Department has neither the authority, nor the access to information needed to validate contributions and receipts. HFS has no oversight authority for contributions associated with the Group Insurance program to ensure compliance with State statute, as recommended by the OAG. If the requirement for verifying fund activity lies with the entity responsible for the financial reporting, then the Department will work with the Comptroller’s Office in establishing this fund as “shared,” whereas each agency will be responsible for reporting on their respective activity.

In an auditor’s comment, we noted that no State Agency has implemented controls to ensure revenues are collected in accordance with State statute for this State administered insurance program. Consequently, the auditors were unable to test whether revenues were fairly stated for the Fund. Once the auditors brought this issue to the attention of the Department, the Department performed the minimum amount of work in order for the auditors to report on the financial statements for the Fund. The Department’s response to the audit concern did not eliminate the issue reported in the finding. The auditor’s recommendation is directed to the Department, since the Department has assumed the responsibility for preparing financial statements for the Fund.

INSUFFICIENT CONTROLS OVER THE UNIVERSITY OF ILLINOIS HOSPITAL SERVICES FUND

The Department did not have adequate controls for hospital rates that are reimbursed to the University of Illinois Hospital for services provided to individuals.

The Department and the Board of Trustees of the University of Illinois entered into an Interagency Agreement to require the Department to reimburse the University of Illinois and Clinics (Hospital) for services provided by the Hospital.

During our testing of University of Illinois Hospital Services Fund transactions, we noted the following deficiencies:

· The Department did not timely recalculate the total per diem rate or the Hospital inpatient payment rate for rate year 2007 (October 1, 2006 through September 30, 2007). During the entire 2007 rate year, the Department utilized the rates for rate year 2006. The 2007 rates should have been updated by October 1, 2006, but were not updated until November 1, 2007. As a result of not using the correct rates for rate year 2007, the Department had to provide additional payments totaling $6,586,337 to the Hospital to make up the difference between the 2006 and 2007 rates during fiscal year 2008. Subsequently, the Hospital did not make an intergovernmental transfer of approximately $1,400,000, relating to the difference between what was originally transferred and what should have been transferred to the Department.

· The Department did not recalculate the total per diem rate or the Hospital inpatient payment rate for rate year 2008 (October 1, 2007 through September 30, 2008). The Department also did not revise the certified payment amount for the 2008 rate year expenditure amount that was certified on November 14, 2007 by the Hospital. During the 2008 rate year, the Department utilized the rates for rate year 2007. The 2008 rates should have been updated by October 1, 2007. However, beginning December 1, 2007 the Department did adjust the inpatient per diem rate and the Hospital inpatient payment rate. For the inpatient per diem rate, the Department incorrectly added $280 to the inpatient per diem rate, but this amount was actually part of the disproportionate share adjustment and should not have been added to the inpatient per diem rate. For the Hospital inpatient payment rate, the Department increased the rate by $108 which in return decreased the intergovernmental transfer installment rate. Department management stated that the rates were adjusted in order to facilitate an additional $3,000,000 to the University of Illinois, which was a cash management decision, coordinated with the Office of Management and Budget, to have the Department provide more of the non-federal share of the Medicaid payments, rather than the University of Illinois Hospital. (Finding 6, pages 25-27)

We recommended the Department implement additional internal control procedures to ensure total per diem rates and Hospital inpatient payment rates are incremented annually as required by the Interagency Agreement and the Illinois Administrative Code. Further, we recommended the Department adjust the certified expenditure rate to coincide with the yearly certification provided by the Hospital.

Department officials agreed with our recommendation and stated that the final 2008 rates will be calculated and adjustments will be processed as necessary. The Department is in discussion with the Board of Trustees of the University of Illinois to implement recently approved Medicaid State Plan amendments that change the reimbursement methodology for the University of Illinois hospital. It is important to note that the transfers are not paid by the hospital, but rather the Board of Trustees of the University of Illinois who is providing a portion of the funding for the non-federal share of the Medicaid payments.

INCORRECT HEALTH INSURANCE PREMIUM RATES CHARGED

The Department did not charge the correct health insurance premium rates for the Teacher’s Retirement Insurance Program and College Insurance Program.

The Department set the fiscal year 2008 health insurance premium rates for Teachers Retirement System benefit recipient and dependent beneficiaries by increasing the prior year rate by 5%. The Department did not take into account the percentage that was to be paid by the Teacher Health Insurance Security Fund. As a result, we noted that the Department did not have an adequate rate-setting methodology used to determine the amount of the health care premiums to be charged. In addition, the Department did not present the rate-setting methodology (included but not limited to utilization levels and costs) used to determine health care premiums to the Teachers’ Retirement System by April 15^thas required.

We also noted the following 2008 premium rates of Teacher Retirement Insurance Program and College Insurance Program health insurance were not in compliance with parameters established in State statute.

· The monthly health insurance premium rate charged for a Teachers Retirement System dependent beneficiary who is Medicare primary was $240.09; however, the health insurance premium rate should have only been $229.63. The beneficiaries were overcharged a total of $152,643 during fiscal year 2008.

· The monthly health insurance premium rate charged for a Teachers Retirement System benefit recipient for ages twenty three and under selecting the major medical coverage program was $139.54; however, the health insurance premium rate should have only been $117.17. The benefit recipients were overcharged a total of $2,617 during fiscal year 2008.

· The monthly health insurance premium rate charged to a Teachers Retirement System benefit recipient for ages twenty three and under selecting the medical coverage program was $69.77; however, the health insurance premium rate should have only been $58.58. The benefit recipients were overcharged a total of $269 during fiscal year 2008.

· The monthly health insurance premium rate charged for a Community College benefit recipient for ages twenty three and under selecting a managed care program was $73.01; however, the health insurance premium rate should have been at least $181.84. The benefit recipients were undercharged a total of $7,946 during fiscal year 2008. (Finding 7, pages 28-30)

We recommended the Department ensures health insurance premium rates are set for the Teacher’s Health Insurance Program and the College Insurance Program as required by the State Employees Group Insurance Act of 1971. We also recommended the Department ensures adequate rate setting methodologies are established and make annual required reports to the Teachers Retirement System.

Department officials agreed to the finding and recommendation and stated that the Department has submitted draft legislative language to address the issue and clarify that the determination of premiums shall be limited solely to an increase of no more than 5% of the prior year.

In an auditor’s comment, we noted that: 1) the Department’s corrective action plan noted in its response is overly simple and an unreasonable resolution to the issues addressed in the finding; and 2) a rate setting methodology should be developed annually and include but not be limited to utilization levels and costs as currently required by the State Employees Group Insurance Act of 1971.

OTHER FINDINGS

The remaining findings are reportedly being given attention by the Department. We will review the Department’s progress toward implementation of our recommendations in our next audit.

AUDITORS’ OPINION

Based on their audit of the Department's financial statements for the year ended June 30, 2008, the auditors expressed unqualified opinions on the Department’s financial statements of the governmental activities, the business-type activities, each major fund, and the aggregate remaining fund information.

STATE COMPLIANCE EXAMINATION –

ACCOUNTANTS’ REPORT

The auditors qualified their report on State Compliance for findings 08-1, 08-5 and 08-8. Except for the noncompliance described in these findings, the auditors state the Department complied, in all material respects, with the requirements described in the report.

___________________________________

WILLIAM G. HOLLAND, Auditor General

WGH:TLD:pp

AUDITORS ASSIGNED

This audit was performed by the Office of the Auditor General's staff.

SYNOPSIS

INSUFFICIENT CONTROLS OVER THE UNIVERSITY OF ILLINOIS HOSPITAL SERVICES FUND

INCORRECT HEALTH INSURANCE PREMIUM RATES CHARGED

AUDITORS’ OPINION