REPORT DIGEST STATE OF ILLINOIS STATEWIDE SINGLE AUDIT REPORT SINGLE AUDIT FOR THE YEAR ENDED JUNE 30, 2020 Release Date: September 9, 2021 FINDINGS THIS AUDIT: 29 CATEGORY: NEW -- REPEAT -- TOTAL Category 1: 4 -- 14 -- 18 Category 2: 6 -- 5 -- 11 Category 3: 0 -- 0 -- 0 TOTAL: 10 -- 19 -- 29 FINDINGS LAST AUDIT: 69 Category 1: Findings that are material weaknesses in internal control and/or a qualification on compliance with State laws and regulations (material noncompliance). Category 2: Findings that are significant deficiencies in internal control and noncompliance with State laws and regulations. Category 3: Findings that have no internal control issues but are in noncompliance with State laws and regulations. State of Illinois, Office of the Auditor General FRANK J. MAUTINO, AUDITOR GENERAL To obtain a copy of the Report contact: Office of the Auditor General, Iles Park Plaza, 740 E. Ash Street, Springfield, IL 62703 (217) 782-6046 or TTY (888) 261-2887 This Report Digest and Full Report are also available on the worldwide web at www.auditor.illinois.gov SYNOPSIS • The State expended approximately $38.4 billion from federal awards in FY20. • A total of 28 programs or program clusters were classified and audited as major programs at 16 State agencies. These programs constituted approximately 89.5% of all federal spending, or about $34.3 billion. In addition, 52 State agencies expended federal financial assistance in FY20. Twelve State agencies accounted for about 99.1% of federal dollars spent. Significant Agency Findings Classified as Material Noncompliance Resulting in an Auditor Qualification The Department of Healthcare and Family Services: • Did not perform eligibility redeterminations for individuals receiving benefits under the Children’s Health Insurance Program (CHIP) in accordance with timeframes required by the State Plan. • Does not have adequate procedures to determine eligibility for beneficiaries of the Children’s Health Insurance Program (CHIP) and Medicaid Cluster programs. The Department of Human Services: • Could not locate case file documentation supporting eligibility determinations and special test requirements for beneficiaries of the Temporary Assistance for Needy Families (TANF) program. • Did not perform eligibility decisions for individuals receiving benefits under the Temporary Assistance for Needy Families (TANF) Cluster, SNAP Cluster (SNAP), and Medicaid Cluster programs in accordance with timeframes required by the respective State Plans. • Was unable to provide adequate documentation to substantiate the maintenance of effort (MOE) requirements were met for the Block Grants for Prevention and Treatment of Substance Abuse (SAPT) program for award year 2018 that closed during State fiscal year 2020. • Did not adequately review single audit reports received from its subrecipients for the Temporary Assistance for Needy Families (TANF) Cluster, CCDF Cluster (Child Care or CCC), Social Services Block Grant (Title XX or SSBG), and Block Grants for Prevention and Treatment of Substance Abuse (SAPT). • Did not follow its established program monitoring policies and procedures for subrecipients of the Temporary Assistance for Needy Families (TANF) Cluster, CCDF Cluster (Child Care), Social Services Block Grant (Title XX), and Block Grants for Prevention and Treatment of Substance Abuse (SAPT) programs. The Illinois Criminal Justice Information Authority: • Created a risk assessment policy but did not execute the risk assessment of subrecipients of the Crime Victim Assistance (CVA) program as required by the Uniform Guidance during fiscal year 2020. Additionally, the Authority did not perform programmatic and fiscal on-site visits in accordance with its established monitoring procedures, did not adequately review single audit reports, and did not include identifying information with disbursements made to subrecipients. The Illinois Department of Employment Security: • Does not have adequate controls in place over determining fringe benefits to be charged to the Employment Service Cluster program. • Does not have adequate procedures to determine and document eligibility for veteran beneficiaries of the Employment Service Cluster program. • Did not perform required wage verifications for Pandemic Unemployment Assistance (PUA) program claimants in accordance with program requirements during the year ended June 30, 2020. Additionally, the Department did not have controls to ensure wage verification requirements were performed. • Did not implement Federal requirements to improve program integrity and reduce overpayments. The Illinois State Board of Education: • Did not perform adequate monitoring procedures over subrecipients of the Special Education Cluster (IDEA) (Special Education) program. INTRODUCTION The Illinois Office of the Auditor General conducted a Statewide Single Audit of the FY20 federal grant programs. The audit was conducted in accordance with the Uniform Guidance (Title 2 U.S. Code of Federal Regulation Part 200, Uniform Administration Requirements, Cost Principles, and Audit Requirements for Federal Awards). The Statewide Single Audit includes State agencies that are a part of the primary government and expend federal awards. In total, 52 State agencies expended federal financial assistance in FY20. A separate supplemental report has been compiled by the Governor’s Office of Management and Budget and provides summary information on federal spending by State agency. The Statewide Single Audit does not include those agencies that are defined as component units such as the State universities and finance authorities. The component units continue to have separate single audits when required. The Schedule of Expenditures of Federal Awards (SEFA) reflects total expenditures of approximately $38.4 billion for the year ended June 30, 2020. Overall, the State participated in 312 different federal programs; however, 10 of these programs or program clusters accounted for approximately 90.7% of the total federal award expenditures. (See Exhibit I in the pdf version of this digest.) The funding for the 312 programs was provided by 23 different federal agencies. Exhibit II shows that five federal agencies provided Illinois with the vast majority of federal funding in FY20. (See Exhibit II in the pdf version of this digest.) A total of 28 federal programs or program clusters were identified as major programs in FY20. A major program was defined in accordance with the Uniform Guidance as any program with federal awards expended that meets certain criteria when applying the risk-based approach. Exhibit III provides a brief summary of the number of programs classified as “major” and “non-major” and related federal award expenditures. Exhibit III Classification of Federal Programs “Major vs. Non-Major” and Related Federal Award Expenditures for the year ended June 30, 2020 Audit Coverage – No. – Expenditures in Millions -- % Major Programs or Clusters – 28 -- $34,334.1 – 89.5% Non-Major Programs or Clusters – 284 -- $4,035.1 – 10.5% Total – 312 -- $38,369.2 – 100% Twelve State agencies accounted for approximately 99.1% of all federal dollars spent during FY20 as depicted in Exhibit IV. (See Exhibit IV in the pdf version of this digest.) AUDITORS’ REPORT ON COMPLIANCE WITH REQUIREMENTS THAT COULD HAVE A DIRECT AND MATERIAL EFFECT ON EACH MAJOR PROGRAM AND INTERNAL CONTROL OVER COMPLIANCE The auditors’ report contained qualifications on compliance as summarized below. The complete text of the Auditors’ Report may be found on pages 16-19 of the audit. Qualifications The auditors qualified their report on major programs for the following noncompliance findings: (See chart in the pdf version of this digest.) Internal Control Over Compliance We noted certain matters involving internal control over compliance that were considered to be significant deficiencies. A control deficiency in an entity’s internal control over compliance exists when the design or operation of a control over compliance does not allow management or employees, in the normal course of performing their assigned functions, to prevent, or detect and correct, noncompliance with a type of compliance requirement of a federal program on a timely basis. A significant deficiency in internal control over compliance is a deficiency, or combination of deficiencies, in internal control over compliance with a type of compliance requirement of a federal program that is less severe than a material weakness in internal control over compliance, yet important enough to merit attention by those charged with governance. Overall, 11 of the 29 findings reported in the single audit were classified as compliance significant deficiencies. Material weaknesses were also disclosed in our report. A material weakness in internal control over compliance is a deficiency, or combination of deficiencies, in internal control over compliance, such that there is a reasonable possibility that material noncompliance with a type of compliance requirement of a federal program will not be prevented, or detected and corrected, on a timely basis. Overall, 18 of the 29 findings reported in the single audit were classified as material weaknesses. FINDINGS, CONCLUSIONS, AND RECOMMENDATIONS Exhibit V summarizes the number of report findings by State agency, identifies the number of repeat findings, and references the findings to specific pages in the report. Exhibit VI summarizes the total number of findings, number of repeated findings and the percentage of repeated findings for the past ten years. (See chart in the pdf version of this digest.) (See chart in the pdf version of this digest.) FAILURE TO PERFORM ELIGIBILITY REDETERMINATIONS WITHIN PRESCRIBED TIMEFRAMES DHFS did not perform eligibility redeterminations for individuals receiving benefits under the Children’s Health Insurance Program (CHIP) in accordance with timeframes required by the State Plan. The State Plan for CHIP requires the State to perform eligibility redeterminations on an annual basis. During our testing of 80 case files (with payments sampled of $127,732), evidence was not provided to substantiate redeterminations were performed within required time frames for five CHIP cases (with payments sampled of $6,548). Delays in performing redeterminations ranged from 30 to 362 days greater than one year. Total medical payments made on behalf of these five beneficiaries during the year ended June 30, 2020, were $34,778 for the CHIP Program. Payments made to beneficiaries of the CHIP program totaled approximately $461,117,000 during the year ended June 30, 2020. Failure to properly perform eligibility redetermination procedures in accordance with the State Plans may result in federal funds being awarded to ineligible beneficiaries, which are unallowable costs. (Finding 7, pages 38-39) As a result of DHFS failing to perform eligibility redeterminations within prescribed timeframes, the auditors qualified their opinion on the CHIP program. We recommended DHFS review its current process for performing eligibility redeterminations and consider changes necessary to ensure all eligibility decisions are performed within the timeframes prescribed within the State Plan. More specifically, we recommended DHFS determine how to address what should occur when a returned redetermination is not completed by the time another would normally be sent. DHFS accepted the recommendation. INADEQUATE PROCEDURES TO DETERMINE BENEFICIARY ELIGIBILITY DHFS does not have adequate procedures to determine eligibility for beneficiaries of the Children’s Health Insurance Program (CHIP) and Medicaid Cluster programs. DHFS permits certain beneficiaries of the CHIP and Medicaid Cluster programs to begin receiving medical services based upon a presumption of eligibility. The individuals for which CHIP and Medicaid CHIP presumptive eligibility is permitted are usually children and pregnant women. The initial CHIP and Medicaid CHIP presumptive eligibility period generally begins on the date of the decision and ends the last day of the following month but can also be extended 90 days starting with the date of application for ongoing benefits. DHFS identified a system defect in September 2019 in which the eligibility status of certain CHIP and Medicaid CHIP presumptive eligibility cases was not being updated at the end of the initial presumptive eligibility period. Beginning in February 2020, DHFS created a monthly process to identify and close presumptive eligibility cases that did not properly close at the end of the presumptive eligibility period. During our testing of medical payments made on behalf of CHIP and Medicaid CHIP beneficiaries, we noted three of 40 CHIP case files (with medical payments sampled of $227) and two of 40 Medicaid CHIP case files (with medical payments sampled of $3,746) for which the initial presumptive eligibility period was not discontinued on the last day of the month following the initial application. All five cases were prior to February 2020. Total medical payments made on behalf of the three CHIP beneficiaries and two Medicaid CHIP beneficiaries during the year ended June 30, 2020 were $991 for the CHIP program and $5,072 for the Medicaid Cluster program, respectively. Total CHIP beneficiary payments and Medicaid Cluster beneficiary payments for the year ended June 30, 2020, were approximately $461,117,000 and $13,669,891,000, respectively. DHFS was able to quantify that 6,079 cases prior to February 2020 were not closed at the end of the CHIP and Medicaid CHIP presumptive eligibility period which resulted in $561,459 in unallowable medical payments made on behalf of these beneficiaries being claimed during the year ended June 30, 2020. Failure to identify and close presumptive eligibility cases at the end of the presumptive eligibility period may result in federal funds being awarded to ineligible beneficiaries, which are unallowable costs. (Finding 8, pages 40-41) As a result of DHFS failing to identify and close presumptive eligibility cases at the end of the presumptive eligibility period, the auditors qualified their opinion on the CHIP and Medicaid Cluster programs. As described in the condition above, DHFS corrected the situation noted by implementing a monthly process to identify and close presumptive eligibility cases. We recommended DHFS continue this monthly process to identify and close presumptive eligibility cases. DHFS officials accepted the recommendation and stated they are working to rectify the system defect regarding the communication of presumptive eligibility denials between the two systems so the monthly process can be discontinued. MISSING DOCUMENTATION IN BENEFICIARY FILES IDHS could not locate case file documentation supporting eligibility determinations and special test requirements for beneficiaries of the Temporary Assistance for Needy Families (TANF) program. Details of the beneficiary payments selected in our samples for the TANF program are as follows: Case Type -- Number of Cases Tested -- Total Amount of Payments for Cases Tested -- Total Amount of Payments Made on Behalf of Beneficiaries for Fiscal Year 2020 TANF Cluster – 50 -- $23,644 -- $43,659,000 During our test work, we selected eligibility files to review for compliance with eligibility requirements of the related benefits provided. We noted in 4 of 50 TANF cases (with payments sampled of $2,241), IDHS could not locate the Responsibility Service Plan (RSP) completed and signed by the beneficiary covering the payment date. TANF cash assistance paid to these beneficiaries during the year ended June 30, 2020 totaled $21,134. Further, we noted that the control to ensure the RSPs are collected (i.e. completeness) in accordance with policy is not effectively designed. During our test work, we also selected Child Support Non-Cooperation (Non- Cooperation) and Penalty for Refusal to Work (Refusal to Work) files to review for compliance with the respective special tests and provisions. We noted the following exceptions: • In 8 of 40 TANF Non-Cooperation special test cases, IDHS could not provide evidence that the beneficiary was sanctioned after the beneficiary’s failure to cooperate. TANF cash assistance paid to these beneficiaries during the year ended June 30, 2020 totaled $45,451. In addition, in 1 of 40 TANF Non-Cooperation special test cases, IDHS did not take timely action on the case. • In 1 of 40 TANF Penalty for Refusal to Work special test cases, IDHS could not provide evidence of the RSP or subsequent evidence of sanction. TANF Cluster cash assistance paid to this beneficiary during the year ended June 30, 2020 totaled $4,454. In addition, we noted controls for ensuring completeness of the data needed to access Non-Cooperation and Refusal to Work are not effectively designed. Also, the application of a sanction or documentation of why the sanction is not applicable is not consistently applied. Failure to maintain RSPs may result in inadequate documentation of a recipient’s eligibility and in federal funds being awarded to ineligible beneficiaries. Inability to demonstrate if a sanction has been appropriately applied also may result in federal funds being awarded to an ineligible beneficiary. (Finding 10, pages 44-46) This finding was first reported in the Statewide Single Audit in 2001. As a result of IDHS not maintaining RSPs and inability to demonstrate if a sanction has been appropriately applied, the auditors qualified their opinion on the TANF program. We recommended IDHS review its current process for collecting and maintaining RSPs and documentation to support the appropriate application of sanctions. IDHS accepted the recommendation and noted the current process for creating and maintaining RSPs and creating and documenting sanctions will be reviewed and revised to ensure that process steps are addressing all needed areas for accurate documentation. FAILURE TO PERFORM ELIGIBILITY DECISIONS WITHIN PRESCRIBED TIMEFRAMES IDHS did not perform eligibility decisions for individuals receiving benefits under the Temporary Assistance for Needy Families (TANF) Cluster, SNAP Cluster (SNAP), and Medicaid cluster programs in accordance with timeframes required by the respective State Plans. Each of the State Plans for the TANF Cluster, SNAP, and Medicaid Cluster programs require the State to perform eligibility redeterminations on an annual basis. For Medicaid, the determination may not exceed 90 days for disability basis and 45 days for all other reasons. During our test work over eligibility, we noted the State was late (overdue) in performing initial and redetermination eligibility decisions for individuals receiving benefits under the TANF Cluster, SNAP, and Medicaid cluster programs. Evidence was not provided to document redeterminations were performed within required time frames for 4 TANF/SNAP cluster cases and 6 Medicaid Cluster cases (with payments sampled of $2,193 and $3,006 respectively). Additionally, there were 2 Medicaid cases not meeting the initial determination time frames (with payments sampled of $4,011). Details of the beneficiary payments selected in our samples for the TANF/ SNAP Cluster and Medicaid Cluster programs are as follows. The Medicaid Cluster amounts include both IDHS and DHFS as beneficiary eligibility is primarily the responsibility of IDHS while the beneficiary expenses are recorded in both agencies depending on the type of claim. Major Program -- Number of Cases Sampled -- Total Amount of Payments for Cases Sampled -- Total Beneficiary Payments in Fiscal Year 2020 TANF/SNAP Cluster – 50 -- $26,408 -- $3,283,004,000 Medicaid Cluster – 100 -- $201,498 -- $10,844,109,000 IDHS does not have adequate resources to perform and document initial eligibility or redeterminations within the required timeframes. Failure to properly perform eligibility decisions in accordance with the State Plans may result in federal funds being awarded to ineligible beneficiaries, which are unallowable costs. (Finding 11, pages 47-49) This finding was first reported in the Statewide Single Audit in 2003. As a result of IDHS failing to properly perform eligibility decisions, the auditors qualified their opinion on the SNAP Cluster, TANF Cluster, and Medicaid Cluster. We recommended IDHS review its current process for performing eligibility decisions and consider changes necessary to ensure all initial and redetermination decisions are performed within the timeframes prescribed within the State Plans for each affected program. IDHS accepted the recommendation and noted to ensure case processing within required timeframes, statewide processing management will be utilized to review and assign outstanding requests coming due to certification. IDHS noted they have worked to improve their processing timeliness by adding two statewide processing centers and increasing caseworker headcount and are in the process of adding a third statewide processing center. FAILURE TO PROVIDE ADEQUATE DOCUMENTATION FOR THE SAPT MOE REQUIREMENT IDHS was unable to provide adequate documentation to substantiate the maintenance of effort (MOE) requirements were met for the Block Grants for Prevention and Treatment of Substance Abuse (SAPT) program for award year 2018 that closed during State fiscal year 2020. As a condition of receiving federal funding under the SAPT program, USDHHS requires the State to maintain the level of State and locally funded expenditures for substance abuse prevention and treatment activities at an amount that is at least equal to the average level of these same amounts for the prior two years. During the current fiscal year, we noted IDHS was required to maintain aggregate State expenditures for State fiscal year June 30, 2018 (SFY18) of $86,140,868. IDHS reported actual aggregate State expenditures for State fiscal year June 30, 2018 of $112,550,165. However, included in the total MOE reported expenditures were $38,792,743 of managed care organization (MCO) billings in SFY18. The MCO billings represented MCO encounter data amounts, and IDHS could not provide evidence or reconcile MCO encounter data to actual State paid expenditures. Accordingly, these expenditures are not allowable for purposes of meeting the maintenance of effort requirement. IDHS appears to be approximately $12.4 million short of the required $86 million MOE requirement. Failure to maintain required State expenditure levels for MOE and maintain adequate supporting documentation to support expenditures used to meet the MOE requirement results in noncompliance with program requirements. (Finding 12, pages 50-51) This finding was first reported in the Statewide Single Audit in 2014. As a result of IDHS’s failure to maintain required State expenditure levels for MOE and maintain adequate supporting documentation to support expenditures to meet the MOE requirement, the auditors qualified their opinion on the SAPT program. We recommended IDHS review its process for identifying allowable expenditures to achieve the SAPT MOE, including receiving input from the Substance Abuse and Mental Health Services Administration (SAMHSA) regarding the applicability of MCO encounter data expenditures. IDHS accepted our recommendation and indicated they have developed a protocol which has been approved by SAMHSA and the Center for Substance Abuse Treatment (CSAT), pending resolution of some clarifying matters. INADEQUATE REVIEW OF SINGLE AUDIT REPORTS IDHS did not adequately review single audit reports received from its subrecipients for the Temporary Assistance for Needy Families (TANF) Cluster, CCDF Cluster (Child Care or CCC), Social Services Block Grant (Title XX or SSBG), and Block Grants for Prevention and Treatment of Substance Abuse (SAPT) programs. The State of Illinois established the Grant Accountability Transparency Unit (GATU) to implement the provisions of the State’s Grant Accountability and Transparency Act (GATA) on a centralized basis. GATU has established standardized reporting requirements for subrecipients of the various Federal programs administered by the State through its various departments. Subrecipients of the State are required to certify whether they expended more than $750,000 in federal awards during the fiscal year and submitted their single audit reporting packages to the Federal Audit Clearinghouse (FAC), if required. IDHS staff are responsible for ensuring single audit reports are received from subrecipients and reviewing the reports to determine the need for issuing management decision letters (MDL) within required time frames and receiving corrective action plans (CAP). During our review of a sample of 156 subrecipient single audit desk review files, we noted IDHS did not notify 5 subrecipients of the results of single audit desk reviews or issue management decisions on reported findings within 6 months of acceptance of the single audit report by the FAC as required. Also, the required CAP was not collected within the required time frame. Desk Review Period -- Number of Subrecipients -- Type of Funding 180-210 days after FAC acceptance – 1 -- CCC 210-240 days after FAC acceptance -- 1 -- SSBG 240+ days after FAC acceptance -- 3 -- CCC, SSBG, SAPT We also noted the single audit desk reviews for June 30, 2019 are still in process and have not been finalized as of the date of our test work (March 1, 2021) for 3 subrecipients with CCC, SAPT, TANF, and SSBG. Further, we noted 2 CCC subrecipients with fiscal year-ends December 31, 2018 and later who did not submit their reporting package within 9 months of their fiscal year end in accordance with GATU policies. No documentation was available to demonstrate follow-up, waivers being granted, or sanctions imposed on these subrecipients by IDHS. IDHS’ subrecipient expenditures under the federal programs for the year ended June 30, 2020 were approximately as follows: Program -- Total Fiscal Year 2020 Subrecipient Expenditures -- Total Fiscal Year 2020 Program Expenditures -- % TANF Cluster -- $16,396,000 -- $501,507,000 -- 3.3% CCDF Cluster -- $120,311,000 -- $432,781,000 -- 27.8% Title XX -- $42,998,000 -- $61,421,000 -- 70.0% SAPT -- $58,112,000 -- $62,404,000 -- 93.12% Failure to obtain and review subrecipient single audit reports in a timely manner could result in federal funds being expended for unallowable purposes and subrecipients not properly administering the federal programs in accordance with laws, regulations, and the grant agreement. (Finding 14, pages 54-56) This finding was first reported in the Statewide Single Audit in 2011. As a result of IDHS’s failure to obtain and review subrecipient single audit reports in a timely manner, the auditors qualified their opinion on the TANF Cluster, CCDF Cluster, Title XX program, and SAPT program. We recommended IDHS establish controls to ensure single audit reports are received timely and to ensure desk reviews are completed and documented in a timely manner to evidence whether MDLs should be issued by IDHS within six months. In addition, we recommended IDHS establish controls to ensure any required CAP is also received. IDHS agreed with our recommendation and indicated they will continue to work to establish controls to ensure single audit reports are received and processed timely, CAPs are received, and desk reviews are completed and documented timely within the Audit Report Review Management System (ARRMS) in order to ensure MDLs are issued within the required timeframe. FAILURE TO FOLLOW ESTABLISHED PROGRAM SUBRECIPIENT MONITORING PROCEDURES AND TO NOTIFY SUBRECIPIENTS OF FEDERAL FUNDING IDHS did not follow its established program monitoring policies and procedures for subrecipients of the Temporary Assistance for Needy Families (TANF) Cluster, CCDF Cluster (Child Care), Social Services Block Grant (Title XX), and Block Grants for Prevention and Treatment of Substance Abuse (SAPT) programs. IDHS has implemented procedures whereby program staff perform periodic program on-site and desk reviews of IDHS subrecipient compliance with regulations applicable to the federal programs administered by IDHS. Generally, these reviews are formally documented and include the issuance of a report of the review results of the subrecipient summarizing the procedures performed, results of the procedures, and any findings or observations for improvement noted. IDHS’s policies require the subrecipient to respond to each finding by providing a written corrective action plan. Additionally, IDHS program staff perform reviews of expenditure reports submitted by subrecipients. IDHS subrecipient monitoring procedures are subject to the review and approval of a supervisor. During our test work over program on- site review procedures performed for 141 subrecipients of the TANF Cluster, CCDF Cluster, Title XX, and SAPT programs, we noted IDHS did not follow its established program monitoring procedures as follows: • During our test work performed, we noted that IDHS did not perform on- site monitoring reviews of subrecipients in fiscal year 2020 in accordance with IDHS’ planned monitoring schedule and/or could not provide support for the review. Specifically, we noted the following exceptions: Federal Program -- Number of Reviews Not Performed -- Number of Subrecipients Tested TANF Cluster – 1 -- 14 CCDF Cluster – 5 -- 43 Title XX -- 1 -- 42 SAPT – 18 -- 42 • IDHS did not provide timely notification (within 60 days) of the results of the programmatic on-site reviews. We noted the following exceptions: Federal Program -- Number of Late Communications -- Number of Subrecipients Tested -- Number of Days Late (Range) TANF Cluster – 1 – 14 -- 3 Title XX -- 3 -- 42 -- 9 – 46 SAPT -- 9 -- 42 -- 3 – 273 • IDHS did not receive corrective action plans (CAPs) on a timely basis (within 60 days) after communicating programmatic review findings or follow up with subrecipients on delinquent CAPs. We noted the following exceptions: Federal Program -- Number of Late CAPs -- Number of Subrecipients Tested -- Number of Days Late CCDF Cluster -- 2 -- 43 -- 62 – 77 Title XX – 1 – 42 -- 69 SAPT -- 9 -- 42 -- 5 – 199 For the Title XX program, IDHS personnel were unable to provide support for one of 27 expenditure reports reviewed for payment for $36,092. Additionally, for three Title XX subrecipients and 31 CCDF Cluster subrecipients sampled, IDHS did not communicate the required assistance listing number (CFDA number) to the subrecipients at the time of disbursement. IDHS’s subrecipient expenditures under the federal programs for the year ended June 30, 2020, were approximately as follows: Program -- Total Fiscal Year 2020 Subrecipient Expenditures -- Total Fiscal Year 2020 Program Expenditures -- % TANF Cluster -- $16,396,000 -- $501,507,000 -- 3.3% CCDF Cluster 120,311,000 -- 432,781,000 -- 27.8% Title XX -- 42,998,000 -- 61,421,000 -- 70.0% SAPT -- 58,112,000 -- 62,404,000 -- 93.12% Failure to adequately perform and document program on-site monitoring reviews of subrecipients and notify subrecipients of findings in a timely manner may result in subrecipients not properly administering the Federal programs in accordance with laws, regulations, and the grant agreement. Failure to communicate CFDA numbers at time of disbursement can hamper the subrecipients’ ability to correctly prepare their schedule of federal awards. (Finding 15, pages 57-60) This finding was first reported in the Statewide Single Audit in 2011. As a result of IDHS’s failure to adequately perform and document program on-site monitoring reviews of subrecipients and notify subrecipients of findings in a timely manner, the auditors qualified their opinion on the TANF Cluster, CCDF Cluster, SSBG program, and SAPT program. We recommended IDHS ensure programmatic on-site and expenditure report reviews are performed and documented for subrecipients in accordance with established policies and procedures. In addition, we recommended IDHS review its process for reporting and following up on program findings relative to subrecipient on-site reviews to ensure timely corrective action is taken. Further, we recommended IDHS add to their warrant description the CFDA number for each disbursement made to subrecipients. IDHS accepted the recommendation and noted they continue to work to ensure that monitoring reviews of grantees are performed timely and appropriately documented and will continue to review procedures to ensure IDHS is following the required guidelines for reviews. In addition, IDHS will review the requirement for ensuring the CFDA number is communicated to the subrecipients when payments are issued. FAILURE TO EXECUTE RISK ASSESSMENT AND ADEQUATELY MONITOR SUBRECIPIENTS The Illinois Criminal Justice Information Authority (ICJIA) created a risk assessment policy but did not execute the risk assessment of subrecipients of the Crime Victim Assistance (CVA) program as required by the Uniform Guidance during fiscal year 2020. Additionally, ICJIA did not perform programmatic and fiscal on-site visits in accordance with its established monitoring procedures, did not adequately review single audit reports, and did not include identifying information with disbursements made to subrecipients. The Uniform Guidance requires pass- through agencies to perform a risk assessment to establish appropriate monitoring procedures based upon the risks inherent at each subrecipient. ICJIA is required to monitor subrecipients to determine whether they establish and operate their fiscal system according to the conditions of the award document and to ensure that funds are requested and expended according to the subrecipient’s cash needs and eligible costs. ICJIA’s monitoring procedures for all subrecipients consisted of performing single audit report desk reviews, reviewing fiscal and data reports submitted by subrecipients, and performing periodic program and fiscal site visits. ICJIA created a risk assessment policy during fiscal year 2020 but did not perform the risk assessments and document related conclusions for subrecipients as specified in the policy. Accordingly, we could not determine if the 30 program and 1 fiscal on-site reviews conducted correlated with the risk criteria set forth in the policy. In reviewing the on-site program monitoring procedures performed by ICJIA for seven subrecipients (with expenditures totaling $3,146,878), we noted the following exceptions: • ICJIA’s program on-site monitoring reviews included completing a brief checklist to determine whether certain program-specific compliance requirements (including activities allowed, matching, and maintenance of effort requirements) and select fiscal activities were being performed in accordance with the grant award. The procedures performed appeared to primarily consist of inquiries of personnel responsible for administering the program at the subrecipient location. • ICJIA did not consistently document the supervisory review of the site visit reports or supervisory review of communications of on-site monitoring results to subrecipients in accordance with ICJIA’s policies for three subrecipients tested. Specifically: • Two of the seven site visit reports contained no evidence of review by the supervisor. • For one of the seven reviews, there was no evidence of the follow up letter. • For two of the seven reviews, the follow up letter was sent without evidence of supervisor review. • ICJIA’s fiscal on-site monitoring review included more detailed procedures over the various fiscal processes (payroll, procurement, and reporting) impacting compliance requirements applicable to most federal programs. The review also included sampling of transactions across multiple awards provided by ICJIA. For the one sample, evidence of the corrective action plan and file closure were not available. In addition, no evidence of supervisory review of the file was provided. Additionally, ICJIA did not adequately review single audit reports for subrecipients of the CVA program. The State of Illinois established the Grant Accountability Transparency Unit (GATU) to implement the provisions of the State’s Grant Accountability and Transparency Act (GATA) on a centralized basis. GATU has established standardized reporting requirements for subrecipients of the various Federal programs administered by the State through its various departments. Subrecipients of the State are required to certify whether they expended more than $750,000 in federal awards during the fiscal year and submitted their single audit reporting packages to the Federal Audit Clearinghouse (if required). ICJIA staff are responsible for reviewing the reports of their subrecipients and issuing management decisions on findings reported within required time frames. During our test work of a sample of single audit desk review files for 16 CVA program subrecipients, we noted ICJIA did not have appropriate internal controls in place to ensure receipt of single audit reports or issuance of management decisions within required time frames. Finally, all pass-through entities must identify the dollar amount made available under each Federal award and the assistance listing number (or CFDA number) at the time of disbursement per 2 CFR 200.332(a)(1)(xii). ICJIA did not provide any notification of CFDA numbers to its subrecipients when funds were disbursed during fiscal year 2020. We noted ICJIA passed through approximately $68,765,000 to subrecipients of the CVA program during the year ended June 30, 2020. Failure to execute required risk assessments and adequately monitor subrecipients including review of single audit reports may result in subrecipients not properly administering the federal programs in accordance with laws, regulations, and the terms and conditions of the award. Not communicating CFDA numbers can hamper the subrecipients’ ability to correctly prepare their schedule of federal awards. (Finding 18, pages 66-69) As a result of ICJIA’s failure to execute required risk assessments, adequately monitor subrecipients, and communicate CFDA numbers, the auditors qualified their opinion on the Crime Victim Assistance program. We recommended ICJIA perform and document risk assessments of each subrecipient and ensure monitoring visits are performed in accordance with the results of such risk assessments. We also recommended ICJIA ensure adequate documentation is retained for all program and fiscal reviews. In addition, we recommended ICJIA establish controls to ensure single audit reports and any CAP are received timely and desk reviews are completed and documented in a timely manner to substantiate whether MDLs should be issued by ICJIA within six months. Lastly, ICJIA should add to their warrant description the CFDA number associated with each disbursement. ICJIA concurred with our recommendation and noted they will ensure preliminary MDLs within the required timeframe. Additionally, ICJIA will implement a process for ensuring financial oversight of grantees based on assessed risk and adequately document the internal review. ICJIA noted they have incorporated and communicated more changes to their policy and procedures (and will continuously update as needed) to more comprehensively oversee and update their grantee files on a timely basis and to ensure appropriate and complete documentation is maintained and updated monthly or more regularly as needed. ICJIA has begun adding the CFDA number to each disbursement. INADEQUATE SUPPORT FOR FRINGE BENEFIT COSTS CHARGED TO FEDERAL PROGRAMS The Illinois Department of Employment Security (IDES) does not have controls in place over determining fringe benefits to be charged to the Employment Service Cluster program. The Employment Service Cluster Program is an administrative grant program which primarily funds personal service costs, fringe benefit expenditures, and indirect costs which are allocated to its federal and state programs through the use of cost centers established for each of IDES’ activities and programs. On an annual basis, the Department of Central Management Services (DCMS) establishes rates for group insurance fringe benefit charges (including health insurance, dental insurance, and life insurance) to be used by all State agencies to determine the insurance premiums to be paid for State employees. During our testing of 40 fringe benefit expenditures charged to the Employment Service Cluster program (totaling $214,000), we noted that for 37 of the 40 samples, we were unable to recalculate benefit amounts such as social security, Medicare, and group insurance. Differences noted ranged from $1 to $252. As a result, we were unable to determine whether the fringe benefit expenditures were appropriately supported in accordance with federal requirements due to the lack of established internal control procedures to ensure fringe benefit amounts are complete and accurate. Fringe benefit costs charged to the Employment Services Cluster program for the year ended June 30, 2020 were approximately $10,775,000. Failure to establish effective internal control over the completeness and accuracy of fringe benefit expenditures claimed may result in the unallowable costs being charged to federal programs. (Finding 20, pages 72-73) As a result of IDES’s lack of adequate controls to determine fringe benefits to be charged to the program, the auditors qualified their opinion on the Employment Services Cluster program. We recommended IDES identify the calculation discrepancies for fringe benefits and implement corrective action. IDES officials accepted our recommendation and indicated they would work actively with CMS in designing a new statewide payroll application which they believe will address the deficiencies identified. INADEQUATE PROCEDURES TO DETERMINE AND DOCUMENT VETERAN BENEFIT ELIGIBILITY IDES does not have adequate procedures to determine and document eligibility for veteran beneficiaries of the Employment Service Cluster program. The Employment Service Cluster program provides career services to meet the employment needs of eligible veterans of the Disabled Veterans’ Outreach Program (DVOP). Services are provided to eligible veterans based upon priority and maximum emphasis requirements established by Veterans’ Program Letter 03-14 and Training and Employment Guidance Letter (TEGL) 19-13. In accordance with the statute, USDOL directives specify the following order of priority in the provision of services: (1) special disabled veterans; (2) other disabled veterans; and (3) other eligible veterans with significant barriers to employment (SBE). As part of IDES’ process to determine eligibility of program beneficiaries, a Veteran Intake Form (VIF) is completed by each veteran and reviewed b a program manager to verify the veteran qualifies for services. During our testing of 40 veterans who received services from the Employment Services Cluster program, we noted that the VIF for 18 veterans was unable to be provided by IDES. Of these 18 veterans with missing VIFs, DVOP services were provided to 2 veterans who were ineligible as they did not meet the established criteria to receive such services. The remaining 16 were determined to be eligible for services based on the information in each veteran’s file; however, the VIF could not be located to validate the control evidence. There are no questioned costs noted as there are no direct monetary benefits received by the veterans who are receiving reemployment services. Failure to properly document and perform eligibility determinations in accordance with internal policy and federal regulations may result in federal funds being awarded to ineligible beneficiaries, which are unallowable costs. (Finding 21, pages 74-75) As a result of IDES’s failure to ensure eligibility for services was fully documented, the auditors qualified their opinion on the Employment Service Cluster program. We recommended IDES review its current procedures and consider any changes necessary to ensure eligibility determinations are documented and performed in accordance with internal policy and federal regulations, including evidence of review. IDES accepted the finding and indicated they will institute changes to their process to ensure compliance. INADEQUATE PROCESS OVER DETERMINING ELIGIBILITY FOR THE PANDEMIC UNEMPLOYMENT ASSISTANCE PROGRAM IDES did not perform required wage verifications for Pandemic Unemployment Assistance (PUA) program claimants in accordance with program requirements during the year ended June 30, 2020. Additionally, IDES did not have controls to ensure wage verification requirements were performed. The PUA program was established by the Coronavirus Aid, Relief, and Economic Security Act (CARES) enacted on March 27, 2020. The main provisions of the PUA program include providing up to 39 weeks of benefits to qualifying individuals who were otherwise able to work and available for work within the meaning of applicable state law, except that they were unemployed, partially unemployed, or unable or unavailable to work due to COVID-19 related reasons, as defined in the CARES Act. Benefit payments under PUA were retroactive, for weeks of unemployment, partial unemployment, or inability to work due to COVID-19 reasons starting on or after January 27, 2020 and through December 31, 2020. During our audit of PUA recipients through June 30, 2020, we noted IDES did not perform wage verifications for any PUA claimants who received amounts greater than the standard $198 weekly benefit amount (WBA). For the PUA claimants, IDES is required to perform wage verifications within 21 days of the application being submitted. IDES management stated that benefits paid to PUA claimants as of June 30, 2020 who received greater than $198 WBA and did not have the required wage verification performed within 21 days were approximately $155,083,000. Total PUA payments were approximately $378,422,000, or 4% of the total $9.5 billion CARES Unemployment Insurance programs including PUA, Pandemic Emergency Unemployment Compensation (PEUC), and Federal Pandemic Unemployment Compensation (FPUC) included in the Schedule of Expenditures of Federal Awards during the year ended June 30, 2020. Additionally, IDES did not establish processes and controls for wage verifications during the year ended June 30, 2020. Failure to establish adequate processes and internal controls may result in noncompliance with program regulations and payments to ineligible recipients. (Finding 22, pages 76-78) As a result of IDES not performing required wage verifications and not having controls to ensure wage verification requirements were performed, the auditors qualified their opinion on the Unemployment Insurance Program. We recommended IDES review its current procedures and consider any changes necessary to ensure adequate processes are established to compete wage verification for all PUA recipients within 21 days based on the regulations change dated January 2021 requiring all wages to be verified. In addition, IDES should continue to perform wage verifications and send recoupment letters for those who received erroneous or excessive benefits from May to December 2020. IDES officials accepted the finding and indicated they have made two procedural changes to address this finding, including engaging an outside contractor to provide additional staffing to assist with the massive PUA workflows and starting all claims at the minimum WBA, pending income verification, beginning in January 2021. FAILURE TO IMPLEMENT UI PROGRAM INTEGRITY AND OVERPAYMENT REDUCTION REQUIREMENTS IDES did not implement Federal requirements to improve program integrity and reduce overpayments. The State is required to establish written procedures for: (1) identifying overpayments, (2) classifying overpayments into categories based on the reason the overpayment occurred (i.e. employer error, non-response from employers, beneficiary fraud, etc.), and (3) establishing appropriate methods for following up on each category of overpayment. In establishing these procedures, the State is required to enter into three agreements prior to commending recoveries. The first agreement permits the State to offset State unemployment insurance (UI) from Federal UI overpayments (Cross Program Offset and Recovery Agreement). The second agreement permits the State to recover overpayments from benefits being administered by another State (Interstate Reciprocal Overpayment Recovery Agreement). The third agreement permits the State to utilize the Treasury Offset Program to recover overpayments that remain uncollected one year after the debt was determined to be due. Additionally, the State is (1) required to impose a monetary penalty (not less than 15 percent) on claimants whose fraudulent acts resulted in overpayments, and (2) prohibited from providing relief from charges to an employer’s UI account when overpayments are the result of the employer’s failure to respond timely or adequately to a request for information. During our test work, we noted that while IDES has developed the written procedures relative to overpayments and has entered into the required agreements described in the previous paragraph, the written procedures did not address the requirement to impose a monetary penalty on fraud overpayments. Additionally, we noted the policies do not address the prohibition of providing employers relief resulting from an employer failing to provide timely or adequate information. Failure to implement federal requirements could result in noncompliance with laws, regulations, and the grant agreement. (Finding 24, pages 82-83) This finding was first reported in the Statewide Single Audit in 2015. As a result of IDES not implementing Federal requirements to improve program integrity and reduce overpayments, the auditors qualified their opinion on the Unemployment Insurance Program. We recommended IDES develop and implement written procedures to improve UI program integrity and reduce overpayments that incorporate the required monetary penalty on fraud overpayments and prohibit providing relief to employers who fail to provide timely and adequate responses to information requests. IDES accepted the finding and indicated written procedures regarding the 15% penalty will be incorporated into established procedure(s) covering overpayments. IDES also indicated in Calendar Year 2021, they will implement its identified process on the prohibition of non-charging due to employer fault. INADEQUATE MONITORING OF SPECIAL EDUCATION SUBRECIPIENTS The Illinois State Board of Education (ISBE) did not perform adequate monitoring procedures over subrecipients of the Special Education Cluster (IDEA) (Special Education) program. ISBE selects subrecipients of certain USDE programs to perform on-site fiscal and administrative monitoring procedures using a risk-based approach. ISBE’s risk assessments are based on the funding level received by the entity, the financial status, the improvement status, any past audit findings, and the type of entity. Once the higher risk subrecipients are selected for monitoring, ISBE selects programs and individual locations within each subrecipient for additional reviews which may consist of on-site reviews, desk reviews, or analytical procedures. During the year ended June 30, 2020, ISBE’s programmatic monitoring procedures only included requirements pertaining to the Title I and Title II federal programs, as well as select fiscal requirements applicable to certain federal programs. Accordingly, program requirements pertaining to the Special Education program were not included in the on- site reviews, desk reviews, or analytical procedures performed for ISBE’s higher risk subrecipients during the year ended June 30, 2020. ISBE has represented that certain monitoring procedures were performed; however, the procedures are not correlated with the risk assessment nor consistently applied to the subrecipients based on risk ratings. In addition, ISBE did not establish adequate controls to ensure its subrecipient risk assessment procedures properly addressed each of ISBE’s federal programs as required by the Uniform Guidance. ISBE’s payments to subrecipients of the Special Education program during the year ended June 30, 2020 totaled $535,716,000. Failure to execute approved risk assessments such that program monitoring is performed based on the risk assessment could result in subrecipients not properly administering the federal programs in accordance with laws, regulations, and the terms and conditions of the award. (Finding 29, pages 93-94) This finding was first reported in the Statewide Single Audit in 2017. As a result of ISBE not performing adequate monitoring procedures over subrecipients, the auditors qualified their opinion on the Special Education Cluster. We recommended ISBE execute the Special Education risk assessment and perform the program monitoring as denoted in the risk assessment. ISBE agreed with the finding and noted local education agency (LEA) performance on compliance indicators included in the LEA Determinations served as the foundation for the risk- based approach in FY20 in determining those higher risk subrecipients in need of further monitoring and support. ISBE officials also indicated the special education risk- based accountability and support system being developed for FY21 expands the factors considered for determining higher risk subrecipients under LEA Determinations by using both compliance and results (outcomes) indicators. OTHER FINDINGS The remaining findings pertain to other compliance and internal control matters. We will follow up on the status of corrective action on all findings in our next Statewide Single Audit for the year ended June 30, 2021. AUDITORS’ OPINION The auditors stated the Schedule of Expenditures of Federal Awards for the State of Illinois as of and for the year ended June 30, 2020, is presented fairly in all material respects. This single audit was conducted by the firm of KPMG LLP. JANE CLARK Division Director This report is transmitted in accordance with Section 3-14 of the Illinois State Auditing Act. FRANK J. MAUTINO Auditor General FJM:CMD