Thatâs because the state has no well-documented disaster recovery plan and doesnât run periodic disaster tests.
Thousands of Mainers may be taking advantage of the unemployment system run by the Maine Department of Labor, forcing the state to spend millions of dollars more than it should. Or not. No one really knows.
One-third of the unemployment claims examined by the state auditor last year did not have a required work-search log. Claimants may be looking for jobs; they may not be. It hasnât been well-tracked.
Maine Center for Disease Control and Prevention officials insist the stateâs vaccines have been stored at the proper temperature, but the state auditor canât be sure.
Last year, CDC workers either were not testing the refrigeratorsâ temperatures as required or were testing them but not entering the results into the computer system.
The findings in the latest state audit go on for more than 100 pages: key computer systems left vulnerable, money spent without oversight, questionable eligibility for state assistance programs, errors in accounting, rules not followed, important policies and procedures not in place and workers not doing their jobs or doing them wrong.
Some of the issues are new. Others have been going on for years, bouncing from one audit to the next, despite officialsâ promises that theyâll be fixed.
Both the current state auditor and her predecessor call that frustrating â âespecially because (my office knows) there are opportunities to save money,â current auditor Pola Buckley said.
Department leaders and state officials say theyâre working on it. The problems, they promise, will be fixed.
âTheyâre all importantâ
The Maine Department of Audit has been responsible for inspecting the stateâs financial statements and expenditures of federal money every year since 1987. It also looks to see if a department has required policies and procedures in place and whether it is following those rules. The audits are done using nationally accepted standards, and the audit department itself undergoes a peer review, including federal auditors, every three years.
The department is charged with remaining independent as it looks into 22 to 28 major programs in other state departments, including the Health and Human Services, Education, Labor and Transportation.
The most pressing findings are noted in the audit report itself. Thatâs where the auditor presents material weaknesses and material noncompliance problems (most severe) and significant deficiencies (less severe but still worrisome). Other findings, considered less serious by the auditor, are presented in an accompanying management letter. But the ranking of importance can be subjective.
âI found myself always concerned that theyâre all important to correct,â said Neria Douglass, who served as state auditor for eight years until this past January, and now serves as state treasurer.
Every finding comes with an auditorâs recommendation for fixing the problem, as well as a response/corrective action plan by the department being audited.
The audit department gives its findings to lawmakers, the governorâs office and the departments that have been audited. It has no power to force anyone to follow its recommendations, and it has no authority to sanction a state department for severe and repeated problems.
However, the federal government does. It uses the annual audit to gauge how well Maine is handling federal money and following federal rules. It can require the state to pay back money that has been mishandled; divert new, incoming federal funds to fix a problem; or bar the state from receiving additional federal money.
Less-serious management letter findings are not sent to the federal government.
Experts say itâs unreasonable to expect a perfect, finding-free audit. Federal requirements are intricate and ever-changing. The state handles billions of dollars a year and oversees hundreds of programs. And state workers are only human.
In 2003, for example, the audit found the Maine Department of Public Safety had accidentally sent the wrong person a check for $1.2 million. The check was returned within a few days.
Department leaders point out that the number of audit findings has gone down in recent years. But while some of that is likely due to improvement, some of it is because findings were consolidated and there have been changes to the mix of programs audited.
DHHS often has among the most findings. Itâs a large department that oversees a lot of the stateâs programs and deals with a lot of federal money and federal rules, so itâs easy to misstep or inadvertently break a rule.
But DHHS often has repeated findings from one year to the next.
âTheyâd say, âWell, weâre going to do ABC to comply with the finding.â Then they either would do A and B and not get to C, or weâd find whatever they were going to do didnât really get the job done,â Douglass said.
The most recent audit found:
* Policies and procedures in place for the Income and Eligibility Verification System are not always followed. No follow-up was documented for 17 of 60 client cases the auditor examined, including cases in which the clients were deceased, incarcerated or had moved out of state. Itâs been a finding since at least 2009.
* No adequate procedure is in place to determine eligibility for the Childrenâs Health Insurance Program, or CHIP. Itâs been a finding since at least 2010.
* DHHS pays millions of dollars each year to the Centers for Medicare and Medicaid Services for Medicare Part A and B premiums for Mainers â $117 million in 2012 â but it canât ensure that those Mainers are eligible. Itâs been a finding since at least 2010.
âThe feds send a paper copy of the invoice and an electronic file with all the detail, but the Department of Health and Human Services pays the bill off the hard copy without checking to make sure those people are eligible,â Buckley said. âIt could be that everythingâs fine . . . or it could be (costing Maine) millions of dollars. Or it could be somewhere in between.â
DHHS officials say theyâve seen their overall findings drop in recent years, from 59 in 2009 to 38 in 2012, and questioned costs have decreased from $15.2 million to $2.1 million. DHHS hired an internal auditor several years ago, and officials there say they are working on fixing repeat findings.
The department did not completely agree with the auditorâs finding that DHHS didnât have adequate procedures in place to determine eligibility for CHIP. Officials said eligibility was actually incorrectly determined in only one case, though the department knows it has some issues stemming from two computer systems.
âThis is one of those corrections that will take a little time to take care of,â said DHHS spokesman John Martins.Â
DHHS isnât the only state department with repeated findings.
Sometimes a department just doesnât agree with the auditor. Officials believe theyâre doing things the right way, no matter what the auditor says.
Thatâs what has happened with a finding involving the Department of Administrative and Financial Services. For years, the auditor has said the department isnât properly accounting for the transfer of money between the Dirigo Health Enterprise Fund and Fund for a Healthy Maine. However, department officials say theyâre doing it the way that both meets accounting standards and is most meaningful for readers of the financial statements.
âItâs not that itâs recorded incorrectly or recorded for the wrong amount â itâs just on a line thatâs different from what they want,â said State Controller Terry Brann, whose office is part of the Department of Administrative and Financial Services. âThere really is no way to resolve it other than, at some point, one or the other adjusts their position.â
Itâs gotten to the point that the departmentâs response to the auditor is now a copy-and-paste of its response the previous year.
Sometimes a department agrees with the auditor but says it doesnât have the time or the means to fix the problem, even when the issue comes up more than once.
For at least the past couple of years, the state auditor found the Department of Labor wasnât making sure people with unemployment claims proved they were looking for work, as required. The latest audit found missing logs for about a third of the 120 cases it examined.
The situation so concerned Buckley that she brought it to the attention of the Legislatureâs State and Local Government Committee even before the audit report was finished.
DOL officials said they received so many unemployment claims during the recession that it was hard to keep up. At the peak, the DOL was receiving paperwork search logs from up to 25,000 people.
The department now requires that claimants maintain logs but only send them in when requested. DOL officials hope the more targeted checks will catch fraud while cutting down on paper overload.
âIt makes the enforcement piece easier because weâre not focusing on counting paper but on doing the audits on the individuals we have flags about,â said Julie Rabinowitz, spokeswoman for DOL.
Since at least 2009, the audit has found that the Maine Department of Education doesnât make sure school systems comply with federal regulations after they receive federal money. The latest audit found the DOE monitored only 10 of 144 school systems.
Department officials say they started getting the manpower and resources they needed to deal with the situation in 2012.
âWe have over 300 grant recipients, and with 365 days in a year and each review taking anywhere from several days to several weeks, we canât get the monitoring in for everybody, obviously, in a year. So we have developed some new methods and procedures,â said Heather Neal, supervisor of the departmentâs fiscal review and compliance team. âRight now, weâre going out and weâre trying to test things to make sure our methods are effective and efficient.â
Department officials expect to have the issue fixed by February 2014. However, if they donât, auditors may not bring it up anymore.
If the federal government doesnât take action, repeated findings can drop off the audit after a few years.
New findings
Not every finding is repeated. Several new ones made the the audit for 2012, including:
* The statewide computer system and other program or department computer systems have no well-documented disaster recovery plan and do not go through periodic disaster recovery testing.
* There is no way to tell whether school systems provided accurate child counts to the Maine Department of Education last year because the department didnât have them certify the numbers given. Child counts are used to determine how much money school systems get in state aid, among other things.
* The auditor found security weaknesses in ImmPact, the statewide, Web-based computer system that orders, administers and tracks vaccinations, and stores Mainersâ immunization records. The auditor was so concerned that someone could get into the system or access confidential medical information that the audit department refused to publicly disclose any details about those vulnerabilities. The auditor also found that more people had administrator-level access to the system than should have. ImmPact was one of the systems that had no well-documented recovery plan. Â
*Â Thirty-two of 40 site reviews showed CDC workers had not tested the temperature of vaccine refrigerators as required by the federal government. The auditor could not ensure vaccines were stored at the proper temperatures.
* Weaknesses were found in the Department of Transportationâs IT system, including the computer systems that process more than $370 million in federal expenditures and the departmentâs payroll.
* The Department of Laborâs Bureau of Unemployment Compensation turned in federal unemployment tax forms three and a half months late.
* No policies and procedures were in place at the Maine Department of Transportation or the Department of Economic and Community Development to ensure federal money went to parties that were not suspended or barred from federal assistance programs.
The new findings involve millions of dollars, the safety of public health and the security of sensitive information. Many could be traced to human error. A number of those involved a new worker who didnât know what had to be done or wasnât certified to do it.
Some department officials disputed, lamented or were surprised by some of the new findings.
Deborah Johnson, director of the Office of Community Development, which is part of the Department of Economic and Community Development, said her department always ensures that the parties arenât suspended or barred from federal assistance programs before it passes on federal money. But in the instance examined by the auditor, she said, the federal government had approved the towns getting the money, so the department didnât do its own check.
âThis was a one-shot deal,â she said. âWe pride ourselves on never getting any findings.â
DOT officials said they, too, always run a check before awarding federal money. The audit, they said, caught the one time rules werenât followed by an inexperienced staff person. They were surprised the mistake had been made.
âOur director of contracting came to me and sheâs like, âI have no idea how this happened â we always check these,'â said Karen Doyle, director of finance and administration for the DOT. âIt was just a case of the person that did this purchase doesnât usually do purchases. They do other things. But because it was a crane, we used his expertise in knowing what a crane should do and didnât realize he didnât know the contracting part as well as we thought.â
The departmentâs contracting unit now checks all federal award recipients, whether the award involves a contract, purchase or something else.  Â
Although the auditor said CDC workers didnât test the temperature of vaccine refrigerator units, department officials are certain they did. The problem was that temperature-recording wasnât marked âmandatoryâ in the computer system, so some workers didnât log it in, they said.
The field is marked âmandatoryâ now.
âOne of the old audit axioms is, âIf itâs not documented, it didnât happen,'â said Herb Downs, director of the Division of Audit for DHHS, the department that oversees the CDC.
Generally, department officials agreed with the auditorâs new findings and agreed there were issues â and potentially serious problems â that needed to be fixed.
Some individual departments have well-established recovery plans should something happen to their computer systems, but the statewide system does not. That has worried officials at the Office of Information Technology as much as it concerned the auditor.
âIf a crisis hit, we have the people and personnel to jump into action and fix things, but we want it more automated,â said Jim Smith, chief information officer for OIT. âYou just canât afford to be down for some of these critical systems anymore.âÂ
Smith was so concerned that he brought up the issue during a discussion with Gov. Paul LePage. The governor, he said, requested a comprehensive plan to improve preparedness.
OIT is now working on it. Itâs about three-quarters of the way through identifying critical pieces of the system and is planning to work with a third party on disaster recovery planning and is establishing annual or semi-annual disaster recovery drills.
âWe take this very seriously,â Smith said.Â
Sent to lawmakers
The stateâs annual audit report and management letter are posted on the stateâs website. Although they typically get little attention, at least one taxpayer has taken note.
Jennifer Murray, a former member of Cascoâs Finance Committee, began studying town audits a few years ago in an effort to find out more about local spending. That recently led her to search out the latest state audit.
She got just a few pages into it before she got angry.
â(Maine has) budget concerns over and over, yet we canât even manage what we have, constantly, in these departments,â she said.Â
Murray approached the Sun Journal with her concerns. She believes too few people are paying attention to the findings.
âIf I went in the room and I said, âRaise your hand if you know what a management letter is,â I donât think our legislators, I donât think our senators, they probably wouldnât even know how to explain what it is,â she said.Â
The audit was sent to the governorâs office, speaker of the house and president of the senate.
In a statement released by his office, House Speaker Mark Eves, D-North Berwick, said he was briefed on the latest audit by senior legislative staff and the state auditor. He said his staff also carefully reviewed the report.
He was most concerned about the DHHS findings that called into question eligibility for state assistance.Â
âMaking sure programs like food stamps, Medicaid and foster care assistance go to the appropriate people is critical to safeguarding our taxpayer dollars,â he said in the statement. âThese benefits must go to the people the law intended to help â our truly needy. In the last five years, weâve seen errors in the system reduced, but this audit shows we still have more work to do.â
The governorâs office also released a statement saying the governor has reviewed the audit and is confident in the continuing work within the state agencies.
âStaff within the administration is working on addressing weaknesses and is committed to the audit process as an integral part of the governmentâs system of âchecks and balancesâ â not only in providing a review of state program stewardship, but also in fostering accountability to Maine citizens,â the statement said.
It added, âThe audit process, while it typically has not been widely reported on, is certainly an area the governor takes interest in. We realize we cannot fix every problem overnight. However, it is imperative to serve taxpayersâ interests by improving fiscal management in a timely manner to the best of our ability.â
The Appropriations Committee also looks at the audit report every year. However, committee members focused so much time and attention on the state budget this spring and summer that they havenât yet taken up the audit. Co-chairwoman Rep. Peggy Rotundo, D-Lewiston, said the committee likely will invite Buckley to present the audit at the committeeâs August or September meeting.
Department leaders also received a copy of the audit findings. All say theyâre working on the issues presented. The DOE was so concerned about its repeated findings that about two and a half years ago it put together a team of people to track and fix audit findings. DHHS has had its own internal auditor since 2009. The department recently received legislative approval to hire three more people, giving the department a team to deal with audit findings.
Although department leaders say theyâre working on their problems and the number of findings has decreased in recent years, the current and former auditor remain concerned about some of the findings that remain â particularly those that have repeated.
âWhen they continue year after year, you find yourself thinking, âThis is now a priority,'â Douglass said.
She said she met with department leaders over the years, in both the past and current administrations, in an effort to get some of the repeated problems fixed, particularly at DHHS. But while there were a lot of promises, she said, the problems continued to come up for one reason or another.
âI like to think thereâs a will to fix these problems,â Douglass said. âSometimes theyâre just more difficult to fix than you might otherwise think. And the other side of things is that theyâre often focused on delivering services rather than complying.âÂ
She added, âUltimately, I think itâs important to remember that when we get federal funds or when we conduct a program and we have criteria, we need to make sure we comply with the requirements.â
Buckley, the current auditor, also wants to reduce the repeated findings. Hoping that greater awareness might help, sheâs looking at changing the report to note next to repeated findings all the years theyâve made it into the audit. It might be harder, she thinks, to ignore a finding that has 2010, 2011 and 2012 marked beside it.
âWeâre still very committed to getting our message across,â she said.
But whether or not its departments listen to the auditorâs concerns, Maine may soon not have much of a choice about fixing its problems.
The federal government, Buckley said, is starting to be stronger in its own follow-up.
Some findings in the most recent state audit:
DEPARTMENT OF ADMINISTRATIVE AND FINANCIAL SERVICES
Division of Financial and Personnel Services
* Lottery fundâs accounts receivable balance is not supported by detail records. Canât provide a report with an accounts receivable balance for lottery games by lottery agent. Opens the possibility that the state doesnât have an accurate accounting of money owed by lottery agents.
Maine Revenue Services
* The procedure used to calculate the allowance for âuncollectable taxes receivableâ is insufficient. Percentages largely based on judgment rather than quantitative/analytical method. Could make the valuation inaccurate.
Office of the State Controller
* Department did not properly account for the transfer of money between Dirigo Health Enterprise Fund and Fund for a Healthy Maine. Could cause an understatement of certain revenues and expenses.
General Government Service Center
* Didnât follow federal cash management requirements. Of the 70 cash draws tested, 33 were not in compliance. Risks sanctions by the federal government.
Office of Information Technology
* Required risk analysis and security reviews not performed on the system that processes $2.5 billion in Medicaid claims. Due to staff turnover, lack of resources and misinterpretation of requirements. Raises potential security risks.
* Inadequate controls over Income and Eligibility Verification System data exchanges. Of the 37 IEVS data exchanges, auditors found problems with 29. System involves Medicaid and a number of assistance programs.
* Policies and procedures not always in place for IEVS to determine the eligibility and level of benefits. No follow-up documented for 17 of 60 client cases examined, including clients who were deceased, had moved out of state or were incarcerated.
* Weakness found in the Department of Transportationâs IT system, including the information systems that process more than $370 million in federal expenditures and the departmentâs payroll. Could be a security risk.
* No well-documented disaster recovery plan in place and periodic disaster testing not performed on the statewide computer system.
Departmentâs response: Officials disagree with some findings, including that the procedure used to calculate the allowance for âuncollectable taxes receivableâ is insufficient and that the department did not properly account for the transfer of money between Dirigo Health Enterprise Fund and Fund for a Healthy Maine. They also say they can provide the state lottery information the auditor wanted, but not in the way requested. The department is working on that. Officials say they are also working on addressing the other findings, including the need for a statewide computer system recovery plan.Â
DEPARTMENT OF EDUCATION
Education Finance
* No adequate procedures in place to ensure that grant recipients had actual expenditures before they got reimbursed. Involved a program with 180 grant recipients and $112.1 million.
Special Services
* Spent $65,846 more than allowed by the federal government for administration and other state-level activities. Involved $6.2 million in administrative spending for a school-age special education grant program. Human error. Money was returned to the federal government.
* Didnât adequately monitor school systems to make sure they comply with federal regulations when they receive federal money. Only 10 of 144 monitored. School systems could break federal rules and the DOE wouldnât know.
* Didnât get certification from school systems that their child counts are accurate and have not been duplicated. Could result in incorrect decisions about school aid and other funding.Â
* Incorrect child count data used in determining special ed preschool grants. Human error. Could have caused some school systems to receive a too-small or too-large share of grant money.
Child Nutrition Services
* Didnât report information required by the Federal Financial Accountability and Transparency Act regarding the $42 million school nutrition program. Risks federal sanctions.
Departmentâs response: For the past two and a half years, the department has maintained a team of people to track and fix audit findings. It agrees with the majority of the latest findings and either has fixed the issues or is working on fixing them.
DEPARTMENT OF HEALTH AND HUMAN SERVICES
Center for Disease Control
* Auditor found security weaknesses in ImmPact, the statewide, Web-based computer system that orders, administers and tracks vaccinations, as well as storing Mainersâ immunization records. Could allow inappropriate access, modification or disclosure of confidential or sensitive information.
* More people had administrator-level access to the ImmPact system than should have.
* ImmPact system has no well-documented disaster recovery plan and periodic disaster recovery testing is not performed.
* CDC workers had not tested the temperature of vaccine refrigerators as required by the federal government. Auditor could not ensure vaccines were stored at the proper temperatures.
* The immunization program was charged $1,121 for desktop support and technology services by the Office of Information Technology for two temporary employees who no longer worked for the program. OIT did not know the two werenât working there anymore. OITâs monthly charges were not reviewed by the immunization program.
Service Center
* Did not submit accurate data regarding expenditures of federal awards, including the over reporting of $949,640 for TANF, over reporting of $557,455 in Child Care Development Fund money and misreporting of $1.8 million in SNAP money. Human error.
* Costs not allocated correctly; some programs overcharged and some undercharged. Caused by human error, lack of communication and training and insufficient data for cost allocation.
* No proof that an authorized person approved an expenditure. Also, a travel voucher was approved by someone not authorized to approve one. Caused by human error and unfamiliarity with state policy. Opens the possibility that the state paid for expenses and travel that it shouldnât have.
Office of Child and Family Services
* Purchased movie tickets as part of a group activity for foster parents and children. Expense not allowed.
Office of MaineCare Services
* Recouped an excessive amount of Cost of Care money from private nonmedical institutions.Â
* Did not hold vendor responsible for securing the computer system that deals with the CHIP health coverage program for children. It could not assure the auditor that electronic information was secure in transit, that the data could be recovered in the event of a disaster and that it had an adequate contingency plan should something happen to the system. Could lead to fraud, abuse, the disclosure of personal information, unintentional errors and the disruption of claims processing or payments to providers
* Did not ensure vendor performed a risk assessment to evaluate the new MaineCare claims management system. That system processes Medicaid and CHIP claims totaling $2.5 billion per year. Lack of evaluation could lead to fraud and the potential disclosure of personal health information.
* Access controls over Maine Integrated Health Management Solution computer system need to be improved. Could lead to fraud, abuse, disclosure of protected health information or other errors.
* Pharmacy providers overpaid, likely by $662,000. Money not recovered as of the audit reportâs publication.Â
* Paid $117 million to the Centers for Medicaid and Medicare Services for Medicare Part A and B premiums for Mainers, but it canât ensure those Mainers are eligible.
* No controls in place to ensure provider agreements contain required provisions, including that the provider will comply with patientsâ advance directives.
* No adequate procedure to determine eligibility for CHIP, the health-care insurance program for children.
Office for Family Independence
* Medicaid Eligibility Quality Control unit was unable to find two of the 40 cases selected for review.
* Did not require one TANF recipient to engage in qualified work or document exception. Due to a new staff memberâs training being interrupted by the reassignment of his or her supervisor.
Departmentâs response: The department has had its own internal auditor since 2009 and recently received legislative approval to hire three more people, providing a team to deal with audit findings. The department agrees with the majority of the most recent findings and have fixed a number of them, including ensuring that workers record the temperature of vaccine refrigerator units and limiting the people who have administrative access to the ImmPact system. It is working on fixing other findings.
DEPARTMENT OF LABOR
Bureau of Unemployment Compensation
* Turned in federal unemployment tax forms three and a half months late.
* One-third of unemployment claims examined lacked a work-search log. Could be paying millions of dollars in unemployment to people who arenât looking for work.
Departmentâs response: Officials say newly hired employee didnât have the certification needed to submit the unemployment tax forms for the federal government. The employee is certified now and the job description has been flagged to ensure any future hires are certified before they begin work. The department agrees that some work-search logs were missing because it had trouble keeping up with the influx during the recession, though officials believe the potential impact and cost to the system is much less than the auditor proposed. Regardless, the department has changed its policy. It now requires that claimants maintain logs but only send them in when requested. Officials hope the more targeted checks will catch fraud while cutting down on paper overload.
MAINE DEPARTMENT OF TRANSPORTATION
Contract Procurement Office
* Did not have policies and procedures in place to ensure awards were made only to parties not suspended or barred from federal assistance programs.
Departmentâs response: Officials agree with the finding, though note they have always run such a check before. This was a one-time situation involving an inexperienced staff person who normally deals with another part of the department. The departmentâs contracting unit now checks all federal award recipients, whether the award involves a contract, purchase or something else.
DEPARTMENT OF ECONOMIC AND COMMUNITY DEVELOPMENT
Office of Community Development
* Did not have sufficient procedures in place to ensure that awards were made only to parties who were not suspended or barred from participating in federal assistance programs.
Departmentâs response: The department always ensures that the parties arenât suspended or barred from federal assistance programs. In this instance, the federal government had approved the towns getting the money and so the department didnât do its own check. It will run checks on all parties in the future.
Send questions/comments to the editors.