10.1 Effective Internal Controls

Lead Agencies must ensure the integrity of the use of CCDF funds through effective fiscal management and must ensure that financial practices are in place. Lead Agencies must have effective fiscal management practices in place for all CCDF expenditures. 10.1.1 Organizational structure to support integrity and internal controls Describe how the Lead Agency’s organizational structure ensures the oversight and implementation of effective internal controls that promote and support program integrity and accountability. Describe: 1. Assignment of authority and responsibilities related to program integrity. The VDOE has an organizational structure in place that supports program and fiscal integrity and accountability. Internal controls permeate through the agency, as all VDOE staff are required to complete ARMICS training upon on-boarding to the agency to ensure that personnel at every level of authority and responsibility share the culture of integrity and accountability. The Office of Business and Risk Management is an integral part of the internal control system. The office monitors and evaluates internal controls as part of the agency’s annual risk assessment program. This program is carried out pursuant to the Virginia Department of Accounts Comptroller’s Directives for Agency Risk Management and Internal Control Standards (ARMICS). ARMICS is a mandate of the Commonwealth of Virginia, which requires State Agencies to implement internal control standards and ￿best practices.￿ The standards and related testing and internal self- assessments were designed to: · Provide accountability for meeting Agency objectives; · Promote operational efficiency and effectiveness; · Improve the reliability of financial statements; · Strengthen compliance with laws and regulations; and · Reduce the risk of financial or other asset losses due to fraud, waste, or abuse. 2. Delegation of duties. VDOE has a clearly defined chain of command for decision making and approvals. Written organizational charts, workflows, job descriptions, employee work plans, and other resources are maintained that outline activities and assign responsibility for all key processes. As the Lead Agency for CCDF, VDOE has an MOU with the Virginia Department of Social Services for the implementation of the Child Care Subsidy Program. The MOU assigns responsibilities for specific processes to each agency and includes requirements for internal controls, reporting and monitoring. 3. Coordination of activities. The Office of Business and Risk Management conducts risks assessments, testing, and self- assessments to ensure that internal controls are effective. Risk assessments and internal control surveys are distributed and tracked throughout the agency to ensure that internal control practices are applied, tested, and analyzed. 4. Communication between fiscal and program staff. Regular meetings between program and fiscal staff provide ongoing communications and a platform for identifying and resolving issues. There is also constant communication between VDOE and subrecipients regarding both program and fiscal related topics. 5. Segregation of duties. VDOE has a structure in place that involves separating key duties and responsibilities. For CCDF funds, the VDOE Fiscal control all CCDF fund activity. The Division of ECCE program staff provide the direction for use of funds through a chain of command that ultimately relies on the CCDF Administrator and Deputy Superintendent for final approvals. VDOE Fiscal staff have a similar chain of command resulting in approvals from the Assistant and Deputy Superintendent. There is a clear delegation of duties between program and fiscal staff that can also be found within each division. Staff are assigned specific duties so that one person or division within the agency does not have complete authority over the funds. Program and fiscal staff have clearly defined procedures that allow checks and balances when authorizing, processing, recording and reviewing work and transactions. 6. Establishment of checks and balances to identify potential fraud risks. Program and fiscal staff have clearly defined procedures that allow checks and balances when authorizing, processing, recording and reviewing work and transactions. Systems are designed that require approvals through the chain of command. This ensures transactions/decisions have been reviewed to ensure proper completion and allows for checks and balances to identify fraud risks. There is a system of supervision for employees that involves assigning, reviewing and approving work. The lines of responsibility are clearly defined. Supervision involves performance evaluation, training, periodic reviews of work and ensuring that procedures are followed. VDOE has robust security in place for all systems and access. The security control involves limiting access of assets to authorized individuals. The assets include information, space, funds and equipment. 7. Other activities that support program integrity. Record-keeping: VDOE keeps records on all transactions and files them so that they can be easily reviewed and audited. Training: VODE uses training to reduce the risk of errors and inefficiency in operation by ensuring that personnel have the proper education and training to perform their duties. Members of teams are cross-trained to ensure work is complete. Supervisors ensure that employees have the knowledge, skills and abilities to perform their job function. Performance Planning and Evaluation: Key performance indicators are developed by senior management to identify unexpected results and unusual trends. These indicators provide the guidance needed for staff. These controls provide the needed structure to ensure accountability and fiscal integrity of CCDF funds. Monitoring and audits: VDOE program and fiscal staff regularly monitor and audit funds to identify potential mistakes and fraud. There is an established system of checks and balances in place that includes reviewing data and reports to identify potential issues and possible fraud. VDOE has regular audits from the state’s internal auditors. The agency risk assessment makes sure all internal controls are in place and working. Include the following elements in your description: 1. Assignment of authority and responsibilities related to program integrity. 2. Delegation of duties. 3. Coordination of activities. 4. Communication between fiscal and program staff. 5. Segregation of duties. 6. Establishment of checks and balances to identify potential fraud risks. 7. Other activities that support program integrity. 10.1.2 Fiscal management practices Describe how the Lead Agency ensures effective fiscal management practices for all CCDF expenditures, including: a. Fiscal oversight of CCDF funds, including grants and contracts. Describe: VDOE’s Fiscal Office maintains oversight for all CCDF Funds. The agency uses internal controls and delegation of duties to ensure that all funds are spent as outlined by the State’s Department of Accounts in the Commonwealth’s Accounting Policy and Procedures manual. Funds are tracked by AIN, grant award number, project code, and other identifiers to ensure that all funds can be tracked back to the correct grant and program. Regular meetings between program and fiscal staff provide ongoing communications and a platform for identifying and resolving issues. VDOE program and fiscal staff regularly monitor and audit funds to identify potential mistakes and fraud. There is an established system of checks and balances in place that includes reviewing data and reports to identify potential issues and possible fraud. VDOE has regular audits from the state’s internal auditors. The agency risk assessment makes sure all internal controls are in place and working. Fiscal oversight of the subsidy program, which is implemented by the Virginia Department of Social Services (VDSS), includes written policies and procedures in the MOU between VDOE and VDSS that specifies the allowable use of funds, as well as procedures for reviewing and submitting expenditures for reimbursement. As a state agency, VDSS is also subject to the Commonwealth’s Accounting Policy and Procedures manual and the internal control requirements of the Agency Risk Management and Controls Standards (ARMICS). The VDSS Payment Accuracy Unit is responsible for reviewing Child Care subsidy cases processed by local departments of social services to ensure accuracy and compliance with federal and state laws and guidance. The Unit audits cases, provides feedback, requests corrective action plans, and suggests changes to Child Care Subsidy practices and guidance. VDSS Child Care Regional Consultants also follow a process outlines in an annual monitoring plan to ensure case accuracy and local agency compliance. Program monitoring includes the regular review of case management reports, financial reports, and case records. The primary focus of the review is to assess compliance with program guidance and requirements. VDSS is also subject to annual audits from the state’s internal auditors. Fiscal oversight of the quality program includes conducting monitoring reviews of subgrantees and contractors at a minimum of every 3 years. The review schedule is based on risk assessments to identify potential areas and levels of concern. The subrecipients’ Single Audit Reports are also reviewed to identify any findings related to CCDF funds or programs. b. Tracking systems that ensure reasonable and allowable costs and allow for tracing of funds to a level of expenditure adequate to establish that such funds have not been used in violation of the provision of this part. Describe: VDOE follows procedures outlined by the State’s Department of Accounts in the Commonwealth’s Accounting Policy and Procedures manual that defines the coding for tracking funds. Funds are tracked in the agency’s financial management system by AIN, grant award number, project code, and other identifiers to ensure that all funds can be tracked back to the correct grant and program. VDOE maintains written agreements with CCDF sub-recipients that include budgets and an itemization of allowable expenditures. Invoices are recorded, reviewed, and compared to the contracts/subgrants to ensure compliance with the terms of the agreement. There are two levels of verification for expenditures. The program office provides the first level and approval ensuring all costs are reasonable, allowable, and allocable to the CCDF grant. The fiscal office then provides additional approvals to ensure reasonable and allowable costs. Subrecipient monitoring is performed at a minimum of 3 years and includes reviewing expenditures for compliance. Single Audit Reports are also reviewed to identify any concerns with the allowable use of CCDF funds by subrecipients. c. Processes and procedures to prepare and submit required state and federal fiscal reporting. Describe: VDOE’s fiscal office uses general ledger reports from our automated financial management system to compile information for the ACF-696 quarterly financial status report. The reports identify expenditures by funding stream, grant number, project code, and activity type. Information from the general ledger reports are reconciled to internal tracking documents and subrecipient reports to verify for accuracy and reasonableness. The VODE fiscal staff prepare the financial data to be reported on the ACF696. Expenditure reports are pulled from the VDOE financial system of record, ORACLE. These expenditure reports are reviewed and verified by the fiscal staff. ACF 696 reports are prepared by the CCDF grants program manager for the respective date of the reporting period. Expenditures are coded by grant, funding stream that align with project codes. They are categorized by administration, quality activities, infant and toddler activities, direct services, non-direct services, state share of matching, and further broken down into the appropriate sub-categories that align with those on the ACF-696. Expenditures from each category are then added together and reported in the correct category on the ACF- 696. VDOE uses the ACF instructions to determine the proper category for reporting on the ACF-696 when coding expenditures. Once all expenditures are added to the ACF-696, the grants manager determines the percentages of expenditures and where we are meeting our mandatory goals for administration, direct services, and matching goals. Expenditure reports are summarized in a spreadsheet for each grant and backed up with Oracle financials so that reviewers can verify data before it is submitted. The grants team enters the report in GrantSolution. The reports then have several levels of review and approvement that include the Associate Director of Grants and Finance with final approval from the CCDF Administrator or the Deputy Superintendent of Operations. d. Other. Describe: 10.1.3 Effectiveness of fiscal management practices Describe how the Lead Agency knows there are effective fiscal management practices in place for all CCDF expenditures, including: a. How the Lead Agency defines effective fiscal management practices. Describe: The primary aspect of effective fiscal management VDOE has adopted is to maintain effective internal controls through the Commonwealth’s Agency Risk Management and Internal Control Standards (ARMICS), which is a mandated program to safeguard the agency’s assets, reduce loss, promote efficient and effective operations, and keep accurate financial records. ARMICS was developed based on the COSO framework of internal controls, and requires that all agencies demonstrate that it has the necessary components to achieve the following objectives: · Strategic: Support for being the best managed state in the nation through internal control best practices · Operational: Effective and efficient use of fiscal resources and other assets · Reporting: Integrity and reliability of financial reporting · Compliance: Compliance with applicable laws and regulations · Stewardship: Protection and conversation of assets. Under ARMICS, VDOE is required to submit agency level risk assessments and process/transaction level control assessments related to the following internal control components: · Control Environment · Risk Assessment · Control Activities · Information & Communication · Monitoring Activities Risk assessments are performed for all fiscal process identified, as well as accounting administration and general ledger agency level control activities. Controls are then put into place that will help provide reasonable assurance that the agency is in compliance with the regulations and terms of CCDF. In conjunction with ARMICS, VDOE is required to comply with processes specified in the Commonwealth’s Accounting Policy and Procedures manual, is monitored by the Comptroller’s Department of Accounts for compliance, and is subject to annual audits by the Auditor of Public Accounts. b. How the Lead Agency measures and tracks results of their fiscal management practices. Describe: The Lead Agency measures and tracks the results through internal control self- assessment requirements and audits by the DOA. c. How the results inform implementation. Describe: If issues are identified through the audits, VDOE implements a corrective action plan or adjusts their internal procedures. If multiple agencies receive the same findings, additional guidance is issued, policies are reviewed, or training is developed to help the agencies. d. Other. Describe: 10.1.4 Identifying risk Describe the processes the Lead Agency uses to identify risk in the CCDF program including: a. Each process used by the Lead Agency to identify risk (including entities responsible for implementing each process). Describe: Contracts, agreements, and subgrants: All sub- recipients are screened and monitored with a risk assessment tool to identify their level of risk, which takes into account the dollar amount of the agreement, size of the population served, time elapsed since previous review, previous track record, and potential for fraud. The level of risk is evaluated based on the likelihood of occurrence and the impact of the risk. Subsequent periodic desk reviews of reimbursements to subrecipients are performed to ensure that funds are used according to federal and state guidelines. CCDF Subsidy Implementation: An internal control assessment tool is provided to local departments of social services to be completed each year, and is designed to provide a systematic approach to assessing risk at the organizational level and the process/transaction level. The tool focuses on the following control activities: Organizational control environment, organizational structure, assignment of authority and responsibility, expenditures, personnel, payroll, procurement, and accounts payable. Compliance reviews are conducted based on the following risk factors: dollar amount of funds allocated, size of the locality, number of findings in previous reviews, time lapsed since prior review, and referrals from interested parties. CCDF Subsidy Eligibility: Regional Program Consultants conduct risk assessments of local departments of social services based on funding level, locality size, history of findings, referrals, and time since the last monitoring visit. CCDF Subsidy Providers & Families: An electronic child care time and attendance system generates ￿red flag’ reports for discrepancies such as card swipes occurring at odd hours or unusual intervals, providers only submitting manual attendance, provider bills for children no longer attending, and children never having absences reported. Other factors such as previous incidents and referrals from affected parties are also considered. The Virginia Department of Social Service’s (VDSS) Payment Accuracy Unit conducts annual case monitoring according to federal improper payment guidelines. The Vendor Services Unit reviews manual attendance submitted by providers to ensure validity, accuracy, and timeliness to process payments to subsidy vendors. The unit also compares attendance submitted manually with attendance recorded via swipe machines to ensure duplicate or excessive billing does not occur. Procurement divisions at both VDOE and VDSS conduct contract reviews in accordance with state procurement regulations and contract terms. b. The frequency of each risk assessment. Describe: Risk assessments related to contracts, local departments of social services, and providers are conducted annually during monitoring planning for the year. State agency-wide ARMICS risk assessments are conducted annually and are updated based on changes in significant fiscal procedures. c. How the Lead Agency uses risk assessment results to inform program improvement. Describe: Results from risk assessments inform management and program staff of possible training needs and program areas that may need policy changes. If ineffective controls are identified, then fiscal and program staff will work together to develop guidance documents to correct the deficiencies. In addition, risk assessments are the determining factor for scheduling annual monitoring and compliance reviews. Findings from the compliance reviews, whether intentional or unintentional, may result in the implementation of corrective action plans, payment recoveries and adjustments, and referrals to fraud investigators. Follow-up reviews are conducted to verify corrections. If improper payments due to agency errors are detected, local administrative reimbursements are adjusted to cover the misspent funds. Each local department of social services is served by at least one fraud investigator who investigates allegations of fraud. Fraud staff will refer fraud cases to local Commonwealth Attorney’s if the case meets certain criteria established by the Attorney’s office for prosecution. If overpayment or fraud is established, the child care staff in the applicable local department establishes and monitors a repayment agreement. State staff and regional consultants follow-up with the localities, and recoveries are reported in the financial systems. Vendors who are found to have committed fraud are permanently disqualified from program participation. Providers may appeal under Virginia’s Administrative Process Act. Applicants/recipients will be disqualified from participating in the child care subsidy program for 3 months upon the first finding of child care fraud, 12 months upon the second finding and permanently upon the third finding, unless otherwise mandated by court. Applicants/recipients may appeal through the agency’s administrative disqualification process. Appeals are heard and determined by hearing officers in the VDSS Division of Appeals and Fair Hearings. Should an applicant/recipient choose, they may further appeal to Circuit Court. d. How the Lead Agency knows that the risk assessment processes utilized are effective. Describe: Through the VDOE annual internal control self-assessment activity, compliance testing is performed to determine the extent to which staff follow prescribed policies and procedures in actual practice. Testing compares actual actions against established policies and procedures to determine how well internal controls are being followed. Testing methods such as reviewing sample transactions, observing operations, and interviewing key personnel involved in the processes are used to evaluate the effectiveness of the internal control and related risk assessment. Findings of the self-assessments are then analyzed to determine the level of compliance with key controls, and to identify the cause of any exceptions. Key activity controls tested include both preventative controls (to stop inappropriate transactions before execution) and detective controls (identify erroneous or questionable transactions after they have occurred on a timely basis). VDOE also validates the risk assessment tools by tracking and analyzing results of various monitoring functions, including reviews conducted by Procurement staff on contracts and agreements, Single Audits findings of all subrecipients and contractors, sample monitoring and testing performed by the Payment Accuracy and Vendor Relations Units, compliance reviews of local departments of social services, and monitoring by Regional Practice Consultants. Staff interviews are also conducted to identify any concerns with prevention or detection tools. e. Other. Describe: 10.1.5 Processes to train about CCDF requirements and program integrity Describe the processes the Lead Agency uses to train staff of the Lead Agency and other agencies engaged in the administration of CCDF, and child care providers about program requirements and integrity. a. Describe how the Lead Agency ensures that all staff who administer the CCDF program (including through MOUs, grants, and contracts) are informed and trained regarding program requirements and integrity. i. Describe the training provided to staff members around CCDF program requirements and program integrity: VDOE works with the VDSS to provide written guidance on program requirements. Informational memos are distributed when there are program changes and webinars provide additional more detailed guidance. Training classes are also offered for new staff and annual training is developed for all staff. There is a specific training for program integrity and identifying fraud that is offered each year. ii. Describe how staff training is evaluated for effectiveness: Regional Practice Consultants conduct monitoring activities at the local departments of social services related to eligibility determinations, case changes, and redetermination. They also provide training and daily technical assistance to staff and track questions that are raised regarding CCDF, which are compiled and shared with state staff. Payment Accuracy staff conduct case monitoring, and the Virginia Department of Social Services’ Local Review Team conducts compliance reviews of administrative expenditures at all localities. Based on the outcomes of the reviews, compilation of data, and monthly meetings to discuss issues and concerns, topics of needed training are identified. Program manuals and on-line training courses are revised to ensure that training materials are up to date, and information broadcasts are distributed to all CCDF staff and local agency management frequently as clarifications or changes are warranted. State and local staff are also subject to an annual employee performance planning and evaluation process. All employees and their supervisors identify areas in which training is needed to improve performance outcomes. iii. Describe how the Lead Agency uses program integrity data (e.g., error rate results, risk assessment data) to inform ongoing staff training needs: Results from monitoring and regular error rate reviews are used to inform weaknesses and areas of improvement for staff. If common mistakes are identified, training and technical assistance can be provided to the localities and used for future training topics. b. Describe how the Lead Agency ensures all providers for children receiving CCDF funds are informed and trained regarding CCDF program requirements and program integrity: i. Describe the training for providers around CCDF program requirements and program integrity: Providers have access to many training opportunities. Orientation sessions are held for child day centers and family day home providers. Both licensed and unlicensed providers have virtual training opportunities. Child Care Aware of VA also offers an orientation on CCDF requirements to all child care providers. ii. Describe how provider training is evaluated for effectiveness: The Office of Child Care Health and Safety conducts their annual inspections to help evaluate compliance with state and federal requirements. Trainings or policy clarification memos are developed from the areas of non-compliance found during the reviews. iii. Describe how the Lead Agency uses program integrity data (e.g., error rate results, risk assessment data) to inform ongoing provider training needs: If patterns of error or non-compliance appear in the data, policy clarifications and training is prepared. 10.1.6 Evaluate internal control activities Describe how the Lead Agency uses the following to regularly evaluate the effectiveness of Lead Agency internal control activities for all CCDF expenditures. a. Error rate review triennial report results (if applicable). Describe who this information is shared with and how the Lead Agency uses the information to evaluate the effectiveness of its internal controls: Virginia has a team dedicated to the error rate reviews. This team conducts annual case monitoring according to the federal improper guidelines. Consultants at the regional level review program implementation by the local departments of social services using a standardized case and fiscal review process and risk assessment. When errors are noted, the local department of social services is required to submit a corrective action plan. Payment errors are collected through a reimbursement offset process. Additionally, the sub-recipient monitoring coordinator, completes an error analysis report that is shared to program staff. The results of the analysis inform areas for targeted training. Training plans are developed each year for local departments of social services and vendors. b. Audit results. Describe who this information is shared with and how the Lead Agency uses the information to evaluate the effectiveness of its internal controls: VDOE receives an annual audit from the Virginia Auditor of Public Accounts (APA). The results of the audit are issued to the Governor of Virginia, Joint Legislative Audit and Review Commission, and Superintendent of Public Instruction for the Department of Education. Results are also published on the APA website and included in the Commonwealth of Virginia Single Audit Report, which is also published on the Virginia Department of Accounts website. The audit report is discussed with VDOE management during an exit conference, and the agency’s response is recorded and published with the audit report. The APA report is then distributed to division managers and relevant staff that are responsible for preparing the corrective action plans. Staff use this information to identify weaknesses in internal controls that led to the findings. Strengths and weaknesses are analyzed to determine the effectiveness of the internal controls and adjustments are made accordingly. The Virginia Department of Accounts (DOA) also conducts period compliance monitoring, which includes fiscal and internal control reviews. Results of the compliance reviews are issued to the Superintendent of Public Instruction for the Department of Education, and are published on the DOA website. The compliance review report is discussed with VDOE management during an exit conference, and corrective action plan requirements are shared with applicable staff. c. Other. Describe who this information is shared with and how the Lead Agency uses the information to evaluate the effectiveness of its internal controls: 10.1.7 Identified weaknesses in internal controls Has the Lead Agency or other entity identified any weaknesses in its internal controls? a. [x] No. If no, describe when and how it was most recently determined that there were no weaknesses in the Lead Agency’s internal controls. Virginia Department of Accounts Comptroller’s Directives for Agency Risk Management and Internal Control Standards (ARMICS). ARMICS is a mandate of the Commonwealth of Virginia, which requires State Agencies to implement internal control standards and ￿best practices.￿ ARMICS was developed based on the COSO framework of internal controls, and requires that all agencies demonstrate that it has the necessary internal control components to: · Provide accountability for meeting Agency objectives; · Promote operational efficiency and effectiveness; · Improve the reliability of financial statements; · Strengthen compliance with laws and regulations; and · Reduce the risk of financial or other asset losses due to fraud, waste, or abuse. b. [ ] Yes. If yes, what were the indicators? How did you use the information to strengthen your internal controls?