That’s because the state has no well-documented disaster recovery plan and doesn’t run periodic disaster tests.

Thousands of Mainers may be taking advantage of the unemployment system run by the Maine Department of Labor, forcing the state to spend millions of dollars more than it should. Or not. No one really knows.

One-third of the unemployment claims examined by the state auditor last year did not have a required work-search log. Claimants may be looking for jobs; they may not be. It hasn’t been well-tracked.

Maine Center for Disease Control and Prevention officials insist the state’s vaccines have been stored at the proper temperature, but the state auditor can’t be sure.

Last year, CDC workers either were not testing the refrigerators’ temperatures as required or were testing them but not entering the results into the computer system.

The findings in the latest state audit go on for more than 100 pages: key computer systems left vulnerable, money spent without oversight, questionable eligibility for state assistance programs, errors in accounting, rules not followed, important policies and procedures not in place and workers not doing their jobs or doing them wrong.

Some of the issues are new. Others have been going on for years, bouncing from one audit to the next, despite officials’ promises that they’ll be fixed.

Both the current state auditor and her predecessor call that frustrating — “especially because (my office knows) there are opportunities to save money,” current auditor Pola Buckley said.

Department leaders and state officials say they’re working on it. The problems, they promise, will be fixed.

‘They’re all important’

The Maine Department of Audit has been responsible for inspecting the state’s financial statements and expenditures of federal money every year since 1987. It also looks to see if a department has required policies and procedures in place and whether it is following those rules. The audits are done using nationally accepted standards, and the audit department itself undergoes a peer review, including federal auditors, every three years.

The department is charged with remaining independent as it looks into 22 to 28 major programs in other state departments, including the Health and Human Services, Education, Labor and Transportation.

The most pressing findings are noted in the audit report itself. That’s where the auditor presents material weaknesses and material noncompliance problems (most severe) and significant deficiencies (less severe but still worrisome). Other findings, considered less serious by the auditor, are presented in an accompanying management letter. But the ranking of importance can be subjective.

“I found myself always concerned that they’re all important to correct,” said Neria Douglass, who served as state auditor for eight years until this past January, and now serves as state treasurer.

Every finding comes with an auditor’s recommendation for fixing the problem, as well as a response/corrective action plan by the department being audited.

The audit department gives its findings to lawmakers, the governor’s office and the departments that have been audited. It has no power to force anyone to follow its recommendations, and it has no authority to sanction a state department for severe and repeated problems.

However, the federal government does. It uses the annual audit to gauge how well Maine is handling federal money and following federal rules. It can require the state to pay back money that has been mishandled; divert new, incoming federal funds to fix a problem; or bar the state from receiving additional federal money.

Less-serious management letter findings are not sent to the federal government.

Experts say it’s unreasonable to expect a perfect, finding-free audit. Federal requirements are intricate and ever-changing. The state handles billions of dollars a year and oversees hundreds of programs. And state workers are only human.

In 2003, for example, the audit found the Maine Department of Public Safety had accidentally sent the wrong person a check for $1.2 million. The check was returned within a few days.

Department leaders point out that the number of audit findings has gone down in recent years. But while some of that is likely due to improvement, some of it is because findings were consolidated and there have been changes to the mix of programs audited.

DHHS often has among the most findings. It’s a large department that oversees a lot of the state’s programs and deals with a lot of federal money and federal rules, so it’s easy to misstep or inadvertently break a rule.

But DHHS often has repeated findings from one year to the next.

“They’d say, ‘Well, we’re going to do ABC to comply with the finding.’ Then they either would do A and B and not get to C, or we’d find whatever they were going to do didn’t really get the job done,” Douglass said.

The most recent audit found:

* Policies and procedures in place for the Income and Eligibility Verification System are not always followed. No follow-up was documented for 17 of 60 client cases the auditor examined, including cases in which the clients were deceased, incarcerated or had moved out of state. It’s been a finding since at least 2009.

* No adequate procedure is in place to determine eligibility for the Children’s Health Insurance Program, or CHIP. It’s been a finding since at least 2010.

* DHHS pays millions of dollars each year to the Centers for Medicare and Medicaid Services for Medicare Part A and B premiums for Mainers — $117 million in 2012 — but it can’t ensure that those Mainers are eligible. It’s been a finding since at least 2010.

“The feds send a paper copy of the invoice and an electronic file with all the detail, but the Department of Health and Human Services pays the bill off the hard copy without checking to make sure those people are eligible,” Buckley said. “It could be that everything’s fine . . . or it could be (costing Maine) millions of dollars. Or it could be somewhere in between.”

DHHS officials say they’ve seen their overall findings drop in recent years, from 59 in 2009 to 38 in 2012, and questioned costs have decreased from $15.2 million to $2.1 million. DHHS hired an internal auditor several years ago, and officials there say they are working on fixing repeat findings.

The department did not completely agree with the auditor’s finding that DHHS didn’t have adequate procedures in place to determine eligibility for CHIP. Officials said eligibility was actually incorrectly determined in only one case, though the department knows it has some issues stemming from two computer systems.

“This is one of those corrections that will take a little time to take care of,” said DHHS spokesman John Martins. 

DHHS isn’t the only state department with repeated findings.

Sometimes a department just doesn’t agree with the auditor. Officials believe they’re doing things the right way, no matter what the auditor says.

That’s what has happened with a finding involving the Department of Administrative and Financial Services. For years, the auditor has said the department isn’t properly accounting for the transfer of money between the Dirigo Health Enterprise Fund and Fund for a Healthy Maine. However, department officials say they’re doing it the way that both meets accounting standards and is most meaningful for readers of the financial statements.

“It’s not that it’s recorded incorrectly or recorded for the wrong amount — it’s just on a line that’s different from what they want,” said State Controller Terry Brann, whose office is part of the Department of Administrative and Financial Services. “There really is no way to resolve it other than, at some point, one or the other adjusts their position.”

It’s gotten to the point that the department’s response to the auditor is now a copy-and-paste of its response the previous year.

Sometimes a department agrees with the auditor but says it doesn’t have the time or the means to fix the problem, even when the issue comes up more than once.

For at least the past couple of years, the state auditor found the Department of Labor wasn’t making sure people with unemployment claims proved they were looking for work, as required. The latest audit found missing logs for about a third of the 120 cases it examined.

The situation so concerned Buckley that she brought it to the attention of the Legislature’s State and Local Government Committee even before the audit report was finished.

DOL officials said they received so many unemployment claims during the recession that it was hard to keep up. At the peak, the DOL was receiving paperwork search logs from up to 25,000 people.

The department now requires that claimants maintain logs but only send them in when requested. DOL officials hope the more targeted checks will catch fraud while cutting down on paper overload.

“It makes the enforcement piece easier because we’re not focusing on counting paper but on doing the audits on the individuals we have flags about,” said Julie Rabinowitz, spokeswoman for DOL.

Since at least 2009, the audit has found that the Maine Department of Education doesn’t make sure school systems comply with federal regulations after they receive federal money. The latest audit found the DOE monitored only 10 of 144 school systems.

Department officials say they started getting the manpower and resources they needed to deal with the situation in 2012.

“We have over 300 grant recipients, and with 365 days in a year and each review taking anywhere from several days to several weeks, we can’t get the monitoring in for everybody, obviously, in a year. So we have developed some new methods and procedures,” said Heather Neal, supervisor of the department’s fiscal review and compliance team. “Right now, we’re going out and we’re trying to test things to make sure our methods are effective and efficient.”

Department officials expect to have the issue fixed by February 2014. However, if they don’t, auditors may not bring it up anymore.

If the federal government doesn’t take action, repeated findings can drop off the audit after a few years.

New findings

Not every finding is repeated. Several new ones made the the audit for 2012, including:

* The statewide computer system and other program or department computer systems have no well-documented disaster recovery plan and do not go through periodic disaster recovery testing.

* There is no way to tell whether school systems provided accurate child counts to the Maine Department of Education last year because the department didn’t have them certify the numbers given. Child counts are used to determine how much money school systems get in state aid, among other things.

* The auditor found security weaknesses in ImmPact, the statewide, Web-based computer system that orders, administers and tracks vaccinations, and stores Mainers’ immunization records. The auditor was so concerned that someone could get into the system or access confidential medical information that the audit department refused to publicly disclose any details about those vulnerabilities. The auditor also found that more people had administrator-level access to the system than should have. ImmPact was one of the systems that had no well-documented recovery plan.   

*  Thirty-two of 40 site reviews showed CDC workers had not tested the temperature of vaccine refrigerators as required by the federal government. The auditor could not ensure vaccines were stored at the proper temperatures.

* Weaknesses were found in the Department of Transportation’s IT system, including the computer systems that process more than $370 million in federal expenditures and the department’s payroll.

* The Department of Labor’s Bureau of Unemployment Compensation turned in federal unemployment tax forms three and a half months late.

* No policies and procedures were in place at the Maine Department of Transportation or the Department of Economic and Community Development to ensure federal money went to parties that were not suspended or barred from federal assistance programs.

The new findings involve millions of dollars, the safety of public health and the security of sensitive information. Many could be traced to human error. A number of those involved a new worker who didn’t know what had to be done or wasn’t certified to do it.

Some department officials disputed, lamented or were surprised by some of the new findings.

Deborah Johnson, director of the Office of Community Development, which is part of the Department of Economic and Community Development, said her department always ensures that the parties aren’t suspended or barred from federal assistance programs before it passes on federal money. But in the instance examined by the auditor, she said, the federal government had approved the towns getting the money, so the department didn’t do its own check.

“This was a one-shot deal,” she said. “We pride ourselves on never getting any findings.”

DOT officials said they, too, always run a check before awarding federal money. The audit, they said, caught the one time rules weren’t followed by an inexperienced staff person. They were surprised the mistake had been made.

“Our director of contracting came to me and she’s like, ‘I have no idea how this happened — we always check these,'” said Karen Doyle, director of finance and administration for the DOT. “It was just a case of the person that did this purchase doesn’t usually do purchases. They do other things. But because it was a crane, we used his expertise in knowing what a crane should do and didn’t realize he didn’t know the contracting part as well as we thought.”

The department’s contracting unit now checks all federal award recipients, whether the award involves a contract, purchase or something else.     

Although the auditor said CDC workers didn’t test the temperature of vaccine refrigerator units, department officials are certain they did. The problem was that temperature-recording wasn’t marked “mandatory” in the computer system, so some workers didn’t log it in, they said.

The field is marked “mandatory” now.

“One of the old audit axioms is, ‘If it’s not documented, it didn’t happen,'” said Herb Downs, director of the Division of Audit for DHHS, the department that oversees the CDC.

Generally, department officials agreed with the auditor’s new findings and agreed there were issues — and potentially serious problems — that needed to be fixed.

Some individual departments have well-established recovery plans should something happen to their computer systems, but the statewide system does not. That has worried officials at the Office of Information Technology as much as it concerned the auditor.

“If a crisis hit, we have the people and personnel to jump into action and fix things, but we want it more automated,” said Jim Smith, chief information officer for OIT. “You just can’t afford to be down for some of these critical systems anymore.” 

Smith was so concerned that he brought up the issue during a discussion with Gov. Paul LePage. The governor, he said, requested a comprehensive plan to improve preparedness.

OIT is now working on it. It’s about three-quarters of the way through identifying critical pieces of the system and is planning to work with a third party on disaster recovery planning and is establishing annual or semi-annual disaster recovery drills.

“We take this very seriously,” Smith said. 

Sent to lawmakers

The state’s annual audit report and management letter are posted on the state’s website. Although they typically get little attention, at least one taxpayer has taken note.

Jennifer Murray, a former member of Casco’s Finance Committee, began studying town audits a few years ago in an effort to find out more about local spending. That recently led her to search out the latest state audit.

She got just a few pages into it before she got angry.

“(Maine has) budget concerns over and over, yet we can’t even manage what we have, constantly, in these departments,” she said. 

Murray approached the Sun Journal with her concerns. She believes too few people are paying attention to the findings.

“If I went in the room and I said, ‘Raise your hand if you know what a management letter is,’ I don’t think our legislators, I don’t think our senators, they probably wouldn’t even know how to explain what it is,” she said. 

The audit was sent to the governor’s office, speaker of the house and president of the senate.

In a statement released by his office, House Speaker Mark Eves, D-North Berwick, said he was briefed on the latest audit by senior legislative staff and the state auditor. He said his staff also carefully reviewed the report.

He was most concerned about the DHHS findings that called into question eligibility for state assistance. 

“Making sure programs like food stamps, Medicaid and foster care assistance go to the appropriate people is critical to safeguarding our taxpayer dollars,” he said in the statement. “These benefits must go to the people the law intended to help — our truly needy. In the last five years, we’ve seen errors in the system reduced, but this audit shows we still have more work to do.”

The governor’s office also released a statement saying the governor has reviewed the audit and is confident in the continuing work within the state agencies.

“Staff within the administration is working on addressing weaknesses and is committed to the audit process as an integral part of the government’s system of ‘checks and balances’ — not only in providing a review of state program stewardship, but also in fostering accountability to Maine citizens,” the statement said.

It added, “The audit process, while it typically has not been widely reported on, is certainly an area the governor takes interest in. We realize we cannot fix every problem overnight. However, it is imperative to serve taxpayers’ interests by improving fiscal management in a timely manner to the best of our ability.”

The Appropriations Committee also looks at the audit report every year. However, committee members focused so much time and attention on the state budget this spring and summer that they haven’t yet taken up the audit. Co-chairwoman Rep. Peggy Rotundo, D-Lewiston, said the committee likely will invite Buckley to present the audit at the committee’s August or September meeting.

Department leaders also received a copy of the audit findings. All say they’re working on the issues presented. The DOE was so concerned about its repeated findings that about two and a half years ago it put together a team of people to track and fix audit findings. DHHS has had its own internal auditor since 2009. The department recently received legislative approval to hire three more people, giving the department a team to deal with audit findings.

Although department leaders say they’re working on their problems and the number of findings has decreased in recent years, the current and former auditor remain concerned about some of the findings that remain — particularly those that have repeated.

“When they continue year after year, you find yourself thinking, ‘This is now a priority,'” Douglass said.

She said she met with department leaders over the years, in both the past and current administrations, in an effort to get some of the repeated problems fixed, particularly at DHHS. But while there were a lot of promises, she said, the problems continued to come up for one reason or another.

“I like to think there’s a will to fix these problems,” Douglass said. “Sometimes they’re just more difficult to fix than you might otherwise think. And the other side of things is that they’re often focused on delivering services rather than complying.” 

She added, “Ultimately, I think it’s important to remember that when we get federal funds or when we conduct a program and we have criteria, we need to make sure we comply with the requirements.”

Buckley, the current auditor, also wants to reduce the repeated findings. Hoping that greater awareness might help, she’s looking at changing the report to note next to repeated findings all the years they’ve made it into the audit. It might be harder, she thinks, to ignore a finding that has 2010, 2011 and 2012 marked beside it.

“We’re still very committed to getting our message across,” she said.

But whether or not its departments listen to the auditor’s concerns, Maine may soon not have much of a choice about fixing its problems.

The federal government, Buckley said, is starting to be stronger in its own follow-up.

ltice@sunjournal.com

Some findings in the most recent state audit:

DEPARTMENT OF ADMINISTRATIVE AND FINANCIAL SERVICES

Division of Financial and Personnel Services

* Lottery fund’s accounts receivable balance is not supported by detail records. Can’t provide a report with an accounts receivable balance for lottery games by lottery agent. Opens the possibility that the state doesn’t have an accurate accounting of money owed by lottery agents.

Maine Revenue Services

* The procedure used to calculate the allowance for “uncollectable taxes receivable” is insufficient. Percentages largely based on judgment rather than quantitative/analytical method. Could make the valuation inaccurate.

Office of the State Controller

* Department did not properly account for the transfer of money between Dirigo Health Enterprise Fund and Fund for a Healthy Maine. Could cause an understatement of certain revenues and expenses.

General Government Service Center

* Didn’t follow federal cash management requirements. Of the 70 cash draws tested, 33 were not in compliance. Risks sanctions by the federal government.

Office of Information Technology

* Required risk analysis and security reviews not performed on the system that processes $2.5 billion in Medicaid claims. Due to staff turnover, lack of resources and misinterpretation of requirements. Raises potential security risks.

* Inadequate controls over Income and Eligibility Verification System data exchanges. Of the 37 IEVS data exchanges, auditors found problems with 29. System involves Medicaid and a number of assistance programs.

* Policies and procedures not always in place for IEVS to determine the eligibility and level of benefits. No follow-up documented for 17 of 60 client cases examined, including clients who were deceased, had moved out of state or were incarcerated.

* Weakness found in the Department of Transportation’s IT system, including the information systems that process more than $370 million in federal expenditures and the department’s payroll. Could be a security risk.

* No well-documented disaster recovery plan in place and periodic disaster testing not performed on the statewide computer system.

Department’s response: Officials disagree with some findings, including that the procedure used to calculate the allowance for “uncollectable taxes receivable” is insufficient and that the department did not properly account for the transfer of money between Dirigo Health Enterprise Fund and Fund for a Healthy Maine. They also say they can provide the state lottery information the auditor wanted, but not in the way requested. The department is working on that. Officials say they are also working on addressing the other findings, including the need for a statewide computer system recovery plan. 

DEPARTMENT OF EDUCATION

Education Finance

* No adequate procedures in place to ensure that grant recipients had actual expenditures before they got reimbursed. Involved a program with 180 grant recipients and $112.1 million.

Special Services

* Spent $65,846 more than allowed by the federal government for administration and other state-level activities. Involved $6.2 million in administrative spending for a school-age special education grant program. Human error. Money was returned to the federal government.

* Didn’t adequately monitor school systems to make sure they comply with federal regulations when they receive federal money. Only 10 of 144 monitored. School systems could break federal rules and the DOE wouldn’t know.

* Didn’t get certification from school systems that their child counts are accurate and have not been duplicated. Could result in incorrect decisions about school aid and other funding. 

* Incorrect child count data used in determining special ed preschool grants. Human error. Could have caused some school systems to receive a too-small or too-large share of grant money.

Child Nutrition Services

* Didn’t report information required by the Federal Financial Accountability and Transparency Act regarding the $42 million school nutrition program. Risks federal sanctions.

Department’s response: For the past two and a half years, the department has maintained a team of people to track and fix audit findings. It agrees with the majority of the latest findings and either has fixed the issues or is working on fixing them.

DEPARTMENT OF HEALTH AND HUMAN SERVICES

Center for Disease Control

* Auditor found security weaknesses in ImmPact, the statewide, Web-based computer system that orders, administers and tracks vaccinations, as well as storing Mainers’ immunization records. Could allow inappropriate access, modification or disclosure of confidential or sensitive information.

* More people had administrator-level access to the ImmPact system than should have.

* ImmPact system has no well-documented disaster recovery plan and periodic disaster recovery testing is not performed.

* CDC workers had not tested the temperature of vaccine refrigerators as required by the federal government. Auditor could not ensure vaccines were stored at the proper temperatures.

* The immunization program was charged $1,121 for desktop support and technology services by the Office of Information Technology for two temporary employees who no longer worked for the program. OIT did not know the two weren’t working there anymore. OIT’s monthly charges were not reviewed by the immunization program.

Service Center

* Did not submit accurate data regarding expenditures of federal awards, including the over reporting of $949,640 for TANF, over reporting of $557,455 in Child Care Development Fund money and misreporting of $1.8 million in SNAP money. Human error.

* Costs not allocated correctly; some programs overcharged and some undercharged. Caused by human error, lack of communication and training and insufficient data for cost allocation.

* No proof that an authorized person approved an expenditure. Also, a travel voucher was approved by someone not authorized to approve one. Caused by human error and unfamiliarity with state policy. Opens the possibility that the state paid for expenses and travel that it shouldn’t have.

Office of Child and Family Services

* Purchased movie tickets as part of a group activity for foster parents and children. Expense not allowed.

Office of MaineCare Services

* Recouped an excessive amount of Cost of Care money from private nonmedical institutions. 

* Did not hold vendor responsible for securing the computer system that deals with the CHIP health coverage program for children. It could not assure the auditor that electronic information was secure in transit, that the data could be recovered in the event of a disaster and that it had an adequate contingency plan should something happen to the system. Could lead to fraud, abuse, the disclosure of personal information, unintentional errors and the disruption of claims processing or payments to providers

* Did not ensure vendor performed a risk assessment to evaluate the new MaineCare claims management system. That system processes Medicaid and CHIP claims totaling $2.5 billion per year. Lack of evaluation could lead to fraud and the potential disclosure of personal health information.

* Access controls over Maine Integrated Health Management Solution computer system need to be improved. Could lead to fraud, abuse, disclosure of protected health information or other errors.

* Pharmacy providers overpaid, likely by $662,000. Money not recovered as of the audit report’s publication. 

* Paid $117 million to the Centers for Medicaid and Medicare Services for Medicare Part A and B premiums for Mainers, but it can’t ensure those Mainers are eligible.

* No controls in place to ensure provider agreements contain required provisions, including that the provider will comply with patients’ advance directives.

* No adequate procedure to determine eligibility for CHIP, the health-care insurance program for children.

Office for Family Independence

* Medicaid Eligibility Quality Control unit was unable to find two of the 40 cases selected for review.

* Did not require one TANF recipient to engage in qualified work or document exception. Due to a new staff member’s training being interrupted by the reassignment of his or her supervisor.

Department’s response: The department has had its own internal auditor since 2009 and recently received legislative approval to hire three more people, providing a team to deal with audit findings. The department agrees with the majority of the most recent findings and have fixed a number of them, including ensuring that workers record the temperature of vaccine refrigerator units and limiting the people who have administrative access to the ImmPact system. It is working on fixing other findings.

DEPARTMENT OF LABOR

Bureau of Unemployment Compensation

* Turned in federal unemployment tax forms three and a half months late.

* One-third of unemployment claims examined lacked a work-search log. Could be paying millions of dollars in unemployment to people who aren’t looking for work.

Department’s response: Officials say newly hired employee didn’t have the certification needed to submit the unemployment tax forms for the federal government. The employee is certified now and the job description has been flagged to ensure any future hires are certified before they begin work. The department agrees that some work-search logs were missing because it had trouble keeping up with the influx during the recession, though officials believe the potential impact and cost to the system is much less than the auditor proposed. Regardless, the department has changed its policy. It now requires that claimants maintain logs but only send them in when requested. Officials hope the more targeted checks will catch fraud while cutting down on paper overload.

MAINE DEPARTMENT OF TRANSPORTATION

Contract Procurement Office

* Did not have policies and procedures in place to ensure awards were made only to parties not suspended or barred from federal assistance programs.

Department’s response: Officials agree with the finding, though note they have always run such a check before. This was a one-time situation involving an inexperienced staff person who normally deals with another part of the department. The department’s contracting unit now checks all federal award recipients, whether the award involves a contract, purchase or something else.

DEPARTMENT OF ECONOMIC AND COMMUNITY DEVELOPMENT

Office of Community Development

* Did not have sufficient procedures in place to ensure that awards were made only to parties who were not suspended or barred from participating in federal assistance programs.

Department’s response: The department always ensures that the parties aren’t suspended or barred from federal assistance programs. In this instance, the federal government had approved the towns getting the money and so the department didn’t do its own check. It will run checks on all parties in the future.