Evidence record
Department of Medical Assistance Services Report on Audit for the Year Ended June 30, 2024
- Jurisdiction
- Virginia
- Publishing agency
- Virginia Auditor of Public Accounts
- Publication date
- December 13, 2024
- Source record
- Original document linked
Findings
7
Recommendations
7
Overall conclusion
Medical Assistance Services properly stated, in all material respects, the amounts recorded and reported in the Commonwealth’s accounting and financial reporting system, Medical Assistance Services’ financial systems, and supplemental information and attachments submitted to the Department of Accounts. The audit identified internal control and compliance findings that require management’s attention and corrective action, including one material weakness and several significant deficiencies. Management has taken adequate corrective action with respect to two prior audit findings identified as complete in the Findings Summary in the Appendix.
Scope
Audit of the Department of Medical Assistance Services (DMAS), including the Medicaid Cluster and Coronavirus State and Local Fiscal Recovery Funds federal grant programs, for the fiscal year ended June 30, 2024. The scope covered DMAS’s financial transactions, internal control over financial reporting, and compliance with applicable laws, regulations, contracts, and grant agreements. It included controls over accounts payable, accounts receivable, contract procurement and management, general fund revenues (drug rebates) and expenses, federal revenues/expenses and compliance for the Medicaid Cluster and CSLFRF, provider assessment revenues and expenses, and information system security (including access controls). The audit assessed the reliability of DMAS’s financial reporting as presented in the Commonwealth of Virginia’s Annual Comprehensive Financial Report and its compliance with the Department of Accounts and the federal single audit; it also examined corrective actions related to prior-year findings and risk alerts related to unpatched software and centralized audit log information. The audit considered DMAS’s relationships with its fiscal agent and IT third-party service providers, and used nonstatistical sampling; the Single Audit Report will be available in February 2025.
Findings (7)
Each finding has a stable link.
- F-705
Obtain and Review Information Security Audit
- F-706
Perform Annual System Access Reviews
- F-707
Improve Information Security Program and Controls
- F-708
Improve Fiscal Agent Oversight
- F-709
Improve Database Security
- F-710
Improve Vulnerability Remediation Efforts
- F-711
Improve IT Third-Party Oversight Process
Recommendations (7)
- R-643
Develop and implement formal database security policies and a baseline configuration aligned with the CIS Benchmark; establish a process to review configurations on a scheduled basis and address gaps identified in the FOIAE document.
Related finding F-709 - R-644
Allocate resources to remediate vulnerabilities within the required timeframes (e.g., high within 30 days, medium within 60 days, others within 90 days) and obtain extensions if needed; ensure ongoing vulnerability monitoring.
Related finding F-710 - R-645
Finalize and implement the IT Third-Party Risk Management Procedure; verify monthly the geographic location of sensitive data, ensure vulnerability scans are performed every 90 days, and ensure formal oversight is conducted in a timely manner.
Related finding F-711 - R-639
Continue to obtain and review information security audits and ensure timely corrective actions are implemented.
Related finding F-705 - R-640
Continue to perform annual system access reviews and ensure results are properly acted upon.
Related finding F-706 - R-641
Prioritize and dedicate resources to timely completion of corrective action plans and ensure compliance with SEC530, addressing remaining IT general controls weaknesses.
Related finding F-707 - R-642
Work with the fiscal agent to add language requiring an independent assessment of internal controls over significant fiscal activities and financial reporting, and obtain a SOC I, Type 2 report annually.
Related finding F-708