Picture: State of Maine Seal OPEGA Performance Audit Final Report December 2007 Bureau of Rehabilitation Services: Procurements for Consumers - Weak Controls Allow Misuse of Funds, Affecting Resources Available to Serve all Consumers Report No. SR-BRS-06 a report to the Government Oversight Committee from the Office of Program Evaluation and Government Accountability of the Maine State Legislature GOVERNMENT OVERSIGHT COMMITTEE Sen. Elizabeth H. Mitchell, Chair Rep. Marilyn E. Canavan, Chair Sen. Kevin L. Raye Sen. Philip L. Bartlett II Sen. Jonathan T. E. Courtney Sen. Joseph C. Perry Sen. Dana L. Dow Rep. Scott E. Lansley Rep. Andrea M. Boland Rep. Everett W. McLeod Rep. Peggy A. Pendleton Rep. Michael A. Vaughan OFFICE OF PROGRAM EVALUATION & GOVERNMENT ACCOUNTABILITY Director Beth Ashcroft, CIA Staff Mary Gingrow-Shaw, Principal Analyst Jennifer Reichenbach, Senior Analyst Wendy Cherubini, Analyst Scott Farwell, Analyst Susan Reynolds, Analyst Etta Begin, Administrative Secretary Mailing Address:82 State House Station, Augusta, Maine 04333-0082 Phone: (207) 287-1901 Fax: (207) 287-1906 Web: http://www.maine.gov/legis/opega/ Email: etta.begin@legislature.maine.gov ABOUT OPEGA & THE GOVERNMENT OVERSIGHT COMMITTEE The Office of Program Evaluation and Government Accountability (OPEGA) was created by statute in 2003 to assist the Legislature in its oversight role by providing independent reviews of the agencies and programs of State Government. The Office began operation in January 2005. Oversight is an essential function because legislators need to know if current laws and appropriations are achieving intended results. Although the Maine Legislature has always conducted budget reviews and legislative studies, until OPEGA, the Legislature had no independent staff unit with sufficient resources and authority to evaluate the efficiency and effectiveness of Maine government. The joint legislative Government Oversight Committee (GOC) was established as a bipartisan committee to oversee OPEGA’s activities. OPEGA’s reviews are performed at the direction of the Government Oversight Committee. Legislators, committees, or members of the public should make their requests for reviews to members of the Committee or OPEGA directly. Copies of OPEGA's reports are free. Reports are available in electronic format at: http://www.maine.gov/legis/opega Hard copies of reports may be obtained by contacting OPEGA at: 207-287-1901 Table of Contents (Page numbers reference formatted copy) EXECUTIVE SUMMARY Purpose 1 Conclusion 1 Findings and Action Plans 2 FULL REPORT Purpose 3 Methods and Scope 4 Background 5 What are VR services and how are they funded? 5 How does BRS deliver VR services? 6 What is the Vocational Rehabilitation process? 7 How are goods and services procured for consumers? 11 What prior concerns existed with BRS procurement processes and how have they been addressed? 15 What are the internal controls and typical risks associated with a procurement process? 16 Conclusion 17 Findings & Observations 19 Management Actions 31 Agency Response 38 Acknowledgements 38 Agency Response Letter EXECUTIVE SUMMARY Bureau of Rehabilitation Services: Procurements for Consumers — Weak Controls Allow Misuse of Funds, Affecting Resources Available to Serve All Consumers Purpose The Bureau of Rehabilitation Services (BRS) is located within the Department of Labor (DOL). Its mission is to provide full access to employment, independence and community integration for people with disabilities. The majority of Bureau expenditures are for vocational rehabilitation (VR) services. VR services are governed by the federal Rehabilitation Act of 1973 and are intended to assist disabled individuals in achieving gainful employment. BRS provides these services through the Division for the Blind and Visually Impaired (DBVI), which exclusively serves blind and visually impaired persons, and the Division of Vocational Rehabilitation (DVR), which serves all others. Each year, approximately 11,000 VR cases are in open status at DVR and DBVI combined. In State Fiscal Year (SFY) 2006, DVR and DBVI spent $10 million to procure a variety of goods and services for their consumers with the goal of helping them achieve employment. Significant internal control weaknesses in BRS’ procurement process had been noted in past audit reports by both the State Auditor and an independent consultant hired by BRS. BRS had worked to implement recommendations from these audits, but no comprehensive review had been conducted to gauge whether the internal control system had been sufficiently strengthened. Given the past concerns and magnitude of expenditures involved, the Government Oversight Committee (GOC) directed the Office of Program Evaluation and Government Accountability (OPEGA) to determine whether internal controls for BRS VR programs are now adequate. OPEGA focused on current procurement processes and practices at DVR and DBVI, as well as transactions for SFY 2004 – 2006. Conclusion Despite actions taken by BRS to address past concerns, internal controls are still not adequate to assure expenditures for DVR and DBVI consumers are appropriate, reasonable, properly approved or accounted for. Consequently, OPEGA’s review found instances of the misuse of funds, including apparent fraud. Findings and Action Plans OPEGA has noted a number of serious findings as a result of this audit. In response to these findings, BRS and the Security and Employment Service Center (footnote 1 The Security and Employment Service Center is a unit of the Division of Financial and Personnel Services located within the Department of Administrative and Financial Services. It provides accounting and financial services support to BRS.) devoted significant attention and resources to designing a complete system of internal controls that will adequately protect State resources while maintaining the integrity of BRS’ mission and support its service improvement goals. BRS and the Service Center have committed to a variety of actions which OPEGA agrees should adequately address the concerns noted. These actions should also result in improved consumer outcomes and increased resources available to serve additional consumers. Table Summarizing Findings and Management Actions Findings 1. Weak control environment 2. Instances of misuse of funds, including apparent fraud 3. Inadequate policies and procedures to support proper stewardship of resources 4. Inadequate separation of duties for purchase transactions 5. Insufficient verification of expenditures 6. Poor documentation to support expenditures 7. Lack of computer controls Management Actions A. Implement revised procurement process by July 2008. B. Strengthen written policies and procedures by September 2008. C. Establish necessary computer controls in ORSIS (footnote 2 The Office of Rehabilitation Services Information System (ORSIS) is the primary application supporting VR services. ORSIS is used for federal reporting, tracking consumer progress and case expenditures, budgeting and procurement.) by Spring 2008. D. Implement redesigned case review system by January 2008. E. Initiate monitoring of ORSIS data to identify transactions or cases with risk indicators by March 2008. F. Conduct semi-annual Service Center audits of BRS procurement transactions beginning January 2008. G. Develop and conduct training programs for all employees by December 2008. H. Incorporate compliance with all fiscal and program requirements into performance reviews for all staff by June 2008. I. Complete comprehensive review, by February 2008, of other higher risk cases identified by OPEGA but not already examined in this review. We also observed that BRS may be able to increase resources available for all consumers by consistently asking consumers to contribute financially, if able, toward their own plans. In addition, centralizing the ORSIS computer servers could increase efficiency at BRS and reduce errors in ORSIS data. For additional details, see the full OPEGA report. FULL REPORT Bureau of Rehabilitation Services: Procurements for Consumers — Weak Controls Allow Misuse of Funds, Affecting Resources Available to Serve All Consumers Purpose The Maine Legislature’s Office of Program Evaluation and Government Accountability (OPEGA) has completed a performance audit of procurements for consumers served by the Bureau of Rehabilitation Services. OPEGA conducted this audit at the direction of the joint legislative Government Oversight Committee, in accordance with 3 MRSA §§991-997 and the Government Auditing Standards set forth by the United States Government Accountability Office. The Bureau of Rehabilitation Services (BRS) is located within the Department of Labor (DOL). Its mission is to provide full access to employment, independence and community integration for people with disabilities. BRS administers a number of programs, but the majority of Bureau expenditures are for vocational rehabilitation (VR) services. VR services are governed by the federal Rehabilitation Act of 1973 and are intended to assist disabled individuals in achieving gainful employment. BRS provides these services through the Division for the Blind and Visually Impaired (DBVI), which exclusively serves blind and visually impaired persons, and the Division of Vocational Rehabilitation (DVR), which serves all others. Each year, approximately 11,000 VR cases are in open status at DVR and DBVI combined. In State Fiscal Year (SFY) 2006, DVR and DBVI spent $10 million to procure a variety of goods and services for their consumers with the goal of helping them achieve employment. Significant internal control weaknesses in BRS’ procurement process were noted in past audit reports by both the State Auditor and an independent consultant hired by BRS. BRS had worked to implement recommendations from these audits, but no comprehensive review had been conducted to gauge whether the internal control system was sufficiently strengthened. Given the past concerns and magnitude of expenditures involved, the Government Oversight Committee directed OPEGA to conduct this audit. We sought to determine whether internal controls for BRS VR programs are adequate to assure that expenditures for consumers are appropriate, reasonable, properly approved and accounted for. Methods and Scope In performing this audit, we focused on current procurement processes and practices at DVR and DBVI, as well as transactions for SFY 2004 – 2006. Our work involved reviewing a variety of documents including: * the Rehabilitation Act and relevant federal and State regulations; * Single Audit Reports from the State Auditor; * the 2004 Financial Management Processes Review Report by independent consultant Berry, Dunn, McNeil and Parker; * reports resulting from similar audits of VR agencies in other states; and * BRS policies, procedural directives, training materials and the 2005-2006 Highlights Report. We also: * interviewed staff at various BRS field offices and the Service Center, as well as key informants from other organizations; and * documented procurement processes and associated risks and internal control activities. In addition, we analyzed three years of transaction data from BRS’ Office of Rehabilitation Services Information Services (ORSIS) system and the Maine Financial & Administrative Statewide Information System (MFASIS) to identify potential inappropriate expenditures or unusual procurement trends. We selected a limited sample of transactions in 68 case files identified as higher risk (footnote 3 Certain types of indicators, i.e. large payments made directly to consumers, or existence of multiple indicators made cases higher risk.) during that data analysis and examined them for evidence of appropriateness and compliance with procurement-related policies and procedures. Background What are VR services and how are they funded? The vocational rehabilitation services provided by BRS are comprehensive and varied, going beyond those found in routine job training programs. They can include: * functional assessments; * job development and coaching; * work evaluations; * medical and therapeutic services; * miscellaneous goods; * provision of assistive technology or equipment and associated training; and * financial assistance for post-secondary education, vocational training, transportation, self-employment business planning and start-up, and maintenance expenses such as occasional rent and interview clothing. Most of DVR and DBVI’s VR services are funded by annual federal grants from the Rehabilitation Service Administration’s (RSA) Vocational Rehabilitation Program. These grants require a State General Fund match of about 21%. The Bureau also receives several smaller federal grants, program income from the Social Security Administration and State allocations. In the three years reviewed by OPEGA, DVR and DBVI spent approximately $26.5 million purchasing goods and services for consumers, an average of about $8.8 million per year. The highest categories of expenditures were: * job development, supports, training and related services; * functional assessments of job-related implications of consumer disabilities; * post secondary education; and * transportation and maintenance. How does BRS deliver VR services? Maine is one of twenty-four states that delivers VR services through two separate agencies. DVR and DBVI are considered separate entities by the federal RSA. Each receives a federal grant from, submits an Annual Plan to, and is evaluated separately by, RSA. The BRS central office oversees DVR and DBVI as well as the Division of Deafness. The central office maintains and analyzes data for federal reporting. Statewide there are 10 DVR offices, six of which also house a DBVI office. A seventh DBVI office is located separately. Figure 1 illustrates the location of these offices, all of which are co-located with a DOL Career Center. (Description of Figure 1: Organizational chart with Bureau of Rehabilitation Services at top, DVR and DBVI underneath with offices below showing both divisions have offices in Augusta, Bangor, Lewiston, Portland, Presque Isle and Rockland. DVR has offices in Houlton, Machias, Saco and Skowhegan and DBVI has an office in Ellsworth.) DBVI’s 35 person staff includes the Director, and 10.5 Vocational Rehabilitation Counselors (VRC) overseen by 3 regional supervisors. In addition to VR, and outside the scope of this audit, DBVI administers the Independent Living Program for Older Blind Adults as well as the Business Enterprise Program. It also provides assistance to local school systems through the Blind Children’s Education Program. DVR’s staff of 107 is significantly larger, with 64 VRCs, 9 supervisors and 2 regional managers. This Division also coordinates the Bureau’s in-state accreditation process for private Community Rehabilitation Providers (CRP) serving both DVR and DBVI consumers. CRPs are vendors that provide job development, job coaching and job supports to BRS consumers. VR services are delivered or coordinated by VRCs carrying caseloads of approximately 120-140 consumers. Delivering these services effectively requires high quality professional judgment by VR counselors with support and coaching from their supervisors. VRCs are required by RSA to meet specific educational standards upon employment (a Masters Degree in VR counseling), or have a specific plan to attain their degrees while employed. In spite of high caseload sizes, both DVR and DBVI have historically had a wait list in effect for persons found to be eligible. For the past 3 years, BRS has worked diligently to reduce the wait list length. These efforts have yielded results. DVR’s wait list has been reduced by more than 50%, from a high of 12 months to less than 6; generally fluctuating between 4.5 and 5.5 months. DBVI’s wait list is much shorter, about 60 days, and is often invisible to consumers who can begin to receive services soon after eligibility has been determined. BRS has developed its own in-house information system, ORSIS, to facilitate federal reporting requirements and track consumer progress and individual case expenditures. Procurement transactions for consumer goods and services begin with data entered into ORSIS. ORSIS also tracks budget information and obligations, maintains information on consumer demographics, and tracks case status and outcomes by caseload and by office. What is the Vocational Rehabilitation process? By federal law, VR programs are highly individualized, serving persons with myriad barriers to employment and frequently changing medical, psychological and economic circumstances. Counselors are responsible for: * determining eligibility; * completing a Comprehensive Assessment of Rehabilitation Needs; * developing Individual Employment Plans (IPE) with consumers; * providing consumers with a selection of vendors to choose from; * assessing progress; * amending IPEs when necessary; and * deciding when to close cases as successful or unsuccessful. They are also responsible for ensuring each case and the case record is in compliance with the Rehabilitation Act and associated federal regulations, as well as State VR program policies. Figure 2 depicts the flow of the entire VR process. Consumers who question or disagree with the BRS decisions regarding their cases have the right to appeal at any point. All public sector VR programs are required to have an independent, associated Client Assistance Program to handle consumer complaints and appeals. Appealed decisions may be upheld or overturned but, regardless, the consumer is afforded the free support of an advocate to assist them in the process. Sometimes, a consumer is found eligible for services, and may begin receiving them, but circumstances develop that render the consumer no longer able to benefit from vocational services. In these instances, a VR decision is made to close the case and these consumers are also informed of the appeal process. (Figure 2 is a flow chart titled Vocational Rehabilitation Process. It shows the VR process as follows - Application and Eligibility Determination, Eligible - Order of Selection Category I Wait List, Comprehensive Assessment of Rehabilitation Needs, Development of Individualized Plan for Employement (IPE), IPE Implementation - DVR provides consumer with counseling, training, education, transportation, supported employment and other goods/services to meet vocational goals. Most purchases for consumers are made during IPE implementation, IPE amendments - If necessary, Successful Case Closure - Once individual has worked successfully in an integrated setting for at least 90 days, or for self-employment, earning income at or above minimum wage and income projections have been met or exceeded, Post Employment Services - If necessary. Next to the flow chart is a box with the following text inside: Unsuccessful Closures. Cases are closed for a variety of reasons: Found not eligible; Decides to leave the program at any point in the process - while on wait list, before IPE developed, after IPE developed; Refuses to cooperate or can't be located, Shown to be unable to benefit from VR Services. The Rights of Appeal are given to all applicants as well as contact information for the Client Assistance Program (CAP).) Eligibility The rehabilitation process for consumers at both DBVI and DVR is fundamentally the same. It begins with an individual filling out an application requesting services. Within 60 days of receiving a signed application, a VRC determines eligibility. BRS provides vocational rehabilitation services in accordance with federal regulations governing RSA’s Vocational Rehabilitation Services Program. To be eligible for services under this program, a person must: * have a physical or mental impairment that substantially impedes employment; * be able to benefit from VR services in terms of employment; and * require VR services to prepare for, enter, engage in, or retain employment. In Maine, and nationally, there has been an increase in the number of individuals accessing VR services with mental health and cognitive disabilities. Figure 3 shows a breakdown of the major disabling conditions served in DBVI and DVR in 2005.(Footnote 4 Maine Department of Labor, Bureau of Rehabilitation Services 2005-2006 Highlights Report.) (Figure 3 is a pie chart titled Major Disabling Conditions Served in VR Programs in 2005. The chart shows Mental Illness 32%, Blind and visually impaired 10%, Deaf/hard of hearing 7%, Physical 26% and Cognitive 25%) Maine is one of the states with inadequate resources to serve all eligible consumers who apply. The Rehabilitation Act requires states in this situation to use an Order of Selection (OOS) to prioritize those applicants with the most severe disabilities. Counselors are responsible for assigning a priority category. Currently in Maine, only individuals in Category I receive services. Individuals assigned Category II and III are provided with information and referral services. Comprehensive Assessment/Individual Plan for Employment The vocational rehabilitation program is designed to maximize consumer involvement in determining a vocational goal and achieving it. Consumers work with their VRC to complete a Comprehensive Assessment of Rehabilitation Needs. This assessment includes an identification of strengths, work history, preferences, career needs and a vocational goal. Following the assessment, the consumer and counselor develop an Individual Plan for Employment (IPE). The IPE is a written plan with specified services and supports necessary to achieve a vocational goal. Usually, the goal is a job in the general employment market at a standard rate of pay. Other acceptable employment goals include self-employment or, in the case of DBVI, homemaker. The homemaker goal is unique to DBVI consumers, 55% of whom were over 65 years of age in SFY 2006. Many of them were homemakers prior to developing a visual impairment and they do not desire outside paid employment. In these cases, the IPE focuses on helping the consumer be self-sufficient at home. In SFY 2006, 75% of DBVI’s successful closures were homemakers.(Footnote 5 Ibid.) In contrast, DVR consumers are typically much younger. In SFY 2006, 63% were between 23-54 years of age while 31% were under 23 years. (Footnote 6 Ibid.) Many of the younger consumers come to DVR while preparing to transition from high school special education programs to employment. In many of these cases, financial assistance with post-secondary education is a key component of the IPE. IPE Implementation During IPE implementation, counselors coordinate and monitor services necessary to reach an individual’s vocational goal. Job development, coaching, placement and supported employment services are purchased from outside Community Rehabilitation Providers. Figure 4 illustrates the roles of counselor, consumer and CRP. (Figure 4 titled Roles in the Vocational Rehabilitation Process shows the Consumer who has Goals, Preferences, Needs and Plans next to the Counselor providing Guidance, Tools, Resources and support. From this relationship comes the Individual Plan for Employment which is supported by Community Rehabilitation PRovider (CRPs) services, Educational Opportunities, Technological Supports, Medical Services and Miscellaneous Goods. CRPs are further described in a box - Community Rehabilitation Providers (CRPs) are one type of vendor that may be involved in a consumer's vocational rehabilitation. They typically provide services like job development and job coaching.) CRPs report regularly to the vocational rehabilitation counselors who are also in contact with consumers. Most VR expenditures for consumer services are for CRP services. Consumers may receive a variety of other services or goods necessitated by the IPE, such as costs of clothing for a job interview or travel necessary for participation in a VR service or to go to school. One growing category of expenditures is post-secondary education, reflecting current labor market needs for educated employees. Case Closure A case can be closed as successful once a consumer has worked at a job for at least 90 days, or met or exceeded their self-employment income or homemaker goals. For a short time, BRS can also provide post-employment services for individuals needing limited assistance to retain, regain or advance in employment. Consumers may also return to the program as new cases if their situation changes. There is no limit for how long a case may remain open. Successful DVR cases are currently taking an average of 36 months to move from application to closure. This represents an increase over 2003 of 5 months, partially due to time spent on the wait list and in IPE development. (Footnote 7 Division of Vocational Rehabilitation Services 2006 Annual Plan Draft) Successful DBVI cases currently move from application to closure in about 29 months. Many cases are closed prior to completing the VR process and achieving an employment goal. Cases are closed unsuccessfully when applicants are determined to be ineligible, leave while on the wait list, decide not to work on an IPE, are uncooperative, cannot be located or are found to be unable to benefit from VR services. Other factors can also impact the rate of unsuccessful closures and the length of time cases remain open. These include: * staff turnover; * Maine’s unemployment rate; * the availability of appropriate employment opportunities; and * the regional economy. DVR served 10,620 individuals during SFY 2005 and closed 2,847 cases. Of the closed cases, 1,106 were closed prior to an IPE being developed, 715 were closed after IPE development and 655 were closed successfully.(Footnote 8 Ibid.) DBVI served 926 individuals during the same time period and successfully closed 203 cases. How are goods and services purchased for consumers? DVR and DBVI use four procurement processes to purchase goods and services for consumers: standard, manifest, reimbursement and advance. The ORSIS system supports these processes by functioning as a purchasing and accounts payable system. Standard Process BRS’ standard process for procuring goods or services for consumers begins with the counselor determining a purchase is necessary to: * help ascertain consumer eligibility and strengths or limitations; * develop the IPE; or * meet the consumer’s vocational goal specified in the IPE. If the needed service is one provided by CRPs, the consumer selects a CRP from a list provided by the counselor. Only BRS-approved vendors can be used for CRP services. Pay rates for these services are set by BRS and included on the vendor list. Consumers choose non-CRP vendors, such as post-secondary schools, department stores, vehicle repair shops, etc., in consultation with VRCs.(Footnote 9 DBVI also has an annual contract with The IRIS Network to provide consumer services not covered in this audit.) (A sidebar summarizes 4 BRS Procurement Processes as follows. Standard - BRS approves individual expenditure prior to purchase and later confirms receipt. Manifest - BRS approves a series of future automatic payments to consumers. Reimbursement - BRS approves reimbursement for a purchase the consumer has already made. Advance - BRS approves payment to a consumer in advance of a planned future purchase.) The purchasing process is part manual and part electronic using forms in ORSIS called R20s. R20s serve as purchase orders. They are initiated by VRCs, completed in ORSIS and then printed. The printed copies must be signed by support staff, the case counselor, another counselor or a supervisor prior to being sent to vendors. After the goods/services are provided, vendors sign and return the original R20s which now serve as invoices. Separate vendor invoices or reports may also be provided with these documents. The case counselors verify, with the consumers, satisfactory receipt of all goods or services and then sign the R20s approving payment. If the case counselor signed the R20 before it was sent to the vendor, a different person must sign at this time to approve payment. Typically, support staff then enter the payment information in ORSIS and send the hard copies of the signed R20s via interoffice mail to the Security and Employment Service Center (Footnote 10 The Security and Employment Service Center is a unit of the Division of Financial and Personnel Services within DAFS. It provides accounting and financial services support to BRS.) within the Department of Administrative and Financial Services (DAFS) where they are filed. Each day, payment R20 transactions entered into ORSIS from every BRS office are electronically batched within the Bureau of Rehabilitation Services Information System (BRSIS). Service Center staff electronically pull the batch of transactions and review it for compatibility with the Maine Financial and Administrative Statewide Information System (MFASIS).(Footnote 11 As of July 1, 2007, MFASIS was replaced by AdvantageME.) This review involves checking that the vendors to be paid exist in the MFASIS vendor database and that Employment Identification Numbers are included in the electronic record where required. The Service Center then transfers the payment data from BRSIS into MFASIS. MFASIS processes this data and generates checks which are disbursed directly to vendors or consumers. Figure 5 illustrates the flow of transactions from ORSIS to MFASIS. (Figure 5 shows the transaction flow from BRS systems to DAFS systmes. Under BRS Systems is ORSIS which Maintains vocational rehabilitation case data - Case Activity Data, Case Notes, Consumer Data, Obligation Detail, Budgetary Detail and Expenditure Detail and BRSIS which Batches expenditures and has Limited Expenditure Data. Under DAFS is MFASIS which processes accounting transactions and produces checks and has Limited Expenditure Transaction Data.) It is important to note that procurements for consumer goods and services are processed differently than other BRS procurements. Transactions for expenditures related to employee travel and expenses, administrative supplies, etc. go through regular State procurement procedures at the Service Center rather than through ORSIS. Two or three levels of approval are required and the Service Center assures each payment document is adequately supported by other authenticated documentation (original invoices, purchase orders, etc.) before a check is issued. However, DAFS allows certain departmental information systems, including BRSIS, to interface with MFASIS directly without transactions going through additional review at the Service Center. It is assumed the necessary controls are in place in the individual departments where the transactions originated. Group Purchases The standard procurement process is also used for grouped purchases, primarily by DBVI. A number of items, such as canes, are purchased for a “group” consumer and disbursed as needed to individuals. Services, such as mobility and orientation instruction, may also be charged to group consumers although instructors typically do show the hours spent with each individual consumer on their invoices. Table 1 shows the number and dollar amount of group purchases for the three years reviewed. Goods and services procured as a group are processed in ORSIS under specially established group identification numbers rather than the identification numbers for specific consumers being served. Paper copies of group purchase invoices may be included in the manual case files maintained for the individual consumers served, but these transactions and associated costs are not captured in the electronic case records maintained in ORSIS for these consumers. Table 1. Dollar Amount and Number of Group Purchases by Division and SFY Amounts Spent - In 2004: DBVI $92,128 on 314 transactions, DVR $8,647 on 36 transactions, Total $100,775 on 350 transactions In 2005: DBVI $151,388 on 281 transactions, DVR $802 on 10 transactions, Total $152,190 on 291 transactions In 2006: DBVI $222,623 on 361 transactions, DVR $360 on 2 transactions, Total $222,983 on 363 transactions Totals for 3 years: DBVI $466,139 on 956 transactions, DVR $9,809 on 48 transactions, Grand Total $475,948 on 1,004 transactions Manifest Process Manifests are used to generate payments for a regularly recurring consumer need determined by the counselor, for example, the weekly cost of gasoline to attend a semester of school. A manifest authorization specifies the payment amount and the dates payments will be issued. Counselors authorize and approve the manifest R20s which are established in ORSIS. The electronic transaction is transferred to MFASIS and checks are automatically issued for the time periods established. Manifest payments are typically made to non-CRP vendors or directly to the consumer. Table 2 shows the number and dollar amount of manifest payments for the three years reviewed. Table 2. Dollar Amount and Number of Manifest Payments by Division and SFY Amounts Spent - In 2004: DBVI $1,750 on 9 transactions, DVR $377,228 on 5,203 transactions, Total $378,978 on 5,212 transactions In 2005: DBVI $620 on 9 transactions, DVR $340,556 on 5,057 transactions, Total $341,176 on 5,066 transactions In 2006: DBVI $1,510 on 32 transactions, DVR $334,192 on 4,639 transactions, Total $335,702 on 4,671 transactions Totals for 3 years: DBVI $3,880 on 50 transactions, DVR $1,051,976 on 14,899 transactions, Grand Total $1,055,856 on 14,949 transactions Reimbursement and Advance Processes The reimbursement process is used to pay for an item(s) the consumer has already received. Payment may be made to the vendor or directly to the consumer. The counselor determines whether the item was necessary to meet the vocational goal and, if so, asks the consumer or vendor to provide a receipt. A R20 authorization is created in ORSIS and usually signed by support staff. Since the purchase has been made and there is a receipt, the counselor then signs the R20 to approve payment. As in the standard process, the payment transaction is initiated in ORSIS and transferred to MFASIS with the Service Center issuing the check. BRS uses the advance process to provide funds to consumers prior to a purchase being made. Counselors decide a good/service is necessary to achieving the vocational goal and authorize an amount. The authorizing R20 is typically signed by support staff and then signed by the counselor to approve payment. The payment transaction is entered to ORSIS and transferred to MFASIS. The Service Center issues payment directly to the consumer who is expected to provide receipts for purchases made, and to refund any change from the purchase, to the counselor. Advances may also be used when particular vendors will not accept BRS R20s as purchase orders, and in other situations determined appropriate by counselors. What prior concerns existed with BRS procurement processes and how have they been addressed? For several consecutive years, the State Auditor reported Single Audit findings regarding inadequate financial controls in BRS. In response to these findings, DOL hired an outside consultant to conduct a comprehensive review of BRS’ financial management system. The report from consultant Berry, Dunn, McNeil and Parker (BDMP) was submitted to BRS in August 2004. Many of the report’s 38 recommendations addressed internal control weaknesses in the areas of procurement and expenditure policies, procedures and practices. BRS began to work on implementing the BDMP recommendations related to procuring consumer goods and services. Actions included revising the procurement process to require two different signatures on paper R20’s to complete a purchase transaction - one individual to authorize the order and a different one to approve payment. BRS also began a review of specific policies and procedures as well as agency performance. New policy and procedural directives to guide VR staff were issued for: * transportation assistance; * self-employment; * post-secondary education; * consumers with substance abuse; * incarcerated individuals; * case closure; and * high cost or long term cases. In the midst of this, BRS discovered a historic expenditure error that resulted in the need to obtain an emergency supplemental General Fund appropriation of about $2 million. The root cause of the error lay in poor financial data provided to management and, consequently, the Bureau turned its focus to improving the quality of budget and expenditure information available to Division Directors and BRS central management. Since then, BRS has worked closely with the Service Center (Footnote 12 In SFY 2006, BRS accounting functions previously performed within the Bureau were moved to the DAFS Service Center, along with those of the entire Department of Labor, as part of the State’s move to centralize financial functions.) on reports and procedures to routinely monitor division budgets from a high level. Currently, BRS and Service Center staff regularly review and compare budget to actual expenditure data. Financial reports required by RSA are developed in the Service Center using MFASIS data. According to both BRS and Service Center management, these reports and budgetary information are now accurate and reliable. The State Single Audit for SFY 2005 continued to find that BRS lacked internal controls to ensure compliance with allowable cost requirements and the State Auditor recommended establishing internal control procedures, implementing computer controls and periodically reviewing work performed by rehabilitation counselors. These findings are repeated in the recently released report for the SFY 2006 Single Audit that was being conducted concurrent with OPEGA’s review. BRS also participates in the Department of Labor’s Bend the Curve initiative which began in 2004. Bend the Curve is a comprehensive planning exercise to assess the Department’s approach to delivery of services and look for areas of improvement. Bend the Curve specifically looks for ways to improve service delivery and reduce costs – bending the expense curve down in anticipation of declining or flat revenues in the future. Unlike most of the Labor Department, and in recognition of the Order of Selection and wait list, any savings realized by BRS via Bend the Curve are to be utilized to increase the number of persons served. What are the internal controls and typical risks associated with a procurement process? Internal controls are policies, procedures and processes that help to provide reasonable assurance the organization: * achieves management objectives; * promotes effective and efficient operations; * produces reliable financial and operational reports; * is in compliance with applicable laws, regulations, internal policies and procedures; * is protected from the risk of fraud and waste; and * provides quality services consistent with the organization’s mission. Internal controls are critical to the success of an organization’s work as they serve to prevent or detect undesirable situations (risks) that can interfere with achieving organizational objectives. They need to be viewed by managers and employees as key to the organization’s main function. An effective internal control system is not separate from other systems, but rather an integrated component of the entire organization and an important part of everyday responsibilities of management and employees. In a procurement process, internal controls guard against a number of inherent risks that could result in direct financial loss. These controls can be manual, electronic or a combination of both, but they are not usually regarded as optional. Table 3 lists some of the typical procurement process risks and some of the standard controls used to minimize them. Supervisory approvals, separation of duties, and checking the quantities and pricing on invoices against orders and receipts are often considered key controls. Table 3. Typical Risks and Standard Controls in Procurement Processes Typical Procurement Risks include but are not limited to: * Fraudulent customers or vendors * Overpayments for goods/services * Unnecessary purchases * Receipt of goods/services by persons other than intended customer * Purchases by unauthorized individuals * Employees receiving inappropriate payments * Duplicate payments Standard Controls include but are not limited to: * Written procurement policies and procedures * Verification that vendors are valid * Separation of functions or duties so that one individual cannot complete a transaction alone * Supervisory approval of orders and/or payments * Matching quantities and pricing on invoices against orders and receipt documentation Conclusion Despite actions taken by BRS to address past concerns, internal controls are still not adequate to assure expenditures for DVR and DBVI consumers are appropriate, reasonable, properly approved or accounted for. Consequently, OPEGA’s review found instances of the misuse of funds, including apparent fraud. This weak control environment flows, primarily, from the Bureau’s predominant emphasis on service delivery, consumer satisfaction, and maximizing counselor authority with regard to case decisions. Counselor relationships with consumers are seen as critical to successful outcomes and the organizational culture supports counselor control and independence supplemented with supervisory guidance. Counselors are responsible for a number of critical decisions, including financial ones, regarding individual consumers with complex needs and vocational goals. BRS supervisors react to counselor requests for assistance in resolving specific issues on specific cases, but do not proactively review all cases, or even a sample thereof. Over the past several years, management has also focused on bringing much needed improvements to other fundamental parts of its financial management system such as the budget, grant management and cash management. Less emphasis has been placed on financial accountability and risk mitigation at the transaction level than the other efforts ongoing at BRS. The lack of effective controls at the transaction level is especially problematic, however, as the State’s MFASIS system issues payments based on data provided by BRS’ ORSIS system with no separate review of each transaction for accuracy and validity. While BRS acknowledges its stewardship role, it has not given priority to establishing effective controls to support that role. During the course of OPEGA’s audit, BRS became increasingly aware of internal control weaknesses, the ineffectiveness of steps previously taken to address them, and its vulnerability to a number of unacceptable risks. BRS has committed to significant management actions that reflect this awareness. We believe the resulting controls, if fully implemented, will appropriately balance the need to minimize financial risk with the flexibility needed to serve consumers. (Footnote 13 OPEGA does, however, recognize the State Controller’s responsibility for financial controls in procurement processes throughout State Government and notes that additional actions may be required of BRS by the Controller.) They should also result in improved consumer outcomes and increased resources available to serve additional consumers. Findings & Observations (Box with definitions of finding and observation: Finding - a situation noted within the scope of the review that deserves immediate attention and action. Observation - a noted opportunity for improving effectiveness or efficiency in an area outside the scope of the review.) Finding 1 - Weak Control Environment “The control environment sets the tone of an organization, influencing the control consciousness of its people. It is the foundation for all other components of internal control; providing discipline and structure. Control environment factors include integrity and ethical values, commitment to competence, management participation, management philosophy and operating style, organizational structure, assignment of authority, and human resource policies and practices.” (Footnote 14 Office of Vocational and Educational Services for Individuals with Disabilities (VESID) Internal Controls Over the Procurement of Goods and Services for the Period 1/1/00-6/30/04, University of the State of New York, The State Education Department, Office of Audit Services, 2004 (http://oms33.nysed.gov/press/090704attachmt.htm).) BRS and Service Center management have not met their responsibility to create an adequate control environment for the procurement of consumer goods and services at DVR and DBVI. This is evidenced by the conditions discussed in Findings 2-7. In any organization, management is responsible for establishing and maintaining an effective control environment as part of its stewardship over the use of resources. It must “set the tone” to enable effective controls to be instituted and used properly by all employees. Management is also responsible for monitoring activities, assessing risk and striking an appropriate balance between the need to control risk and the need to provide services efficiently and flexibly. Finding this balance can be difficult. Controls may be perceived as inhibiting service delivery by, for example, increasing the time it takes to deliver a service or good to one’s consumers. Systems designed to optimize customer service may operate at the expense of critical internal controls. Over the years, BRS has emphasized reducing the wait list, expediting payments, improving consumer satisfaction and maintaining counselor independence and flexibility over standardization and controls. These choices mean that financial risks associated with the procurement process remain largely uncontrolled and BRS is vulnerable to fraud and other misuse of funds as a result. Interestingly, the weak control environment may also be contributing to the perception, if not the reality, of inequitable treatment of consumers. The availability of particular goods and services, and the manner in which they may be obtained, may vary by counselor or by office. BRS and the Service Center have worked diligently to address past weaknesses noted in budgetary and cash management processes, but actions taken to address weaknesses in the procurement process were more limited. Those actions taken did not fully address the weaknesses for various reasons that were apparently unrecognized by management. For example, the BDMP report recommended separating duties by requiring a second approval on purchase transactions, preferably that of a supervisor. DVR and DBVI determined requiring supervisory approval would significantly hinder operations and instead required that two different individuals, who could be counselors and support staff, sign the paper R20s used for authorizing orders and payment of invoices. OPEGA found this to be an ineffective control. Counselors actually retained the ability to control whole transactions due to the nature of their relationships with peers and support staff and ORSIS lacked sufficient controls. (See Findings 4 and 7). Without any other compensating controls in place, duties were still not effectively separated. OPEGA notes that the degree of financial risk associated with the weak control environment is lower at DBVI than DVR. DBVI serves fewer consumers with a smaller staff and DBVI consumers do not have the same diverse range of disabilities as DVR consumers. Consequently, DBVI’s somewhat different approach to serving consumers keeps risk lower despite weak controls. For example, OPEGA’s data analysis showed that certain types of purchases with higher inherent risk occurred more frequently at DVR than DBVI – 99% of the 22,730 payments made directly to consumers during SFY 2004 - 2006 went to DVR consumers, while only 1% went to DBVI consumers. Nonetheless, establishing a more effective control environment in both Divisions will improve management’s ability to safeguard assets and responsibly steward public resources, while providing quality services in a fair and equitable manner. See Actions A-I in the Management Actions section of this report for management’s commitments to addressing this finding. Finding 2 - Misuse of Funds Including Apparent Fraud Misuse is the incurring of unnecessary or careless expenditures of public resources or property resulting from deficient practices, systems, controls, or decisions. Fraud is defined as a dishonest and intentional course of action that results in obtaining money, property, or an advantage to which the individual committing the action would not normally be entitled. Lack of internal controls over procurements for consumers at DVR and DBVI resulted in the misuse of funds including instances of apparent fraud. OPEGA’s analysis of SFY 2004-2006 expenditures identified one or more transactions in 2,181 different cases that had indicators of potential for fraud or misuse of funds. OPEGA selected transactions in 68 of the higher risk cases, (Footnote 15 Certain types of indicators, i.e. large payments made directly to consumers, or existence of multiple indicators made cases higher risk.) representing $577,979 in expenditures, for detailed review. Cases within the sample that OPEGA still deemed suspicious after its review were further examined by BRS. As a result of this process, BRS confirmed cases of apparent fraud involving three employees. These cases have been referred to the Attorney General’s Office for criminal investigation. BRS also agreed that 12 other cases had some degree of misused funds, potential fraud or both. In one extreme case, a consumer directly received $17,150 in a single payment to purchase equipment and services to start a new business. One month later another $343 was provided. The case file included a hand written list of equipment and other projected costs (insurance, advertising), but no other documentation supporting those projections. Case notes indicate the counselor’s intention to inspect the business and goods purchased, but there was no evidence a visit was actually made. The consumer did not provide DVR with receipts for any of the purchases. Six months after issuing the checks, DVR sent the consumer a letter requesting employment status information. DVR received no response from the consumer and closed the case as unsuccessful. Other instances of misused funds involved lesser dollar amounts. For example, in one case, payments made for post-secondary education exceeded the policy guideline amount by $2,500 with no supporting justification in the case file. In another case, a consumer with an expressed need for transportation assistance received a direct payment of $2,558 to pay for transmission repair on his vehicle -- after insisting the vendor would not take a BRS purchase order, or present a bill for payment to the State. After receiving this payment, and another advance of $399 to purchase work clothes, the consumer broke all contact with DVR without ever providing receipts for those items. We estimate the transactions included in our sample representing fraud or other misuse totaled over $100,000. BRS determined other cases in OPEGA’s sample did not represent fraud or misuse, but agreed they should definitely have been reviewed for that potential and were not. BRS has yet to make a determination on another 2 cases that OPEGA questioned. See Actions D-F and I in the Management Actions section of this report for steps BRS and the Service Center plan to take to detect any other instances of misused funds. Finding 3 - Inadequate Policies and Procedures to Support Stewardship of Resources “Written policies and procedures help ensure employees know what is expected of them and also provide for standardization among district offices. The policies and procedures are particularly important when there are offices in many locations and there is high staff turnover. Policies and procedures are an important internal control that establish responsibilities and accountability, and help ensure consistency among staff.” (Footnote 16 Office of Vocational and Educational Services for Individuals with Disabilities (VESID) Internal Controls Over the Procurement of Goods and Services for the Period 1/1/00-6/30/04, University of the State of New York, The State Education Department, Office of Audit Services, 2004 (http://oms33.nysed.gov/press/090704attachmt.htm).) BRS lacks effective policies and procedures to help ensure all staff responsibly steward resources and provide consistent, equitable treatment of consumers. Existing policy manuals provide some guiding principles to help counselors make independent decisions and the New Counselor Training Manual has various sample forms for counselors to use related to procurement of goods and services. However, the policies are not well supported by procedures establishing how they should be implemented and the forms often lack clear written instructions for completing them. In addition, OPEGA noted practices that were not governed by any written policies or procedures, as well as non-compliance with some policies that do exist. For example, payments made directly to consumers as advances or reimbursements carry high inherent risk the consumer will not purchase what is intended or will not provide evidence of the purchase. BRS has no written policies or procedures describing when such payments are appropriate, establishing dollar limits or requiring documentation or supervisory review. During the time period under audit, DVR and DBVI combined made a total of over $4.2 million in direct payments to consumers or approximately $1.4 million per year. OPEGA reviewed 24 cases with direct payments to consumers. Nineteen of them had large payments for goods and services such as tuition, rent, car repairs, tools and equipment where the payment could have been made directly to a vendor instead of the consumer. Many of the case files contained little or no documentation the items were actually purchased, or used as intended. Table 4 shows the breakdown of direct payments to consumers for SFY 2004 – 2006. Table 4. Direct Payments to Consumers SFY 04-06 Amounts Spent- In 2004: DVR $1,468,420, DBVI $16,142, Total $1,484,562 In 2005: DVR $1,205,546, DBVI $30,738, Total $1,236,284 In 2006: DVR $1,505,939, DBVI $21,049, Total $1,526,988 Totals for 3 years: DVR, 4,179,905, DBVI $67,929, Grand Total $4,247,834 We also noted other practices creating opportunities for misuse of funds currently unregulated by written policies or procedures. They include: * payments made in excess of authorized amounts; * cases where the only expenditures were direct payments to consumers for transportation and/or maintenance—with no explanation of why; * consumers receiving goods such as equipment for a business, computers or vehicles without signing a Maine VR Purchased Equipment Agreement (Footnote 17 BRS has a form for this agreement which requires consumers to return purchased items if they are no longer using them toward their employment goal.); * little documentary evidence of price comparisons or other efforts to assure economical purchasing of items such as computers, business equipment and used vehicles; * current BRS staff receiving services as consumers (Footnote 18 Consumers of DVR or DBVI may become employed by BRS but remain eligible to receive some post-employment services as consumers.); and * current BRS staff receiving payments as vendors.(Footnote 19 BRS staff serving as vendors is generally prohibited.) Post-secondary education, on which BRS spends over $1 million per year, is an example of inconsistent compliance with existing policy and procedures. Federal regulations govern contributions to post-secondary education and training, and BRS has written guidance for how to determine the appropriate VR contribution. Under BRS policy, this contribution generally should not exceed what BRS would contribute for the consumer to attend the University of Maine or a Maine community college. BRS procedures also require counselors to complete a specific form to calculate the amount of that contribution. There are written instructions on how to complete the form, although they are somewhat unclear. OPEGA reviewed 13 files with post-secondary education expenditures and found procedures were not followed consistently or documented to the degree necessary to verify compliance with policy. OPEGA observed files with incomplete financial aid forms, forms for one year but not subsequent years, and forms apparently indicating a lesser amount of unmet need than paid by VR, with no documentation explaining the difference. Files also often lacked transcripts or other documentation of the consumer successfully completing the course work. Table 5 shows the breakdown of payments for post-secondary education in SFY 2004 – 2006. Table 5 Payments for Post Secondary Education SFY 04-06 Amounts Spent - In 2004: DVR $1,354,991, DBVI $62,717, Total $1,417,708 In 2005: DVR $1,327,633, DBVI $42,567, Total $1,370,200 In 2006: DVR $1,305,198, DBVI $56,048, Total $1,361,246 Totals for 3 years: DVR $3,987,822, DBVI $161,332, Grand Total $4,149,154 Other examples of weak policies and procedures or non-compliance include: * IPEs did not always include a total plan cost estimate; * expenditures were sometimes charged as group purchases when they should have been charged to individual consumers to more accurately capture total VR costs for those consumers; * purchases for goods or services seemingly unrelated to vocational goals or employment plans were made with no documentation to justify them; * no documentation existed in files to show whether the DVR Transportation Procedural Directive was followed, i.e. blue book value not in file, no evidence of VRC consultation with certified mechanic, no evidence of 30 day repair warranty from licensed mechanic; and * CRP approved vendor list was not up to date and nothing prevents other vendors from being used. See Management Actions B, D, G and H for steps BRS plans to take to address this finding. Finding 4 - Inadequate Separation of Duties for Purchase Transactions “Key duties and responsibilities should be divided or separated among different individuals to reduce the risk of errors and misappropriations. No one individual should control all key aspects of a transaction or event and the work of one employee should serve as a check on others. Ideally, for the purchasing process, the initiation, authorization, approval, ordering, receipt, payment and record keeping should be performed by different employees. Where the duties can not be adequately separated, there should be increased supervisory review and oversight.” (Footnote 20 Office of Vocational and Educational Services for Individuals with Disabilities (VESID) Internal Controls Over the Procurement of Goods and Services for the Period 1/1/00-6/30/04, University of the State of New York, The State Education Department, Office of Audit Services, 2004 (http://oms33.nysed.gov/press/090704attachmt.htm).) Procurement and payables functions at BRS are not effectively separated. As discussed in Finding 1, BRS addressed past concerns about this weakness by initiating a two signature requirement on the paper R20s used for authorizing orders and payment of invoices. This action, however, has not been sufficient to resolve the problem for two reasons. First, counselors continue to control all aspects of purchase transactions due to the nature of their relationship with support staff and each other. Typically, a counselor asks support staff or a peer to process and sign an order for a good or service (authorizing R20) which is then subsequently approved for payment by the counselor (invoicing R20). No approval by a supervisor, or other individual with authority to deny the authorization or payment, is required. Manifests (Footnote 21 Manifests are for repeated regular payments usually made directly to consumers for a limited period of time.) require no second signature and are controlled solely by the counselors who initiate them. Additionally: a. any employee, including a counselor, can get a new vendor established in ORSIS and then in MFASIS/AdvantageME by sending a form to the Controller’s office without anyone verifying whether the vendor is valid; b. the counselor determines what vendors will be used or what vendors a consumer will choose from; and c. the counselor controls the evidence (documentation) of the consumer’s receipt of goods or services. Second, ORSIS does not limit access to functions based on role. All employees with general access (support staff, counselor, supervisor, manager) are able to perform purchasing and payable functions within the system. Single employees are also able to perform multiple functions like create new vendors, authorize purchases, and approve payments – thus allowing them to complete an entire purchase transaction without any oversight. ORSIS does not require any approvals before transferring completed transactions to MFASIS/AdvantageME for payment and there is no review of individual transactions prior to or after the transfer. Consequently, two signatures on the paper documents are meaningless. The vulnerability presented by the ineffective separation of duties at BRS is exacerbated by a lack of policies and procedures (Finding 3), and is not compensated for by supervisory review of specific case expenditures (Finding 5). See Management Actions A, C and D for BRS’ plans to effect proper separation of duties. Finding 5 - Insufficient Verification of Expenditures “Verification is determining on a periodic basis the completeness, accuracy, authenticity, and validity of transactions, events, or information. It is management’s responsibility to ensure activities are being conducted in accordance with directives. Management should identify key areas and implement procedures to periodically ensure the transactions or events are processed in accordance with expectations.” (Footnote 22 Ibid.) BRS has insufficient controls for periodically verifying whether purchase transactions are appropriate, accurate and in compliance with policies and procedures. OPEGA noted the following: * BRS’ New Counselor Training Manual includes a Case Review Form for supervisors to use and implies that case reviews should be completed at four different phases of a case. In reality, case files are not regularly reviewed and, in fact, may never be reviewed by supervisors. Nearly 76% of the 53 cases that OPEGA tested for evidence of formal case review showed no evidence of any supervisory review at all. Some cases are reviewed informally when counselors request supervisory guidance, but these reviews are not formally recorded on the Case Review Form and do not include proper fiscal review of all expenditures. * The multi-page Case Review Form does include a fiscal review section asking about consideration of comparable services, necessity of services provided, consistency with agency policy, and cost-effective provision of services. However, questions specifically addressing financial documentation such as receipts, invoices and calculation of expenditures like post-secondary education, are not part of the Case Review Form. It also appears the form is not used. Supervisors OPEGA spoke with had never used or were unfamiliar with this form and we saw no Case Review Forms in the files reviewed. * In July 2004, BRS issued a procedural directive requiring supervisors to review high cost or long term cases. High cost cases were defined as those with new IPEs or amendments exceeding $6,000 or cumulative expenses of $12,000 or more. Long term cases were those open more than 5 years. Under the directive, this case review was supposed to be documented in the individual case record. OPEGA found this directive was not being complied with. Twenty-five of the cases reviewed by OPEGA met the criteria for supervisory review but 64% of them showed no evidence of review in the individual case file or any other file. The remainder had evidence of informal review that did not appear to include verification of individual expenditures for the case. OPEGA also spoke with one supervisor who said she was completely unfamiliar with a case that had a total cost exceeding $85,000. She stated the case had not been reviewed partly because it was assigned to a new counselor who had only worked at BRS for 18 months. * Available ORSIS reports and specific analyses of ORSIS data are not being used to identify questionable expenditures. Nor are they being used to monitor expenditure trends that may indicate a need for new or enhanced controls to ensure the economical use of resources. * The Service Center relies on BRS to maintain effective controls over procurement transactions. The Service Center does not perform any verification of its own on transactions that are transferred from BRSIS to MFASIS/AdvantageME for actual payment. This means the Service Center is not checking whether transactions have been properly approved, whether payment amounts agree to invoices, etc. There also are no daily batch controls to assure that all transaction data is accurately transferred from one system to the other and no periodic reconciliations of payment data in ORSIS and MFASIS/AdvantageME to assure the data in both systems agree. OPEGA attempted to perform a reconciliation and found payments in MFASIS which had been deleted in ORSIS. While the explanation for these particular discrepancies appears reasonable, discrepancies between the two systems could affect the accuracy of federal and management reporting and be indicators of inappropriate activity. See Management Actions C-G for how BRS plans to achieve adequate verification of expenditures. Finding 6 - Poor Documentation to Support Expenditures “All transactions, purchased goods and services, and significant events should be clearly documented in each consumer’s case file. The documentation should be complete, accurate, organized in a standard format, and recorded promptly.” (Footnote 23 Ibid.) OPEGA found documentation in case files to be incomplete, inconsistent and inadequate to support expenditures made, to demonstrate compliance with policies and procedures, or to allow assessment of efforts to purchase economically. Some case files could not be located or had been shredded based on the case closure date even though there were post closure expenditures. Specifically, OPEGA observed case files with: * insufficient evidence consumer had received goods and services – lack of invoices, receipts, signed statements, school transcripts, etc.; * misfiled R20s that belonged to cases for other consumers; * payments for amounts greater than amount requested by consumer, or on the receipt, with no justifying explanation; * payments initiated more than 90 days after the purchase was authorized even though R20 authorization forms are void after 90 days; * inconsistent/inaccurate coding of expenditures – e.g. purchases coded as miscellaneous when more specific codes for transportation or education should have been used; * inadequate documentation explaining purchases and their relationship to IPEs or vocational goals; and * inconsistent and/or inadequate documentation of calculations for contributions to post-secondary education. In several cases, there were no receipts for significant purchases like business equipment and home modifications. Nor were there any case notes indicating the counselor had visited the consumer to verify equipment purchases or home modifications had actually been made. Official documentation such as school transcripts, certifications or other proof a consumer had successfully completed a semester of school or training program was also lacking in several files. OPEGA generally found required documentation to be missing from case files for consumers with self-employment goals. For example, a June 2004 DVR procedural directive on self-employment requires the VRC to verify income generated by the consumer’s business in order to close a self-employment case as successful. Income must be equivalent to minimum wage or higher. Files reviewed by OPEGA included some information on businesses opening like statements from owners, newspaper articles and advertisements. However, documentation of income from these businesses, such as profit and loss statements or tax returns, were not observed in any files successfully closed with self-employment goals. BRS expects that documentation weaknesses will be resolved with implementation of Management Actions A, B, D, G and H. Finding 7 - Computer Controls Lacking “Computerized information systems are an integral part of most organizations’ operations. The systems are used to facilitate processing transactions as well as to monitor and report results. Controls must be in place to limit access to authorized users; ensure data on the system are complete, accurate and timely; maintain an audit trail for each transaction; verify the validity of data; and generate reports that effectively monitor performance.” (Footnote 24 Ibid.) ORSIS is functioning as a purchasing and accounts payable system, but has not been recognized as such. Consequently, BRS has not incorporated into ORSIS the internal controls typically found in such systems to ensure assets, including funds and data, are properly safeguarded. For example, ORSIS edit checks are inadequate to ensure the validity of financial data and transactions. OPEGA found the system allows payment back dating, payments on closed cases or for consumers in ineligible statuses, and payments in excess of authorizations - all without edits to alert users or to require special approvals in order to process the authorization or payment. In SFY 2004 - 2006, there were 199 payments made on closed cases and 4,577 payments exceeding the associated authorization amounts by a total of $549,707. Most users can also change authorized purchase amounts in ORSIS after R20s have been sent to vendors. Also, as noted in Finding 4, permissions to functions and data in ORSIS are not based on the roles of particular users. System access is not sufficiently controlled to prevent unauthorized transactions or protect the validity, reliability and completeness of ORSIS data. ORSIS does not permit “read-only” access to the system. All ORSIS users, including staff with no caseloads, have a general level of system access allowing them to create consumer records, change consumer records on open cases, and create and change authorizations and payments. Other system control concerns OPEGA noted include: * any employee can approve payments in excess of the amount originally authorized; * a few users are able to delete payment and/or authorization records in ORSIS even after payments have officially been processed and checks mailed; * some users can back date consumer statuses; and * the ORSIS programmer has full access to the production environment and is able to access and change live data. OPEGA also noted concerns with regard to management of the system in general. For example, OPEGA observed that monitoring changes to data and the overall reliability of the database has not been a priority despite the lack of controls as just described. In addition, there is no formal process for regularly reviewing the appropriateness and necessity of system permissions for specific users or to remove system access when someone leaves BRS employment. OPEGA reviewed individuals with last names beginning with A or B on the list of users and identified four individuals with ORSIS access who are no longer employed by BRS. Lastly, the process for making changes to the ORSIS system is mostly informal and changes made are not well documented. Nor do system changes require documented approval by an appropriate stakeholder before they are implemented. Overall, the process also does not appear to include consideration of the impact of requested changes on the system as a whole, or on other change priorities. See Management Action C for BRS’ planned improvements to computer controls. Observation 1 - Consumer Contributions Could Increase Available VR Resources BRS may be able to increase resources available for all consumers, and improve consumer “buy-in” to the success of their plans, by consistently requesting that consumers contribute financially, if able, toward their own plans. Under the Rehabilitation Act, an individual’s eligibility for the program must be determined solely by the individual’s disability with no regard to the individual’s financial status. VR agencies are allowed, however, to gather income information and may ask consumers to contribute financially toward the cost of their individual employment plans. Consumers cannot be denied goods or services necessary to the plan if they do not wish to contribute, but any contributions they do make result in more resources being available to serve other consumers. Currently, DVR and DBVI counselors have discretion in whether or not to request a contribution and there is no standard procedure a counselor can use to assess a consumer’s ability to contribute. Consequently, OPEGA observed inconsistent gathering of income information and found little documentation of requests made of consumers, consumer responses or actual contributions made, even in cases where it appeared the consumer or consumer’s family likely had the financial capacity to do so. BRS previously considered revising its policy to require counselors to assess consumers’ ability to contribute and request contributions, if appropriate, for every case. Treating consumers equitably in this regard, however, would require counselors to collect accurate and complete income information, including household income, and assess contribution potential for every consumer. BRS ultimately felt this would not be a good use of resources as it believes most of its consumers have very limited incomes and would likely not be in a position to make any contribution. BRS continues, however, to have insufficient financial resources to serve all eligible consumers. Given this, OPEGA encourages BRS to consider gathering the data necessary to better evaluate the potential financial benefits of seeking consumer contributions on a more routine basis and then reconsidering its policy as appropriate. Observation 2 – Centralization of ORSIS Servers Could Increase Efficiency and Reduce Data Problems Opportunity exists to increase efficiencies at BRS and reduce data errors, inconsistencies and lost transactions within ORSIS by fully centralizing the computer network on which ORSIS is deployed. Currently, the network is decentralized with a central server at the hub and local servers associated with each BRS office. For the most part, the central database only receives information from the local servers, but does not communicate out to them. The local servers also cannot communicate with each other. Consequently, each office effectively maintains its own ORSIS database and there is a process for merging information from each local server into the central server. Each server, central and local, also has its own security protection. Consequently, users requiring access to data residing on more than one server, i.e. District Managers and central office staff, must maintain multiple user ID’s and passwords and log in separately to each server. OPEGA observed that maintaining security and accurate, consistent and complete data in this network environment appears to consume considerable human resources. The current configuration also creates inefficiencies in serving consumers as information cannot be readily shared among local offices through ORSIS. BRS had planned to move to a new network configuration under the new OIT Enterprise for the Department of Labor but the implementation of the Enterprise system has been repeatedly delayed. OPEGA encourages BRS to continue to pursue full centralization of ORSIS with OIT, perhaps collecting data on the financial and service consequences of the current configuration to help justify it as a priority. Management Actions BRS has taken a holistic approach to addressing the significant weaknesses identified in this audit. Upon receiving OPEGA’s recommendations, BRS and the Service Center devoted significant attention and resources to designing a complete system of internal controls that would adequately protect State resources while maintaining the integrity of BRS’ mission and supporting its service improvement goals. Since BRS currently does not have enough resources to serve all eligible consumers in a timely manner, any dollars gained through improved fiscal management will allow more consumers to be successfully served. BRS and the Service Center sought to strike a reasonable balance between fiscal controls and programmatic needs and worked closely with OPEGA to assure that the proposed controls would address the concerns identified. Taken together, the management actions described below will result in a system of controls that addresses OPEGA’s findings in an integrated way and should create a culture that promotes both fiscal responsibility and improved service delivery. The Service Improvement Quality Assurance unit (SIQA) within BRS will oversee a work plan for implementing the actions agreed upon. Leadership of the Bureau and Department is fully committed to providing the necessary resources to assure execution of the action plan described below. Action A - Revised Procurement Processes By July 2008, BRS will implement new procurement processes that, taken together with new case review protocols, will effectively separate duties. The specifics are as follows: * Counselors will continue to authorize all purchases with the exception of those to be paid via manifest. Manifest authorizations will require supervisory approval and will have limits on the period of time the manifest can be established for. * Supervisory review or consultation may be required by policy for specific types of transactions or situations (see Action B). In these cases, counselors will seek supervisory review or consultation prior to authorizing a purchase and evidence of the review will be maintained in the case file. * Counselors will verify that the goods and services to be paid for were received by the client and were satisfactory. Counselors will also obtain appropriate evidence of that receipt. * Support staff will initiate payment of invoices after verifying that the authorization, invoice and receipt documentation agree as to quantity, type and cost of the goods or services. Support staff will be required to obtain supervisory approval before initiating payments that exceed the authorized amount or where there is any other discrepancy in the three pieces of documentation supporting the transaction. * The documentation supporting the payment transaction, including evidence of receipt, will be maintained in the case file. * ORSIS permissions will be carefully structured based on staff roles to limit authority and access to transactions consistent with these protocols. ORSIS controls will require an authorization to be entered in ORSIS before a payment can be initiated and will not allow both the authorization and payment in ORSIS to be entered by the same person. Supervisory and other independent review of the appropriateness of individual transactions, overall expenditures on cases and compliance with procurement policies and processes will be accomplished through the revised case review protocols (see Actions D-F). Action B - Strengthened Policies and Procedures To further reinforce the ethical competencies and services expectations of its professional work force, BRS will update its programmatic policies and procedures or develop new ones as required to address the OPEGA findings. New/revised policies and procedures will be incorporated into a procedure manual and program rules and will include the following as appropriate: * guidelines and examples of situations where the policy should be applied or where exceptions may be allowed; * dollar amount guidelines; * requirements for supervisory review/consultation of deviations from policy/procedure; * documentation requirements; and * specific procedures to support effective implementation of the policy. In addition, intranet resources such as forms necessary to facilitate and measure compliance with policies and procedures are currently being developed. BRS expects to have new or updated policies and procedures addressing the following areas developed by September 2008: * direct payments to consumers for reimbursements, advances, or other reasons; * invoices exceeding authorized amounts; * use of CRP approved vendor listing; * actions taken to consider least cost methods consistent with the client IPE; * retaining a State interest in goods purchased to implement an individual client IPE; * cost estimates on IPEs; * documentation of expenditure’s relationship to vocational goal; * employee conflicts of interest, including situations where BRS employees are VR consumers; * calculation of VR contribution and consumer contributions for post-secondary education; * transportation assistance to support core VR services; * use of grouped purchases; * self-employment as a vocational goal; * comprehensive assessment of rehabilitation needs; and * payments on authorizations older than 120 days. BRS will also establish administrative policies and procedures related to the following and include them in the policy and procedure manual: * revised procurement process; * expected fiscal documentation to be maintained in case files; * detailed instructions on coding of expenditures; * case file sign-out system; and * case record retention requirements. Action C - Strengthened Computer Controls According to BRS, ORSIS has been a very problematic application since its development in late 1995. The Bureau has operated with this system despite its serious deficiencies. As a result, the Bureau has incurred continuing development costs over the entire life of the system. BRS states that these costs are currently running around $200,000 a year. BRS intends to further develop and implement the computer controls in ORSIS that are necessary to help ensure compliance with established policies and procedures as well as further safeguard the accuracy and completeness of data. BRS reports it has been allocating significant staff time (12-15 hours/week) toward this effort through weekly Daily Operations Group (DOG) meetings, but that progress is extremely slow. BRS has significant concerns about ORSIS capability, and has set a completion date of Spring 2008, with a contingency plan that if this date is not met, all options for a successor application to ORSIS will be evaluated. BRS is currently working toward completing the following specific actions to address OPEGA’s findings with regard to ORSIS controls: * Update ORSIS’ permissions structure to separate duties and establish new procedures and rules for approval of payments (see Finding 4). * Incorporate automated controls and edit checks into ORSIS to safeguard funds and data such as: - change “paid date” field to be system generated (completed July 2007); - allow payments on closed cases only with supervisory approval; - allow payments in excess of authorized amount only with supervisory approval and proper separation of duties; - assure authorization records cannot be deleted after payment has been initiated or made; - limit backdating of payments in ORSIS to only the few users authorized to perform this function (completed July 2007); - prevent changes to authorizations after any supervisory approval required by policy; - allow payments on authorizations over 120 days old only with supervisory approval and proper separation of duties; and - remove ORSIS programmer’s access to live production system and limit ability to manage database to BRS Database Manager(s). (This is dependent upon completion of an existing OIT initiative to implement an infrastructure that better separates the development, testing, and production environments, as well as the roles/responsibilities of those who are responsible for those environments). * Continue work already begun to explore the feasibility of designing and adding functionality to ORSIS that will automate some manual controls such as: - electronic approvals using fields for required staff employee IDs so a transaction does not proceed until electronic approval by authorized individual is entered; and - 3-way match using ORSIS to validate match between authorizing R20, invoice information entered and receipt information entered, with any differences requiring resolution by a supervisor. * Incorporate ongoing monitoring and analysis of ORSIS permissions into the Daily Operations Group meetings to ensure those permissions are appropriate and current, and data is protected, valid and reliable. * Improve documentation relating to system changes including documentation of: - change requests, subsequent actions and tests; - impact assessments of requested changes on ORSIS and on other change priorities; and - change approval by appropriate stakeholder(s). * Develop procedures for how to monitor supervisory permission overrides and review ORSIS data to ensure those procedures are followed and properly documented. * Modify ORSIS to add “read-only” access for particular users with no caseload responsibilities. * Establish a process for reconciling ORSIS and AdvantageME on a monthly basis. In response to OPEGA’s observations, BRS will continue to seek implementation of a fully centralized database to resolve the issue of data inconsistencies between local and central servers. This action is dependent upon implementation of DOL’s Enterprise system. Action D - Redesigned and Strengthened Case Review System BRS will implement a redesigned and strengthened case review system by January 2008. The system provides comprehensive case review encompassing both programmatic and fiscal components. Anticipated benefits include increased resource availability and successful consumer outcomes, as well as increased focus and review of cases involving multiple and/or fiscally significant risk factors. The Bureau also intends for this redesigned system to transform the role of supervisors from reactive, resolving problems when cases are brought forward by counselors, to proactive, performing standard comprehensive review of a percentage of counselor case loads on a quarterly basis. Under this redesigned system, supervisors will review: * all cases assigned to VRCs during their first 6 months of employment at specific points in the VR process - eligibility determination, comprehensive assessment of rehabilitation needs, IPE development and closure; * individual high cost and long-term cases; and * all post-secondary and self-employment cases where expenditures are estimated to be greater than BRS policy. Additionally, ten percent of all cases active for at least 6 months will be reviewed annually through quarterly supervisor sessions and ten percent of all closed and post-employment cases will be reviewed annually through quarterly SIQA-led sessions. Development of supervisory skills necessary for effective case review is currently underway. In addition, the case reviews will be performed and documented using a revised case review form that prompts coverage of both programmatic and fiscal aspects of the case, as well as the adequacy of documentation to meet both programmatic and fiscal requirements. Case review documentation will be maintained centrally with a notation made in the individual case record. Information gathered will be shared with counselors, supervisors, managers and training coordinators for performance and system improvement. Action E - Monitoring for Risk Indicators Effective March 2008, the SIQA unit will begin monitoring ORSIS data on a semi-annual basis to identify transactions or cases that may be at higher risk for fraud, misuse of funds or non-compliance with BRS policies. SIQA will use existing ORSIS reports and create new ORSIS reports, based on the data-mining logic OPEGA used in this review, to screen for indicators of these risks. The SIQA unit will refer flagged cases to division operations leadership for review and assessment of overall service quality and compliance. The SIQA unit and division operations leadership will also assess multi-year results of this monitoring at standard intervals to identify case management and internal control issues that may need attention. Action F - Service Center Auditing The financial management representative assigned to BRS within the DAFS Security and Employment Service Center will begin conducting a semi-annual review of BRS procurement transactions by January 2008. The Service Center will select a random sample of individual case files at 6 BRS field offices and review the related transactions for: * fiscal soundness; * supporting documentation of expenditures; * internal control/segregation of duties; * economical purchasing; * expenditure reasonableness and relationship to IPE; and * accurate coding of expenditures. The Service Center will compile its findings and forward them, with recommendations for resolution, to BRS management. BRS management will address and resolve the concerns identified and provide a report to the MDOL Commissioner. Action G - Training for Supervisors, Managers and Staff BRS will develop training programs for all managers, supervisors and staff on new or revised policies and procedures and the Bureau’s redesigned case management and procurement review processes. Supervisors will also receive strengthened training in performance coaching, instruction and consultation in case review. The training is expected to: * clearly communicate tasks, expectations, responsibilities, effective separation of duties and all procurement requirements; * communicate the rationale and necessity for the revisions to policy, procedure and process and the revised internal controls incorporated therein; and * reinforce a culture of oversight, internal controls and fiduciary accountability that supports providing individual case services in the most cost efficient and economical manner available. Training for all managers, supervisors and staff will be provided by December 2008. Action H - Enhanced Accountability for Staff Compliance Effective July 2008, compliance with all fiscal and programmatic requirements will be incorporated into counselor and supervisor performance evaluations. Action I - Expanded Awareness and Identification of Existing Fraud or Misuse of Funds BRS has already completed its own review of all 68 cases included in OPEGA’s sample for this audit. BRS reviewed these cases with its revised case review tools and protocols to assure they will help identify cases with potential fiscal risk in the future. As reported in Finding 2, BRS’ review of the 68 cases did confirm cases of apparent fraud involving three employees as well as other cases with misused funds. The Bureau is taking appropriate action on these cases. As a result of the review, BRS also expanded its inquiry to include several complete caseloads. BRS will report to OPEGA on the results, and actions taken, when that review is complete. In addition, BRS intends to review other cases identified by OPEGA as being at risk for fraud or misuse, but not included in OPEGA’s sample. BRS expects to complete this review by February 2008. At that time, BRS will report to OPEGA on the results of the review, including the dollar amount of any actual misuse or fraud identified, and any actions taken by BRS. Lastly, BRS will implement a robust procedure for addressing reported fraud or misuse of funds which includes an assessment of the related risk and protocol for making procedural changes to prevent reoccurrence. Agency Response In accordance with 3 MRSA §996, OPEGA provided the Department of Labor’s Bureau of Rehabilitation Services and the Department of Administrative and Financial Services’ Security and Employment Service Center with an opportunity to submit comments on the draft of this report. The response letter can be found at the end of this report. Acknowledgements OPEGA would like to thank management and staff in the Bureau of Rehabilitation Services, the DAFS Security and Employment Service Center and the Office of Information Technology software development group supporting BRS who worked diligently to provide the extensive information requested during this audit. Their cooperation and willingness to share their time and knowledge provided for more valuable results. We also want to specifically acknowledge the Commissioner and Deputy Commissioner of Labor, the Commissioner of Administrative and Financial Services, the Associate Commissioner of Financial and Personnel Services, the Director of the Bureau of Rehabilitation Services, the DVR and DBVI Division Directors, the Director of the Security and Employment Service Center, and the Manager of Systems Improvement and Quality Assurance at BRS for the serious attention and effort they have given to addressing the findings from this audit. **** 11/29/2007 MAINE DEPARTMENT OF LABOR BUREAU OF REHABILITATION SERVICES AGENCY RESPONSE TO OPEGA REPORT "BRS Procurements for Customers - Weak Controls Allow Misuse of Funds, Affecting Resources Available to Serve all Customers" The Bureau of Rehabilitation Services (BRS) offers the following response to the recent performance audit of its processes for handling "Procurements for Consumers". Core Mission and Culture The Vocational Rehabilitation programs administered by BRS are authorized and governed under Title 1 of the Federal Rehabilitation Act, the preamble of which expresses its purpose - - "To Empower Individuals with Disabilities to Maximize Employment, Economic Self Sufficiency, Independence, and Inclusion and Integration into Society." The Rehabilitation Services Administration (RSA) within the US Department of Education is charged with overall review and monitoring of state program compliance with the Federal Rehabilitation Act. The RSA conducts annual reviews and on-site monitoring to test state program compliance with the provisions of its state plan and with the Evaluation Standards and Performance Indicators established under Section 106 of the Act. At the heart of this effort is the investment of public money in the potential employability of a person with a significant disability. The fundamental assumption is that there is a public benefit in empowering individuals to be active in the workforce, understanding that the alternative is continued investment in systems that offer a lifetime of public maintenance programs. The Challenge The employment rate of working-aged people with disabilities is approximately 38 percent, less than half the rate of their non-disabled peers. National data confirm a return on investment of over six times the cost of individual Vocational Rehabilitation (VR) services. Given the current economic, workforce environment and related forecasts, it is clearly very important that BRS be successful in its work. Our system challenge is to carry out this mission with a careful balance of purpose, stewardship of public resources, and empowerment of clients to accomplish employment/career hopes and dreams; in short professional vocational rehabilitation counseling. Case by case, the accomplishment of a successful outcome for VR customers is the result of a process that must correctly identify individual aspirations, skills and abilities. And, the counselor must partner with each consumer to develop an employment goal and create a plan to overcome specific barriers to employment that arise from a primary disability or unique combination of disabilities. In this context, our system emphasis has been on direct and personalized customer services. Over time, program eligibility has been expanded, and program service priorities have been directed to serve those with the most significant disabilities. Our response to resource reduction has been to absorb cuts as far away from direct client services as possible. Over the years, federal policy changes have expanded the categories of people eligible for program services, the types of qualified employment outcomes, and the variety of services that can be provided. Expanded service eligibility, greater case complexity, and the resultant strain on resources have required continuous changes in organizational structure, expanding caseload responsibilities per counselor and front line supervisors and continuing reallocation of program resources away from organizational management and systems leadership. These choices have had a cumulative effect. In recent years, BRS has absorbed the departure of supervisors and managers, as well as seasoned counselors to better paying opportunities in the private sector and to retirement. Agency-wide, our turnover rate has been a steady 15%. The Bureau has been permitted to fill vacant counselors positions pursuant to a blanket waiver from the freeze on state hiring. However, in the more competitive Greater Portland, Lewiston and Augusta labor markets where we must compete with the private sector to attract staff with the required professional credentials, the counselor turnover rate has been significantly higher. Recognizing these workforce challenges, BRS has taken some action to address capacity in the mid-management level, but we must figure out how to do more. For example, within DVR, we are restructuring from three to two Regional Managers and increasing supervisory lines. These actions will relieve short term pressure, but BRS is challenged to devise long term solutions to address the attraction of private sector employment for master level counselors with a concentration in vocational rehabilitation counseling. 04-06 Program Performance and Management Activities Central to the OPEGA review of BRS procurement practices and processes is its review of transactions processed by the Bureau over state fiscal years '04, '05 and '06; e.g. July 1, 2003 through June 30, 2006. During this three-year period, more than 30,000 people were served by BRS programs, and in excess of 180,000 transactions were completed on behalf of active clients with individual plans for employment. Coincidentally, the average time in plan for BRS clients is approximately 36 months. In the 3 year period selected by OPEGA for review, 2,661 clients were successfully closed in competitive employment as a result of VR services. The Bureau routinely reports data to track compliance with federal program performance standards and indicators to the Rehabilitation Services Administration within the USDOE. Program data reported to the RSA during the OPEGA examination period reflect the following information regarding the impact of Maine's VR programs. Wage Impact of VR Program: During SFY 04, 05, and '06, 2,042 consumers achieved a successful outcome for job placement after receiving services through BRS VR programs. The average weekly wage increase for these individuals was more than 300 percent. Public Assistance Impact of VR Program: During this same three-year period, approximately 50 percent of those consumers who received public assistance at the beginning of their programs no longer required public assistance support upon completion. This resulted in a decrease in the need for public assistance dollars totaling $2,845,032. Following an assessment process begun in the winter of 2004, the Bureau recognized that overall client service and employment outcomes suffered from a cumulative reduction in attention to supervision and management of case review protocols. Around the same time, however, the new Bureau Director was made aware of a program budget problem whose impact ranged from 1 to over 3.1 million dollars. Addressing this fiscal crisis and managing the program impact in consultation with state, regional and federal program stakeholders diverted much of our attention from other pressing program priorities for the ensuing 12 months. Despite this distraction, the Bureau's Lead Team developed and implemented an operational plan for improving overall systems quality and reorganized its central office operations to place more emphasis on transparent financial analysis, organizational development and service improvement. Supplemental Materials Appendix One: Client Service Improvement Map (designed in '04; and last revised July '07). An example of the tools used by the Bureau Lead Team to prioritize, manage and update its systems improvement work over time. Appendix Two: BRS SFY 04 -06 Management Intervention Highlights. A narrative timeline of systems change activities during the review period reflecting the work undertaken to prioritize and address competing program management challenges. The OPEGA review and The Plan Going Forward From the outset, BRS management has viewed the OPEGA evaluation process as an exceptional opportunity to focus and improve our operations, continue initiatives around transparent financial management, effectively use available resources, streamline procedures, emphasize results, and improve customer satisfaction. We are confident that the recommendations contained in this report, combined with existing program improvement work plans, will absolutely assist the Bureau in achieving these program goals. BRS explicitly acknowledges and affirms its commitment and responsibility to assure that every program dollar is managed as a public investment in enabling people with disabilities to become employed and self-sufficient. To this end, the management actions presented herein will be incorporated into systems intervention strategies to improve VR program services. Specifically, BRS accepts the OPEGA findings and offers management actions intended to address the program deficiencies highlighted therein. These management actions focus on service improvement for individual customers and overall systems quality assurance. We seek to incorporate these management actions into the work underway to re-engineer every aspect of VR case management and improve the experience of job seekers with disabilities as they move through the VR process. Going forward, BRS will execute the management action commitments and implement robust internal controls as outlined in the OPEGA report by: ... implementing new program policies and procedures; ... implementing redesigned case review protocols and case management performance standards; and monitoring compliance via individual performance review and analysis of case data available through ORSIS; ... implementing rigorous procurement standards and monitoring compliance in partnership with the Security and Employment Service Center (SESC) by conducting a semi-annual audit of client service procurements. CONCLUSION BRS management sincerely thanks the OPEGA staff and our SESC partners for their assistance in getting through this review process and converting the findings into action to mitigate risks inherent in the VR procurement process. In closing, we have provided the following summary documents "Making VR Work for ME" and "Connecting the Dots". The first is a one page operational plan for implementing the systems changes discussed herein. This plan incorporates the check-list of management action commitments into the Bureau's organic plan for achieving sustainable systems improvements; and The latter presents the agency plan in a matrix format and offers a timeline for completion of the management actions. The agency will use these tools and others to monitor progress in achieving the systems change commitments contained herein. Making VR Work For ME: An Operational Plan to Improve VR Services BRS will implement transparent internal controls and monitor their effectiveness. 1. Case Management Systems: Implement redesigned case review (see Appendix Three: Flowchart of Case Review Re-design); and reinforce case management performance standards to improve outcomes/results for customers. ... Continue focus on service improvement and quality assurance; meeting federal standards and indicators with priority on improving the rehabilitation rate for successful closures; and managing the wait for case services; ... Management action priorities will include: clarification and adoption of new Standard Operating Procedures, case documentation and case management protocols; system-wide staff training; sharpened system-wide performance expectations; and improved supervisory training re: monitoring and coaching performance. 2. Fiscal Management Systems: Implement risk management protocols, improve control and monitoring of procurements, and audit effectiveness of procurement controls and financial systems changes. ... Management action priorities will include: implementing rigorous procurement standards coupled with an internal audit process to establish baseline data, test penetration of the new standards, and provide data to agency management to support continous improvement of systems procurement practices going forward. SESC staff assigned to provide financial management services to the agency will conduct the internal audit of client services procurement transactions (see Appendix Four: Pre-Audit of Procurements). ... Initially, the audit will be done in six-month intervals. The results from the first audit will form a baseline against which penetration and effectiveness of process improvements can be measured. At the end of 18 months, with three data sets and expertise with using the information, the agency will review the usefulness of the data produced and may adjust the frequency, refocus the audit parameters or adopt a revised method(s) of measuring the effectiveness of procurement protocols and managing risks in the procurement process. 3. Quality Assurance System: Assess effectiveness of case review and management system changes; measure improvements in targeted services areas; identify and manage emergent risks and challenges; plan, do, check, act (PDCA) to assure continuous improvement. ...Management action priorities will include: strengthened controls to facilitate computer reliant elements of the client services delivery system and automated elements of financial transaction processing; adopting the OPEGA data mining [see note 1] protocol to flag case anomalies in targeted areas of risk, standardizing the internal process for investigation and analysis of data mining results, and initiation of corrective actions and continuous improvement strategies. Note 1 - Data Mining: OPEGA reviewed BRS procurement practices and processes and constructed a complex data query designed to perform a computer automated sweep of ORSIS data and flag variances from protocol and processing irregularities. The cases flagged as a result of this "data mining" were reviewed along with others to assess what has actually taken place in the case and to determine if and to what extent fraud, misuse or waste of funds had occurred. ... Initially, using the results from the original OPEGA data queries as a baseline, we will rerun the query against ORSIS systems data at 12 months and 18 months to again mine for case anomalies and investigate the flags raised. At the end of these two runs, we will reassess the data produced by the query and determine if and how to adjust the frequency, refocus the query or adopt a revised method(s) of measuring case services quality and managing risks in the case services system. Connecting the Dots: Our purpose in constructing the following matrix and timeline is to demonstrate at a glance that all of the elements of the OPEGA review and the management actions developed in response thereto, are captured in the foregoing " Making VR Work for ME" plan for achieving and sustaining comprehensive improvement in the quality of services provided by BRS. Service Improvement / Management Action Matrix [Table shows three columns:] Case Management: Implement redesigned case review; case management performance standards; improve customers outcomes. Fiscal Management: Implement risk management protocols; improve control and monitoring of procurements , and audit effectiveness of internal controls. Quality Assurance: Implement data analysis; audit effectiveness of service delivery standards; PDCA. Action A - Implement Revised Procurement Process = Case Management Action B - Strengthened Written Policies and Procedures = Case Management Action C - Establish Controls in ORSIS = Quality Assurance Action D - Redesigned Case Review System = Case Management Action E - Monitor ORSIS Data for Risk Indicators = Quality Assurance Action F - Audit Procurement Transactions = Fiscal Management Action G - Conduct Systemwide Training = Case Management Action H - Incorporate Compliance Into Staff Performance Review = Case Management Action I - Complete Review of Other Cases Identified by OPEGA = Quality Assurance Service Improvement/Management Action Timeline Management Action and Completion Target Dates MA-F: Implement Pre-Audit of Procurement Transactions - Jan. '08 MA-I: Complete Review of Other Cases Identified by OPEGA - Feb. '08 MA-E: Monitor ORSIS Data for Risk Indicators - March '08 MA-C: Establish Controls in ORSIS - May '08 MA-A: Implement Revised Procurement Process - July '08 MA-H: Incorporate Compliance Into Staff Performance Review - July '08 MA-B: Strengthened Written Policies and Procedures - Sept. '08 MA-G: Conduct System-wide Training - Dec. '08 MA-D: Implement Redesigned Case Review System - Dec. '08 Appendix 1 - BRS Client Service Improvement Activities [Diagram showing a radial display of Activities and component parts. Numbers below identify groupings by ray; in visual format, rays are not numbered.] BRS Client Service Improvement Activities 1 Financial Management 1.1 Budget Development 1.2 R20 1.3 Analysis of Cost code usage/Cost code frequency analysis 1.4 Contract Development 1.4.1 Management 1.5 Create Future Financial management System 1.5.1 Barry-Dunn Study 1.6 State & Federal Reports 2 Leadership 2.1 External Relationships 2.1.1 Collaboration with DHHS 2.1.2 Benefits Counseling 2.1.3 State Rehab Counsel 2.1.4 Advocates 2.1.5 Vendors 2.1.6 Muskie Institute 2.1.7 Mid-coast Service Collaborative 2.2 Coaching and Mentoring 2.3 Expansion of Supervisory Support 3 Access to Services 3.1 Able ME 4 Case Work Management Practices 4.1 Job Development 4.1.1 Report Format 4.1.2 Job Readiness Assessment 4.1.3 Bangor Pilot 4.1.4 In-house Job developer 4.2 Redefinition Order of selection 4.3 Case reviews 4.3.1 Case Consultation 4.3.2 High-Cost Case review 4.4 Self-employment 4.5 Closure of long-term cases 4.6 Vendor payment for Outcome 4.7 Career Exploration 4.8 Bangor Youth Initiative 4.9 Financial Means Test 5 Caseload Size [connected by dotted line to Wait list reduction] 6 Legislation 7 Wait list reduction [connected by dotted line to Caseload size] 8 Data Management 8.1 Fiscal Data 8.1.1 Trend Analysis 8.2 Operational Data 8.2.1 Caseload Performance Data 9 Standards and Indicators 9.1 State 9.1.1 Resource Development Vendor Quality Assurance 9.1.2 Client Surveys 9.1.3 Public Education 9.1.4 Statewide Need Assessment 9.2 Federal 9.2.1 Rehab Rate 9.2.2 Increasing Successful Outcomes 9.2.3 State Plan 10 Tools & Resources for Staff 10.1 Cell phones 10.2 Software 10.2.1 ORSIS 10.3 Hardware 10.4 Training 10.5 Client Forms Completion Standardization 10.5.1 Use of Intranet to post forms 10.6 Improve VR Services 10.6.1 Resource Directory 10.6.2 Standardization or Wait list notification 10.6.3 Standardization of comprehensive assessment tools and practices 10.6.4 Contracting for Assessment Resources 10.7 Enterprise 10.8 Technology Upgrades 10.8.1 Assistive Technology NexTalk Dragon Dictate Video Phones 10.9 Use of the Internet for Forms 11 Staffing 11.1 Whole agency aligned to purpose 11.2 Retention 11.2.1 Staff Morale 11.2.2 Frontline Staff Compensation 11.2.3 Who Works Here and What are they doing Photo Directory Statewide Conference Relationship Building 11.2.4 Clerical Issues 11.2.5 Job Reclassification 11.3 Staff recruitment 11.4 training 11.4.1 New Staff Training 11.4.2 Succession Planning and Guidance Memos 11.4.3 Professional development/Training 11.4.4 Staff Cross training Appendix 2 BRS SFY 04-06 Management Intervention Highlights Host Department: Over the years, state VR services have been housed in several different Departments. 1992-94 DHHS 1994 -96 DOE 1996 - Present DOL SFY 04 - July '03 through June '04 December '03 Penny Plourde starts as Director, Division of Vocational Rehabilitation. This Division Director position had been vacant for over 3 years. March '04 MDOL Administrative contracts with Barry/Dunn to do management review of BRS. BRS Director accepts new position. May 22, 2004 Jill C. Duson (JCD) starts as Director. JCD implements 90-day entry plan focused on quick assessment of personnel and management resources; creation of Bureau Lead Team (BLT) structure; clarification of budget status; initiation of Keep-Stop-Start meetings with staff in all offices. Wait for service is averaging 7 to 8 months. SFY 05 - July '04 through June '05 August '04 Barry, Dunn report and recommendations issued. Prioritized report recommendations; built implementation matrix for Bureau action to improve policies and operations; prioritized Bureau action to improve R-20 payments processing, and negotiated timeline with MDOL shared services group to document federal drawdown and other financial admin. procedures performed for BRS. September '04 MDOL Shared Services discloses discrepancy in estimate of funds available to support program activities in FY'05. JCD implements delay in service commitments to current clients and slow down of new client intake pending clarification of funds available. All other operations issues tabled pending resolution of program solvency concerns. October '04 MDOL notifies State Controller and RSA of budget shortfall estimated between $1 million to $2.3 million. MDOL request assistance from Controller to review shared services investigation and analysis of the problem, and to assist with discussion with federal partner re: action to avoid program grant penalties. BRS releases three financial positions to MDOL shared services. November '04 MDOL assigns shared services personnel to assess and define the cause and scope of the budget shortfall and recommend action to avoid recurrence. MDOL Shared Services hires new finance analyst to be allocated full-time to BRS. Shared services continues effort to finalize analysis of the cause and extent of the budget shortfall. Current estimate: $2 to $2.1 million. November '04 MDOL approves filling of new position to support BRS fiscal analysis and financial management needs going forward. JCD freezes intake of new clients pending review of fiscal status & options with MDOL, the Governor's Office and the Legislature, projects that waitlist for DVR clients may reach 18 months February '05. December '04 Commissioner requests and Governor approves inclusion of a supplemental budget request of $2 million for BRS program services to be submitted for consideration by the Legislature. BRS continues focus on triage response to client service requests. And, is fully engaged with facilitating analysis of treatment of the funding request (if approved) by USDOE, the State Controller's Office and lead finance staff within MDOL Shared Services. BRS begins design of MFASIS based financial management and variance driven reporting process. March '05 BRS goes forward with statewide staff meeting and KSS analysis to identify service improvement and quality assurance opportunities and gain commitment to special projects/task team approaches to achieving results. Using a variety of Bend The Curve tools and methodologies, BRS prioritizes client service improvement activities and commits to several short initiatives: Short-term initiatives (6 to 12 months): ...VSM based projects: R-20 process improvements; improve/capture of SSA-VR reimbursement revenue. ...Special Projects: unbundle and make more efficient use of dollars spent on job development services; standardize and make more effective use of funds committed to self-employment plans; evaluate long-term cases for closure. April '05 The Legislature approves the requested 2 million dollar supplemental appropriation and the funds became available to the Bureau in April '05. DVR client waiting period for services reaches 14 months. BRS completes initial design and preliminary tests of reports in new MFASIS based financial management process. May '05 MDOL allocates closure of BRS '05 books and development of BRS '06 budget to separate staff within its Shared Services Group. BRS lifts freeze on intake of new clients and reduces DVR wait list to 12 months. BRS implements MFASIS based financial management process for SFY '06 with plan for quarterly testing and adjustment. May '05 BRS establishes wait list ceiling and management plan. BLT sets program goal to reduce the wait list for DVR services to 10 months by December '05, and implement a sustainable plan to manage the wait for service within a range of 4 - 6 months by June of '06. SFY 06 - July '05 through June '06 September '05 Implementing Financial Management Protocols. The implementation of the new financial management process was complicated. BRS began transition to an ongoing check-in process based on quarterly variance reporting using data from the first quarter of the SFY '06 (August - September). October '05 Further Implementation of BTC tools BRS worked with teams implementing the short term projects commissioned in May '05 to standardize the use of project management tools tmeasure progress and quantify project impacts. BRS began incorporating project management principles into its work on long-term 12-14 months) initiatives: ... restructure program incentives and improve the rehabilitation rate by tying vendor payments to client outcomes; ... re-engineer case review, case management and performance expectations. October '05 Re-design case review Starting point of development with DVR leaders group. November '05 Results Based Funding (RBF) -- aka Vendor Payment for Outcomes BRS staff position paper: summary of RBF as rolled out in other states; options for developing a Maine project. BRS developed a substantial body of work to support consideration of a comprehensive change in how VR compensates community vendors for rehabilitation service. The consideration of this initiative was given highest priority by the BRS Leadership Team, generating substantial research and analysis of project results and contact with consultants engaged in the work with several other state VR programs. March '06 RBF Project Review Next generation RBF? Consulting again with other states experts, seeking more substantial documentation/analysis of improvements in outcomes for clients and the impact of project variations at different stages of development. BRS redid its analysis, attempting to incorporate learnings from multi-year data from other states into a "next-generation" project design for Maine. August '06 Received word that BRS would likely be subject of OPEGA review November '06 RBF Stakeholder Meeting Project review with experts from other state VR programs; national RBF experts; Maine CRP's; advocates; consumers and other stakeholders. January '07 "No Go" Decision on RBF Bureau management priorities spread too thin for it to make sense to add in this major change. Decision to hold and reconsider after case review re-design is implemented. February '07 Re-design Case review Note: decision to test by using new tool on OPEGA generated cases. Appendix 3: FlowChart of Case Review Re-design [Table with arrows shows relationship over time of VR Case Flow, Internal Monitoring and Support (by Supervisors), Internal Case Review, and External Audit.] VR CASE FLOW Eligibility / Wait List - Status 02-04 followed by Comp. Assessment Plan Devel. - Status 10-12 followed by Active Case/Cost Services - Status 14-22 followed by Case Closure - Status 26-28 followed by Post-Employment - Status 32-33 INTERNAL MONITORING AND SUPPORT Eligibility / Wait List: Supervisors review all eligibilities for new VRC's for 6 mos. Comp. Assessment Plan Devel.: -Supervisors review all new VRC IPE's for 6 mos. -Supervisors review high cost plans. Active Case/Cost Services: -Supervisors review high cost & long-term cases. -Supervisors review all self-emp. >$7500 and >$2500 Case Closure: Supervisors review all new VRC case closures for 6 mos. INTERNAL CASE REVIEW (10%) Active Case/Cost Services: Case Review Tool Quarterly CR days for cases in active status > 6mos. DVR SMELT NOMELT DBVI CSW/R.C. Case Closure: Case Review Tool Quarterly CR days of CO team. Post-Employment: Case Review Tool Quarterly CR days of CO Team. [Below processes are distinct from those above:] EXTERNAL AUDIT RSA Fed Oversight Single State Audit Consumer Satisfaction Surveys SRC's, CAP INTERNAL PRE-AUDIT Service Center B SIQA Risk Report Appendix 4: SESC Pre-Audit Procedure PRE-AUDIT PROCEDURE BRS PROCUREMENTS Internal control review by SESC of BRS ORSIS R-20 payments which are processed as batch payments and paid by the State Treasurer (Pilot within 30 days & implement within 90 days) Frequency: Bi-annually Fall Spring Locations: Augusta, Bangor, Lewiston, Portland, Rockland, Saco Notification: Director and Regional Manager Written notice: One week prior to audit commencement Number of case files reviewed: 20 at each location - If more than 25% of files indicate irregularities, sample with be expanded Randomly selected Review of fiscal implications: Matching of expenditures to back up documentation; expenditure to IPE; fiscal soundness Review of Individual Employment Plan (IPE): Review expenditures to assert reasonableness of expenditures Documentation: Review will be documented Memo dated and signed by internal SESC Auditor will be maintained in Regional Office Reports: A summary report will be issued listing overall assessment Findings issued for: Lack of internal controls/segregation of duties Inadequate supporting documentation Missing approvals on R-20s Expenditures that don't pertain to IPE and are questionable Inaccurate coding Is purchase economical Finding: Issued to Management Will be kept in audit binder for reference Finding response by Management within one month Audit follow-up with Management documented in binder