Legislative Joint Auditing

Members, if you would take your seats. This meeting of the legislative Joint Auditing committees hereby called to order. Chair Cesar Korum. First item on the agenda is the adoption of the minutes from the September 13th, 2024 meeting should have had a copy of those emailed to you prior to this meeting, uh, would entertain a motion to adopt the minutes of the September 13th, 2024 meeting. I see a motion. Senator English. Second, Senator Peyton, all those in favor say aye. All those opposed. Minutes have been adopted. Next item on the agenda is an adoption of the reports of the executive and standing committees. This time I would recognize my co-chair, Senator Peyton, to present the executive committee report. Thank you, Mr. Chair. The executive committee met Thursday, October 10th, 2024 and adopted the minutes from the meeting held September 12, 2024. Staff reported to the committee the audit special and investigative reports scheduled to be presented to the standing committees and the full legislative joint audit. committee this month. Staff also noticed noted reports that are anticipated to be released by year end. In other business, Mr. White informed the committee of legislative audit's recent successful peer review in which the highest rating of pass was received. Senator Peyton asked Mr. White to update the committee regarding audit staffing and ability to remain current on audit work, Mr. White indicated that resources have been reallocated so that work can be completed and additional advertising has aided. In hiring new staff. Senator Johnson requested that Mr. White inform the committee regarding any new budget needs. Mr. White indicated the audit would be requesting two main changes to its budget. First, audit will request additional funding for an information technology officer to further prioritize computer system and information security. Second, supplemental appropriation and special language will be requested to enable audit to begin an intern. Internship program. With no additional business to discuss, the meeting was adjourned. Um, I'd just like to say before I make the motion to adopt this report. I'm gonna have a subsequent motion immediately following the adoption of this report, Mr. Chair, I move that we adopt this report. Thank you, Senator Peyton. Senator Peyton has moved adoption of report. Do I see a second? I see a second Representative rise, is there any discussion? All right, seeing none. Uh, Senator Peyton, uh, maybe before we move forward with the adoption of the report, did you have another motion you wanted to present? Well, I don't think we can have two motions on the floor. All right. So all those in favor of the motion to adopt the report, say aye? All those opposed. Guys have it. The report has been adopted. Senator Peyton, you're recognized for your motion. Thank you, Mr. Chair. So I'm going to make a motion that this Committee, uh, support for the letter of support on or Stanford support on the, uh, budget request of the audit. Uh, legislative joint audit, but before I ask you to vote on that if it's, if it pleases the chair, I'd, I'd like staff to present. The reasoning behind it and what they gave to us in executive committee and then I'll have a motion to support their budget proposal, Mr. White, you're recognized. Thank you, Mr. Chair. Um, as discussed in the standing report, legislative audit and his budget request for this upcoming biennial has kind of two main initiatives that we're looking at. One of those is we're asking for an additional position, a legislative audit, IT security officer, and it would be an individual legislative audit dedicated to keeping our systems secure as well as the public's data that we manage and that we receive, helping make sure to keep that secure places priority and places it as a priority legislative audit. So that's one of the initiatives or one of the requests. The second piece of the request is mentioned as we're looking at starting an internship program. We see that as a pipeline of getting us legislative auditors for tomorrow. Um, and in the difficult hiring market in the accounting industry, it's important that we have an internship program. When we're speaking with recent graduates, they frequently mention that they've already had 1 or 2 internship programs and we want to be part of their consideration prior to them accepting employment with private firm. Arms. Um, So with that internship program, what it's gonna, what we're asking for is 10 extra help positions also require some special language and funding associated with those positions and then as well as in order for us to start that internship program in June of this coming year, we'll be asking for a supplemental appropriation for that one month. And that completes the summary of the budget request. All right, Senator Peyton has made a motion that this committee support. All right. So Senator Peyton has made a motion to support the budget request of legislative audit is Before we vote, is there any discussion on that actually do I have a, a second. I see a second Senator English. Is there any discussion on the motion? Senator Love, you're recognized. Thank you, Mr. Chair. I was just gonna ask how much additional funding are we, are we? Talking about for both of those requests. Yes, sir. So for the IT security officer position. It's 129,000 for that appropriation for the internship program we're looking at 230. Both of those come with some matching funding, which is around 4470 is where that's at in total, um, just then on top of that, there's the regular, um, capital outlay request, you know, that's going to be the change column you'll see on the request. So those two initiatives we're looking at 470. So does that make us competitive as far as Internships as as we as we see it. Uh, as far as the the pay and the internships, is that gonna be make us competitive and Getting people, I mean, I don't want to start a program and then we don't get anybody, but. Understood where we're projecting it, we feel like we will be competitive and able to get interns. Yes, sir. OK. All right. Thank you. Thank you, Mr. Chair. Representative Rye, you're. Do you have a question? OK. Senator Chesterfield, you're recognized. Thank you, Mr. Chair. Do we already know who we're going to hire for the 129,000. Or is it gonna be let out, uh, or is it gonna be Posted and people will be able to apply. Great question, Senator. We have somebody on staff that we're providing the training to, we're getting them the capability they already bring with prior experience and they're spending a portion of their time already on these duties. What it is is moving them into that role and having that appropriate that position defined in our appropriation as being what they do. OK, thank you. And when we talk about the interns, are we talking about the summer programs that we have are we talking about internships throughout the year. Uh, again, a great question. So what we're budgeting for is we're asking for summer internship program, um, after we're able to get it going in the summer, we do have enough appropriation we're asking for it to where we could as well be looking at a spring internship program, so spring and summer is what we'd be looking for. All right, thank you. Thank you, Mr. Chair. All right, seeing no further discussion. The question is, uh, whether the motion is to whether to support. Uh, do you wanna? Yeah on the motion. So, Mr. Chair, I move that the legislative Joint Audit Committee as a whole. Put a recommendation. With the request to the Budget committee where this will be considered. And I'd just like to add, uh, I read it in the in the report, but when, when they got the highest rating by this peer review group. It, it's a nationwide peer review group that comes into Arkansas and looks at what they do. We all know the excellence that they that they've, that they've shown us, but to be recognized like that by the, by this. Review and getting the highest rating, uh, We know that they're independent and that they're nonpartisan and, and, and they call balls and strikes as they see them. I've, I've certainly come to appreciate them more than ever, um, I think it's important that if they're going to maintain that standard that they have a system of, of hiring and bringing new help in where where this internship can actually help vet and train those candidates, and then, uh, as Mr. White said, cybersecurity is a big issue, and, and they're dealing with a lot of confidential information and so it's important that they have the ability internally to guard that information, and, uh. Through this cybersecurity position, so I would appreciate a good vote. I move that we support their efforts. In their budget request. All right, Senator Peyton has explained his motion. We've already had a second on the motion which was Senator English, seeing no further discussion, all those in favor say aye. All those opposed. Yeah I have it, motion passes. Next we have the report on the standing committee for counties and municipalities that recognize Representative Rye at this time, Representative Rye. The committee adopted the minutes of the meeting held on September 12, 2024. The committee was updated on the status of water and sewer audits staff since '79 letters reminding entities that are delinquent in submitting reports to submit written plans on how these reports will be obtained. In response to these letters, 6 reports and 28 engagement letters were received in 10 entities provided written plans to obtain the required report. The committee requested certified letters be sent to the mayors, city clerk and treasurers, and the city council members of the 35 entities that have not responded to previous requests. The representative of the Arkansas Natural Resources Commission updated the committee on the current status of water rights studies required of water departments officials from two entities were previously filed reports were were present to answer questions or or to provide additional information. The committee reviewed 3 deferred reports and 161 current reports. Officials from five entities were present to address repeat findings. Two previously deferred reports were filed of the 161 current reports reviewed, 5 were referred to prosecutor prosecuting attorneys and the attorney general and 2 were certified to the governmental bonding Board. The committee filed 146 current reports and the 1st 16 to allow officials to answer questions or provide further information at a future meeting. Mr. Chair, I that for adoption of this report. Thank you, Representative Representative Rye has moved adoption of the report. Do I see a second? He a second. Someone. 2nd Senator Johnson. Is there any discussion? Seeing none, all those in favor say aye. All those opposed. I have it, the report has been adopted. Next we have the standing Committee on Educational Institutions, Senator Chesterfield, you're recognized to present the report. Thank you, Mr. Chair. The committee reviewed 14 audit reports consisting of school districts and an education service cooperative for the fiscal year ending June 30th, 2023. Additionally, one investigative report was reviewed by the committee. Representatives from the Osceola School District were present and answered questions from the committee related to findings in their audit report. Which was deferred from the September meeting. Representatives from the Pine Bluff School District were present and answered questions from the committee related to repeat findings and their audit report. The audit report of the Lone Oak School District was certified to the governmental governmental bonding board as well as refer to the applicable prosecuting attorney and attorney general. The Nevada County School District audit report and the Southeast Arkansas Education Service Cooperative investigative report were referred to the prosecuting attorney and. Attorney General. The audit report for Lone Oak School District was deferred to the December meeting so that school officials could be present to answer committee questions related to findings in the audit report. The committee filed 14 reports that were brought before it and deferred one audit report to the December meeting. Mr. Chair, I move adoption of this report. Thank you, Senator Chesterfield. Senator Chesterfield has moved adoption of the report. Do I see a second? So your 2nd representative Rye. Oh, any discussion? Seeing none, all those in favor say aye. All those opposed. Report's been adopted. Next, we have the standing Committee on state agencies Representative Furman, you're recognized to present the report. Thank you, Mr. Chair. 10 reports were on the committee's agenda yesterday. Two reports with the following findings were presented. The Department of Education did not properly maintain student loan receivables and had undocumented or improper disbursements in 4 student scholarship programs. The Northwest Technical Institute, a division of the Department of Ed, hired an attorney without proper authorization. The commissioner of State lands did not properly record the liability for excess land sale proceeds at fiscal year end. In addition, the special report regarding Arkansas PBS was presented. This was deferred from the September meeting of the full legislative Joint Audit Committee. Various agency staff members were present to report on how the agencies intend to address audit findings and to answer committee questions. During the meeting, the committee filed the 10 reports. I move that we adopt this report. Thank you, Representative Furman. Representative Furman has moved for the adoption of the report. Do I see a second? Second, Senator English. Is there any discussion? Seeing none, all those in favor say aye. All those opposed. Guys have it. The report has been adopted. Next we'll move to a review of reports. First item on the agenda. Is a special report. Concerning a review of expenditures for services provided to the Arkansas governor or governor's office. Through the Department of Public Safety division of Arkansas State Police for the period of June 1, 2022 through December 31, 2023. This time I recognize. Mr. David Gasaway to present the report Mr. Gasoway, you're recognized. Thank you, Mr. Chair. This report is issued in response to a request approved by this committee for legislative audit to review expenditures of Arkansas State Police for services provided to the governor or the governor's office made confidential by Act 7 of the first extraordinary session of 2023. The review was conducted primarily for the period June 1, 2022 through December 31st, 2023. Therefore, expenditures related to both the current and previous go Governor were included. Arkansas code assigned state police responsibility for the safety and security of the governor and family. The governor's mansion and grounds and the state Capitol building and grounds. Act 7 amended the code to make certain information compiled or possessed by state police concerning these safety and security duties exempt from from disclosure under Freedom of Information Act. Act 7 also requires state police to submit to legislative council a quarterly report of expenses incurred for services provided to the governor. The first objective of this review was to determine the expenditures classified by state police as exempt from disclosure under FOIA. State police identified 3 such categories. All expenditures coded in ASIS to the Executive Protection Call Center, vehicle fuel and maintenance expenditures from the state police fleet management system and aircraft expenditures. As shown in exhibit one on page 2 of the report, expenditures related to these services totaled 4.15 million for the review period. The second objective was to develop an understanding of state police procedures for preparing quarterly expenditure reports. To accumulate expenditures directly related to executive protection, state police uses a list of warrants written in the period coded to the Executive Protection call center in ASIS. These expenditures are largely comprised of the salary expenses of executive protection detail personnel, but also include the travel costs of those personnel as well as maintenance and operations expenditures. To determine executive protection vehicle cost, state police obtained information from ASIS using the specific fleet numbers and the call center associated with the specific vehicles designated for the protection and and transportation of the governor and family. Aircraft expenditures are primarily calculated using the actual flight hours obtained from from the state police flight logs applied to the operational cost rates for the applicable aircraft. The cost per hour calculations were 1,015 and $655 for the airplane and helicopter respectively. The cost of contract pilots when needed is calculated on a flight by flight basis. State police did not capture the purchase of vehicles, aircraft, equipment or weapons and did not quantify or report fuel and maintenance costs for vehicles, not specifically designated for the protection and transportation of the governor and family. The 3rd objective was to review the quarterly expenditure reports for accuracy, completeness, and compliance with Act 7. We reviewed the reports state police submitted to ALC for the quarters ended September 30th and December 31st of 2023 and found that expenditures noted in both reports were successfully traced to the executive Protection Call Center in ASIS. However, the two reports did not did not include vehicle fuel and maintenance expenditures and also did not include aircraft expenditures resulting in expenditures being understated. Although transactions for the 1st quarter of 2024 fall outside the scope of this engagement, it should be noted that expenditures related to vehicle fuel and maintenance as well as aircraft usage were included in the report submitted by state police to ALC for the quarter ended March 31st of 2024. The fourth objective objective was to review expenditures to ensure proper coding and classification compliance with laws and regulations and compliance with the public purpose doctrine. We reviewed the $4 million in expenditures coded to the executive protection Call Center in ASIS and concluded that those costs were supported by appropriate documentation and complied with relevant state laws and regulations, as well as the public purpose doctrine. Additionally, we traced the $29,000 in expenditures reported for vehicle fuel and maintenance to fuel card transactions for the identified vehicles. No exceptions were noted. Testing was also performed on over $106,000 in estimated cost calculations attributed to the usage of state police aircraft assets. We obtained and reviewed state police flight logs to determine how much of the flight time was used by the former and current governors with respect to total flight time. Usage percentages for the airplane and helicopter are reflected in exhibits 2 and 3 respectively. These exhibits are shown on the slide and on page 5 of the report. After recalculation of the estimated cost for use of the state police aircraft, state police could not provide satisfactory evidence to support the initial hourly rates provided. State police agreed that the hourly rates being used were likely outdated and calculated new rates based on a five year average of of actual cost and flight hours. The original the original hourly rates were adjusted to $1,839 and $1,287 for use of the airplane and helicopter respectively. Because of state police's use of the outdated hourly rates, the summary of expenditures provided in exhibit one on page 2 was understated by $59,000. Due to the risk that expenditures could have been omitted from the report presented in exhibit 1 on page 2, we conducted additional procedures for call center coding in the annual financial report of the Department of Public Safety for the year ended June 30th, 2023. Which included expenditures made from all state police call centers. We also reviewed travel from known executive protection detail personnel to obtain greater assurance that state police's population of expenditures was complete. No additional executive protection expenditures were noted as a result of this expanded testing. Based on this review, we concluded that state police has developed a reasonable methodology for accumulating, calculating and reporting the expenditures made confidential by Act 7. While the first two quarterly reports submitted to ALC did not include expenditures for vehicle fuel and maintenance or for aircraft costs, subsequent reports did include expenditures for those categories. Furthermore, review of the $4 million in expenditures from the executive protection costs Center indicated no instances of noncompliance with state law laws or regulations or with the public purpose doctrine. Although state police initially used outdated hourly cost rates for the fuel and maintenance for its airplane and helicopter, those rates have been updated. Mr. Chair, this concludes my presentation. Representatives from state police are present to respond to committee questions. All right, thank you, Mr. Gasaway. Looks like we have one person. In the queue who has questions maybe Senator Love, you'll recognize, sir. Thank you, Ms. Trey. I just, I want to go back to that slide where it says governor related and non-governor related. I just, that's not, so I'm, I'm just curious, what is the non-governor related mean? What's, what's the definition? OK, so a lot of that, um, that, that's gonna be the state police use of the aircraft, uh, I would say about 85% of that is going to be for police business, whether it be, uh, transport, transporting. Uh, state police management, um, or state, uh, transporting, um, Uh, inmates, um, wait, hold on, but I thought this was out of the call center for the protection of the governor. No, sir. So the, um, there is a, uh, this is in addition to the, the call center. They had to, because they can't, uh, this was a, this is a calculation that they make to figure out how much of the total cost of the airplane is related to the governor. It's, it's hourly, um, hourly rates, uh, based and, and multiplied times the number of hours spent, uh, transporting the governor. OK. All right. I just, I was just curious because I thought we were talking about expenses, expenditures related to the The protection transportation of the governor. So when you say non-governor related, uh. But all right, I, I, I think I understand what you're, where you're coming from, so thank you. All right, seeing, uh, Senator Hammer, you are recognized. I think it was here. I just want to put a summary statement on this. The, the bottom line is there wasn't anything wrong. There was some outdated, uh, factors that were being used to calculate the cost, but that has been identified and since then the state police have updated their systems to where it'll be more of a real-time reflection of the true cost, is that it? Yes, sir, that's it. OK, thanks. Seeing no further questions at this time I would entertain a motion to file the report. Senator Peyton. Uh, Mr. Chair, I move that we file the report. I have a motion to file a report. Senator Peyton, is there a second? Second, Senator English, all those in favor say aye. All those opposed. I have it, the report will be filed. Next item on the agenda is a special report related to cybersecurity incidents reported by public entities for the period of July 1, 2023 through June 30th, 2024. This time I recognize Mr. Larry Doss to present the report. Mr. Dolls you recognized. Thank you, Mr. Chair. This report is issued pursuant to the requirement contained in Arkansas code that legislative audit compile and submit to the General Assembly. An annual list of all cybersecurity incidents reported to us by a public entity. Prior to the passage of Act 260 of 2021, there was no requirement for public entities in Arkansas to report cybersecurity incidents. The General Assembly recognized the need to collect information and evaluate cybersecurity incidents so that proactive measures can be taken to prevent disruption of government operations. For the purposes of this report, the term public entity refers generically to organizations at all levels of Arkansas government. A cybersecurity incident is any event that compromises the security, confidentiality, or integrity of an of an entity's. Information systems, applications, data, or networks. During the review period, 132 cybersecurity incidents were reported to legislative audit by 71 public entities at all levels of state government. A complete list of these incidents is provided in Appendix C. Of the 132 incidents reported, 109 have been resolved and 23 remain under investigation. Exhibit one, shown on this slide. And on page 2 of the report. Provides a summary of incidents by type for fiscal year 2022, 2023, and 2024. During the review period, a third-party software provider used by several Arkansas governmental entities experienced a breach that affected Move It, a file transfer service owned by Progress Software. Although Arkansas entities were not directly breached. The attack affected organizations with which they interact, such as retirement systems, banks, and the National Student Clearing House, as well as organizations that used MoveI to send files containing sensitive data belonging to Arkansas entities. The complete extent of this breach is still being investigated. Mr. Chair, this concludes my presentation. I would be happy to answer any questions from the committee. Thank you, Mr. Doss. Senator Chesterfield, you're recognized. Thank you, Mr. Chair, and thank you so much, sir, for the report. What I am concerned about. Uh, our school systems that continue to have folks access their bank accounts, steal money, and then the bank has to make good on it. Is this a part of what we're dealing with with cybersecurity or is it labeled somewhere else? School districts are required to report, and that is compiled within this report. Yes, ma'am. What are we doing to help them do a better job because we consistently get reports where somebody's breached the um security of the bank or the security of the school system in its dealings with the bank. Take money, not get caught. What are we doing to harden that? Are we doing special training for them? Are we insisting that they do special training for themselves through DESE or something of that sort, or can you share that with me? Senator, I, I, I don't know if I can speak to all the efforts of other agencies and what they do. What I can tell is when our auditors are in the field and in discussions with these entities, they follow up on these breaches or these incidents and, and at that time, they're having discussions of what are best practices and what can be done to further prevent these type situations. At the same time, I know that our staff has recently attended a, an association, uh, training, um, I think it was the. Educational administrators. Yes, it was educational administrators association and our staff spoke on that topic to a lot of financial individuals in the room and explain to them some best practices. Thank you. Thank you, Mr. Chair. Representative Stephen Meeks, you're recognized. Thank you, Mr. Chairman, uh, just, uh, two quick questions. First off, who's investigating the, the move at breach that you just talked about. You said it was still under investigation. Do we know who's who's actually investigating that? As we understand it, the, the organizations that have been affected, meaning the third party organizations, um, the, so law enforcement's not involved at this point then, as you understand it, as we understand it, correct, uh, and then the, the, the second question I have is, uh, in the report, uh, the, the, the count of incidents is going up, um, as your auditors are in the field interacting with these with the agencies, are they, uh, at a point now where they're comfortable reporting these incidents. To y'all, do they understand the need for reporting these incidents to y'all or is there still some things that are out there that are happening either simply because people just don't, you know, they're afraid they're gonna get in trouble or they're not knowledgeable of the fact that they need to, to report the incidents. We are still experiencing some entities that are not aware of the law, um. So we are constantly educating them on the, the need to report those. So we don't have the full picture yet of what's actually happening, but we're getting there, it sounds like. Yes sir. All right, thank you. Senator Hammer, you're recognized. Thank you, Mr. Chair. On page 2 of the report identifies ransomware. I'm just curious, the agencies or maybe it's in the report and I just haven't found it yet. The agencies that experience ransomware, who were they? And was there money that had to be paid out on that like private industry has to pay out for. ranch more attacks. We have to be very careful about releasing sensitive information about who was impacted. So this is very generic by design, to our knowledge. No ransomware has been paid. We have, we have not received any information regarding ransomware being paid. OK, and then under the unauthorized access, can you tell if that was from employees or was that from outside entities? If you could say, from what we understand, largely from outside entities. OK. All right. Thank you. Representative Car you recognized. OK, I have a question. So with regard to the breach of confidentiality. Uh, you know, that's. Particularly concerning because the state of Arkansas holds a lot of information that I'm sure people would like to keep private from their tax returns to. Uh, certain health protected information if they're Medicaid. Uh, participants. So. Now what exactly, I mean, can you give us any indication of of what type of confidential information has been breached in these, in 2024, 10. Breaches of confidentiality. These involved a range of breaches, um, certainly those that were Related to the third parties and the move it, those were, those involved fouls, large files of data, uh, we are aware that they contained personally identifiable information. Some entities, these were uh student files, some entities, these were, um, Retirement information. So we are aware that there was a range of personally identifiable information. OK. And then, you know, in terms of Who's responsible for these attacks. Uh, can you give us any idea? Are these individuals are these, uh, foreign government entities are these, um, some type of organized criminal, uh, organizations who's who's responsible for The bulk of these attacks on, uh, our systems. We feel that a, a percentage of them certainly are coming from foreign actors, uh, whether that has, has been tracked down because that's very difficult to narrow down by law enforcement and resolve entirely. Um, most of these are, are more local, um, just from, from what we gather, but there are some that are coming from, um, VPNs within the state, virtual private networks, they've hidden their identity, um, but are, are clearly foreign actors involved in some of these. Very interesting. All right, uh, Senator Hammer, you are recognized. On, on page, uh, on the appendix C. Where to note one about the entities reported the cybersecurity incident occurred with an information system maintained by contractual provider and another computer-related service department. These include entities affected by the moveitgress software breach. That can you educate me on the move it progress software breach in our were they the provider of the services that we're supposed to keep the school entities safe from cyberattacks. Or can you educate me or do you know? Move it is, uh, software provided by a company called Progress, and it is what a lot of organizations use to package. Large quantities of data and transfer it, uh, from one entity to another securely. Um, there are other softwares out there that do something similar. This one started. As far back as 2022. Um, I think cybersecurity for Mandiant identified some issues with the software, those had been resolved across the industry and then again in 2023, there were some critical flaws identified with this software that led to these vulnerabilities that were exploited, um, that, that you're seeing now. So where all these school entities listed, which is a pretty long list. Using that same software? The, the National Student Clearinghouse uses that software and all schools use the National Student Clearinghouse. So this is a supply chain issue of providers. And do you know if any restitution was made to the schools for the data breach. Or or that gets down to an individual contractual agreement with each one of these entities. It is our understanding that the school district's contract or, or do business with the, the National Student Clearing House. And that's who was affected by this. I am not aware of it paid by the software provider to the National Student Clearing House or Further on to the districts. OK. And then the last question is, do you know, are they still using them or is there another option besides this one to be used or do you know? To my knowledge, they implemented fixes, patches, upgrades, and they are still using this software. OK. All right. Thank you. Representative Wooldridge are recognized. Thank you, Mr. Chair. Uh, you may have covered this, I missed it, but for the agencies or districts, is there some process in place to notify our Kansans when their information has maybe been compromised? Uh, yes, there is a statutory requirement when PII has been compromised and who they have to report that to, yeah. Thank you, sir. OK, seeing no further questions, Senator Chesterfield, do you recognize the motion. Maybe All right. Senator Chesterfield has made a motion to accept the report. We've used various terms here except file adopt, uh, accept the report, uh, is the motion. Do I see a 2nd, 2, Senator English. Uh, is there any discussion? Seeing none, all those in favor say aye. All those opposed. You guys have it report has been accepted. Next item on the agenda is a special report. From the Arkansas State and Public school employees health benefits uh related to the Department of Transformation and Shared Services, Employee benefits division for the fiscal year ended June 30th, 2023. This time I recognize Mr. Cameron's Spivey to present the report. You're recognized, sir. Thank you, Mr. Chair. Arkansas code requires legislative audit to conduct an annual review of the employee benefits division and the performance of the health and benefit plans. The primary objective of this report was to analyze the fund balance of both the state and public school employee health and benefit plans at June 30, 2023. EBD administers the health and benefit plans for both state and public school employees. Benefits are provided through self-funding, a method by which the state takes in contributions from both the employee and the employer. Separate funds are set up for each plan to pay health and pharmacy claims and to serve as reserves to prevent dramatic rate increases for subscribers. Additionally, in January 2023, United Healthcare began managing the group Medicare Advantage plan, commonly referred to as the MAPD plan for Medicare eligible retirees. This exhibit, which is found on page 2 of the report. It shows the planned enrollment for both subscribers and members for each plan. The term subscribers refers to both employees and retirees who are enrolled in the plans, while the term members refers to subscribers and their qualifying dependents who are enrolled in the plans. As detailed in this exhibit from fiscal year 2022 to 2023, the number of subscribers decreased by 2272 for the ASC plan and 1,283 for the PSE plan, creating a net decrease of 1,555 for both plans. The exhibit shown on this slide and on page 2 provides Medicare eligible retirees by enrollment in a retiree plan. First plan discussed in is the ASC plan. As shown in the exhibit on slide on the side and on page 3 of the report, the ASC plan had approximately $3363 million in fund revenue for fiscal year 2023. State contributions provided 58% of total revenue, subscriber monthly premiums made up 28%. AARPA funds provided 6% and other revenues accounted for 8%. Other revenues included performance guarantees, penalties, investment income, pharmacy rebates, Medicare Part D subsidies, and FICA savings. As shown in exhibit 6 on page 5 and on the slide, the ASC fund balance increased to 82.8 million at the end of the fiscal year. The fund's growth was primarily the result of planned revenues exceeding expenditures by 41.9 million and a 2.6 million decrease in the actuarial incurred but not reported health and pharmacy claims. Revenues were higher primarily due to $21 million in one-time ARPA funds and 3.2 million in high interest earnings. The health and pharmacy claim cost to the fund per subscriber totaled $6693 per month. A $24 decrease from the prior year. The out of pocket costs 2 subscribers also decreased in fiscal year 2023. Exhibit 4 on the slide and on page 4 provides a 5-year comparison of cost per subscriber for the ASC plan. This exhibit which is provided on page 5 of the report shows the changes in claims and administrative costs, as well as premiums and other revenues for the ASC plan for the past 5 years. The increase in premiums and other revenues was primarily due to the $21 million in one-time ARPA funds the plan received. Schedule 3 on page 14 shows health and pharmacy claims by Plan Type. Shown on the slide is the portion of the schedule related to the ASC plan. For fiscal year 2023, health and pharmacy claims paid from the fund totaled 196, and 98 million respectively. MA MAPD plan costs totaled approximately 90. Additionally, Schedule 4 on page 15 provides a three-year comparison of health and pharmacy claims. Factors contributing to changes from the previous fiscal year included a decrease of 4.1 million in claims over 250,000 and implementation of the MAPD plan beginning in January 2023. The next few slides contain information regarding the PSE plan. The exhibit on the slide and on page 6 shows over $488 million in fund revenue for the PSE plan for fiscal year 2023. Legislative funding provided 29% of the total contributions from school districts amounted to 28%. Subscribers' monthly premiums made up 30%. ARPA funds comprised 6% and other revenues delivered 6%. As shown in exhibit 10 on page 8 and on the slide, the PSC fund balance increased to 204.6 million at the end of the fiscal year. The fund's growth rate was primarily due to 31.7 million in one-time ARPA funds and a 28.6 million increase in school district premiums due to the required school contribution rate increasing. Exhibit 8 on page 7 and on the slide provides a five-year comparison of cost per subscriber for the PSC plan. Health and pharmacy claims costs to the plan per subscriberber totaled $492 per month. A $30 increase from the prior year. Out of pocket cost to employees increased as well. This exhibit which is provided on page 7 of the report shows the changes in claims and administrative costs as well as premiums and other revenues for the PSC plan for the past 5 years. The increase in premiums and other revenues was primarily due to 331.7 million in one one-time funding, one-time AARPA funds to the plan. This slide shows the portion of Schedule 3 related to PSC Health and Pharmacy claims by Plan Type. For fiscal year 2023, Health and Pharmacy claims paid from the fund to 293.2 million and 85.7 million respectively. MAPD plan costs totaled approximately 3.8 million. Additionally, Schedule 6 on page 17 provides a three-year comparison of health and pharmacy claims. Factors contributing to changes from the previous fiscal year included an increase of $6.6 million in claims over 250,000 and implementation of the MAPD plan, MAPD plan beginning in January 2023. We also reviewed the 20 members of the ASC plan in the 22 members of the PSC plan with cumulative claims exceeding 500,000. We tested these claims for accuracy and timeliness of case management services and noted no discrepancies. The total cumulative health and pharmacy claims exceeding 5,000,000 total 37 or 32.7 million, an increase of 4.7.7 million from the prior year. Our report contains one finding as noted on page 9. EBD made two accounting errors during fiscal year 2023. Patient-centered outcome Research Institute fees for both ASC and PSC were paid out of the ASC fund. The agency then erroneously transferred fees duplicating the erroneous entry amount. As a result, ASC expenditures were overstated, which resulted in the fund balance being understated. Inversely, PSE expenditures were understated, which resulted in the fund balance being overstated. Additionally, expected contributions could not be reconciled to actual contributiontions recorded in ASIS for both ASC and PSC. Mr. Chair, this concludes my presentation. Agency representatives are here to answer committee questions. Thank you, Mr. Spivey. Senator Chesterfield, you're recognized. Thank you, Mr. Chair. Since, uh, a portion of the funding comes from one time money. And when that one time money goes away, does that put the The entity at risk. Or Were you told what was going to happen in order to make up that money that came from ARPA. Shall I repeat my question? Senator Chesfield, we're trying to determine whether or not this is uh something that would be more appropriate for staff. We do have member, uh, guests here in attendance who. Maybe, uh, the most appropriate people to answer your question. So this time, uh, those who are here related to this item, looks like Mr. Wallace with the employee benefits division. Miss Land Miss Traylor and Mr. Caldwell. And uh. Each of you, if each of you would stand, we're gonna do is we customarily do in this committee, which is swear in the witnesses of each of you would raise your right hands. Do you each solemnly swear or affirm that the testimony you're about to give before this committee will be the truth, the whole truth, and nothing but the truth. Thank you. You can take your seat. Senator Chesterfield, if you want to ask your question again, these may be the most appropriate individuals to answer your question. Thank you. Thank you, Mr. Chair and gentlemen, thank you for being here. Since, uh, the funding of this is dependent to some extent on one-time money. What happens when that one-time money goes away, does that put the entity at risk? Thank you for your question, Grant Wallace, director of Employee Benefits division. As we're looking at this, we are within a 4th year of a 5-year strategy to level out uh the employer and employee kind of contributions. Uh, yes, we're watching the one-time funding. No, it is not putting our funding at risk. Uh, we are looking to put it at risk. I mean it's part of the natural spend there was some reimbursement, and that's where the one-time funding really came in is those were values that were reimbursed of expenses that were taken during the COVID time period that the plan absorbeds. That funding was not coming in, so that's where it really does kind of level out, um, and we are not at risk once those funds are going away. It's part it's kind of cooked into what we are balancing out, looking 5 years out, 7 years out around where all of our revenue streams need to be to make sure we keep the fund balances at healthy amounts. All right, thank you. Thank you, Mr. Chair. Senator Hammer, you're recognized. Like share anything that y'all see in the report that you take exception to or you disagree with. Senator, not from my perspective. OK, so everything in there from your perspective seems to reflect accurately. Um, where we are within the systems as far as the numbers shown in the report. Yes, sir. OK, thank you. Senator Hickey, you're recognized. Thank you, Mr. Chair. Along the same lines that, uh, Senator Chesterfield asked just, uh, on page 5, of course, I guess you're one of those entities that can retain your, uh, earnings, the interest earnings off of those investments. You all are accounting for A certain percentage drop in rates and how that's going to affect the line item up to 20-25% is what it looks like to me right now. Yes, sir, and these are funds that are invested with the Treasury, uh, money management trust program. So we are monitoring that this is not something that um. For lack of a better term, we count on, uh, you know, we, we have kept our actuarial analysis at a lower interest rate return. This has kind of been gravy on top as interest rates have spiked up over the last, you know, 1824 months. So, again, if we get a 60,600 to $800,000 hit, you know, because of these lower rates that are coming again, that's, I'm just. Kind of calculating how much I know that they've dropped. That's, that's also not gonna affect any of our operations. Right, because, because the way our actuaries have it, we are probably, um, and sitting here and estimating. 0.5 lower than what our returns actually have been. So we're trying to be more conservative in in those estimates and I continue to ask them to, to adjust those rates when they're doing their actuarial analysis so that we are, as you are suggesting, making sure that we're anticipating the decline and working with it and it's not going to be a surprise to us. Thank you, Mr. Wallace. Thank you, Senator Hickey. I, I do have a question quickly. Um, The fund balance is increasing. That's obviously a good thing. We, we like to see that. But some of that may be attributable to, I, I know we made a change with United Health. Uh, from the pharmacy standpoint, we made a change to Navidas, and there are people who've not, from what I've heard. Particularly, uh, the, in education, not happy with United Healthcare, uh, some, you hear about pharmacists and, you know, they're concerned about their reimbursements from Navidis, while it may be good for our fund balances. Um, I'm hearing that there are providers that won't accept United Health. Uh, because of just the way they conduct business. Uh, you've heard from pharmacists about issues with Navitis. I mean, can you speak to those issues because while it may be good for the fund balances, uh, you know, I've heard from a lot of Folks in education, retired teachers in particular who are not happy with this at all. So let's take the uh Medicare Advantage, the United Healthcare plan first on this one, and it is something that we have engaged and are continuing to engage with our retired teachers association, quite honestly, it's an education issue and a communication issue, um, that we need to help and better get some comfort level with our retired teachers on that plan. But then on the flip side, working with United Healthcare on their works and making sure that there's an adequate network coverage throughout the state. Uh, we continue to push upon them to make sure when it especially comes on the specialties, um, uh, whether you're looking at rehab services or orthopedic services or anything like that, uh, we're continuing to push upon them and impress upon them the importance of having an adequate network to provide those services throughout the state, uh, so that's really kind of the strategy that I've had on that. We are engaging uh a company called Retiree first to help with our education and awareness within the retired teachers on the Medicare Advantage program. It is a very good program, uh, unfortunately, there's a lot of misinformation out there around it, and we need to improve that. Uh, now looking at the pharmacy benefit manager and our relationship with NAvitis, that is something that we, it was announced the first day that I was announced as director, I've spent every single day in my tenure working on this issue, and it is something, uh, that I take. To hard and very seriously and continue to work with them to make sure that we are one balancing out our responsibility to the fiduciaryly manage the program and the trust fund also creating an adequate network and making sure that our pharmacists are paid appropriately and being market competitive within other, uh plans throughout the state. Um, I, I would not want to see EBD being on the extreme one way or the other, uh, when it comes to those reimbursements, so, uh, we. Continue to work with that, we will continue to work with that, um, and I will, uh, just continue to report back on how we are trying to improve that relationship and those services, uh, for our members. Thank you and I appreciate that. I will say and just expressing concerns that I've heard from some providers specifically in my district with regard to United Health. That they make it so difficult in terms of the audits that they, uh, and the, the kind of the requirements that they impose upon providers to obtain reimbursement that they make it so difficult that many of those providers have said, hey, if you've got United Health, you might as well go on because we're not. Uh, we're, we're not gonna accept that anymore, so it sounds like you are trying to address that. Is that right? Yes, sir. All right. Thank, thank you. Senator Hammer, you're recognized. Thank you, Mr. Chair. um. On a maybe tied into that or as another thought, the number of retired employees and teachers specifically that have switched over to. The Medicare plan, those numbers are up or down from last year. What's the, what's the trend? They're hanging pretty steady, to be quite honest. They're ranging somewhere between 14 17,000 participants, um, and that there's just some steadiness in that, which again is why we're trying to do an education and more awareness, uh, around that plan and that offering. OK. And then the, the fund balance I'm looking at page 9. In fiscal year 23, the fund balances, um, They increased 44.1 million. And 70.8 million respectfully. That's they increased by that much or they increased up to that much. They increase by that much. They increase by that much. OK. So, As a director, what is your goal as far as what you think is a healthy fund balance for those that do you have a personal ambition that you want to get them to or I, I know there's a lot of variables that may play into that, but. If you don't know, you don't have one, that's OK. I'm just curious, is there a number out there you're trying to get to? I wouldn't say there's a specific target that I've established in my head at this point. Uh, I know legislatively we have to be, uh, at a minimum of 14 and 16% on those funds. I would like to be above that, probably ranging, uh, in the twenties somewhere, um, and having a good cushion. I, I know actuaries tend to say you need a 3-month reserve for what your plan. Uh, I probably lean more towards the 6 month reserve kind of end of that spectrum. Um, and, and again, it's just knowing the history of this plan, uh, I, I don't want to get us back into a point that we ever get into a red zone of coming back and trying to uh ask for additional one-time monies they're trying to sit here and scrape this little fund over here and this little penny over here, uh, to make sure that we've, uh, I do take my fiduciary responsible responsibility very seriously and making sure that these balances remain. healthy, uh, and that our rates remain competitive and that our benefits are as strong as they possibly can be. OK, so with that, what is the number that we need to have to have 3 months reserve? I don't know that off the top of my head. Could you get that? I, I'd kind of like to know where that compares to the numbers reflected in this report. What's the, what's the number we need to get to and then this is covering a time period of 21 to 23. And all that is when we were still under, uh, medi Impact, is that correct? Correct. OK, so transitioning, how do you see the numbers shaking out? You got a 5-year plan and your five-year plan began ticking at what year? So that would have been in plan year 2023, uh, yes, so playing year 2023 would have been the first year that they were looking at redoing the rate share and the cost share between employees and employers. And employer, so looking at the landscape, you got one year under old, you got 4 years under new, um, And this is 23 numbers. Do you, do you have anything you could say as far as the trend that we're in the 2nd year and having made the transition, so the state plan is looking healthy and remains, um, very solid and stable with where that strategy is going. The public school plan, uh, has not. We actually paused that strategy for the rate plan for 2025. Um, the match was actually reduced from $300 to $2000. $34.50. Um, and that has been a huge financial impact to the reserve balances. Um, now, I do appreciate the work that the education committees did earlier this week and trying to level that back out and their recommendation of moving that to 312 will get us back on track, uh, to making sure that those balances remain healthy, you know, in the out years to come. OK, and last question is I'm looking at page, um, 15 of the report. And on page 15 of the report, it shows the, um, uh, state employee, 3-year health and pharmacy claims comparison. And in 21, uh the active pharmacy plan claims seem to be up. In fact, they, they went up higher than the other two, if I'm reading this right. But yet in 22, they went down 23, they seemed pretty stable between the retired health plan claims and retire pharmacy plan claims. What, what's attributing to the drop in 22 and holding steady in 23 on that. You know, without really diving into the demographic. I don't have that historical demographic, I would probably say that that's probably the largest contributor. I think we've also had a decline of members over those previous 2022, 2023 years, which is also going to contribute, uh, less members, less spend, uh, so without seeing that drug makeup that was going on, uh, we may have been in a utilization period where we had really expensive drugs and we've kind of cycled off of that, um, the initial thing that comes to mind is probably our COVID vaccine. Nations during that one time period, uh, and probably some of the initial COVID medications that were done, uh, during the that last, uh, I think 2021 you said was the high period, so it's probably all of that is probably. Uh, mixing into why that number is higher and we've seen that decline and level out over 2022 and 2023. All right, at the large claims, do we have a catastrophic fund to take care of the large claims or they absorbed into the overall cost because I noticed we had a couple heavy hits it, uh, during that period. So we had no, there's not a, a, a catastrophic, they are absorbed into our trust fund balances. I think there'd be any thoughts to establishing one so it wouldn't be such a hit or is that just? Not conceivable. It's something that I'm always willing to look and investigate and see what kind of, uh, options shake out. Uh, it's not something that I have thought of at this point. OK, we'll follow up. Thank you. Senator Chesterfield, you're recognized. Could you tell me how you decide uh Which system you go into if someone were a part of both the ATRS and. Public employee, how would you determine which one of these plans would be applicable to them should they retire soon. Yes, ma'am. It's one of those that, uh, to be honest, it's kind of been all over the board historically from what I've learned, uh, my preference as the director would be the retirement system that you had the most years of service under should be the plan that you fall under. So that, that's how I've made the determination do so appreciate it. Thank you. Senator Hickey, you're recognized. Thank you, Mr. Chair, and I know some of this is, uh, maybe outside of what leg audits report was, but since it's brought up on the fund balances, I just want to reiterate and make sure that Myself and everybody else understands. I think I do. So, the fund balance itself, that what you're, what you're required to maintain is actually in statute, which we did whenever we're in physical session. And also, if I remember correctly, if it were to exceed a certain amount, then at that, at that particular point is whenever you would start, we would, we would get it back between the range, is that correct? Yes, I have to, if I go one way to the extreme, either lower or higher, I have to come back and report to the legislature my plan to account for those extremities and how I'm going to reconcile that to get it back into a range. I think that's so important that the members in the public Understand that we actually did that because there's a lot of you all know that we were not solving. There for a while and that, that was our, uh, uh, avenue that we were gonna keep our, keep our eyes on this at all times, and if, uh, the fund balances did get too high, then we could rework, uh, rework that as we needed and then also if they got too low, then we would have to adjust and figure out other revenue sources. So there is a rhyme or reason with those fund balances. Uh, I heard what you said about the 3 months and the 6 months, but actually what's going to dictate that, if I'm correct, and you say, is, is going to be the statute on. On what is maintained there. Yes, sir, or if y'all approve my when I have to report back if y'all approve whatever strategy your plan is going to, to do that. Yes, sir. Thank you, Mr. Walls. Seeing no further questions. Yeah. I have a, uh, Senator Chesterfield, you're recognized for a motion. Senator Chesterfield has moved acceptance of the report. Do I see a second? Second, uh, Representative Nix. All those, uh, is there any discussion? Seeing down all those in favor say aye? All those opposed. You guys have it report's been accepted. We'll now move to other business first on the agenda we have an update regarding the special report related to a review of transactions and procedures of the bauxite District Court. For the period of April 1, 2024 through July 31, 2024. This time I would recognize Miss Atchley to present the report, Ms. Hatchley. Thank you, Mr. Chair. Subsequent to presentation of a special report on the city of Bauxite District Court at a meeting held in September. This committee requested that legislative audit follow up on recommendations contained within that report. Our first recommendation was that bauxite transfer $338,923 from the police department fund. The bond and bond account to reimburse an improper transfer. As of October 7th, Bauxite officials have acknowledged that $1000 has been transferred, leaving 37,923 still due to be transferred. Our second recommendation is that they transfer 1800 from the general or police department fund to the court automation fund to reimburse improper disbursements. This transfer has been completed. Third recommendation was that they seek legal guidance regarding the terms of the interlocal agreement between the city of Bauxite and the city of Bryant for services rendered during the period April 2023 to March of 2024. On September 18th, the city of Bauxott entered into an agreement with the city of Brant to repay the amount owed in a six-month installment plan. The 4th recommendation was that they request the bank remove the word automation from the name of the bond and fund account to comply with Arkansas code. This matter has been resolved. And our final recommendation was for bauxite and the district judge to take necessary steps to ensure that the bond and fine checks are signed by authorized individuals in compliance with Arkansas code. This matter was resolved by adding the district judge back to the account. Mr. Chairman, this concludes my update on the status of Audit's recommendations for the city of Bauxite in regards to the district court's special report. Thank you, Ms. Ashley. I appreciate that. So I have a question. So from what I heard you say. Out of the $37,000 that was owed back. On at least one of the items that they owe money on. There was one that they actually paid. There's another one that there was 37,000 owed on and they've paid one, only 1000 of it back. Why did they only pay 1000 of it back. Uh, Mr. Chair, that the funds were not available to complete the entire transfer. They have acknowledged our staff that they anticipate future transfers as funds are available. So what happened to the funds? It is our understanding that those funds were utilized um for police department normal operations and payroll. Are those funds uh. Are are they legally, uh, can you use those funds legally for those purposes? No, that, that's why in our, in our first, uh, report, we identified that as an improper transfer. OK. All right, yeah, well, we've been dealing with this for a while, so it's good to know that. All right, Senator Hammer, you're recognized. Um, thank you, Mr. Chairman. Maybe you're said and I didn't hear you. Did the judge get put on the account? Yes, sir, she did. OK, thanks. Senator Hammer, you're right. How'd you verify all that? How have you verified everything you gave us through the auditor on site or? Yes sir, the auditor on site and then they provided us copies of deposit tickets, uh, information from the bank. So we have. We have Verified it. We didn't just take their word, we have documentation to support each item. OK. And what's the monthly payment they're gonna pay back over the next 6 months? Do you have that for the uh for what they owe the city of Bryant. It's $2000. OK. All right. Thank you. Seeing no further questions at this time, thank you, Ms. Achley for the update. Next item on the agenda. I Looks like, uh. The next meeting of the legislative Joint Auditing Committee will be held Thursday, December 5th and Friday, December 6, 2024. Or at the call of the chairs, seeing no new business at this time I would entertain a motion to adjourn. So your motion, Senator Peyton second, Senator English, all those in favor say aye. All those opposed. Thank you very much. This meeting is adjourned. Good job.