**GUIDE FOR AUDITING**

**STATE DISBURSEMENT UNITS**

![](media/image1.png)

**DEPARTMENT OF HEALTH AND HUMAN SERVICES**

**OFFICE OF CHILD SUPPORT ENFORCEMENT**

**OFFICE OF AUDIT**

##### June 2003

##### 

##### [TABLE OF CONTENTS]{.underline}

##### PAGE

[**AUDITS OF STATE DISBURSEMENT UNITS (SDUs)
1**](#audits-of-state-disbursement-units-sdus)

[**CHAPTER I - INTRODUCTION 1**](#chapter-i---introduction)

[**PREFACE 1**](#preface)

[**BACKGROUND 1**](#background)

[**OBJECTIVE 2**](#objective)

[**SCOPE OF THE AUDIT 2**](#scope-of-the-audit)

[AICPA Generally Accepted Auditing Standards
2](#american-institute-of-certified-public-accountants-aicpa-generally-accepted-auditing-standards)

[General Accounting Office Government Auditing Standards
4](#general-accounting-office-government-auditing-standards)

[Compliance with the Code of Federal Regulations (CFR)
4](#compliance-with-the-code-of-federal-regulations-cfr)

[**AUTHORITY FOR SYSTEMS CERTIFICATION REVIEW AND AUDIT
4**](#authority-for-systems-certification-review-and-audit)

[**CHAPTER II - FUNCTIONS OF THE SDU
6**](#chapter-ii---functions-of-the-sdu)

[Mail Opening 6](#mail-opening)

[Receipt Posting 7](#receipt-posting)

[Imaging/Encoding 8](#imagingencoding)

[EFT Processing 9](#eft-processing)

[Deposit Preparation and Reconciliation
9](#deposit-preparation-and-reconciliation)

[**CHAPTER III -- AUDIT PROGRAM 10**](#chapter-iii-audit-program)

[Preliminary Audit Work 10](#preliminary-audit-work)

[Obtain an Understanding of Internal Control
11](#obtain-an-understanding-of-internal-control)

[Evaluate the Operating Effectiveness of Controls
12](#evaluate-the-operating-effectiveness-of-controls)

[**CHAPTER IV - OCSE AUDIT REPORT 16**](#chapter-iv---ocse-audit-report)

## AUDITS OF STATE DISBURSEMENT UNITS (SDUs)

## CHAPTER I - INTRODUCTION

## PREFACE

This guide presents background information and recommended audit steps
for performing audits of a State's central collection and disbursement
unit operated under the Title IV-D program as part of the systems
certification review. The guide will also be used specifically for SDU
Audits in the future. This document provides guidance and standards to
be used by the OCSE auditors during the PRWORA systems certification
reviews under Objectives F-2 and H-2 of the document entitled,
"Automated Systems for Child Support Enforcement: A Guide for States,"
revised April 1999, and updated December 1999 and August 2000. An audit
will be performed, using this guide, in circumstances where a State
received conditional certification due to SDU deficiencies, and the
certification condition has not been lifted within one year following
the date of certification. ACF will conduct an audit of the SDU under
the authority of section 452(a)(4)(C)(iii) of the Social Security Act.
This guide parallels work that is performed by the OCSE Office of Audit
during the SDU review as part of the Systems Certification Team during
certification reviews. It expands upon that work.

This guide contains (1) background and authority for performing such
audits; (2) the objectives of SDU audits; and (3) auditing standards and
procedures that apply to this type of audit.

## BACKGROUND

Section 454B of the Social Security Act required States to establish a
State Disbursement Unit (SDU) for the collection and disbursement of
child support payments by October 1, 1998, or October 1, 1999, if
payments were received by the courts. The SDU must process payments in
all IV-D cases and in non-IV-D income withholding orders issued on or
after January 1, 1994. The SDU must be operated by the State IV-D agency
or a contractor directly responsible to the agency. The SDU must post
collection information directly into the State's automated child support
enforcement system in IV-D cases, or post collection information to a
front-end system and provide collection information in IV-D cases to the
child support system through an electronic interface.

The SDU must use automated procedures, electronic processes, and
computer-driven technology to the maximum extent feasible, efficient,
and economical, for the collection and disbursement of support payments.
Procedures usually include receipt and disbursement of all payments;
accurate identification of payments; prompt disbursement of the
custodial parent's share of any payment; and furnishing to any parent,
upon request, timely information on the current status of payments under
a support order. States are not required to convert and maintain in
automated form records of payments in non-IV-D withholding cases before
the effective date of the SDU. Refer to OCSE-AT-97-13 "COLLECTION AND
DISBURSEMENT OF SUPPORT PAYMENTS," for more detail regarding SDU
requirements.

As part of the PRWORA systems certification review, the auditors will
perform an on-site visit of the SDU, even if the SDU functions are
partially or fully performed by an outside entity, such as a contractor
or another State agency.

## OBJECTIVE

This audit is not an audit of Child Support collections. The objective
of the State Disbursement Unit Audit is to obtain reasonable assurance
that the internal controls implemented by the IV-D agency to safeguard
assets, including the recording, authorization, custody and execution of
collections and the corresponding payments, are functioning effectively
as intended. However, because of inherent limitations in any internal
control, errors or fraud may occur and not be detected by this audit.

## SCOPE OF THE AUDIT

# American Institute of Certified Public Accountants (AICPA) Generally Accepted Auditing Standards

The State Disbursement Unit Audit will be conducted in accordance with
American Institute of Certified Public Accountants (AICPA) Generally
Accepted Auditing Standards (GAAS). Although Certified Public
Accountants (CPAs) are licensed by the state in which they practice, the
most important influence on CPAs is exerted by their national
professional organization, the AICPA. The AICPA sets professional
requirements for CPAs, conducts research, and publishes materials on
many different subjects related to accounting, auditing, attestation and
assurance services, management consulting services, and taxes. The AICPA
is empowered to set standards (guidelines) and rules that all members
and other practicing CPAs must follow. There are four major areas in
which the AICPA has authority to set standards and make rules: auditing
standards; compilation and review standards; other attestation
standards; and the Code of Professional Conduct.

Auditing standards are general guidelines to aid auditors in fulfilling
their professional responsibilities in the audit of financial
statements. The Auditing Standards Board (ASB) is responsible for
issuing pronouncements on auditing matters. These pronouncements are
called Statements on Auditing Standards (SASs). The ASB and its
predecessor organizations have been responsible for a considerable
portion of the existing auditing literature used by the profession.

GAAS are too general to provide meaningful guidance to auditors in
specific areas. More specific guidance is found in the SASs issued by
the ASB of the AICPA. SASs interpret GAAS and are the most authoritative
references available to auditors. These statements have the status of
GAAS and are often referred to as auditing standards or GAAS, even
though they are not part of GAAS. OCSE Office of Audit will conduct SDU
audits in accordance with SAS 55, "Consideration of the Internal Control
Structure in a Financial Statement Audit" and SAS 60, "Communication of
Internal Control Related Matters Noted in an Audit." SAS 60 requires the
independent auditor to report to the audit committee (or its equivalent)
all \"reportable conditions\" noted in the audit. A reportable condition
is defined in SAS 60 as "a matter that represents a significant
deficiency in the design or operation of the internal control which
could adversely affect the organization\'s ability to record, process,
summarize, and report financial data consistent with the assertions of
management in the financial statements" (or Federal reports). The
Auditing Standards Board recently issued SAS 78, which amends SAS 55.
The purpose of the SAS 78 is to conform the definition of internal
control to the one developed by the Committee of Sponsoring
Organizations (COSO) in its document "Internal Control - An Integrated
Framework." In so doing, the ASB concluded that internal control is not
a structure. It is more of a process. Hence, the reversion to just
"internal control."

Professional judgment must be used to adapt the standards to the
specific environment being used. (Required per the General Standards of
GAAS). **Elements of internal control of any organization include the
control environment, the accounting system, and control procedures.**

**The control environment reflects management's attitude, awareness and
actions taken concerning the importance of controls within the entity.**
The accounting system consists of methods and records established to
identify, assemble, analyze, classify, record, and report an entity's
transactions and to maintain accountability for the related assets and
liabilities. **Control procedures are those policies and procedures
other than those in the control environment and accounting system that
management has established to provide reasonable assurance that specific
entity objectives will be** **achieved.** These procedures may be
integrated into specific components of the control environment and
accounting system.

Generally, control procedures pertain to:

-   **Proper authorization of transactions and activities.**

-   **Segregation of duties to reduce the opportunities to allow any
    person to be in a position to both perpetrate and conceal errors or
    irregularities in the normal course of his duties -- assigning
    different people to the responsibilities of authorizing
    transactions, recording transactions, and maintaining custody of
    assets.**

-   **Design and use of adequate documents and records to help ensure
    the proper recording of transactions and events.**

-   **Adequate safeguards over access to and use of assets and records,
    such as secured facilities and authorization for access to computer
    programs and data files.**

-   **Independent checks on performance and proper valuation of recorded
    amounts, such as clerical checks, reconciliations, comparison of
    assets with recorded accountability, computer-programmed controls,
    management review of periodic reports that summarize the detail of
    account balances, and user review of computer-generated reports.**

The auditor needs to consider factors that affect the risk of material
misstatement of accounting records in attempting to understand the
organization's internal control. Procedures to obtain an understanding
of the controls within the SDU include inquiry of appropriate
management, supervisory and staff personnel; inspection of entity
documents and records; and observation of entity activities and
operations.

SAS 55 states that internal control objectives can best be analyzed
based on specific business activities. Groupings of similar functions
are known as transaction cycles. SAS 55 specifies internal control
policies for handling receipts and suggested tests of the control
policies. These policies deal with Authorization, Validity, Proper
Recording, Accountability and Comparison, and Protection and Limited
Access. OCSE Office of Audit incorporates these procedures into our
review of how the SDU processes and records child support collections.

# General Accounting Office Government Auditing Standards

Audits will be performed in accordance with the "Government Auditing
Standards, 1994 revision," issued by the Comptroller General of the
United States as prescribed by section 452(a) (4) of the Social Security
Act and this Audit Guide. The Government Auditing Standards, written by
the General Accounting Office (GAO), also known as the "Yellow Book,"
are known as Generally Accepted Government Auditing Standards (GAGAS).
The Yellow Book deals with internal controls over receipts in the
Sections that deal with Internal Controls, specifically Sections 4.21
through 4.29. Section 4.21 states that AIPCA standards and GAGAS require
that, "Auditors should obtain a sufficient understanding of internal
controls to plan the audit and determine the nature, timing, and extent
of tests to be performed."

GAGAS do not prescribe additional internal control standards for
financial statement audits. However, they provide guidance on aspects of
internal control that are dealt with in SAS 55, including the control
environment (Sections 4.23 and 4.24) and

safeguarding controls (Sections 4.25 through 4.29).

# Compliance with the Code of Federal Regulations (CFR)

45 CFR 302.20 "Separation of Cash Handling and Accounting Functions,"
specifically Section 302.20(a) states, "The IV-D agency will maintain
methods of administration designed to assure that persons responsible
for handling cash receipts of support do not participate in accounting
or operating functions which would permit them to conceal in the
accounting records the misuse of support receipts. Such methods of
administration shall follow generally recognized accounting standards."

## AUTHORITY FOR SYSTEMS CERTIFICATION REVIEW AND AUDIT

The PRWORA systems certification process, including review of the State
SDU, is conducted under the authority of section 454(24)(B) of the Act,
and 45 CFR 302.85 (a)(2), which requires each State, by October 1, 2000,
to have a Statewide computerized Child Support Enforcement system that
meets all of the requirements of Title IV-D of the Act enacted on or
before the date of enactment of the Personal Responsibility and Work
Opportunity Reconciliation Act of 1996, in accordance with 45 CFR 307.5,
307.11, and the document entitled, "Automated Systems for Child Support
Enforcement: A Guide for States," revised April 1999, and updated
December 1999 and August 2000.

State SDU audits are conducted under the authority of Section
452(a)(4)(C)(iii), Title IV, Part D of the Social Security Act (the
Act). This authority provides that the Secretary's designee shall
"conduct audits in accordance with the Government Auditing Standards of
the Comptroller General of the United States...of the adequacy of the
financial management of the State plan approved under this part for such
other purposes as the Secretary may find necessary." The authority for
OCSE to conduct such audits is also contained within 45 CFR 305.60(c).

The regulations at 45 CFR 305.60(c) indicate that OCSE will conduct
audits for such other purposes as the Secretary determines necessary. In
addition, paragraph (c)(1) of that regulation indicates that these
audits include audits to determine whether the state is substantially
complying with one or more of the requirements of title IV-D of the Act

(with the exception of the requirements of section 454(24) of the Social
Security Act related to statewide automated systems, and section
454(27)(A) and (B)(i) of the Act related to State Disbursement Unit) as
defined in section 305.63 of this part. Under this provision, these
\"substantial compliance\" audits do not cover plan requirements
regarding statewide automated systems, and state disbursement unit.
Therefore, if a state fails to correct the SDU related deficiencies
identified during the certification process within one year following
the date of certification, OCSE has determined that, that under the
authority of section 452 (a)(4)(C)(iii) of the Act and 45 CFR 305.60(c),
a Federal audit of the state\'s SDU will be conducted using the
standards and criteria set forth in the SDU audit guide.

## CHAPTER II - FUNCTIONS OF THE SDU

The State Disbursement Unit is responsible for all facets of processing
IV-D and employer withheld non-IV-D payments for the State's IV-D
agency. The operational functionality at the SDU can typically be
separated into 3 distinct, but related, areas:

-   Collection processing and posting of payments, including Electronic
    Funds Transfer (EFT). **[Our audit will focus on this
    area]{.underline}**.

-   Customer Service, exceptions processing, research.

-   Non-Sufficient Funds collections.

This audit is clearly not a review of the distribution of child support
payments. The SDU is not responsible for distribution of IV-D
collections. For those States with SDU exemptions that permit local
disbursement, the OCSE audit will include a review of the disbursement
at local offices. Most States use front-end systems to post payments and
related information. At night, information on posted payments is entered
to the State child support system through an electronic interface. The
State system then runs Distribution daily for non-TANF collections and
monthly for TANF collections.

Processes within the SDU include the following:

# Mail Opening

Mail Opening comes under the "custody" transaction component under
Segregation of Duties. Unopened mail must come to the SDU. The mail will
either be delivered by a bonded courier who picks up the mail from the
post office in the early morning or picked up from the post office box
by a designated employee. Only one post office box is required, but it
is preferable for a State to have three different boxes -- one for
employer wage withholding payments, one for out-of-state payments, and
one for noncustodial parent payments.

Mail must be opened in the secured environment of the SDU, restrictively
endorsed, and should be sorted by type of remittance (wage withholding,
out-of-state, NCP) and placed into batches of payments ready for
posting. Any correspondence, such as coupons, should be kept with the
check, for payment identification and entry. Batches should contain: a
designated number of payments (often between 25 and 50); a batch card
that states the number of items and total dollar amount in the batch;
and a batch number. The batch must be logged in. During the process,
items that cannot be receipted must be posted to an "unidentified"
account and later processed by personnel that work "unidentified
collections." NOTE: In many automated processes, checks are not
immediately endorsed. Rather, items are opened, batched, logged, and
delivered to the scan section, which must also be in the secure
environment of the SDU. The financial instruments are immediately imaged
directly from the mailroom and assigned a specific tracking number that
is imprinted on the back of each check. The bank endorsement is printed
in the "pass-two" process. This process is fully acceptable.

Each batch of payments should contain the same number of checks. As each
batch is ready for processing, the mail opener should fill out a batch
header card and the batch control log. These two items often provide the
operation's initial accounting of payments received, and therefore serve
as the basis of accounting controls throughout the operation. An
individual who is not involved in opening the mail runs an adding
machine (or electronic spreadsheet) total of the checks in each batch.
This person can also create a batch on the system, before posting. Once
the batch header and control log have been completed, the batches are
passed on to another person or section for receipt posting. Once posting
is completed, the system should compare the batch total to the total of
the payments in the batch entered on the system. If the amounts do not
balance, the supervisor must approve the adjustment.

NOTE: If imaging is done, the need for the adding machine tape total of
checks is eliminated if the imaging provides compensating controls, such
as once the checks are imaged, a Tracking Maintenance System
automatically maintains a control of the batch.

Once imaged, all items must be accounted for and balanced. The final
reconciliation should involve a process independent of the Tracking
Maintenance System. The system should compare the total of the payments
in the batch entered to the batch total from the Tracking Maintenance
System. Any variance must be investigated and corrected. This process
will ensure that all batches are balanced prior to depositing the money
in the bank.

# Receipt Posting

Receipt Posting comes under the recordkeeping transaction component
under Segregation of Duties. This function should provide an efficient
and accurate method for accurately capturing child support information
included with each payment, while maintaining strict accounting
controls. The receipt posting system should be designed specifically for
processing child support payments. Many SDUs use a front-end system to
initially post the payment. Payment information is transmitted daily
through an electronic interface into the Statewide automated child
support system. The system usually performs distribution daily for
non-TANF cases and monthly for TANF cases.

Some SDUs use a motorized check scanner, with software that recognizes
payments based on the bank routing and bank account numbers identified
by the scanner line on the bottom of the check. Using the information
captured by the scanner, the application software is able to select and
display child support payment information from a database. The
application software should assign a unique transaction number to each
payment processed. These unique numbers can be comprised of batch date,
batch number, check within the batch, and transactions within the batch.
Transaction numbers appear on the check endorsement and are transferred
to the State system for a sound audit trail and simplified research.

The standard audit trail for each check received should contain the
following information:

-   Depositor bank name, depository bank routing number, depository bank
    account [\#]{.smallcaps};

-   The unique transaction number assigned;

-   Operator ID for the person processing the payment;

-   Date and time processed.

If automated equipment is not used, checks and correspondence with the
remittance may be copied. This is not a requirement of the SDU. At a
minimum, each payment must be assigned a unique transaction number.

-   Accounting controls must be an integral part of any application
    software used.

```{=html}
<!-- -->
```
-   The number of checks in the batch and the total dollar amount of
    checks in the batch must be compared to the totals actually
    processed by the system. (The adding machine tape or electronic
    spreadsheet totals, if applicable, should be compared to the totals
    produced by the system.) If totals from the posting are not equal,
    the user must receive a message indicating the discrepancy. A
    supervisor or lead-worker must approve the necessary corrections.

The application software may incorporate a database containing client
information from both the State IV-D system and the court's mainframe
application. This database can be used for data validation and to reduce
data entry keystrokes and, subsequently, misposted payments. NOTE: If a
case is not in the database, money cannot be posted to that case. The
collection must be posted to a suspense account, to be further
identified and worked.

Specific transaction data should be posted next. If the worker attempts
to post money to a case that is not on the database, a warning should be
displayed. The database eliminates data entry keystrokes the first time
a payment is processed at the SDU. This reduces time and error.

Steps in posting the receipt, using automated methods, usually include:

-   Retrieve a batch. Record the worker taking the batch.

-   Log onto the system's payment processing application.

-   Enter the batch information (batch date, batch type, mail date, \#
    of checks in batch).

-   Scan the payment instrument -- bank routing #, bank account #,
    check #. Verify that all necessary information was scanned.

-   Manually enter items that cannot be scanned.

-   Identify the payor: Case ID; SSN; court order number; name; account.

-   Post the amount.

-   Print the audit trail on the payment instrument.

-   Reconcile the batch total to the total amount posted.

-   Close the batch.

NOTE: The "Automated Systems for Child Support Enforcement: A Guide for
States," updated August 2000, under Section F-2 (f), requires that for
each case, the system must maintain a payment history containing the
following information on each payment: amount of the payment; date of
collection; method of payment; date initially received in the State; and
date of disbursement.

# Imaging/Encoding

This is used if the State has imaging technology. It is not a systems
certification requirement. Once the checks have been entered into the
system, the checks may be amount-encoded and imaged and the source
documents imaged. Encoding the checks provides an indexed, softcopy
image of the item that can be used for future payment research. Tasks
under this function include:

-   Prepare batch separator pages.

-   Encode payment instruments.

-   Image payment instruments - This process captures images of the
    payment instruments by batch and encodes each payment instrument
    with the dollar amount of the payment instrument.

-   Image source documents.

# EFT Processing

The system must offer all employers the option of using Electronic Funds
Transfer/ Electronic Data Interchange (EFT/EDI) using the CCD+ and CTX
formats for the transmittal of income withholding. The system must also
support the acceptance and disbursement of payments using Electronic
Funds Transfer (EFT)/Electronic Data Interchange (EDI). The process for
receiving and sending payments using EFT/EDI should briefly be reviewed
during this audit.

The State system must offer all employers the option of using Electronic
Funds Transfer/Electronic Data Interchange (EFTI/EDI) using the CCD+ and
CTX (full CTX 820 remittance format) formats for the transmittal of
income withholding.

# Deposit Preparation and Reconciliation

Deposit preparation and reconciliation come under the authorization
transaction component under Segregation of Duties. A section or person
that is independent of the above processes should perform this process.
The system should provide for prompt deposit of all collections, and for
independent bank reconciliation. There also should be a daily
reconciliation of the front-end system with the Statewide child support
enforcement system.

##  CHAPTER III -- AUDIT PROGRAM

The steps to be performed in an SDU audit about the effectiveness of the
SDU's internal controls are as follows:

### Preliminary Audit Work

1.  Prior to initiation of the fieldwork, auditors should perform
    preliminary steps that will be of assistance in the overall
    performance of the audit. These steps should include a review of
    this Audit Guide and prior OCSE audit findings, if applicable.
    Review any State auditor, Single Audit, or other audit reports.
    Review any updates to the PRWORA Certification Guide that may be
    posted on the OCSE website at
    [www.acf.dhhs.gov/programs/cse](http://www.acf.dhhs.gov/programs/cse).
    Also, review any SDU findings contained in the Systems Certification
    report, if it has been issued. In addition, review the most recent
    version of the PRWORA certification findings to date. Consult with
    the Division of State and Tribal Systems (DSTS) National Lead person
    in charge of PRWORA certification to discuss any known SDU issues.

> To the extent possible, build on work done under the Single Audit Act
> in the area of reviewing internal controls over cash collections.
> Contact the auditor that performed the single audit prior to the
> review in order to determine the extent of work done in reviewing
> internal controls of the SDU. Review workpapers and audit findings.

2.  The auditor should discuss with Regional Office staff issues that
    may affect the audit.

3.  Review the State responses to the systems certification
    questionnaire for Section F, "Financial Management and State
    Disbursement Unit." This should describe whether the SDU is part of
    the statewide CSE system or a separate system. The functions
    performed by the SDU (i.e. payment processing, billing, EFT/EDI)
    should be explained. The questionnaire for this objective may
    provide a breakout of the number of payments processed by the SDU
    categorized by IV-D, Non-IV-D, wage withholding, EFT/EDI, mailed
    payments, cash payments, and the number and percentage of payments
    still being sent to the wrong address.

4.  If the SDU is outside the statewide system, obtain a description of
    the interface between the front-end system and the State system,
    including transmission medium and frequency. Review the description
    of the interface between the State or contractor front-end system
    and statewide system as it relates to providing payment information
    to the statewide CSE system, including how that information is
    transmitted to the statewide CSE system. (i.e. frequency and
    method).

5.  If the SDU is contracted out, obtain a copy of the State's contract
    with the vendor to see what functions the SDU is required to
    perform.

6.  If the State was granted an exemption for any SDU requirements by
    OCSE, obtain a copy of the exemption. Evaluate the type of exemption
    and any time limitations and special conditions stated in the
    exemption. If the State has an exemption for a portion of the SDU
    function, specific audit steps would then be written to provide for
    the review of this exemption or alternative process or configuration
    that does not meet the standard SDU definition or requirements. The
    remaining audit steps in the guide would be followed as applicable
    in reviewing the State's SDU.

### Obtain an Understanding of Internal Control

The auditor should obtain detailed information about the transactions,
their flow through the system, transaction related audit objectives, and
control activities used to achieve control. The following auditing
procedures will be performed to obtain an understanding of the internal
controls:

1.  Complete the OCSE Office of Audit's SDU Internal Control
    Questionnaire. This will highlight processes and procedures used
    within the system and the personnel that perform various functions.

2.  Review the vendor's and/or State's written procedures manual for
    operations within the SDU. This should summarize processes within
    the SDU, job functions within the SDU and levels of responsibility,
    among others.

3.  Verify that the SDU is the sole location for receiving all IV-D
    payments and

non-IV-D income withholding unless the State has an exemption that
permits IV-D non-income withholding collections to be received at the
local level.

4.  Review the SDU's written procedures to determine whether they
    require that all SDU employees with access to or control over funds
    collected under the child support enforcement program are covered by
    a bond against loss resulting from employee dishonesty in an amount
    which the State IV-D agency deems adequate to indemnify the IV-D
    program for loss. This is required under 45 CFR 302.19.

5.  Walk through the SDU facility to determine whether internal controls
    that address the physical security access to the facility have been
    implemented. During the walk-through, the auditor should determine
    whether the following security requirements have been met:

```{=html}
<!-- -->
```
a)  The SDU area must be restricted and located in a self-contained area
    that only performs SDU functions.

b)  It must be locked to outsiders. Cameras are encouraged, but not
    required.

c)  Have floor to ceiling walls. The physical barrier and security
    presented by floor to ceiling solid walls is considerably different
    than soft padded or other demountable walls.

d)  Security type doors, and a locking system for all doors, such as
    card key locks or push button code locks.

e)  Access to the SDU must be limited to SDU staff and other appropriate
    accounting and management personnel.

f)  All payment processing activities that involve checks, money orders,
    etc, including the opening of mail, must take place within the SDU.
    (In a few States, mail is received and sorted elsewhere. However, it
    must be opened within the SDU by authorized staff.)

g)  The SDU must have a fireproof, immovable safe for keeping processed
    checks, money orders and cash until taken to the bank. In addition,
    checks, money orders and cash not processed during the day received
    must be stored in a safe overnight.

h)  If support payments are received at a cashier's window outside of
    the SDU, the cashier must have a fireproof, immovable safe (i.e.: a
    safe with a slot in the top) to keep the payments until taken to the
    SDU for processing. The cashier's window must be in a secured area
    with limited access.

i)  SDU personnel should work at desks without drawers, where funds
    could be concealed. Preferably, personal belongings should be kept
    outside the SDU.

```{=html}
<!-- -->
```
6.  The SDU should issue a standard form letter to all non-custodial
    parents and employers directing them to send payment to the SDU Post
    Office Box address and to make checks payable to the State Child
    Support Enforcement Agency. This letter should have been sent when
    the SDU was established. However, the letter should be sent to new
    employers and non-custodial parents who send support payments to the
    wrong location, such as a local clerk of court. Payment in person
    should be discouraged unless the SDU or State office has a cashier's
    window where payments can be made. If not, clients should be
    directed to make their next payment to the appropriate post office
    box number. Obtain a copy of the standard letter.

### Evaluate the Operating Effectiveness of Controls

1.  Ensure that immediately upon opening the mail, all checks should be
    endorsed "for deposit only" to the appropriate bank, "to be credited
    to the account of the State of XXXXX." This is usually done as part
    of an automated process. As indicated above, if imaging is used,
    checks are not required to be endorsed immediately upon opening of
    the mail.

2.  Ensure that payments received by mail are:

-   Date stamped with date of receipt. (This is part of restrictive
    endorsement.)

-   Recorded to an SDU-maintained batch log, listing the date, the
    initials of the employee opening the mail, and the amount of the
    payment.

NOTE: Some parts of this step may be performed in a more highly
automated environment, but similar results should be obtained through
the automated equipment, such as scanners.

3.  Ensure that when dealing with cash or checks over the counter, a
    prenumbered receipt is issued to the person making the payment, with
    one copy filed for review by an independent person. A person
    receiving payment at a cashier's office cannot post a payment to a
    batch due to required segregation of duties.

4.  Ensure that all collections are secured in a safe that is not
    movable.

5.  Ensure that duties are segregated in accordance with 45 CFR 302.20,
    "Separation of cash handling and accounting functions," which says
    that the State is required to maintain methods of administration to
    assure that persons responsible for handling cash receipts of
    support do not participate in accounting or operating functions
    which would permit them to conceal in the accounting records the
    misuse of support receipts. As stated in the "Objectives of the
    Audit" section, an individual shall not have responsibility for more
    than one of the three transaction components: authorization,
    custody, and recordkeeping. Specific segregation of duties include:

```{=html}
<!-- -->
```
a)  Opening mail, preparing batches

b)  Running an adding machine tape (or electronic spreadsheet) of checks
    in a batch and creating a batch on the system (unless the State does
    imaging, in which case this may not be necessary);

c)  Posting the batch, including unidentified collections;

d)  Depositing the collections;

e)  Preparing daily and monthly reconciliations;

f)  Working unidentified collections.

An individual, either at the worker level or at the supervisory level,
cannot participate in more than one area of payment processing, to the
greatest extent that this is possible considering the size of the SDU
and staff resources. A worker or supervisor cannot perform more than one
function with respect to payment(s) in a particular batch. However, a
supervisor can assist a worker with respect to more than one function
for payment(s) in a batch when necessary.

6.  Ensure that individuals receiving collections or making deposits are
    not involved in reconciliations.

7.  Ensure that an audit trail exists for when receipts are transferred
    from one individual to another or from one unit of the SDU to
    another. All information must be documented, logged and periodically
    reviewed.

```{=html}
<!-- -->
```
8.  Ensure that all pertinent documentation related to receipts is
    maintained. This may include deposit tickets, coupons, and other
    memoranda supporting the transaction.

```{=html}
<!-- -->
```
1.  For several payments posted recently verify that the system
    maintains a payment history containing the following information on
    each payment: amount of the payment; date of collection; method of
    payment; date initially received in the State; and date of
    disbursement.

```{=html}
<!-- -->
```
9.  Follow several payments through the entire SDU process for
    collections received on the day of your visit.

10. Ensure that there is a process in place to research payments that
    can't be posted to a case. Ask the State to describe and then
    demonstrate the process used to handle unidentified collections,
    methods used to research unidentified payments and measures taken to
    minimize the number of unidentified collections. The SDU must have a
    separate unit (or designated person not involved in processing of
    payments) that handles unidentified collections. This process is
    often handled in the SDU, but not always. It varies as far as how it
    is handled and who handles it. Sometimes, unidentified collections
    are handled in the SDU for a short time, and then handed over to the
    State for further work. Sometimes the SDU works every unidentified
    payment until it is identified. In all cases, unidentified payments
    must be recorded and deposited as a subsequent part of the mail
    opening process and the persons working these payments cannot be
    involved in processing these or other collections.

```{=html}
<!-- -->
```
a)  Trace several unidentified collections through the entire SDU
    process.

```{=html}
<!-- -->
```
11. For SDUs that issue checks, review the policy for handling checks
    returned from the Post Office, for example, due to an incorrect
    custodial parent address. These checks are only good for a certain
    number of days. Review the process in place for handling these
    checks. The checks must be kept in a safe. An individual should be
    assigned to work those checks to try and find the correct location
    of the custodial parent. Once the check is stale, it should be
    passed on to the State for processing. Note: Sometimes returned
    checks are handled in the SDU and sometimes they are not, so this
    step may not apply.

```{=html}
<!-- -->
```
a)  Trace several returned checks through the SDU process.

```{=html}
<!-- -->
```
12. Determine which personnel handle financial adjustments for
    correction of errors or for identifying previously unidentified
    collections. Review the financial adjustment process.

13. Review the procedure for non-sufficient fund checks.

14. Ensure that receipts are deposited within 24 hours to the
    appropriate depository. This must be independent of the posting
    process. All receipts, including exception items, must be deposited.
    Mail that comes in on one day and is not able to be processed must
    be kept in a safe overnight.

15. Review the interface between the SDU front-end system and the
    Statewide system. The daily deposit total that comes off the
    front-end system should reconcile with the totals per the Statewide
    system, which should reconcile with the daily deposit records. When
    all batches for each bank deposit are processed, the deposit report
    should be generated by the front-end or State system. This report
    supports and accompanies the deposit document to the bank.

16. Ensure that bank reconciliations are reviewed and approved in
    writing by the appropriate official. An authorized official should
    resolve any discrepancies within a reasonable time period after the
    discrepancies have been noted.

17. All unaccounted for variances should be immediately reported to the
    appropriate supervisor. Exception reports for any part of the
    process must be resolved and signed off by the appropriate
    supervisor.

```{=html}
<!-- -->
```
18. Determine if the contract with the firm managing the SDU provides
    that the firm managing the SDU will disburse checks to the family.
    If the SDU disburses checks, find out the types of checks that are
    cut (i.e.; collections in former TANF cases to the custodial parent
    or pass through of State share in TANF cases). Review the controls
    over the disbursement of checks.

```{=html}
<!-- -->
```
(a) Are pre-numbered checks used?

(b) Is the disbursement process independent of all receipt functions?

(c) Review posting to the non-custodial parent's account to reflect the
    disbursement. (This may or may not be a possible step to do at the
    SDU).

(d) Examine supporting documentation for case type.

(e) Examine checks for authorized signatures.

(f) Inquire as to the frequency of mailing out checks after they are
    cut. (This will affect the timeframes discussed in the next step.)

(g) Determine if timeframes required by 45 CFR 302.32, "Collection and
    disbursement of support payments by the IV-D agency" are being met.

-   If the 2-business-day timeframe for disbursing payment to non-TANF
    families, including Former Assistance, Never Assistance, and
    Medicaid-Only, is not being met, if the 2-business-days after the
    end of the month timeframe for disbursing excess payment to current
    TANF cases is not being met, or if the state has elected to make a
    payment to the TANF family from the state share of assigned support
    and the 2 business days from date of receipt timeframe is not being
    met, determine if there are systemic problems or other processes
    that prevent the SDU from meeting the 2-day timeframe. (for example,
    insufficient resources in the SDU.)

Inquire as to the SDU's record retention policy. Federal regulations at
45 CFR 74.53 sets forth requirements of record retention and access to
records for awards to recipients. The SDU must comply with those
standards, which require that financial records, supporting
documentation, statistical records, and all other records pertinent to
an award should be retained for a period of 3 years from the date of the
submission of the financial report. Exceptions to this policy are noted
in 45 CFR 74.53 (b) (1) through (4).

## CHAPTER IV - OCSE AUDIT REPORT

At the completion of the Audit, OCSE Office of Audit will issue a
written report to State and Federal officials detailing the results of
audit. The OCSE Office of Audit will issue a suggested format for this
report in the future.