By Meg Tully
The State Department of Education hasn’t been doing enough to make sure Maryland child care workers have the required criminal background checks, and sometimes missed following up on criminal alerts for those workers, state auditors found. The department disputed some of the findings, but the auditors held their ground.
The audit report released Tuesday also called for more checks to secure a system that processes $81 million in child care subsidies. Auditors found that former employees still had access to the system and current employees could access functions without any oversight.
Auditors found much to criticize in the department’s financial dealings. (See separate story.)
In a repeat recommendation, the Office of Legislative Audits suggested the education department (MSDE) do more to ensure that all child care employees are recorded in the state’s system so they undergo required criminal background checks and subsequent criminal monitoring.
MSDE licenses child care facilities and in-home child care providers around the state.
Workers in the Child Care Administration Tracking System (CCATS) undergo the initial criminal background check and subsequent criminal alerts. During its annual unannounced inspection visits to child care facilities, the audit said MSDE should compare the names of employees listed in payroll records with the employees listed in the tracking system so that the state knows all employees are in the system.
A test of nine child care facility workers recorded in the CCATS system found no evidence that two employees had undergone the initial required background check, even though they were hired six and 30 months prior to the test. Files indicated that in the case of a third employee (out of nine in the test), the state had reviewed the background check, but there was no documentation to show that had happened.
Criminal activity alerts
Auditors also conducted a test of criminal activity alerts that had been issued subsequent to the initial background check. In fiscal 2014, MSDE received 3,600 such alerts about criminal activity in Maryland for child care employees through the Criminal Justice Information System.
Auditors reviewed 25 alerts of criminal activity by child care employees that were sent to the state’s regional offices.
In six of those cases, the regional offices did not properly follow up on the alerts, the audit found. And in five cases, the state relied on the child care center’s word that the employee was no longer employed instead of reviewing payroll records. It turned out the sixth alert was an employee for a local school system and not a child care facility – but despite the criminal alert, the regional office did not contact the school to verify that the individual was no longer working with children.
In addition to making education policy and monitoring achievement, MSDE licenses and enforces regulations guiding more than 7,000 family child care homes and 2,703 child care centers, and oversees the state’s child care subsidy program.
Department disagrees on some points, auditors push back
The education department disagreed with an auditor’s comment that they should have contacted the local school system when an employee there triggered a criminal alert. The department said in its official audit response that it followed up adequately by determining that the individual was not employed at a child care facility.
In an unusual rebuke of an agency’s response, the auditors disagreed, saying “Although MSDE determined that the individual was not working with a child care center, we believe that MSDE should have contacted the school system to ensure the individual was not working with children.”
MSDE also disagreed with the audit finding calling for more uniform enforcement of the criminal background check requirement, saying that its process already ensures that criminal background checks are obtained for all child care workers. It also stated that alerts are adequately pursued.
MSDE also maintained that it had adequately investigated the five criminal alerts for childcare workers, finding that they were not employed. But auditors said that efforts noted in MSDE’s response did not match up with what they had been told during and after the audit, and no additional evidence had been presented to prove those efforts.
Despite the disagreements, MSDE said it would comply or had already complied with two major recommendations raised by auditors to increase monitoring on child care workers. On Sept. 18, 2015, MSDE clarified child care facility inspection procedures to require that payroll records be examined and matched to employees listed in the tracking system — following the auditor’s recommendations to check that all employees are actually listed in the system. Any differences found during the inspection must be input into CCATS within 10 days.
By Thursday, MSDE also said it would redistribute procedures to all licensing staff emphasizing the importance of reviewing criminal background checks.
Child care subsidies – secure or not?
The audit also raised concerns that too many people, some of whom were no longer employees, had access to many functions in the child care subsidy tracking system during the audit period, July 1, 2011 to June 30, 2014.
That system implements a major program providing financial assistance to eligible families through the 24 local departments of social services. In fiscal 2014, Child Care Subsidy spending was $81.5 million, $37.8 million from the state’s general fund and $43.7 million in federal funds.
In one instance raised in the audit, a user access report showed 90 people who could process critical transactions like child care subsidy requests no longer required access. Sixty-eight people with access were no longer employed by MSDE, the system vendor or local social service departments. More than 500 people had access to do things like issue payment vouchers without requiring any independent approval, a practice auditors discouraged since it lacks proper controls.
In its response, MSDE emphasized that the system, not people, determine eligibility. But auditors maintained that people had ways to change the data that would allow the system to make eligibility determinations – and without proper oversight could manipulate those figures to get a desired outcome.
MSDE also said that it had changed its child care subsidy program system as of Aug. 31, 2015, and that many of the findings no longer applied to the new system. Under that system, vendor Xerox performs many system functions that had been the responsibility of local social services departments.
“In a post-Aug. 31, 2015 environment, no individual has the capability to perform from beginning to end all of the ‘critical’ functions associated with the issuance of a Child Care Subsidy Voucher and subsequent payments,” the response states.
It also added two security reports as of Dec. 31. These reports will allow for MSDE to review if any individual has multiple roles and access capabilities on the system.