5- 96SSHIX-S3346 Audit SOW.docx

Nevada State Purchasing Division Department of Administration 515 E Musser St Ste 300 Carson City, NV 89701 purchasing.nv.gov nevadaepro.com

96SSHIX- S3271 Scope of Work Audit Services

SCOPE OF WORK

The selected contractor(s) will need to perform both an Annual Independent External Financial Audit and an Annual External Programmatic Audit of the Exchange, together with any related work or services within the scope of this Request for Proposal (RFP) for ad-hoc tasks.

The Exchange reserves the right to modify the frequency or scope of the audit, based upon changes to federal or state laws, rules or regulations.

The results of the audits will be reported on an annual basis to any federal and State agencies as required. The Contractor and any subcontractors must retain documentation related to the external audit for ten (10) years form the date of completion of each audit.

Documentation includes paper and electronic media, and other evidence of accounting procedures and practices.

PLEASE NOTE: The terms “bidders”, “vendors” and “contractors” are used interchangeably. The use of the terms “shall”, “must” and “will” are also used interchangeably when describing the Bidder’s/Contractor’s duties.

Bidder’s Qualifications to Propose

The Purchasing Division will accept proposals from organizations with the following types and levels of experience as a Contractor.

A minimum of three (3) years of experience with performance audits following the rules of Generally Accepted Government Auditing Standards (GAGAS).

Three (3) years of experience in providing similar auditing services to government agencies.

Three (3) years of experience performing audits involving health insurance issuers or health care organizations, including issues covered under the Affordable Care Act (ACA).

Three (3) years of experience interpreting and applying Code of Federal Regulations (CFRs) to audit performances.

Experience acquired concurrently is considered acceptable. Failure to meet these minimum types and level of experience will result in a proposal being found non-responsive and eliminated from consideration.

The programmatic audit will address the Exchange compliance with Tittle 45, Code of Federal Regulations (45 CFR) Part 155, Subparts, C, D, E, F, G, K and M for the Individual Market.

The Exchange is required to provide the results of the audits to the Centers for Medicare & Medicaid Services (CMS) and publish a public summary of the results.

Contractor(s) Roles and Responsibilities

The contractor shall:

The contractor shall designate a person to whom all project communications may be addressed and who has the authority to act on all aspects of the contract.

This person will be responsible for the overall project and will be the contact for all invoicing and Contractor staffing issues.

Provide written reports for review and approval by the Silver State Health Insurance Exchange (SSHIX) and formally respond to SSHIX review findings as necessary.

Meet as required with SSHIX staff to discuss progress.

Make its best efforts to maintain staff continuity throughout the life of the project. If, however, a substitution becomes necessary, the Contractor must submit resumes for review, in advance, for all proposed personnel substitutions.

All Contractor personnel substitutions must be approved in writing by SSHIX Representative. Failure to receive the required approvals may result in termination of the contract.

SSHIX’s Roles and Responsibilities

SSHIX Shall:

Designate the SSHIX representative to whom all Contractor communications may be addressed and who has the authority to act on all aspects of the contract.

Provide access to business and technical documents as necessary for the Contractor to complete the tasks identified in this Agreement.

Ensure appropriate resources are available to perform assigned tasks, attend meetings, and answer questions.

Ensure that decisions are made in a timely manner.

Identify and provide access to Subject Matter Experts to assist in the development of technical requirements.

Contract Deliverables

The Contractor understands that all recommendations and contract deliverables must comply with the Patient Protection and Affordable Care Act of 2010 and any subsequent rule changes, including those promulgated in CMS’ annual Notice of Benefit and Payment Parameters.

The Contractor shall provide all deliverables within the timeframe specified and required by SSHIX.

The Contractor understands and acknowledges that all deliverables must be reviewed, approved, and accepted by SSHIX.

The Contractor understands that any SSHIX requested revisions to any deliverable shall be incorporated by the Contractor within seven (7) calendar days from the date in which SSHIX provided its feedback unless a different timeframe is required and specified by SSHIX.

In the event SSHIX requires additional refinements and modifications for any deliverable which occurs after that deliverable has been previously accepted by SSHIX, the Contractor shall be required to make the additional revisions until the revised deliverable is accepted and approved by SSHIX.

The Contractor will provide consultation services on an as-needed basis.

Contractor will make themselves available for project meetings with Exchange staff at a mutually agreed upon cadence.

Deliverables Acceptance Criteria

All finished work must be submitted to SSHIX for review and approval or rejection. Payment for all tasks performed under this Contract will be based on hourly rates. It will be SSHIX sole determination as to whether any tasks have been successfully completed and are acceptable.

Throughout the contract, SSHIX will review and confirm services performed. In addition, the SSHIX will verify and approve the Contractor’s invoices.

Deliverable acceptance criteria consist of the following:

Audit plan, schedules, documentation, digital files, and reports (deliverables) were completed as specified and approved.

Deliverable-specific work was completed as specified and the final deliverable product or service was rendered.

All deliverables are in a format useful to SSHIX.

If a deliverable is not accepted, SSHIX will provide the reason, in writing, within ten (10) business days of receipt of the deliverable.

Audits Requirements

The purpose of this Agreement is for the contractor(s) to develop and conduct the audits in accordance with GAGAS. The fiscal audit must also be conducted in accordance with the standards applicable to financial audits contained in Government Auditing standards (GAS).

Phase 1: Audit Work Plans

Develop and describe the audit objectives, scope, methodology, and the basis for defining the required components of the audit. The Contractor shall follow the audit work plans when conducting the audit and include content from the plan in the final audit reports to SSHIX.

Deliverables & Timeline:

Each year the audit work plans shall be delivered to SSHIX no less than thirty (30) business days prior to audit work commencing. The financial and programmatic audit plans must be developed by following the Generally Accepted Government Auditing Standards (GAGAs), including at a minimum:

Scope of work Audit approach Audit schedule and deliverables project work plan project roles and responsibilities project management process

The plan must also assess compliance with federal government regulations for State-Based Marketplaces and Qualified Health Plan (QHP) issuers, which:

Complies with accounting requirements specified in 45 CFR 155.1200(a)(1) Complies with applicable requirements from subparts 45 CFR 155 (i.e., Subparts C, D, E, F, K and M) and all other financial and programmatic audit requirements issued by The Centers for Medicare & Medicaid Services Includes procedures for assessing each requirement, such as methods, standards, data sources, sample size, and evidence.

Schedule and conduct an annual kickoff meeting with SSHIX to review the proposed audit schedule, discuss scope or work expectations, identify potential project limitations, and discuss timelines.

Schedule and conduct check-ins on an ongoing basis during the time of the audit.

The audit work plans must be approved by SSHIX in writing prior to the work commencing.

The contractor’s proposal shall describe in detail the strategy and timeline for accomplishing the deliverables and timelines referenced within this scope of work

Phase 2: Audit Work

SSHIX defines “audit work” for the purposes of this RFP as transaction testing and record review performed in the most efficient and convenient manner to the Exchange, whether that be on site, via e-mail, via telephone, or virtually. The Contractor shall perform audit work, transacting testing to obtain sufficient appropriate evidence to provide a reasonable basis for any finding or recommendations. The contractor shall:

Request and review project and system data and documentation including, but not limited to:

Internal controls, and related policies and operating procedures Program notices and forms Executed contracts and agreements.

System eligibility and enrollment transactions results

Conduct Sample Testing

Work with SSHIX to determine testing procedures, sample methodology and sizes based in applicable laws and regulations.

Request population data accordingly for financial and programmatic audit testing Select samples, request detailed sample data, and conduct testing including, but not limited to: Programmatic audit Eligibility and enrollment testing Verification testing Financial audit Internal control testing Compliance testing Substantive testing of financial statements

Interview SSHIX staff and stakeholders who represent core functional areas of the SSHIX.

Provide an interview questionnaire to interviewees prior to the interview.

Present preliminary annual external performance audit finding and recommendations resulting from the audit to designated SSHIX staff.

The Contractor will allow SSHIX no less than thirty (30) days to respond to any misstatement of fact prior to the issuance of final report.

Report any material violations discovered during the contract term to SSHIX staff immediately.

The Contractor must assess the Exchange’s compliance with the minimum functions of a state exchange describe in subparts C, D, E, F, G, K and M of 45 CFR Part 155.

The following sets forth the minimum areas that Contractor shall address in performing the audit for the Exchange:

45 CFR Part 155- Elements to Review-Subpart C - General Functions of the Exchange

Consumer assistance tools and programs, including a toll-free call center, website, consumer information that is accessible and in plain language, a Navigator program, and outreach and education.

Navigator program established and standards in place, including training standard.

Agent and broker agreement in place.

Certified Application Counselor program in place.

Process for an applicant or enrollee to designate an Authorized Representative.

Standards for Marketplace notices are in place.

Standards and protocols for electronic transactions with QHP issuers have been implemented.

Privacy and security standards to protect personally identifiable information have been implemented

45 CFR Part 155- Elements to Review -Subpart D -The Exchange Functions in the Individual Market: Eligibility Determinations for the Exchange Participation and Insurance Affordability Programs

Processes in place to assess for potential eligibility for Medicaid, Children’s Health Insurance Program (CHIP), advance payments of the premium tax credit and cost-sharing reductions in compliance with federal regulations.

Processes in place to determine eligibility for enrollment in a QHP through the Marketplace in compliance with federal regulations.

Process in place to verify eligibility for minimum essential coverage other than through an employer sponsored plan.

Process in place for eligibility redeterminations within a benefit year.

Process in place for conducting annual eligibility redetermination.

Processes in place for administration of advance payments of the premium tax credit (APTC) and cost-sharing reductions (CSR) in accordance with federal regulations.

Special eligibility standards and process for American Indians/Alaskan Native is in place.

Notices of eligibility determination provided to applicants includes notice of the right to appeal and instructions regarding how to file an appeal, in accordance with federal regulation.

45 CFR Part 155 - Elements to Review -Subpart E -The Exchange Functions in the Individual Market: Enrollment in Qualified Health Plans

Processes in place for accepting a QHP selection from an applicant who is determined eligible for enrollment in a QHP in accordance with federal regulation and transmitting the information necessary to enable the QHP issuer to enroll the applicant.

Use of a single streamlined application.

Use of initial and annual open enrollment periods.

Process to require issuer application assisters to meet the requirements set forth in 45 CFR 156.260 with respect to: (1) privacy and security standards, (2) applicable state law, and training.

Standards and procedures for special enrollment periods for QHPs in accordance with federal regulation.

Standards and procedures for termination of QHP coverage in accordance with federal regulation

45 CFR Part 155 - Elements to Review -Subpart F - The Exchange Functions: Appeals of Eligibility Determinations for Marketplace Participation and Insurance Affordability Programs

Establishment of an appeals process in accordance with 45 CFR 155.505.

Notice of appeals procedure provided to applicants.

Process in place for accepting appeal requests.

Process in place to continue to consider an applicant eligible while an appeal is pending in accordance with applicable regulations.

Process in place for dismissing an appeal.

Informal resolution and hearing requirements process complies with applicable standards.

Process in place for expedited appeals.

Procedure for appeals decisions.

Appellant access to appeal record.

Employer appeals process regarding determinations that the employer does not provide minimum essential coverage or coverage that is affordable with respect to an employee.

Public access to appeal decisions, subject to applicable law regarding privacy

45 CFR Part 155 - Elements to Review-Subpart K - The Exchange Functions: Certification of Qualified Health Plans

Standard process in place for certifying QHPs Process in place to receive information from QHP issuers on rates and benefit information.

Certification standards in place related to advance payments of the premium tax credit and cost-sharing reductions.

Collection of information regarding transparency in coverage and transparency of cost-sharing information.

Establishment of Exchange network adequacy standards are in place.

Process to evaluate the service area of a QHP.

Process in place for certification of stand-alone dental plans.

Process for recertification of QHPs.

Process for decertification of QHPs.

Phase 3: Deliverables; Reporting

The Contractor will be required to produce written preliminary reports (Draft Audit Report) at least thirty (30) days before producing the final annual audit reports to be issued as a product of the audit no later than March 30th of each year, unless another date is specified by SSHIX.

The audit report shall include, but not be limited to:

A description of the audit methodology, including any quantitative and qualitative tests performed by the auditor.

A description of the scope of the audit Assurance that the audit was conducted in accordance with GAGAS.

Nature of confidential or sensitive information that may have been omitted.

Specific findings, including a summary of compliance or non-compliance with requirements.

Listing any material weaknesses, significant deficiencies, and any identified instance of fraud or potential illegal acts.

Recommended improvements to operating procedures to comply with requirements.

A statement on compliance with the Centers for Medicare & Medicaid Services (CMS) Rule 9957 (45 CFR 155).

Upon completion of the External Financial Audit and the Annual External Programmatic Audit, the contractor will prepare the written reports outlined Required Reports in accordance within the Scope of Work of this Request for Proposal.

Required Reports

Programmatic Audit Reports

Independent Accountant’s Report on Internal Control Over Compliance Independent Accountant's Report on Examination of Compliance Independent External Audit: Findings Report Management Advisory Letter when applicable Final Programmatic Audit Report

Financial Audit Reports

Independent Auditor’s Report on Statement of Revenues and Expenditures Independent Auditor's Report on Internal Control Over Financial Reporting and on Compliance and Other matters Based on an Audit of a Financial Statement Performed in accordance with GAS.

Required Communication Letters

Conduct exit meetings with SSHIX, when applicable to explain findings and discuss conclusions and recommendations.

Review and revise draft audit reports, when applicable.

Submit final annual reports that include proposals on how to remedy any material weaknesses or significant deficiencies identified.

The contractor’s proposal shall describe in detail the strategy and timeline for accomplishing the deliverables and timelines outlined in Audit Requirements and the contractor’s qualifications and experience in performing this type of work.

AD HOC TASK ORDER REQUEST

For those processes that fall outside of the audit tasks/deliverables defined in Audit Requirements that are necessitated by new or revised provisions of state on federal regulations, new or revised reporting requirements, or standards imposed upon state exchanges by regulatory authorities, SSHIX will initiate the Ad Hoc Task Order Request

Contractor to utilize the process detailed below:

SSHIX will submit a request via e-mail to the Contractor.

The request will include the specific objectives, tasks/deliverables required and may include the timeline in which work will need to be completed.

The Contractor must draft and propose a Scope of Work (SOW) to complete the tasks/deliverables described in the request.

The SOW must be received within the timeframe stated by SSHIX in the request.

The SOW must include the job titles with the corresponding estimated number of hours per job title to complete the tasks/deliverables and a timeline in which they will be completed.

Upon receipt of the SOW, SSHIX will review the SOW and negotiate any changes deemed necessary prior to SSHIX determining approval or denial of the SOW.

The Contractor cannot start any work prior to SSHIX written approval of the request’s SOW.

Upon completion of deliverables related to a Task Order Request, if the Contractor is required to prepare a written report, the contractor will prepare a written report of the methods used and results, in the format prescribed by the Task Order Request.

CONTRACT MANAGEMENT AND STAFFING

The Contractor will be responsible for recruiting, training, and providing appropriate staffing and oversight to ensure the integrity and timely completion of the services detailed throughout Scope of Work throughout the course of the contract period.

It is the Contractor’s responsibility to

Provide sufficient additional management and administrative support staff necessary to organize, prepare and carry out all administrative tasks associated with conducting these audits.

Submit resumes of staff assigned to the project for the agency’s review, prior to the start of work. At any time throughout the course of the contract, the agency reserves the right to approve or disapprove the Contractor’s proposed staffing, including consultants or subcontractors and may request a replacement of such staffing, consultant, or subcontractor, if needed.

During the term of the contract, if substitution of staff is required, the qualifications of the newly appointed staff will need to meet or exceed the competencies of those staff previously working for this contract. Any substitutions/replacements may be subject to SSHIX review and written approval.

Revised 2024-10 Page 2 of 2

Page 1 of 1 Nevada State Purchasing 96SSHIX-S3346 image1.png