Idaho's Auditors Say Duplicate Medicaid Payments Were Not Discovered Until Providers Called

Idaho's Legislative Services Office reports on the state's internal controls as part of its audit of the state's annual financial report. Its internal control report for the fiscal year that ended June 30, 2024, carries a cover letter dated September 18, 2025. The audit identified 11 material weaknesses and 8 significant deficiencies.

One of the material weaknesses is Finding 2024-106. Its heading says over $30 million was issued in duplicate payments during fiscal year 2024, "due to a lack of data validation controls." Parts of the finding follow, not the whole.

A New System, and Its Interfaces

In the finding, the Office is the State Controller's Office. It replaced the state's dated mainframe accounting system with a cloud-based enterprise resource planning system. After several delays, the new system was implemented on July 1, 2023.

The auditors had an outside firm run an IT audit of the new system. It reviewed 101 IT general controls. It also assessed the reliability of key data across 62 sampled interfaces in 21 modules of the new system. For interface controls, with a control count of 28, its table gives a failure rate of 79%.

The finding says interfaces were inconsistently configured. Their documentation did not consistently record error handling, testing, or who owned them. Automated mechanisms for data validity were not consistently implemented or documented. And detective controls to proactively find problems with interfacing data "were not established." Technologies and processes were put in place to reactively respond to issues as the Office was made aware of them.

The Duplicate Payments

As a result of these deficiencies, the finding says, multiple incidents raised concern about one interface process. It produces the payment file sent to banks for disbursements.

The first came in November 2023. Because referencing parameters in the process were not configured well enough, it reprocessed records from a prior day. That led to multiple identical payments to Medicaid providers, totaling approximately $30 million. Records of the duplicate payments are not found in the state's accounting system.

The finding then says: "The incident was not discovered until Medicaid providers called the State inquiring about the extra payment."

A second incident came in fiscal year 2025. The payment process was stopped before it finished, to fix a problem with remittance advices. It was started again. That produced duplicate payments, "double and sometimes triple payments."

None of these duplicates were recorded in the accounting system, so they could not be tracked through it. The State Treasurer's Office had to track them, and their recovery, by hand in a spreadsheet.

Asked about other cases, the Office said only "one or two, here and there" were seen. The auditors write that this "did not instill confidence" that more errors had been detected or prevented. They learned of two more. At the Tax Commission, duplicate payments were caught before they were issued. At the Division of Human Resources, over $550,000 in duplicate payments were issued.

Root Causes and Recommendations

The finding says the root cause of the initial error was different for each instance. What the events shared, it says, was a lack of suitable and effective controls, like reconciliations, to stop the payments or find them in time.

The auditors recommend validation controls, including reconciling data. They also recommend that requirements on duplicate entries be validated through unit and user acceptance testing.

The Response and the Auditors' Answer

The Office agreed with the finding. It says it has added an automated script that compares the data with previous files. The script will notify the Office of any issues to review before routing to the bank. It also sends agencies quarterly reports, so they can confirm that their data reached the accounting system correctly.

The auditors answered that the duplicate payment error would not have been detected by those quarterly reports. The amounts in the accounting system matched the agencies' own systems. But neither system matched the payment file sent to the bank. That file was not reconciled back to the accounting system. Without an overall reconciliation from the bank to account balances, the auditors write, "this type of error would continue to go undetected."

That is the silent part. Two systems agreed with each other, and neither held what the bank had been told to pay. A check that compares them would find nothing wrong.