Rhode Island's Auditor Found the Same 24 Problems Again
Summary
Rhode Island's Auditor General audited the state's fiscal 2025 financial statements and found 29 reportable weaknesses in internal control -- 24 of them the same problems the office had already flagged a year earlier, unresolved by the state's new accounting system. Chief among the repeats: Medicaid, 41% of the state's General Fund at $4.3 billion, is still run through a claims system built more than 30 years ago, forcing the state to manually push more than $476 million a year in payments and refunds around it, with no control ensuring each one was authorized.
A new accounting system, the same findings
The State's transition to a new enterprise resource planning (ERP) system for the fiscal 2025 close is the backdrop the auditor cites for the year's largest statewide finding. More than 75 audit adjustments⧉ -- each correcting a misstatement or improper presentation of transactions worth more than $1 million -- had to be proposed and accepted before the state's draft financial statements could be accepted as accurate. That finding, 2025-001, is itself a repeat of finding 2024-001: the same material weakness, under a new label, for a second straight year. Rhode Island General Law section 35-14-3 makes each state agency head responsible for maintaining a system of internal accounting control within their own agency -- the statutory baseline the auditor's findings measure against.
View data as table
| Repeated from FY2024 | 24 | Each individually labeled 'repeat finding' and tied to a specific FY2024 finding number |
|---|---|---|
| New in FY2025 | 5 | 2025-004, 2025-013, 2025-014, 2025-015, 2025-029 |
Both of the audit's Medicaid-specific findings are on that repeat list. The pattern holds across most of the report: of the 29 findings, only five are new this year -- a receivables-transition issue tied to the ERP conversion (2025-004), capital-asset reporting controls (2025-013), misstatements in the state's unemployment and temporary-disability insurance funds (2025-014), a new compensated-absences accounting standard (2025-015), and a $38.5 million fiduciary-accounting misclassification⧉ at the Rhode Island Resource Recovery Corporation (2025-029). A finding staying open a second year does not mean nothing happened; it means the corrective action the state described in its prior response did not fix the underlying control gap before the next audit began.
Medicaid: 41% of the General Fund, run on a 30-year-old system
Medicaid is Rhode Island's single largest program⧉, approximately $4.3 billion in FY2025 expenditures -- 41% of the entire General Fund. Managed-care organizations (MCOs), which enroll and pay providers on the state's behalf, account for $2.1 billion of that, the majority of Medicaid benefit spending. The system meant to process and account for all of it, the Medicaid Management Information System (MMIS), was built more than 30 years ago as a claims processor; the auditor found it was never designed to handle the capitation adjustments and encounter-data reconciliation that modern managed care requires.
What the MMIS can't do, the state's Executive Office of Health and Human Services (EOHHS) does by hand. More than $391 million in payments to providers and MCOs, and more than $85 million in recoupments from them, moved through manual and semi-manual transactions processed by the state's fiscal agent in FY2025 -- outside the MMIS's own claims-processing controls entirely. More than 1,000 of those transactions ran through the year, roughly 210 of them individually worth more than $100,000. The auditor's finding is direct: EOHHS "currently lacks internal controls and procedures to ensure that only authorized payments are processed" for this money. Separately, auditors caught $6.6 million in managed-care premiums owed to MCOs that the state had failed to record as a year-end liability at all -- an error that had to be found from the outside.
View data as table
| Total Medicaid expenditures | 4,300,000,000 | 41% of the State's General Fund expenditures |
|---|---|---|
| Manual provider/MCO payments | 391,000,000 | Processed by the fiscal agent, outside MMIS claims controls; over 210 individual payments exceeded $100,000 |
| Manual recoupments | 85,000,000 | Same manual process; also outside MMIS claims controls |
The same fragility runs through how Medicaid's year-end books get built. At the close of fiscal 2025, the program carried $107 million in receivables, $293 million in liabilities, and $180 million in prepaid managed-care capitation premiums -- all of it, per the auditor, estimated and recorded through "an entirely manual process involving no systemic controls to ensure the accuracy and completeness of reported amounts." This finding, too, repeats FY2024's: EOHHS's own written response acknowledges the manual process but says the program's scale and constant regulatory change mean estimates "will never be exact."
View data as table
| Receivables | 107,000,000 |
|---|---|
| Liabilities | 293,000,000 |
| Prepaid capitation premiums | 180,000,000 |
What happens next
EOHHS's corrective-action plan for the MMIS finding does not promise a near-term fix. The agency told auditors it anticipates beginning procurement of a replacement "Core Module" in calendar year 2027 -- and that implementation "will not be complete for several years" after that. Until then, the manual workarounds documented in this audit continue by design, and the finding is likely to appear a third time when the fiscal 2026 audit is published. The State's Single Audit Report for fiscal 2025, covering compliance on federal programs including Medicaid, was still in progress as of this report and is scheduled for later in the summer of 2026 -- it will test a different, and in Medicaid's case federally funded, slice of the same system.
- 24 of 29 findings in Rhode Island's FY2025 financial-statement audit -- 83% -- repeat findings the state auditor already made about FY2024, including both of the report's Medicaid-specific findings. A new ERP system, live for the first time this fiscal year, did not close that gap.
- More than $476 million in FY2025 Medicaid payments and recoupments moved outside the state's claims-processing system, on a program that is 41% of the General Fund, with auditors finding no control in place to confirm each manual payment was authorized.
- The stated fix -- a new MMIS 'Core Module' -- won't begin procurement until 2027 at the earliest and will take 'several years' to implement after that, per EOHHS's own corrective-action timeline; the manual process the auditor flagged will keep running until then.
All figures in this piece come from the Rhode Island Office of the Auditor General's Findings and Management Comments report on the state's fiscal 2025 financial statements, dated June 24, 2026. The repeat-vs-new count (24 of 29) is this piece's own tally of the status label printed in each finding's own header, not a summary figure stated once in the report; it is fully re-checkable against the document's table of contents and finding headers. The $391 million and $85 million Medicaid figures are the audit's own minimums ("totaling more than"), so the true manually processed total, and its roughly 11% share of Medicaid's budget, are likely somewhat higher than stated here. This piece covers the two Medicaid findings and the statewide adjustment finding in the report; it does not cover the report's other 26 findings, which span information-security controls, transportation-fund reporting, and several component units (RIPTA, Quonset Development Corporation, the RI Convention Center Authority, and others) with their own separate control deficiencies.
Sources(1) ▾
- Rhode Island Office of the Auditor General (David A. Bergantino, CPA, CFE, Auditor General), State of Rhode Island: Findings and Management Comments Resulting from the Audit of the State of Rhode Island's Fiscal 2025 Financial Statements (2026-06-24) — The Auditor General's statutorily required report on the State's internal control over financial reporting and compliance, issued under Government Auditing Standards alongside the FY2025 Annual Comprehensive Financial Report audit -- the sole evidentiary basis for this piece's figures. Source for the transmittal letter's finding/comment counts (p. i), the Executive Summary's 29-finding count and Medicaid-scale framing (p. 1) and RI Gen. Law section 35-14-3 baseline (p. 1), Finding 2025-001's 75-plus-adjustment condition and ERP-transition framing (p. 5), each of the 29 individual findings' repeat/new status as printed in its own header (pp. 5-53), Finding 2025-005's Medicaid/MMIS background and control-deficiency bullets (pp. 12-13), Finding 2025-006's year-end accrual figures and manual-process condition (p. 17), and the Medicaid finding's management-response completion timeline for MMIS replacement (p. 16). oag.ri.gov · original document
Comments
Always open. Logged-in readers can annotate paragraphs in place.
Every year, Rhode Island's Auditor General -- the state's independently elected watchdog over its own books, whose report goes directly to the General Assembly -- audits the state's financial statements and reports back which internal controls are broken. In its report on the fiscal 2025 audit⧉, dated June 24, 2026, the office logged 29 reportable findings. Twenty-four of them -- 83% -- are marked, in the report's own language, as repeats of findings the office already made about fiscal 2024. The state's new accounting system, which went live for the 2025 close, was supposed to be a fresh start; it wasn't one for the vast majority of what the auditor found broken.