In order to receive federal matching funds, states report expenditures quarterly to CMS on the CMS-64. States are required to report their expenditures to CMS within 30 days of the end of each quarter, but may adjust their past reporting for up to 2 years after the expenditure was made, referred to as the 2-year filing limit. Adjustments can reflect resolved disputes or reclassifications of expenditures. Expenditures reported after the 2-year filing limit are generally not eligible for a federal match, with certain exceptions. The CMS-64 is a series of forms that capture expenditure data for different aspects of states’ Medicaid programs, such as different types of services, populations, and different federal matching rates. (See table 1 for examples of the expenditure types captured by the CMS-64.) States report their expenditures quarterly on the CMS-64 at an aggregate level— such as a state’s total expenditures for such categories of services as inpatient hospital services—and these reported expenditures are not linked to individual enrollees or services. States’ reporting may vary depending on the features of their Medicaid program. Some examples of this variation include the following: States that expanded eligibility under PPACA would need to report expenditures not only by the type of services (e.g., inpatient hospital services), but also by populations receiving different federal matching rates, such as expansion enrollees. States with waivers—that is, where the state received approval from HHS to waive certain Medicaid requirements in order to test and evaluate new approaches for delivering and financing care under a demonstration—would need to report those expenditures associated with these waivers on additional forms. CMS is responsible for assuring that expenditures reported by states are supported and allowable, meaning that the state actually made and recorded the expenditure and that the expenditure is consistent with Medicaid requirements. CMS regional offices perform the ongoing oversight, with enhanced oversight procedures in the 20 states with the highest federal Medicaid expenditures. (See fig.1) CMS is required to review the expenditures reported by states each quarter. (See fig. 2.) Regional office reviewers have 50 days to review the expenditures and compute the federal share of states’ Medicaid expenditures. As part of the quarterly review, regional office reviewers also check that expenditures receive the correct matching rate. In general, the amount of federal funds that states receive for Medicaid services is determined annually by a statutory formula—the Federal Medical Assistance Percentage (FMAP), which results in a specific federal matching rate for each state. However, there are a number of exceptions where higher federal matching rates can apply for certain types of beneficiaries, services, or administrative costs. See table 2 for examples of higher matching rates that apply for expenditures for certain types of enrollees, services, or administrative costs. When CMS identifies questionable expenditures or errors through its reviews, there are several ways that they can be resolved, as summarized below. Deferral of federal funds. CMS can defer federal matching funds if, during the quarterly review, the regional office reviewer needs additional information to determine whether a particular expenditure is allowable. The reviewer may recommend that CMS defer the expenditure until the state provides additional support or corrects the reporting. State reducing reported expenditures. If the state agrees that the questionable expenditure is an error, the state can submit an adjusted report during the quarterly review or make an adjustment in a subsequent quarter. These adjustments prevent federal payments for those expenditures. Disallowance of expenditure. If CMS determines an expenditure is not allowable, CMS can issue a disallowance, and the state returns federal funds through reductions in future federal allocations. States may appeal disallowances. CMS uses a variety of processes to assure that state-reported expenditures are supported during quarterly reviews and performs focused financial management reviews on expenditures considered at risk of not complying with Medicaid requirements. Although we found that CMS was identifying errors and compliance issues using both review methods, we also found weaknesses in how CMS targets its oversight resources to address risks. CMS uses quarterly reviews to assess whether expenditures are supported by the state’s accounting systems; are in accordance with CMS approved methodologies, plans, and spending caps; and whether there are significant unexplained variances—changes in expenditures— from one quarter to the next (referred to as a variance analysis). CMS review procedures include validation measures that check to ensure that expenditures were reported within the 2-year limit, which is a check done on all types of expenditures. Another validation measure compares expenditures to various approval documents. For example, when a state has a waiver in place, expenditures are reviewed against waiver agreements that authorize payment for specified services or populations. Other examples include comparing supplemental payment expenditures to caps set for those expenditures. (See table 3.) Our examination of the quarterly reviews indicated that the reviews involved significant coordination with other CMS staff and the state. In addition to reviewing state documentation, officials from two regional offices told us that they consult other regional office staff who oversee the approval of new expenditures to ensure that expenditures reflect approved program features. For example, officials in region 9 told us that in reviewing managed care expenditures, they consult with their colleagues who review the state’s payment methodologies for capitated payments. In reviewing information technology development expenditures—which are subject to a higher federal matching rate— reviewers for all six selected states examined advanced planning documents, which requires coordination with staff who approve those documents to ensure that the state was receiving the correct matching rates and staying within the approved amounts. With regard to coordination with states, we found that regional reviewers for all six reviews contacted states to follow-up on issues identified during the review. Officials also described being in regular contact with states to stay abreast of program, system, and staffing changes to inform their reviews. For example, according to regional officials, Arkansas experienced some significant and unexpected staffing challenges in 2016 that resulted in delays in the state reporting expenditures and returning federal overpayments, and the reviewer worked closely with state staff to track the state’s progress. We found evidence that reviewers identified errors during their quarterly reviews. In the six quarterly reviews we examined, regional offices identified errors in three of the six states. For example, region 3 reviewers found errors in Maryland’s expenditure reporting—including claims for the wrong matching rate for two enrollees who were not eligible for PPACA’s Medicaid expansion and reporting provider incentive payments on the wrong line—and worked with the state to correct those errors. Additionally, region 9 reviewers found errors in California’s reporting of expenditures. For example, they found that the state reported waiver expenditures for the incorrect time period, which has implications for CMS’s ability to monitor and enforce spending limits for the waiver. Reviewers worked with the state to correct those errors. To supplement the quarterly reviews, CMS generally directs regional offices to conduct a focused financial management review (FMR) each year on an area of high risk within the region, typically within one state. According to regional officials, CMS uses these reviews to investigate expenditures in greater depth and detail than is reasonable within the timeframes of a quarterly review. For example, reviewers can examine individual claims for services from providers or the methodologies developed for certain payment types. Regional reviewers also use these reviews to investigate errors that could not have been detected by the quarterly review. For example, regional office 6 officials told us that they uncovered inappropriate financing arrangements when they used an FMR to examine how Texas financed the state share of its supplemental payments to hospitals in one of its counties. To do so, the regional office reviewed payments from the state to the provider, project plans, and interviewed providers—steps that are not part of the quarterly review process. Rather, in the quarterly review, the reviewer only checks that state-reported payments are supported by state accounting records and are within applicable caps; thus, inappropriate financing of the state share would not have been detected through the quarterly review. In fiscal years 2014 through 2017, CMS used FMRs to review various expenditures considered to be at risk for not complying with Medicaid requirements. Specifically, as outlined in annual work plans, regional offices planned to conduct 31 FMRs and estimated that the total amount of federal funds at risk in expenditure areas covered by their planned reviews was $12 billion. (See app. I.) Planned FMRs targeted a wide range of topics, with the reviews most frequently targeting expenditures for the Medicaid expansion population. (See table 4.) We found that CMS frequently identified compliance issues through FMRs. As of March 2018, CMS reported that reviewers had identified compliance issues with financial impact in 11 of the 31 planned FMRs, though most of those findings were still under review. More findings from the planned FMRs are likely as some of the reviews were still ongoing. We reviewed the draft results for 5 FMRs. Among these, CMS found that four states were reporting expenditures that were not allowable. For example, as noted earlier, a 2014 FMR on supplemental payments in Texas revealed inappropriate funding arrangements, and CMS issued a disallowance for approximately $27 million. In some cases, FMRs did not have apparent financial findings, but identified significant internal control weaknesses in the state and recommended specific corrective actions— such as better aligning eligibility and expenditures systems to better detect and correct irregularities—that would provide greater assurances that federal funds are appropriately spent. Both the quarterly reviews and the FMRs occur in conjunction with other ongoing CMS financial oversight activities. For example in addition to reviewing expenditures, regional office reviewers assess how states estimate their costs, set payment rates for managed care and home and community based services, and allocate costs among different Medicaid administrative activities under their cost allocation plans. CMS officials told us that issues relating to state compliance with Medicaid requirements for expenditures could be identified during these other oversight activities and could inform follow-up during the quarterly reviews or be the subject of a FMR. Officials also told us that since FMRs were instituted, the agency has built in more front-end procedures for preventing problems with the accuracy and allowability of reported expenditures. As examples, they cited their work on managed care rate reviews, among other things. We identified two weaknesses in how CMS is allocating resources for overseeing state-reported expenditures that limited the agency’s ability to target risk in its efforts to assure that these expenditures are supported and consistent with Medicaid requirements. First, we found that CMS has allocated similar staff resources to states with differing levels of risk. For example, the staff resources dedicated to reviewing California’s expenditures—ranking first nationally in expenditures and constituting 15 percent of all federal Medicaid expenditures—are comparable to significantly smaller states in other regions, despite California’s history of reporting challenges and its inability to provide electronic records, which requires on-site review. (See fig. 3.) CMS has allocated 2.2 staff to review California’s expenditures in contrast to one person to review Arkansas’ expenditures, which constitute 1 percent of federal Medicaid expenditures, and Arkansas does not have a similar history of complex reporting challenges. We also found that California’s reviewers have set a higher threshold for investigating variances in reported expenditures than in the five other selected states. Specifically, reviewers investigated variances in California of plus or minus 10 percent if the variances represented more than 2 percent of medical expenditures, or $450 million in the quarter we reviewed. The state experienced an approximately 24 percent increase in its prescription drug expenditures—roughly $200 million—during that quarter, but the variance was deemed not significant. In contrast, for two of our five other selected states, we found that reviewers generally investigated variances of plus or minus 10 percent regardless of the dollar amount of the variance and in the remaining three states they had significantly lower dollar thresholds than used for California. Second, CMS reported cancelling the FMR requirement for regional offices in 17 out of 51 instances in the last 5 years when faced with resource constraints. In some cases, CMS excused individual regional offices from conducting planned FMRs due to staff shortage as the agency did for regions 3 and 7 in 2014; region 8 in 2016; and regions 3, 7, 8, and 9 in 2018. In 2015, according to CMS officials, all 10 regions were excused from conducting an FMR, because the regional offices needed their staff to focus on implementing new procedures for validating expenditures for the Medicaid expansion population. In addition to cancelling FMRs, CMS was delayed in finalizing FMRs. Among the eight FMRs that were conducted in fiscal year 2014, three have been issued as final reports, CMS decided no report was needed on a fourth, and the four remaining FMRs from 2014 were still under review as of March 2018, delaying important feedback to states on their vulnerabilities. According to CMS officials, resource constraints have contributed to both of these weaknesses. Our analysis of staffing data indicated that, from fiscal years 2014 to 2018, the number of full time equivalent staff dedicated to financial oversight activities declined by approximately 19 percent across all 10 regions. These staff are responsible not only for completing the quarterly reviews and FMRs, but also other financial oversight activities, including resolving audit findings and other on-going oversight activities noted previously. During this period, federal Medicaid expenditures are estimated to have increased by approximately 31 percent, and the reporting of expenditures has grown more complex. In addition to the decline in dedicated staff, officials told us they faced challenges in filling vacancies either because of hiring restrictions or challenges in recruiting qualified candidates. Officials described instances where regional offices shared resources with other offices to address critical gaps in resources. For example region 9 was able to obtain part-time assistance from a region 6 reviewer to help review California’s expenditures. However, CMS officials told us that they had not permanently reallocated resources between regional offices, because all regional offices are under-resourced given their various oversight responsibilities as of May 2018. With regard to cancelling FMRs, CMS officials noted that other oversight responsibilities, including the quarterly reviews, are required under statute or regulation and thus have a higher priority than FMRs. Compounding its resource allocation challenges, CMS has not conducted a comprehensive, national assessment of risk to determine whether resources for financial oversight activities are (1) adequate and (2) allocated—both across regional offices and oversight tools—to focus on the greatest areas of risk. Agency officials told us that they have not conducted a formal risk assessment, because they are assessing risk on an on-going basis, allocating resources within each region accordingly and sharing resources across regions to the extent possible. However, this approach does not make clear whether the level of resources dedicated to financial oversight nationally is adequate given the risk. Federal internal control standards for risk assessment require agencies to identify and analyze risks related to achieving the defined objectives (i.e., assuring that state-reported expenditures are in accordance with Medicaid rules), and respond to risks based on the significance of the risk. Without completing a comprehensive, national assessment of risk and determining whether staff resources dedicated to financial oversight are adequate and allocated commensurate with risk, CMS is missing an opportunity to improve its ability to identify errors in reported expenditures that could result in hundreds of millions of dollars in potential savings to the Medicaid program. CMS reviewers in the selected regional offices we reviewed did not consistently perform variance analyses—which compare changes in expenditures from the quarter under review to the previous quarter—of higher matched expenditures during quarterly reviews. Further, the sampling procedures used to examine Medicaid expansion expenditures did not account for varying risks across states. CMS has multiple procedures in place to review expenditures that receive a higher federal matching rate. As with other expenditures, reviewers are required to complete a variance analysis, comparing reported expenditures in the quarter under review to those reported in the prior quarter and investigating variances above a certain threshold. However, we found that our three selected regional offices were not consistently conducting these analyses across several different types of expenditures with higher matching rates. While CMS’s internal guidance required that regional offices conduct variance analyses on expenditures with higher matching rates, we found that for the quarter we investigated (generally the 1st quarter of fiscal year 2017), our selected regional offices did not consistently do so for three types of expenditures that we reviewed: IHS, family planning, and certain women with breast or cervical cancer. Two of the three regional offices (regions 3 and 9) did not conduct or did not document these required variance analyses, and the remaining regional office (region 6) conducted the analyses but deviated from standard procedures outlined in CMS guidance, as summarized below. CMS region 3. Reviewers did not conduct variance analyses for either Maryland or Pennsylvania. Regional office staff with whom we spoke said that as part of the quarterly review they conduct the standard variance analysis on category of service lines of the CMS-64. Expenditures for IHS, family planning and services for certain women with breast or cervical cancer are not separately identified at that level. Although CMS reviewers said they thought the standard analysis was sufficient, net changes within a broad service category may obscure major changes within these higher matched expenditures. For example, examining changes in total inpatient hospital expenditures would not necessarily reveal a significant variance limited to inpatient expenditures in IHS facilities that receive a higher federal match. CMS region 9. Reviewers told us that they examined higher matched expenditures for California; however, no variance analyses of IHS, family planning, or breast or cervical cancer services were included in the work papers provided to us. In addition, they told us that they do not conduct a variance analysis on IHS, family planning, and services for certain women with breast or cervical cancer for Nevada, noting that expenditures in these areas tend to be quite small. CMS region 6. Reviewers conducted a variance analysis of these higher matched expenditures for Arkansas and Texas and provided us documentation; however, the documentation showed some deviation from the required steps specified in CMS’s guidance. For example, for Texas, spending on two of the three categories was beyond the threshold for significance, but the reviewer did not document any follow-up with the state. Although expenditures for IHS, family planning, and certain women with breast or cervical cancer constituted a small share of total federal spending on Medicaid services—roughly 1 percent—combined spending on these categories was approximately $1 billion in the first quarter of fiscal year 2017. Our analysis indicated that variances in spending for these three services ranged widely across our six states, and in four of the states, some of their expenditures were above the thresholds for significance. (See fig. 4.) For example, in regional office 3, Maryland experienced a significant variance in its family planning expenditures—an increase of approximately $8 million dollars or 7,700 percent from the previous quarter—but there was no indication in the documentation provided that the regional office identified or investigated that variance. Similar to the variance analyses for other higher matched expenditure types, we found that the selected regional offices did not consistently conduct variance analyses on expenditures reported for the Medicaid expansion population. First, although five of our six states opted to expand Medicaid under PPACA, two of the five states (Maryland and Pennsylvania) were not subjected to a variance analysis for their expansion populations, a segment that accounted for nearly $7 billion in Medicaid expenditures in fiscal year 2016. Among the remaining three states, CMS regional office staff conducted a variance analysis, but in two of them, the reviewers did not document whether they investigated significant variances, leaving it unclear whether this required step was taken. Specifically, for two of the three remaining states—Arkansas and Nevada—reviewers did not document which variances were deemed significant or that any such variances were discussed with state officials. The guidance specified in CMS’s quarterly review guide is not always clear or consistent. For example: For IHS, family planning, and certain women with breast or cervical cancer, the guidance is explicit that the analysis is required, but the automated variance report used by reviewers for the step does not include these expenditures. For Medicaid expansion expenditures, the review guide is not explicit about whether a variance analysis is required, but CMS has an automated variance report available for these expenditures, which suggests that such an analysis was expected. The guidance suggests that a variance analysis should be conducted for expansion enrollees; however, it does not specify whether the analysis should be conducted in conjunction with—or take the place of—more in-depth examinations. According to federal internal controls standards for information and communication, agencies should communicate the information necessary for staff to achieve the agency’s objectives. CMS’s guidance on conducting variance analyses for types of expenditures with higher federal matching rates has not been sufficiently clear to assure that such analyses are being consistently conducted. By not consistently conducting such checks, errors may be going undetected and CMS may be providing federal funds at a higher matching rate than is allowable. CMS has additional procedures in place to review service expenditures reported for the Medicaid expansion population, a category of expenditures that received a 95 percent federal match in 2017. Specifically, in addition to a variance analysis, CMS guidance specifies that each regional office reviewer is to review claims for a sample. The guide directs the reviewer to obtain a full list of all expansion enrollees from the state and to select 30 to 40 for further review. Next, the reviewer is to obtain supporting documentation from the state listing the eligibility factors for the sampled enrollees, such as age, pregnancy status, Medicare enrollment, and income. The reviewer is to select a single claim for each enrollee and verify that the corresponding expenditures were reported under the correct federal matching rate category—i.e., that the sample claim for each individual was accounted for in the relevant section of the CMS-64. The review guide specifies that the sample review be conducted each quarter unless the state has had four consecutive quarters with three or fewer errors, in which case, the sampling must be performed only annually. We found that regional offices were identifying errors in their sampling reviews. For example, region 3 reviewers found that Pennsylvania had incorrectly categorized an individual in the sample as a Medicaid expansion enrollee, with the selected expenditures initially reported as eligible for the higher matching rate. According to CMS central office officials, the sampling methodology has helped identify systemic issues with state expenditure systems in some states and resulted in corrections, adjustments, and in one case, a disallowance. Under current procedures, among our five selected states that expanded Medicaid under PPACA, all five were determined to have had four consecutive clean quarters according to agency officials; that is, the state had three or fewer errors in each quarter. Nationally, all but one of the 33 states that have implemented Medicaid expansion under PPACA had four consecutive clean quarters as of March 2018, according to CMS officials. We found, however, that CMS’s procedures for sampling reviews had a key weakness in that they did not account for varying risks across states, as illustrated in the following examples. We found that sample size does not account for significant differences in program size. For example, both California and Arkansas have expanded Medicaid under PPACA, and regional office staff told us they reviewed claims for 30 expansion enrollees in each of the two states, despite the fact that California has over 10 times as many expansion enrollees as Arkansas. Region 9 officials told us that for California they had initially sampled 100 enrollees during the first quarter they were required to conduct this analysis, but the review was time consuming given staff resources, and they were advised by CMS’s central office to limit their sample to 30 individuals. CMS officials told us that the sampling procedures are resource intensive and that the sample size they decided upon was what they thought they had the resources to complete. Additionally, the sample size does not account for previously identified risks in a state’s program. Specifically, as we noted in a 2015 report, CMS’s sampling review of expansion expenditures was not linked to or informed by reviews of eligibility determinations conducted by CMS, some of which identified high levels of eligibility determination errors. According to CMS officials, the expenditure review is primarily intended to ensure that states are correctly assigning expenditures for the expanded eligibility groups as initially determined, not whether the eligibility determination is correct. Federal standards for internal control related to risk assessment require that agencies identify, analyze, and respond to risks. However, because CMS’s sampling methodology does not account for risk factors like program size and high levels of eligibility determination errors, the agency’s review of expansion population expenditures may be missing opportunities to detect systemic issues with improperly matched expenditures. Quarterly variance analyses and sampling of Medicaid expansion enrollees can be supplemented by financial management reviews. For fiscal year 2016, CMS recommended regional offices conduct FMRs on expenditure claims for expansion enrollees. As of March 2018, however, regional offices had completed an FMR on Medicaid expansion expenditures in only one state, with no findings, and were in the process of completing FMRs for five other states. According to CMS officials, no additional reviews in this area were planned for fiscal year 2018. Financial Impact of Expenditure Reviews Compared with Program Integrity Recoveries The impact of CMS’s expenditure review activities is greater than the impact from other program integrity efforts. For example, in fiscal year 2015, CMS resolved errors through expenditure reviews that saved over $1.4 billion in federal funds. In the same year, CMS reported that efforts by states and the federal government to identify improper payments to providers—for example, services that were billed by a provider but were not received by a beneficiary—resulted in recoveries that totaled $852.9 million, in both state and federal funds. In fiscal years 2014 through 2017, CMS’s regional offices resolved expenditure errors that reduced federal spending by over $5.1 billion, with at least $1 billion in errors resolved in each of three of those four years. Errors were resolved through states agreeing to reduce their reported expenditures, which prevented federal payments to the state for those expenditures; and through CMS issuing disallowances, under which states are required to return federal funds. Although CMS resolved over $1 billion in expenditure errors in each year of fiscal years 2014 through 2016, CMS resolved less than $600 million in fiscal year 2017. CMS officials explained that this change likely reflects delays in clearance of disallowances due to the transition between presidential administrations. (See fig. 3.) In addition to these resolved errors, as of the end of 2017, CMS had $4.47 billion in outstanding deferrals of federal funds, where CMS was delaying federal funds until additional information was provided. Expenditures flagged for deferrals may or may not represent errors. All 10 CMS regional offices resolved errors from fiscal years 2014 through 2017, though the magnitude varied across regions. (See table 5.) Among the 10 regional offices, 9 reported that they had resolved errors through states agreeing to reduce reported expenditures. Additionally, 9 regional offices issued a total of 49 disallowances across 16 states, with the majority of the disallowances occurring in regional offices 2 and 3. Finally, all 10 regional offices had taken deferrals for questionable expenditures, with 22 states having outstanding “active” deferrals that had not been resolved as of the fourth quarter of fiscal year 2017, which ranged in amount from $178 to $444 million. CMS officials told us that the range of resolved errors and deferred funds across regional offices may reflect differences in the proportion of high-expenditure states. For example, regional office 4 oversees four states ranking in the top 20 in terms of Medicaid expenditures, while regional office 8 does not oversee any top- 20 states. The variation may also reflect large actions taken in specific states. For example, the majority of the disallowed funds in regional office 2 from fiscal years 2014 to 2017 were due to a single disallowance of $1.26 billion in one state. The financial significance of individual errors resolved by CMS’s regional offices varied significantly. We found that regional offices resolved errors that ranged from reporting errors that had no federal financial impact— such as expenditures that were allowable, but were reported on the incorrect line—to hundreds of millions of dollars in expenditures that were found to be unallowable under Medicaid requirements. Over the fiscal years we reviewed, more than half of the disallowances CMS issued were less than $15 million; however, in four states CMS issued disallowances of over $100 million, including a disallowance of over $1 billion in New York. (See fig. 5.) In some cases, actions taken by CMS to resolve errors were the culmination of years of work. For example, over several years the California Medicaid program reported a large volume of expenditures for which it did not yet have sufficient supporting documentation. The regional office officials told us that the state reported these expenditures in order to comply with the 2-year filing limit, and had reported these as “placeholder claims,” with the intention of providing additional support at a later time. Over the course of at least 6 years, CMS deferred hundreds of millions of dollars in federal funds related to these placeholder claims. Of the active deferrals as of the end of fiscal year 2017, most of the total amount of deferred funds was taken for expenditures in California, which represented $3.4 billion of the $4.5 billion in total active deferrals. According to CMS officials, in 2015, CMS prohibited California from reporting additional placeholder claims. Region 9 officials told us that they continue to work with the state to clear the deferrals related to this issue. They were able to resolve 9 related deferrals in fiscal year 2017; however, another over 60 deferrals were still unresolved. The growth of federal Medicaid expenditures, estimated at about $370 billion in fiscal year 2017, makes it critically important to assure expenditures are consistent with Medicaid requirements. CMS has a variety of processes in place to review state-reported expenditures, and those reviews have resulted in CMS resolving errors that have saved the federal government a considerable amount of money; over $5 billion in the last 4 years. However, the increasing complexity of expenditure reporting is occurring as resources to review these expenditures are decreasing, hindering CMS’s ability to target risk and potentially allowing for hundreds of millions of federal dollars in errors to go undetected. In the absence of a comprehensive risk assessment, which CMS has not conducted, CMS may be missing opportunities to better target resources to higher risk expenditures and increase the savings from these oversight activities. The variety of different matching rates has contributed to the increased complexity of CMS’s expenditure reviews. Although CMS has review procedures in place to assure that the correct matching rate is applied for services and populations receiving a higher federal matching rate, unclear guidance has contributed to inconsistency in the extent to which these reviews are conducted. In addition, we found weaknesses in the sampling methodology CMS requires its regional offices to use to help ensure that expenditures for Medicaid expansion enrollees—expenditures that receive a higher matching rate and that represented almost 20 percent of total federal Medicaid spending in 2016—are consistent with Medicaid requirements. In particular, the methodology does not account for risk factors like program size or vulnerabilities in state eligibility-determination processes and systems. As a result of the inconsistency in reviews and a sampling methodology that does not consider program risk, errors may be going undetected, resulting in CMS providing federal funds at higher federal matching rates than is allowable. In addition, CMS could be missing opportunities to identify any systemic issues that may contribute to such errors. We are making the following three recommendations to CMS: 1. The Administrator of CMS should complete a comprehensive, national risk assessment and take steps, as needed, to assure that resources to oversee expenditures reported by states are adequate and allocated based on areas of highest risk. (Recommendation 1) 2. The Administrator of CMS should clarify in internal guidance when a variance analysis on expenditures with higher match rates is required. (Recommendation 2) 3. The Administrator of CMS should revise the sampling methodology for reviewing expenditures for the Medicaid expansion population to better target reviews to areas of high risk. (Recommendation 3) We provided a draft of this report to HHS for review and comment. HHS concurred with all three recommendations, noting that it takes seriously its responsibilities to protect taxpayer funds by conducting thorough oversight of states’ claims for federal Medicaid expenditures. Regarding our first recommendation—that CMS complete a comprehensive, national risk assessment and take steps to assure that resources are adequate and allocated based on risk—HHS noted that CMS will complete such an assessment, and, based on this review, will determine the appropriate allocation of resources based on expenditures, program risk, and historical financial issues. CMS will also identify opportunities to increase resources. Regarding our second recommendation—clarifying internal guidance on when a variance analysis on higher matched expenditures is required—HHS noted that CMS will issue such internal guidance. Regarding our third recommendation—that CMS revise the sampling methodology for reviewing expenditures for the Medicaid expansion population to better target reviews to areas of high risk—HHS noted CMS is considering ways to revise its methodology. HHS’s comments are reproduced in appendix II. As agreed with your offices, unless you publicly announce the contents of this report earlier, we plan no further distribution until 30 days from the report date. At that time, we will send copies of this report to the Secretary of Health and Human Services, appropriate congressional committees, and other interested parties. The correspondence is also available at no charge on the GAO website at http://www.gao.gov. If you or your staff members have any questions about this report, please contact me at (202) 512-7114 or yocomc@gao.gov. Contact points for our Offices of Congressional Relations and Public Affairs may be found on the last page of this report. GAO staff who made key contributions to this report are listed in appendix III. Public psychiatric residential treatment facilities Medicare Part B premium buy-ins Outpatient hospital reimbursement for mental health services Review of comprehensive psychiatric emergency program rates Provider taxes implemented to avoid program reductions Health homes data and expenditures reporting Provider incentive payments for health information technology 1115 demonstration provider incentive payments Public psychiatric residential treatment facilities Managed care organizations’ provider payments Provider incentive payments for health information technology Federally qualified health center reimbursement payments Eligibility and enrollment maintenance and operations Managed care organizations’ reporting of drug rebates 3 CMS cancelled these 2014 FMRs due to a staffing shortage. Region 8 was excused from the requirement to conduct an FMR in 2016 due to staffing constraints. In addition to the contact named above, Susan Barnidge (Assistant Director), Jasleen Modi (Analyst-in-Charge), Caroline Hale, Perry Parsons, and Sierra Gaffney made key contributions to this report. Also contributing were Giselle Hicks, Drew Long, and Jennifer Whitworth.

Answer: Medicaid has grown by over 50 percent over the last decade, with about $370 billion in federal spending in fiscal year 2017. CMS is responsible for assuring that expenditures—reported quarterly by states—are consistent with Medicaid requirements and matched with the correct amount of federal funds. CMS's review of reported expenditures has become increasingly complex due to variation in states' Medicaid programs and an increasing number of different matching rates. GAO was asked to examine CMS's oversight of state-reported Medicaid expenditures. In this report, GAO examined how CMS assures that (1) expenditures are supported and consistent with requirements; and (2) the correct federal matching rates were applied to expenditures subject to a higher match. GAO also examined the financial impact of resolved errors. GAO reviewed documentation for the most recently completed quarterly reviews by 3 of CMS's 10 regional offices for six states that varied by Medicaid program expenditures and design. GAO also reviewed policies, procedures, and data on resolved errors; and interviewed CMS and state officials. GAO assessed CMS's oversight processes against federal standards for internal control. The Centers for Medicare & Medicaid Services (CMS), which oversees Medicaid, has various review processes in place to assure that expenditures reported by states are supported and consistent with Medicaid requirements. The agency also has processes to review that the correct federal matching rates were applied to expenditures receiving a higher than standard federal matching rate, which can include certain types of services and populations. These processes collectively have had a considerable federal financial benefit, with CMS resolving errors that reduced federal spending by over $5.1 billion in fiscal years 2014 through 2017. However, GAO identified weaknesses in how CMS targets its resources to address risks when reviewing whether expenditures are supported and consistent with requirements. CMS devotes similar levels of staff resources to review expenditures despite differing levels of risk across states. For example, the number of staff reviewing California's expenditures—which represent 15 percent of federal Medicaid spending—is similar to the number reviewing Arkansas' expenditures, which represents 1 percent of federal Medicaid spending. CMS cancelled in-depth financial management reviews in 17 out of 51 instances over the last 5 years. These reviews target expenditures considered by CMS to be at risk of not meeting program requirements. CMS told GAO that resource constraints contributed to both weaknesses. However, the agency has not completed a comprehensive assessment of risk to (1) determine whether oversight resources are adequate and (2) focus on the most significant areas of risk. Absent such an assessment, CMS is missing an opportunity to identify errors in reported expenditures that could result in substantial savings to the Medicaid program. GAO also found limitations in CMS's processes for reviewing expenditures that receive a higher federal matching rate. Internal guidance for examining variances in these expenditures was unclear, and not all reviewers in the three CMS regional offices GAO reviewed were investigating significant variances in quarter-to-quarter expenditures. Review procedures for expenditures for individuals newly eligible for Medicaid under the Patient Protection and Affordable Care Act were not tailored to different risk levels among states. For example, in its reviews of a sample of claims for this population, CMS reviewed claims for the same number of enrollees—30—in California as for Arkansas, even though California had 10 times the number of newly eligible enrollees as Arkansas. Without clear internal guidance and better targeting of risks in its review procedures for expenditures receiving higher matching rates, CMS may overpay states. GAO is making three recommendations, including that CMS improve its risk-based targeting of oversight efforts and resources, and clarify related internal guidance. The Department of Health and Human Services concurred with these recommendations.