prompt_front: You are given two reports by the government agency.



Question: Write a one-page summary of the report 1.

Report 1: In accordance with the Improper Payments Information Act of 2002 (IPIA), as amended, and OMB guidance, CMS developed the PERM to estimate the national Medicaid improper payment rate  CMS has other mechanisms to review and assess program integrity risks in state Medicaid managed care programs, and it uses information from the PERM to target its program integrity activities and oversight of states’ Medicaid programs  IPIA requires federal executive branch agencies to, among other things, (1) identify programs and activities that may be susceptible to significant improper payments; and (2), on an annual basis, estimate the amount of improper payments for susceptible programs and activities  Agency heads must produce a statistically valid estimate or an estimate that is otherwise appropriate, using an OMB-approved alternate methodology  Those agencies with programs identified by OMB as being high priority for additional oversight and review are required to submit annual reports to their Inspectors General detailing the actions the agency plans to take to recover improper payments and prevent future improper payments  The Inspector General of each agency submitting such a report is required to review the quality of the improper payment estimates and methodology, among other things  OMB designated Medicaid as a high priority program  In addition, the Improper Payments Elimination and Recovery Act of 2010 requires the Inspector General of each agency to conduct a compliance review to report on the agency’s compliance with several criteria, one of which is that an agency has reported an improper payment rate of less than 10 percent for each program and activity  IPIA also directed OMB to issue guidance for agencies in implementing the IPIA improper payments requirements  Among other things, the OMB guidance requires that agencies review payments made at the point that federal funds are transferred to nonfederal entities and report on the root causes of identified improper payments  To calculate the Medicaid improper payment rate through the PERM, CMS computes an annual rolling average of improper payment rates across all states based on a 17-state, 3-year rotation cycle  In accordance with IPIA, as amended, OMB approved CMS’s PERM methodology, and the HHS-OIG conducts annual compliance reviews  Beginning with its annual improper payment compliance review for fiscal year 2014, the HHS-OIG established a rotating approach to reviewing the estimation methodology for high-priority programs, including Medicaid, that OMB deemed susceptible to improper payments  Due to the number and complexity of the programs, the HHS-OIG methodology reviews are scheduled to be performed over a 4-year period; the PERM estimation methodology will be reviewed as a part of its fiscal year 2017 compliance review  Each of the three components of the Medicaid PERM—FFS, managed care, and eligibility—is estimated differently: The FFS component of the PERM measures errors in a sample of FFS claims, which are records of services provided and the amount the Medicaid program paid for these services  For the majority of sampled FFS claims, the PERM review contractor performs a medical review, which includes a review of the medical documentation to determine errors that do not meet federal and state policies, such as medically unnecessary services, diagnosis coding errors, and policy violations  Any FFS claims that were paid for services that should have been covered under a managed care plan’s capitated payment are also considered errors  The managed care component of the PERM measures errors that occur in the capitated payments that state Medicaid agencies make to managed care organizations (MCO) on behalf of enrollees  Capitated payments are periodic payments approved by CMS that state Medicaid agencies make to contracted MCOs to cover the provision of medical services to enrollees, as well as the MCOs’ administrative expenses and their profits or earnings  The PERM assesses whether any payments made to the MCOs were in amounts different than those the state agency is contractually required to pay, which are approved by CMS  In contrast to the FFS component, the managed care component of the PERM neither includes a medical review of services delivered to enrollees, nor reviews of MCO records or data  The eligibility component of the PERM measures errors in state determinations of whether enrollees meet categorical and financial criteria for receipt of benefits under the Medicaid program  The eligibility component assesses determinations for both FFS and managed care enrollees  This component has not been calculated since 2014; instead, CMS piloted different approaches to update the methodologies used to assess enrollee eligibility, as the Patient Protection and Affordable Care Act changed income eligibility requirements for nonelderly, nonpregnant individuals who qualify for Medicaid  Beginning in the 2019 reporting year, eligibility reviews under the PERM will resume and will be conducted by a federal contractor  Medicaid program integrity consists of efforts to ensure that federal and state expenditures are used to deliver quality, necessary care to eligible enrollees, and efforts to prevent fraud, waste, and abuse  We have found in prior work that CMS’s and states’ program integrity efforts focused primarily on payments and services delivered under FFS and did not closely examine program integrity in Medicaid managed care  For Medicaid managed care, CMS has largely delegated program integrity oversight of MCOs to the states  States, in turn, generally oversee MCOs and the providers under contract to MCOs through their contracts with the MCOs and reporting requirements  Some program integrity risks for managed care are similar to those in FFS, including payments made for nonenrolled, ineligible, or deceased individuals; payments to ineligible, excluded, or deceased providers; and payments to providers for improper or false claims, such as payments for services that are not medically necessary  Other program integrity risks are more unique to managed care  For example, capitated payments generally reflect the average cost to provide covered services to enrollees, rather than a specific service  Federal law requires capitation rates to be actuarially sound, meaning that, among other things, they must be reasonably calculated for the populations expected to be covered and for the services expected to be furnished under contract  In order to receive federal funds for its managed care program, a state is required to submit the rates it pays MCOs and the methodology it uses to set those rates to CMS for review and approval  Additionally, federal and state oversight of Medicaid managed care can include ensuring that MCOs fulfill contractual provisions within their managed care contracts  In some cases, these provisions relate directly to program integrity activities, including plans and procedures for identifying, recovering, and reporting on overpayments made to providers  The managed care component of the PERM measures the accuracy of the capitated payments state Medicaid agencies make to MCOs  Specifically, a CMS contractor examines whether the state agency made capitated payments only for eligible enrollees, made capitated payments for the correct amount based on the contract and coverage requirements (time period and geographic location), made capitated payments based on the correct rate for enrollees, and did not make any duplicate payments for enrollees  CMS officials noted that the agency established capitated payments as the level of review, because the capitation rate is the transaction used to determine the federal match in managed care  In general, the federal government matches most state expenditures for Medicaid services on the basis of a statutory formula  In FFS, the federal match is provided for the amount the state pays a health care provider for delivering services to enrollees  With managed care, the federal match is provided for the amount of the capitation rate the state pays the MCO  Capitated payments do not directly relate to the provision of a specific service, but reflect the average cost to provide covered services to enrollees  As a result, CMS officials maintain that the capitated payment is the lowest transaction level at which the agency can clearly identify federal funds without making significant assumptions  Because the managed care component of the PERM review is limited to measuring capitated payments, it does not account for other program integrity risks—such as overpayments to providers and unallowable MCO costs  In addition to errors in capitated payments included in PERM reviews, CMS regulations state that overpayments in managed care include any payment made to an MCO or provider under contract to an MCO to which the MCO or provider is not entitled under Medicaid  Such overpayments included payments for services that were not provided or medically necessary; or to ineligible, excluded, or deceased providers, which are not measured by the PERM  Unallowable MCO costs refers to operating costs that MCOs cannot claim under their managed care contracts, such as certain marketing costs, or that the MCO reported incorrectly  Among the 27 audits and investigations of Medicaid managed care programs we reviewed, 10 identified about $68 million in MCO overpayments to providers and unallowable MCO costs that were not accounted for in PERM estimates  In addition, one investigation of an MCO operating in nine states resulted in a $137 5 million settlement to resolve allegations of false claims  (See app  I for a complete list of the audits and investigations we identified ) However, the full extent of these overpayments and unallowable costs is unknown, because these audits and investigations were conducted over more than 5 years and involved a small fraction of the more than 270 MCOs operating nationwide as of September 2017  Specifically, 24 of the audits and investigations represented reviews in 10 states and, in many cases, focused on individual providers or MCOs; there were about 90 MCOs operating in the 10 states as of September 2017, according to the Kaiser Family Foundation  Some examples of the audits and investigations that identified overpayments and unallowable costs include the following: The Washington State Auditor’s Office found that two MCOs made $17 5 million in overpayments to providers in 2010, which may have increased the state’s 2013 capitation rates  The New York State Comptroller found that two MCOs paid over $6 6 million to excluded and deceased providers from 2011 through 2014  The Massachusetts State Auditor found that one MCO paid $420,000 for health care services and unauthorized prescriptions from excluded providers in 2013 and 2014  The Department of Justice alleged that an MCO operating in several states submitted inflated expenditure information to the state Medicaid agencies, falsified encounter data, and manipulated claims costs and service provision costs in nine states  The MCO agreed to pay over $137 5 million to resolve these claims  The Texas State Auditor’s Office found that an MCO reported $3 8 million in unallowable costs for advertising, company events, gifts, and stock options, along with $34 million in other questionable costs in 2015  The New York State Comptroller also found that an MCO claimed over $260,000 in unallowable administrative expenses, which contributed to an increase in capitation rates across the state  To the extent that the state does not identify or know of MCO overpayments to providers or unallowable MCO costs, the overpayments and unallowable costs could inflate future capitation rates, as the Washington State Auditor and New York State Comptroller noted in their findings  The PERM assesses the accuracy of capitated payments that states make to MCOs  States set capitation rates based on cost data— historical utilization and spending—that MCOs submit to the state Medicaid agencies, but the PERM does not consider these data  Unless removed from these cost data, unidentified overpayments and unallowable costs would likely inflate the MCO cost data that states use to set capitation rates  (See fig  1 ) As a result, future capitation rates would also be inflated, resulting in higher state and federal spending  In fiscal year 2017, the Medicaid managed care improper payment rate was 0 3 percent, while the FFS improper payment rate was 12 9 percent, leading to an assumption that the estimated risks in managed care are less significant than those estimated in FFS  However, the managed care component of the PERM does not determine whether MCO payments to providers were for services that were medically necessary, actually provided, accurately billed and delivered by eligible providers, or whether the MCO costs were allowable and appropriate  As a result, the PERM improper payment estimate potentially understates the extent of program integrity risks in Medicaid managed care  Moreover, this potential understatement in the PERM’s improper payment rate estimate may curtail investigations into the appropriateness of MCO spending  We previously reported that CMS and state program integrity efforts did not closely examine program integrity in Medicaid managed care, focusing primarily on payments and services delivered under FFS  Our current review of the 27 audits we identified encompassed a 5-year period, suggesting that reviews of managed care continue to be limited  An official from a state auditor’s office we spoke with suggested that some states may not audit services delivered under managed care, because of a low improper payment rate  In addition, he noted that his state Medicaid agency used the relatively low payment error rate in managed care as an indicator of few program integrity problems  As noted, CMS has increased its focus on and worked with states to improve oversight of Medicaid managed care; however, these efforts and the oversight efforts of states do not ensure the identification and reporting of overpayments and unallowable costs  In recent years, the agency has sought to strengthen oversight of managed care programs through updated regulations; reviews of states’ managed care programs (Focused Program Integrity Reviews) and collaborative audits, which are conducted jointly by federal program integrity contractors and states; and state monitoring of overpayments  Regulations  In May 2016, CMS updated its regulations for managed care programs in order to strengthen oversight  The updated regulations require a number of additional program integrity activities, such as those listed below  If fully implemented, these updated regulations may help with the identification and removal of overpayments and unallowable costs from data used to set future capitation rates  Under these regulations States must arrange for an independent audit of the accuracy, truthfulness, and completeness of the encounter and financial data submitted by MCOs, at least once every 3 years  Through contracts with MCOs, states must require MCOs to have a mechanism through which providers report and return overpayments to the MCOs  States must also require MCOs to promptly report any identified or recovered overpayments—specifying those that are potentially fraudulent—and submit an annual report on recovered overpayments to their state  States must use this information when setting actuarially sound capitation rates  Through contracts with MCOs, states must also require MCOs to report specific data, information, and documentation  In addition, the MCO’s chief executive officer or authorized representative must certify the accuracy and completeness of the reported data, information, and documentation  States must enroll MCO providers that are not otherwise enrolled with the state to provide services to enrollees in Medicaid FFS, and revalidate the enrollment at least once every 5 years  Initially this requirement was to start for MCO contracts beginning on July 1, 2018  Subsequently enacted legislation codified this requirement in statute and moved the implementation to January 1, 2018  It is too early to know if these regulations will assure better oversight of MCO payments to providers and the data used to set future capitation rates  The above program integrity requirements only went into effect recently—for contracts starting on or after July 1, 2017, and January 1, 2018  In addition, CMS issued a notice in June 2017 stating that the agency will use its enforcement discretion to assist states that are unable to implement new requirements by the required compliance date  Also, CMS has delayed issuance of implementing guidance for certain provisions until the agency completes its review, a step that may further delay states’ implementation  The agency has designated Medicaid managed care for “deregulatory action” and plans to propose a new rule, but has not indicated which of these provisions, if any, would be revised  Focused Program Integrity Reviews  In fiscal year 2014, CMS implemented its Focused Program Integrity Reviews in order to target high-risk program integrity areas in each state, including managed care  As we previously reported, these focused reviews are narrower in scope than the prior reviews conducted by CMS, but they still involve on-site visits to states  In its focused reviews of managed care, CMS found that several states had incomplete oversight of MCO payments to providers, even though the agency relies on states to verify reported MCO overpayments and to ensure the overpayments are excluded from the data used to set capitation rates  In the 27 focused reviews of managed care from 2014 to 2017, CMS found that MCOs in 17 states reported fewer overpayments to their state Medicaid agencies than CMS would expect  For example, MCOs in at least 5 states reported that overpayments were less than 0 1 percent of their total managed care expenditures; while CMS noted in 1 focused review that overpayments typically equal 1 to 10 percent of total expenditures in managed care  CMS also found that 5 of the 27 states did not verify that MCOs excluded overpayments from these data, and 1 state did not exclude overpayments from the capitation rate setting  This is consistent with our March 2017 report in which we noted that CMS commonly found that MCOs reported low amounts of recovered overpayments and conducted few reviews to identify overpayments  Also, officials from three of the five states we interviewed for that report said the focused reviews gave them leverage in dealing with MCOs or led MCOs to focus more on program integrity  We also reported that CMS officials recommended states take steps to improve their oversight of MCOs, based on the focused review findings  The findings from CMS’s focused reviews of managed care also highlight the need for greater federal oversight of states  Without these reviews, it is unclear if states would independently identify MCOs’ reporting of overpayments or work to strengthen MCO reporting  Yet, CMS has not yet published the focused reviews of managed care in 13 states, and it may only conduct a focused review in a state once every three or more years  Given CMS’s timeline for the focused reviews, it may take years to determine if corrective actions result in improved program integrity in services delivered through managed care  Collaborative audits  CMS has expanded the federal-state collaborative audits beyond FFS, and has begun to engage states to participate in collaborative audits of MCOs and providers under contract to MCOs  As a part of the collaborative audit process, the state volunteers to jointly develop the audit processes the federal contractors follow  CMS officials told us that federal contractors have completed 14 collaborative audits of providers under contract to MCOs in three states—Arizona, the District of Columbia, and Tennessee  Only the audit of Trusted Healthcare, an MCO in the District of Columbia, has been published  That audit identified $129,000 in overpayments in a sample of MCO payments to providers, which, if generalized to all of the MCO’s payments over 6 months, would equate to over $4 million in overpayments  According to CMS, three additional states—Louisiana, Nebraska, and New Hampshire—have shown interest in collaborative audits of their MCOs, although such audits require states to prepare data files for the federal contractor and commit staff time  In our March 2017 report, we found that states’ participation in FFS collaborative audits varied and some states reported barriers to their participation  Expanding collaborative audits in managed care will require commitment from and coordination with states  State monitoring of overpayments in managed care  States are required to report overpayments they have identified and recouped along with state expenditures on a quarterly basis  However, based on the responses of the program integrity officials in 13 of the 16 states we contacted, most officials were unable to define the magnitude of overpayments in their managed care programs, which may signify a need for greater federal oversight or coordination  Specifically, officials in 7 of the 13 states could not or did not identify the share of total reported Medicaid overpayments that occurred in managed care  In 11 of the 13 states, officials responded that they did not directly monitor MCO payments to providers  Of those 11 states, officials in 4 said they depend on MCOs to report overpayments and exclude the overpayments from the data used to set capitation rates  As long as states are not taking action to identify overpayments in managed care, they cannot be assured that they are accurately paying MCOs for medically necessary services provided to enrollees  Federal internal control standards call for agency management to identify, analyze, and respond to risks  CMS has taken some steps to identify, analyze, and respond to risks through its regulations, Focused Program Integrity Reviews, and collaborative audits  However, key CMS and state oversight efforts fall short of mitigating the limitations of the PERM estimates of improper payments for managed care, because they do not ensure the identification and reporting of overpayments to providers and unallowable MCO costs  Without addressing these key risks, CMS and states cannot ensure the integrity of Medicaid managed care programs  The 0 3 percent improper payment rate for Medicaid managed care, as measured by the PERM, is significantly lower than the improper payment rate of 12 9 percent for Medicaid FFS  However, this difference does not signal better oversight; rather, it represents differences in the review criteria between FFS and managed care, which result in a less complete accounting for the program integrity risks in managed care  The PERM does not account for key program integrity risks in Medicaid managed care: specifically, unidentified overpayments and unallowable costs  One federal investigation of an MCO operating in nine states resulted in a settlement of $137 5 million to resolve allegations of false claims that were not captured in the national Medicaid improper payment rate estimate  Further, CMS found that MCOs and states do not provide sufficient oversight in Medicaid managed care to address the risks that are not accounted for in the PERM, findings that are reinforced by our reports on Medicaid managed care program integrity  CMS has taken steps to improve its oversight of Medicaid managed care, yet these efforts fall short of ensuring that the agency and states will be able to identify and address overpayments to providers and unallowable MCO costs  Without better measurement of program risks—particularly as expenditures for Medicaid managed care continue to grow—CMS cannot be certain that the low improper payment rate for managed care, as measured by the PERM, accurately reflects lower risks in managed care  The Administrator of CMS should consider and take steps to mitigate the program risks that are not measured in the PERM, such as overpayments and unallowable costs; such an effort could include actions such as revising the PERM methodology or focusing additional audit resources on managed care  (Recommendation 1) We provided a draft of this report to the Department of Health and Human Services (HHS) for comment  In its written comments, HHS concurred with our recommendation, and indicated that it will review regulatory authority and audit resources to determine the best way to account for Medicaid program risks that are not accounted for in the PERM  However, HHS stated that the PERM is not intended to measure all Medicaid program integrity risks, and utilizing the PERM measurement in that way would be a misunderstanding and misuse of the reported rate  HHS also commented that a review of payments from MCOs to providers is outside the scope of IPIA  In addition, HHS asserted that including such a review would diminish the value of PERM reporting—because it would require significant assumptions about the amount of federal share in MCO payments to providers  Further, HHS maintained that such a review also would result in a measurement that was not comparable to other programs or agencies, which would diminish the value of government- wide improper payment rate reporting  We acknowledge that the current PERM methodology has been approved by OMB  However, we maintain that the PERM likely underestimates program integrity risks in Medicaid managed care  To ensure the appropriate targeting of program integrity activities, CMS needs better information about these risks  Given the size of the Medicaid program, its vulnerability to improper payments, and the growth in managed care, it is critical to have a full accounting of program integrity risks in managed care in order to best ensure the integrity of the whole Medicaid program  In its written comments, HHS also summarized several activities it uses to oversee and support states’ Medicaid program integrity efforts, including state program integrity reviews; collaborative audits conducted by federal contractors; Medicaid Integrity Institute training for state employees; and the Medicaid Provider Enrollment Compendium  HHS also provided technical comments, which we incorporated as appropriate  HHS’s comments are reprinted in appendix II  As agreed with your offices, unless you publicly announce the contents of this report earlier, we plan no further distribution until 30 days from the report date  At that time, we will send copies to the Secretary of Health and Human Services, the Administrator of CMS, appropriate congressional committees, and other interested parties  In addition, the report will be available at no charge on the GAO website at http://www gao gov  If you or your staff members have any questions about this report, please contact me at (202) 512-7114 or at yocomc@gao gov  Contact points for our Offices of Congressional Relations and Public Affairs may be found on the last page of this report  GAO staff that made key contributions to this report are listed in appendix III  We reviewed 16 federal and state audits and 11 notices of investigations of Medicaid managed care organizations (MCO) and providers issued from January 2012 to September 2017  As the findings below show, the audits and investigations represent a limited number of reviews that, in many cases, focused on individual states and individual providers or MCOs within that state  Given the limited scope and number of states reviewed, the amount of the overpayments and unallowable costs occurring nationwide is unknown  These audits and investigations show cases of MCO overpayments to providers or unallowable costs, which are not accounted for by the Centers for Medicare & Medicaid Services’ Payment Error Rate Measurement (PERM) ; errors in capitated payments (e g , capitated payments made for deceased individuals), which are accounted for in the PERM; and gaps in managed care oversight  When reporting overpayments and unallowable costs identified in the audits and investigations, we only include amounts specifically attributed to MCOs in our total  This total does not include the following: overpayments and unallowable costs identified in those audits and investigations that did not distinguish between the amounts attributable to MCOs, Medicaid fee-for-service, or Medicare; overpayments and unallowable costs identified in criminal proceedings that are not yet resolved; and errors in capitated payments, as those payments would be reviewed by the PERM  As a result, the total amount of overpayments and unallowable costs and capitated payment errors in this appendix exceed what we report  In addition to the contact named above, Leslie V  Gordon (Assistant Director), Pauline Adams (Analyst-in-Charge), Erika Huber, and Drew Long made key contributions to this report  Also contributing were Muriel Brown and Jennifer Whitworth 


Report 2: For over a decade, each of VA’s 170 medical centers used VHA’s legacy MSPV program to order medical supplies, such as bandages and scalpels  Many of those items were purchased using the Federal Supply Schedules, which provided medical centers with a great deal of flexibility  However, as we reported in 2016, this legacy program prevented VHA from standardizing items used across its medical centers and affected its ability to leverage its buying power to achieve greater cost avoidance  Standardization is a process of narrowing the range of items purchased to meet a given need, such as buying 10 varieties of bandages instead of 100, in order to improve buying power, simplify supply chain management, and provide clinical consistency  In part because of the legacy MSPV program’s limited standardization, VHA decided to transition to a new iteration, called MSPV-NG  The transition to MSPV-NG has been a major effort, involving the MSPV- NG program office, stakeholders from the VHA’s Procurement and Logistics Office and VA’s Strategic Acquisition Center (SAC)—a VA-wide contracting organization—and logistics and clinical personnel at every medical center  The program also includes hundreds of new contracts with individual supply vendors and a new set of prime vendor contracts to distribute the supplies  VA’s goals for the MSPV-NG program include (1) standardizing requirements for supply items for greater clinical consistency; (2) demonstrating cost avoidance by leveraging VA’s substantial buying power when making competitive awards; (3) achieving greater efficiency in ordering and supply chain management, including a metric of ordering 40 percent of medical centers’ supplies from the MSPV-NG formulary; and (4) involving clinicians in requirements development to ensure uniform clinical review of medical supplies  VHA launched the MSPV-NG program in December 2016, but allowed a 4-month transition period  After April 2017, medical centers could no longer use the legacy program  MSPV-NG now restricts ordering to a narrow formulary  VHA policy requires medical centers to use MSPV- NG—as opposed to other means such as open market purchase card transactions—when purchasing items that are available in the formulary  Leading hospital networks we spoke with have similar goals to VA in managing their supply chains, including clinical standardization and reduced costs  These hospital networks reported they analyze their spending to identify items purchased most frequently, and which ones would be the best candidates to standardize first to yield cost savings  The hospitals’ supply chain managers reported establishing consensus with clinicians through early and frequent collaboration, understanding that clinician involvement is critical to the success of any effort to standardize their medical supply chain  By following these practices, these hospital networks have reported they have achieved significant cost savings in some cases, and the potential for improved patient care, while maintaining buy-in from their clinicians  VHA’s implementation of the MSPV-NG program—from its initial work to identify a list of supply requirements in early 2015, through its roll-out of the formulary to medical centers in December 2016—was not executed in line with leading practices  Specifically, VHA lacked a documented program strategy, leadership stability, and workforce capacity for the transition that, if in place, could have facilitated buy-in for the change throughout the organization  Further, the initial requirements development process and tight time frames contributed to ineffective contracting processes  As a result, VHA developed an initial formulary that did not meet the needs of the medical centers and has yet to achieve utilization and cost avoidance goals  VA made some changes in the second phase of requirements development to address deficiencies identified in the initial roll out  Key among these was to increase the level of clinical involvement, that is, to obtain input from the doctors and nurses at VA’s individual medical facilities  Despite changes aimed at improving implementation, the agency continues to face challenges that prevent the program from fully achieving its goals  VA did not document a clear overall strategy for the MSPV-NG program at the start and has not done so to date  About 6 months after our initial requests for a strategy or plan, a VHA official provided us with an October 2015 plan focusing on the mechanics of establishing the MSPV-NG formulary  However, this plan was used only within the VHA Procurement and Logistics Office and had not been approved by VHA or VA leadership  Leading practices for organizational transformation state that agencies must have well-documented plans and strategies for major initiatives (such as MSPV-NG) and communicate them clearly and consistently to all involved—which included VHA headquarters, the SAC, and all 170 medical centers  Without such a strategy, VA could not reasonably ensure that all stakeholders understood VHA’s approach for MSPV-NG and worked together in a coordinated manner to achieve program goals  In our November 2017 report, we recommended that the Director of the MSPV-NG program office should, with input from SAC, develop, document, and communicate to stakeholders an overarching strategy for the program, including how the program office will prioritize categories of supplies for future phases of requirement development and contracting  VA agreed with this recommendation and reported it would have a strategy in place by December 2017  Leadership instability and workforce challenges also made it difficult for VA to execute its transition to MSPV-NG  Our work has shown that leadership buy-in is necessary to ensure that major programs like MSPV- NG have the resources and support they need to execute their missions  Due to a combination of budget and hiring constraints, and lack of prioritization within VA, the MSPV-NG program office has never been fully staffed and has experienced instability in its leadership  As of January 2017, 24 of the office’s 40 positions were filled, and program office officials stated that this lack of staff affected their ability to implement certain aspects of the program within the planned time frames  In addition, since the inception of MSPV-NG, the program office has had four directors, two of whom were acting and two of whom were fulfilling the director position while performing other collateral duties  For instance, one of the acting MSPV-NG program office directors was on detail from a regional health network to fulfill the position, but had to abruptly leave and return to her prior position due to a federal hiring freeze  In our November 2017 report, we recommended that VHA prioritize the hiring of a MSPV- NG program director on a permanent basis  VA agreed with this recommendation and indicated a vacancy announcement will be posted by the end of 2017  The MSPV-NG program office initially developed requirements for items to be included in the formulary based almost exclusively on prior supply purchases, with limited clinician involvement  The program office concluded in its October 2015 formulary plan that relying on data from previous clinician purchases would be a good representation of medical centers’ needs and that clinician input would not be required for identifying which items to include in the initial formulary  Further, rather than standardizing purchases of specific categories of supplies—such as bandages or scalpels—program officials told us they identified medical and surgical items on which VA had spent $16,000 or more annually and ordered at least 12 times per year, and made those items the basis for the formulary  Officials said this analysis initially yielded a list of about 18,000 items, which the program office further refined to about 6,000 items by removing duplicate items or those that were not considered consumable commodities, such as medical equipment  This approach to requirements development stood in sharp contrast to those of the leading hospital networks we met with, which rely heavily on clinician input to help drive the standardization process and focus on individual categories of supplies that provide the best opportunities for cost savings  Based on the requirements developed by the program office, SAC began to issue competitive solicitations for the 6,000 items on the initial formulary in June 2015  Medical supply companies had responded to about 30 percent of the solicitations as of January 2016  As a result, according to SAC officials, they conducted outreach and some of these companies responded that VHA’s requirements did not appear to be based on clinical input and instead consisted of manufacturer-specific requirements that favored particular products instead of broader descriptions  Furthermore, SAC did not solicit large groups of related items, but rather issued separate solicitations for small groups of supply items—consisting of three or fewer items  This is contrary to industry practices of soliciting large groups of related supplies together  Therefore, according to SAC officials, some medical supply companies told them that submitting responses to SAC’s solicitations required more time and resources than they were willing to commit  By its April 2016 deadline for having 6,000 items on the formulary, SAC had been working on the effort for over a year and had established competitive agreements for about 200 items, representing about 3 percent of the planned items  Without contracts for the items on the formulary in place, VA delayed the launch of the MSPV-NG program until December 2016 and SAC began establishing non-competitive agreements in the last few months before the launch of MSPV-NG  As shown in figure 1, these non-competitive agreements accounted for approximately 79 percent of the items on the January 2017 version of the formulary  While this approach enabled the MSPV-NG program office to establish the formulary more quickly, it did so at the expense of one of the primary goals of the MSPV-NG program—leveraging VA’s buying power to obtain cost avoidance through competition

ground_truth: The improper payment rate is a sentinel measure of program integrity risks for the Medicaid program. CMS and the states oversee Medicaid, whose size, structure, and diversity make it vulnerable to improper payments. CMS estimates the Medicaid improper payment rate annually through its PERM, which includes an estimate for Medicaid managed care, in which states contract with MCOs to provide services to Medicaid enrollees. GAO was asked to study the PERM methodology for managed care. In this report, GAO examined the extent to which the PERM accounts for program integrity risks in Medicaid managed care, including CMS's and states' oversight. GAO identified program integrity risks reported in 27 federal and state audits and investigations issued between January 2012 and September 2017; reviewed federal regulations and guidance on the PERM and CMS's Focused Program Integrity Reviews; and contacted program integrity officials in the 16 states with a majority of 2016 Medicaid spending for managed care, as well as CMS officials and program integrity experts. The Centers for Medicare & Medicaid Services' (CMS) estimate of improper payments for Medicaid managed care has limitations that are not mitigated by the agency's and states' current oversight efforts. One component of the Payment Error Rate Measurement (PERM) measures the accuracy of capitated payments, which are periodic payments that state Medicaid agencies make to managed care organizations (MCO) to provide services to enrollees and to cover other allowable costs, such as administrative expenses. However, the managed care component of the PERM neither includes a medical review of services delivered to enrollees, nor reviews of MCO records or data. Further, GAO's review of the 27 federal and state audits and investigations identified key program risks. Ten of the 27 federal and state audits and investigations identified about $68 million in overpayments and unallowable MCO costs that were not accounted for by PERM estimates; another of these investigations resulted in a $137.5 million settlement. These audits and investigations were conducted over more than 5 years and involved a small fraction of the more than 270 MCOs operating nationwide as of September 2017. To the extent that overpayments and unallowable costs are unidentified and not removed from the cost data used to set capitation rates, they may allow inflated MCO payments and minimize the appearance of program risks in Medicaid managed care. CMS and states have taken steps to improve oversight of Medicaid managed care through updated regulations, focused reviews of states' managed care programs, and federal program integrity contractors' audits of managed care services. However, some of these efforts went into effect only recently, and others are unlikely to address the risks in managed care across all states. Furthermore, these efforts do not ensure the identification and reporting of overpayments to providers and unallowable costs by MCOs. Federal internal control standards call for agency management to identify and respond to risks. Without addressing key risks, such as the extent of overpayments and unallowable costs, CMS cannot be certain that its estimated improper payment rate for managed care (0.3 percent compared with 12.9 percent in Medicaid fee-for-service) accurately reflects program risks. The Administrator of CMS should consider and take steps to mitigate the program risks that are not measured in the PERM, such as overpayments and unallowable costs; such an effort could include actions such as revising the PERM methodology or focusing additional audit resources on managed care. HHS concurred with this recommendation. HHS also provided technical comments, which were incorporated as appropriate.

prompt_front: You are given two reports by the government agency.



Question: Write a one-page summary of the report 2.



Report 2:  Once VA’s MSPV-NG initial formulary was established in December 2016, each medical center was charged with implementing it  According to logistics officials we spoke with at selected medical centers, they had varying levels of success due, in part, to incomplete guidance from the program office  Without clear guidance, many medical centers reported they were unable to find direct matches or substitutes on the MSPV-NG formulary for a substantial number of items they routinely used, which negatively impacted utilization rates for the initial formulary  In our November 2017 report, we recommended that the Director of the MSPV- NG program office provide complete guidance to medical centers for matching equivalent supply items  VA agreed with this recommendation and indicated it would provide this guidance to medical centers by December 2017  According to SAC, as of June 2017, only about a third of the items on the initial version of the formulary were being ordered in any significant quantity by medical centers, indicating that many items on the formulary were not those that are needed by medical centers  Senior VHA acquisition officials attributed this mismatch to shortcomings in their initial requirements development process as well as with VA’s purchase data  VA had set a target that medical centers would order 40 percent of their supplies from the MSPV-NG formulary, but utilization rates were below this target with a nationwide average utilization rate across medical centers of about 24 percent as of May 2017  Specifically, Chief Supply Chain Officers—who are responsible for managing the ordering and stocking of medical supplies at six selected medical centers—told us that many items they needed were not included in the MSPV-NG formulary  As such, we found that these six medical centers generally fell below VA’s stated utilization target  As shown in figure 2, among the six selected medical centers we reviewed, one met the target, while the remaining five were below 25 percent utilization  Instead of fully using MSPV-NG, the selected medical centers are purchasing many items through other means, such as purchase cards or new contracts awarded by their local contracting office, in part, because they said the formulary does not meet their needs  These approaches run counter to the goals of the MSPV-NG program and contribute to VA not making the best use of taxpayer dollars  Greater utilization of MSPV-NG is essential to VA achieving the cost avoidance goal of $150 million for its supply chain transformation effort  Under the legacy MSPV program, the National Acquisition Center tracked cost avoidance achieved by comparing prices for competitively-awarded MSPV supply contracts with prices available elsewhere  However, VHA officials stated that they are not currently tracking cost avoidance related specifically to MSPV-NG  In our November 2017 report, we recommended that the VHA Chief Procurement and Logistics Officer, in coordination with SAC, should calculate cost avoidance achieved by MSPV-NG on an ongoing basis  VA agreed with this recommendation and reported it would develop a new metric to measure cost avoidance by June 2018  In Phase 2 of MSPV-NG, the program office has taken some steps to incorporate greater clinical involvement in subsequent requirements development, but both its requirements development and SAC’s contracting efforts have been hampered by staffing and schedule constraints  In the fall of 2016, the program office began to establish panels of clinicians to serve on MSPV-NG integrated product teams (IPT) assigned to the task of developing updated requirements for the second phase of the formulary  Program officials said they had difficulty recruiting clinicians to participate  We found that slightly more than half (20 of the 38) of the IPTs had begun their work to review items and develop updated requirements by the time the MSPV-NG program launched in December 2016  Staff on the IPTs had to complete their responsibilities by the end of March 2017 while simultaneously managing their regular workload as physicians, surgeons, or nurses  By early March 2017, the IPTs still had about 4,200 items to review  Faced with meeting this unrealistic time frame, the MSPV-NG program office had 9 IPT members travel to one location—with an additional 10 members participating virtually—to meet for 5 days to review the remaining items  Members told us that this time pressure limited the extent to which they were able to pursue the goal of standardizing supplies, and that their review ended up being more of a data validation exercise than a standardization review  VHA ultimately met this compressed timeline, but in a rushed manner that limited the impact of clinician involvement  In our November 2017 report, we recommended that the VHA Chief Procurement and Logistics Officer use input from national clinical program offices to prioritize its requirements development and standardization efforts beyond Phase 2 to focus on supply categories that offer the best opportunity for standardization and cost avoidance  VA agreed with this recommendation and stated it is in the process of finalizing guidance that will detail the importance of involving the national clinical program offices in MSPV-NG requirements development and standardization efforts  The SAC plans to replace the existing Phase 1 non-competitive agreements with competitive awards based on the Phase 2 requirements generated by the IPTs, but it may not be able to keep up with expiring agreements due to an unrealistic schedule  Because they were made on a non-competitive basis, the Phase 1 agreements were established for a period of 1 year  In order to keep the full formulary available, the SAC director said the staff must award 200 to 250 contracts before the Phase 1 agreements expire later this year  SAC officials acknowledged that it is unlikely that they will be able to award the contracts by the time the existing agreements expire  According to SAC officials, they are in the process of hiring more staff to deal with the increased workload  Further, the SAC division director told us that they canceled all outstanding Phase 2 solicitations in September 2017 due to low response rates, protests from service-disabled veteran-owned small businesses, and changes in overall MSPV-NG strategy  In our November 2017 report, we recommended that the MSPV-NG program office and SAC should establish a plan for how to mitigate the potential risk of gaps in contract coverage while SAC is still working to make competitive Phase 2 awards, which could include prioritizing supply categories that are most likely to yield cost avoidance  VA agreed with this recommendation and indicated it has developed a plan to mitigate the risk of gaps in contract coverage with short- and mid-term procurement strategies to ensure continued provision of medical and surgical supplies to VHA facilities  The department also stated that it plans to replace the current MSPV-NG contract and formulary process with a new approach where the prime vendor would develop the formulary  However, VA will likely face challenges in this new approach until it fully addresses the existing shortcomings in the MSPV-NG program  Chairman Roe, Ranking Member Walz, and Members of the Committee, this concludes my prepared statement  I would be pleased to respond to any questions that you may have at this time  If you or your staff have any questions about this statement, please contact Shelby S  Oakley at 202-512-4841 or OakleyS@gao gov  In addition, contact points for our Offices of Congressional Relations and Public Affairs may be found on the last page of this statement  Individuals who made key contributions to the report on which this testimony is based are Lisa Gardner, Assistant Director; Emily Bond; Matthew T  Crosby; Lorraine Ettaro; Michael Grogan; Jeff Hartnett; Katherine Lenane; Teague Lyons; Roxanna Sun; and Colleen Taylor  This is a work of the U S  government and is not subject to copyright protection in the United States  The published product may be reproduced and distributed in its entirety without further permission from GAO  However, because this work may contain copyrighted images or other material, permission from the copyright holder may be necessary if you wish to reproduce this material separately 
Report 2:  A FIT official acknowledged that assessing software functionality, rather than implementation, was emphasized during the discovery process  Although DHS relied on OMB and Treasury’s designation of IBC as a federal SSP, this FIT official also told us that because agencies’ specific needs can vary significantly, agencies are responsible for conducting sufficient due diligence to assess a federal SSP’s ability to meet their requirements  Project schedule: DHS, IBC, FIT, and USSM officials acknowledged that migrating the TRIO components to IBC within original time frames was a significant challenge given the overall magnitude and complexity of the TRIO project  According to DHS officials and TRIO project documentation, DHS identified delays in completing various tasks and milestones including providing design phase technical documentation and design processing proposed change requests; meeting proposed baseline schedules for implementing Coast Guard and TSA on the modernized IBC solution; and achieving initial operating capability requirements and stabilizing the production environment after DNDO’s migration to IBC because of various issues related to reporting, invoice payment processing, contract management processes, and resolving help desk tickets in a timely manner  DHS officials also stated that IBC did not consistently update the IMS to ensure that it accurately reflected all required tasks, the completion status, and the resources required to complete them  Concerns related to meeting milestones and updating the IMS were discussed during periodic status update meetings that included DHS, IBC, OMB, FIT, and USSM officials  IBC and DHS officials acknowledged that processes for communicating and resolving issues were not always efficient and contributed to schedule delays  In addition, in November 2016, USSM noted several concerns based on its review of a draft IMS supporting TSA’s re-planning efforts to go-live in October 2017  USSM’s concerns included an incomplete project scope and schedule and need for additional discovery to determine cost and level of effort, an extremely aggressive schedule with very limited contingencies for the lack of interim checkpoints or oversight on tasks exceeding 30 days, the need for a resource-loaded IMS that incorporates an appropriate level of detail, and the need for an expedited program governance strategy and escalation path that DHS and IBC leadership could use to make program decisions within the time allotted on the schedule  Complex requirements: DHS, IBC, FIT, and USSM officials acknowledged the overall complexity of the TRIO project and that the lack of a detailed understanding of the components’ requirements earlier in the project impacted IBC’s and DHS’s ability to satisfy the requirements as planned  For example, USSM and FIT officials told us that under the shared services model, the approach for onboarding new customers usually involves migrating to a proven configuration of a solution that is already being used by the provider’s existing customers  However, rather than taking this approach, DHS and IBC agreed to implement a more recent version of Oracle Federal Financial software (version 12 2) with integrated contract life cycle and project modules  Under this approach, IBC’s plans included migrating other existing customers to this upgraded environment  USSM officials told us that migrating TRIO components to a new solution that required configuring new software and related applications and developing related interfaces introduced additional complexities that contributed to issues on the TRIO project  According to a FIT official, the functionality of this more recent version of software is very different than that of the version IBC’s existing customers used  This official stated that IBC did not have the needed government personnel with knowledge and experience associated with this new software, a condition that likely contributed to the challenges experienced on the TRIO project  IBC officials acknowledged that IBC’s lack of familiarity with Oracle 12 2 increased the complexity of the TRIO project  In addition, DHS and IBC perspectives on the need for changes differed because of the lack of clarity regarding TRIO project requirements  DHS officials told us that many change requests on the TRIO project reflected the need for required functionality based on previously stated requirements  They also told us that they did not consider DNDO-related requirements to be overly complex when compared to those associated with IBC’s similarly sized customers  However, DHS officials stated that as of June 2017, IBC has not yet met DNDO’s needs to deliver a functioning travel system interface and other requirements  According to IBC officials, TRIO project change requests to address components’ requirements were extensive and included significant customizations to meet unique requirements that were not aligned with the federal shared service model  IBC officials noted additional challenges in addressing TRIO project requirements related to DHS’s efforts to address certain organizational change management and business process reengineering responsibilities  According to IBC officials, in some instances, the TRIO components provided conflicting requirements related to the same process that would have been more consistent had DHS completed more of its business process reengineering efforts prior to providing them to IBC  Project costs: According to the July 2014 discovery report, proposed implementation costs for the TRIO project totaled $89 9 million  However, according to DHS officials and TRIO project documentation, estimated costs significantly increased because of schedule delays, unanticipated complexities, and other challenges  In January 2017, DHS prepared a summary of estimated TRIO project implementation costs associated with its IAA with IBC  According to this summary, estimated IBC-related TRIO project implementation costs through fiscal year 2017 increased by approximately $42 8 million (54 percent) from the $79 2 million provided in the original August 2014 IAA with IBC as a result of modifications required, in part, to address challenges impacting the project  DHS officials also expressed concerns regarding increases in estimated operations and maintenance costs for the IBC solution  For example, according to a December 2016 memorandum to DHS on action items associated with failing to meet the baseline schedule date for initial operational capability, DNDO stated that IBC’s updated projected costs of operations and maintenance of its system were unaffordable  In connection with these costs, DHS officials also stated that IBC determined that separate, rather than shared, help desk resources were required to support the TRIO project because it was significantly different from the solution that IBC’s existing customers used  As a result, the officials indicated that these costs were more than originally expected  However, IBC officials told us that a portion of the increase in help desk- related costs was also due to DNDO employees not using the system properly because they were not sufficiently trained on it before it was implemented  In addition, challenges impacting the TRIO project have contributed to significant changes in the path forward on the project; as a result, the extent to which overall TRIO project modernization costs will be impacted going forward has not yet been determined  Project management and communication: According to DHS officials, various program management-related challenges impacted the TRIO project  For example, they expressed concerns regarding the effectiveness of IBC’s project management efforts including cost, schedule, and change management as well as IBC’s allocation of resources and slow decision-making process  They also stated that DHS provided significant time and resources to make up for fundamental project management activities that were under IBC’s control and not performed  In addition, DHS officials identified limitations associated with (1) poorly defined service level agreements and program performance metrics, (2) poor quality control plan, and (3) the lack of mechanisms for measuring delivery and addressing concerns regarding IBC’s performance  DHS officials told us that although various mechanisms can be used to hold commercial vendors accountable—such as cure notices, quality assurance surveillance plans, and incentives or disincentives to monitor performance—few mechanisms are available to hold federal agency service providers accountable for performance concerns  DHS officials also acknowledged challenges in their project management and communication efforts and identified lessons learned to help improve future efforts, including the need to establish a performance-based contract to determine objective and enforceable activity level metrics; be more prepared for organizational changes; improve vendor, project, and schedule management efforts; better understand SSP resource plans and monitor SSP efforts to help ensure that sufficient resources are secured timely; and centralize program management for financial system modernization functions, rather than continuing with the structure used on the TRIO project—for example, the TRIO project’s program management structure consisted of program management offices at the component level performing cost, schedule, and technical monitoring activities with DHS headquarters’ involvement focused on governance and oversight, resulting in duplicate efforts across components  IBC officials acknowledged challenges concerning IBC’s lack of sufficient resources and turnover, as described above  However, they told us that DHS’s approach to project management often resulted in duplicative meetings and a lengthy decision-making process involving several officials and multiple review and approval processes  According to USSM officials, the TRIO project team focused an unbalanced portion of its efforts on the delivery of technology at the expense of organizational change management, communication management, and other project management areas  For example, the failure to incorporate lessons learned from DNDO’s deployment adversely affected subsequent TRIO project implementation efforts, as change management activities did not address previously encountered risks  An OMB staff member concurred with the lessons learned that DHS identified, including those indicating the need for stronger project management  While the project is ongoing, the OMB staff member noted the importance of DHS having well-defined requirements for the project and better coordination to achieve the desired outcomes  In connection with TRIO project challenges, DHS officials told us that IBC notified DHS in April 2016 that it would not be able to meet the planned October 2016 implementation date for TSA  In response, DHS and IBC established the TSA Replan Tiger Team to perform a detailed assessment of potential courses of action  According to DHS officials, DHS and IBC subsequently took various actions to help address these and other challenges impacting the TRIO project, as summarized below  May 2016: IBC requested additional funding for fiscal year 2016 for 14 additional IBC and contractor personnel to strengthen program coordination and management support  According to DHS officials, DHS provided this requested funding along with additional funding to establish a business integration office to help strengthen cross organizational communication  DHS determined that plans for migrating TSA and Coast Guard to IBC during the first quarter of fiscal years 2017 and 2018, respectively, were not viable  As a result, their planned migrations were each extended an additional year  June 2016: DHS and IBC developed a comprehensive remediation plan to track progress on efforts to resolve numerous issues associated with DNDO’s production environment that continued to hamper its stability since going live in November 2015  According to DHS officials, these issues related to invoice payment and interest accruals, contract life cycle management, reporting, and other activities and have required numerous work-arounds to execute business processes  August to October 2016: DHS, Coast Guard, and IBC determined that a similar replanning effort was needed for Coast Guard’s successful migration to IBC  According to DHS officials, IBC indicated that it was unable to simultaneously provide DNDO production and TSA implementation support while also addressing the complexities related to Coast Guard  DHS officials told us that another Tiger Team established to address Coast Guard issues failed to complete the scope of its charter, and as a result, Coast Guard was forced to assume a minimum of a 2- year delay (rather than the 1-year delay previously determined in May 2016) and that this significantly increased program costs  They further stated that some of the team’s deliverables have not been initiated or remain outstanding as of June 2017  December 2016: IBC communicated to DHS that it cannot support the discovery phase with DHS’s CUBE modernization project  In addition, DHS approved the establishment of a Joint Program Management Office to serve as the overarching program management for DHS financial systems modernization projects  According to DHS officials, using a department-wide approach will enable DHS to more effectively leverage the resources and expertise across all modernization projects  January 2017: IBC communicated to DHS that it cannot support Coast Guard implementation in October 2018, and DHS and IBC established a joint CPWG to assess viable options for improving program performance and addressing stakeholder concerns and key TRIO project priorities  February 2017: DHS and IBC issued a joint memorandum to provide an update on contingency planning discussions  DHS and IBC shared commitments and determinations included (1) stabilizing the DNDO production environment and executing TSA implementation activities, (2) delivering the best value for the government and ensuring mutual success to the greatest extent possible, (3) preserving and protecting the current investment, and (4) making TSA implementation the first priority  In addition, DHS and IBC presented two options as representing the best opportunities for success in improving program performance and addressing stakeholder concerns: (1) continue with the status quo plan for Coast Guard implementation in October 2019, with significant improvements to program management and overall support capability and capacity, or (2) platform replacement  Platform replacement was presented as the preferred path toward meeting the needs of both DHS and IBC  Under this option, DHS and IBC would proceed with TSA implementation and work toward an orderly transition of TRIO components to an alternate service provider, hosting location, or both  March 2017: According to DHS officials, DHS, IBC, and USSM officials met to review certain critical success criteria for TSA’s implementation  Based on these discussions, it was determined that TSA would not go live with IBC in fiscal year 2018 given the high-risk schedule and critical criteria involved and the Coast Guard implementation would also be delayed accordingly  Further, TSA release 3 0 would be delivered in October 2017 or as soon as possible thereafter  In addition, the CPWG would continue working to identify an alternative path forward, and DHS and IBC would identify and evaluate critical transition activities and timelines  April 2017: The CPWG recommended moving away from IBC to a commercial service provider leveraging the cloud as the best course of action to complete TRIO project implementation and as the most fiscally responsible approach from a long-term sustainment and cost perspective  The CPWG’s recommendation was based on its analysis of six options and proposed a transition timeline, including key activities, as shown in figure 3  May 2017: During its May 3, 2017 briefing of the Financial Systems Modernization Executive Steering Committee, DHS indicated that two of the options that the CPWG considered were no longer viable, including the CPWG’s recommendation to transition to a commercial cloud service provider because the software was not yet cloud-ready  DHS ranked the remaining four options using 13 OMB risk factors as selection criteria and determined that migrating the solution to a DHS data center represented the best option going forward  In addition, DHS decided to move forward with discovery efforts related to this option  According to its briefing presentation and DHS officials, the notional timeline of planned key events for the TRIO project included various items, as shown in figure 4  DHS officials indicated that DHS expects to present the findings and recommendations resulting from discovery efforts associated with this new path forward to USSM and OMB for concurrence  As of August 2017, results of this effort were under review by DHS leadership  The TRIO project represents a key element of DHS’s efforts to address long-standing deficiencies in its financial management systems and further improve financial management  Following best practices to manage risks effectively can help provide increased assurance that large, complex projects—such as the TRIO project—will achieve planned objectives  DNDO’s AA process substantially met the four characteristics of a reliable, high-quality AOA process  However, Coast Guard’s and TSA’s AAs substantially met one and partially met three of these four characteristics  Further, DHS did not always follow best practices for managing the risks of using IBC for the TRIO project  As a result, TRIO components faced an increased risk that the solution they chose would not represent the best alternative for meeting their mission needs and that the risks impacting the TRIO project would not be effectively managed to mitigate adverse impacts  In addition, significant challenges have impacted the TRIO project, raising concerns about the extent to which objectives will be achieved as planned  Plans for DHS’s path forward on the TRIO project, as of May 2017, involve significant changes, such as transitioning away from IBC and a 2-year delay in completing Coast Guard’s and TSA’s migration to a modernized solution  Without greater adherence to best practices for analyzing alternatives and managing project risks, DHS continues to face increased risk that its financial management system modernization project will not provide reasonable assurance of achieving its mission objectives  We are making the following two recommendations to DHS: The DHS Under Secretary for Management should develop and implement effective processes and improve guidance to reasonably assure that future AAs fully follow AOA process best practices and reflect the four characteristics of a reliable, high-quality AOA process  (Recommendation 1) The DHS Under Secretary for Management should improve the Risk Management Planning Handbook and other relevant guidance for managing risks associated with financial management system modernization projects to fully incorporate risk management best practices, including defining thresholds to facilitate review of performance metrics to determine when risks become unacceptable; identifying and analyzing risks to include periodically reconsidering risk sources, documenting risks specifically related to the lack of sufficient, reliable cost and schedule information needed to help properly manage and oversee the project, and timely disposition of IV&V contractor-identified risks; developing risk mitigation plans with specific risk-handling activities, the costs and benefits of implementing them, and contingency plans for selected critical risks; and implementing risk mitigation plans to include establishing periods of performance for risk-handling activities and defining time intervals for updating and certifying the accuracy and completeness of information on risks in DHS’s risk register  (Recommendation 2) We provided a draft of this product to DHS and the Department of the Interior for comment  In its comments, reprinted in appendix IV, DHS concurred with our recommendations and provided details on its implementation of the recommendations as discussed below  In addition, DHS provided technical comments, which we incorporated as appropriate  The Department of the Interior only provided technical comments, which we incorporated as appropriate  DHS stated that it remains committed to its financial system modernization program  Specifically, regarding our first recommendation to develop and implement effective processes and improve guidance to reasonably assure that future AAs fully follow AOA process best practices and reflect the four characteristics of a reliable, high-quality AOA process, DHS stated that it agrees that effective processes and guidance are necessary to assure best practices  DHS also stated that it is important to note that the GAO-identified best practices were published more than 2 years after the TRIO components’ AAs were completed  While this is the case, as discussed in our report, these best practices are based on long- standing, fundamental tenets of sound decision making and economic analysis and were identified by compiling and reviewing commonly mentioned AOA policies and guidance that are known to and have been used by government and private sector entities  DHS also stated that it has already implemented this recommendation through its issuance of guidance and instructions in 2016 and that a copy of this additional guidance and instructions was provided to GAO  However, the documentation provided by DHS does not fully address our recommendation  As part of our recommendation follow-up process, we will coordinate with DHS to obtain additional information on its efforts to address our recommendation  With regard to our second recommendation to improve the Risk Management Planning Handbook and other relevant guidance, DHS stated that it concurred and agreed that the Risk Management Planning Handbook required updating to fully incorporate risk management best practices  In addition, DHS described actions it will take, and has taken, to revise and publish an updated handbook  We are sending copies of this report to the appropriate congressional committees, the Acting Secretary of Homeland Security, the DHS Under Secretary for Management, the Acting DHS Chief Financial Officer, the Secretary of the Interior, and the Director of the Interior Business Center  In addition, the report is available at no charge on the GAO website at http://www gao gov  If you or your staffs have any questions about this report, please contact me at (202) 512-9869 or khana@gao gov  Contact points for our Offices of Congressional Relations and Public Affairs may be found on the last page of this report  Key contributors to this report are listed in appendix V  To determine the extent to which the Department of Homeland Security (DHS) followed best practices in analyzing the alternatives used in choosing the preferred alternative for modernizing TRIO components’ financial management systems, we reviewed information that the TRIO components provided as part of their alternatives analysis (AA) process, referred to as the AA body of work, which includes the AA and other supporting documentation that is not specifically included in the AA  In addition, we discussed the DHS AA process with the TRIO components and DHS officials  We evaluated each TRIO component’s AA body of work and assessed this information against the GAO-identified 22 analysis of alternatives (AOA) process best practices  We then scored each AA against those best practices  In appendix II, these GAO- identified best practices are described in detail  Our evaluation comprised the following steps: (1) two GAO analysts separately examined the AA information received for each component, providing a score for each of 18 best practices; (2) a third GAO analyst resolved any differences between the two analysts’ initial scoring; and (3) a GAO specialist on AOA best practices, independent of the audit team, reviewed the team’s AA documentation, scores, and analyses for consistency  The GAO specialist also assessed the four best practices related to cost estimating  We used the average scores for each best practice to determine an overall score for four summary characteristics—well-documented, comprehensive, unbiased, and credible—of a reliable, high-quality AOA process at each TRIO component  Next, we shared our preliminary analysis with the TRIO components and DHS, and requested their technical comments and any additional information for our further consideration  For those characteristics of the AA process that received a score of partially met or below, we met with TRIO component and DHS officials to discuss potential reasons that an AA did not always conform to best practices  Finally, using the same methodology and scoring process explained above, we performed a final assessment based on our preliminary analysis and the comments and additional information received  The best practices were not used to determine whether DHS made the correct decision in selecting Department of the Interior’s Interior Business Center (IBC) to implement the financial management systems modernization solution or whether the TRIO project would have arrived at a different conclusion had it more fully conformed to these best practices  We also reviewed DHS guidance for conducting AOAs and AAs against the GAO-identified 22 AOA process best practices using the same methodology described above for reviewing the TRIO components’ AAs  In the course of applying these best practices to a TRIO component’s AA and to DHS guidance for the AA process, we assessed the reasonableness of the information we collected  We determined that the information from the DHS AA process was sufficiently reliable to use in assessing the TRIO components’ AAs and DHS guidance against these 22 best practices  To determine the key factors, metrics, and processes used by the TRIO components in developing and evaluating DHS’s alternative solutions and final choice for financial system modernization, we reviewed each component’s AA, including a description of (1) the alternatives considered, (2) the market research conducted, (3) the three alternatives evaluated, (4) the selection criteria used and how the criteria were weighted, (5) how each alternative scored against the selection criteria, and (6) the alternative that scored the best according to the component’s evaluation  To determine the extent to which DHS managed the risks of using IBC consistent with risk management best practices, we reviewed DHS’s and TRIO components’ risk management guidance and other documentation supporting their risk management efforts, including risk registers, mitigation plans, status reports, and risk management meeting minutes  We also met with officials to gain an understanding of the key processes and documents used for managing and reporting on TRIO project risks  We assessed the processes against best practices that the Software Engineering Institute (SEI) identified  The practices we selected are fundamental to effective risk management activities  These practices are identified in SEI’s Capability Maturity Model® Integration (CMMI®) for Acquisition, Version 1 3  In particular, the key best practices for preparing for risk management are determine risk sources and categories, define risk parameters, and establish a risk management strategy  The key best practices for identifying and analyzing risks are evaluate, categorize, and prioritize risks  The key best practices for mitigating identified risks are develop risk mitigation plans and implement risk mitigation plans  We applied the criteria from the CMMI risk management process area to determine the extent to which the expected practices were implemented, or future activities were planned for, by the program office  The rating system we used is as follows: (1) meets, or generally satisfies all elements of the specific practice; (2) partially meets, or generally satisfies a portion of specific practice elements; and (3) does not meet, or does not satisfy specific practice elements  In the context of the best practices methodology, we assessed the reliability of TRIO project risk data contained in DHS’s risk register  We interviewed officials on how the risk register was developed and maintained, including key control activities used to provide reasonable assurance of the accuracy of the information reported in the register  We reviewed DHS’s July 2016 risk register and minutes from risk management committee meetings (one meeting per quarter, randomly selected)  Of 120 TRIO project risks on the July 2016 risk register, we found 13 risks with missing data  Of 47 active risks identified, 28 risk records had not been modified in the previous 3 months and the register did not indicate when their accuracy was last confirmed and 35 risks were beyond their indicated impact dates but had not been marked as issues  We concluded that the pervasiveness of these data reliability problems decreased the usefulness of the risk register in connection with managing TRIO project risks  To determine the key factors or challenges that have impacted the TRIO project and DHS’s plans for completing remaining key priorities, we met with DHS, IBC, Office of Financial Innovation and Transformation, and Unified Shared Services Management office officials and Office of Management and Budget staff to obtain their perspectives  In addition, we reviewed documentation provided by these officials, including TRIO project status reports and memorandums, leadership briefings, and other presentations  We conducted this performance audit from March 2016 to September 2017 in accordance with generally accepted government auditing standards  Those standards require that we plan and perform the audit to obtain sufficient, appropriate evidence to provide a reasonable basis for our findings and conclusions based on our audit objectives  We believe that the evidence obtained provides a reasonable basis for our findings and conclusions based on our audit objectives  Many guides describe an approach to an analysis of alternatives (AOA); however, there is no single set of practices for the AOA process that has been broadly recognized by both the government and private sector entities  GAO has previously identified 22 best practices for an AOA process by (1) compiling and reviewing commonly mentioned AOA policies and guidance used by different government and private sector entities and (2) incorporating experts’ comments on a draft set of practices to develop a final set of practices  These practices are based on longstanding, fundamental tenets of sound decision making and economic analysis  In addition, these practices can be applied to a wide range of activities in which an alternative must be selected from a set of possible options, as well as to a broad range of capability areas, projects, and programs  These practices can provide a framework to help ensure that entities consistently and reliably select the project alternative that best meets mission needs  The guidance below is an overview of the key principles that lead to a successful AOA process and not as a “how to” guide with detailed instructions for each best practice identified  The 22 best practices that GAO identified are grouped into the following five phases: 1  Initialize the AOA process: Includes best practices that are applied before starting the process of identifying, analyzing, and selecting alternatives  This includes determining the mission need and functional requirements, developing the study time frame, creating a study plan, and determining who conducts the analysis  2  Identify alternatives: Includes best practices that help ensure that the alternatives to be analyzed are sufficient, diverse, and viable  3  Analyze alternatives: Includes best practices that compare the alternatives to be analyzed  The best practices in this category help ensure that the team conducting the analysis uses a standard, quantitative process to assess the alternatives  4  Document and review the AOA process: Includes best practices that would be applied throughout the AOA process, such as documenting all steps taken to initialize, identify, and analyze alternatives and to select a preferred alternative in a single document  5  Select a preferred alternative: Includes a best practice that is applied by the decision maker to compare alternatives and to select a preferred alternative  The five phases address different themes of analysis necessary to complete the AOA process, and comprise the beginning of the AOA process (defining the mission needs and functional requirements) through the final step of the AOA process (selecting a preferred alternative)  We also identified four characteristics that relate to a reliable, high-quality AOA process—that the AOA process is well-documented, comprehensive, unbiased, and credible  Table 4 shows the four characteristics and their relevant AOA best practices  Conforming to the 22 best practices helps ensure that the preferred alternative selected is the one that best meets the agency’s mission needs  Not conforming to the best practices may lead to an unreliable AOA process, and the agency will not have assurance that the preferred alternative best meets mission needs  The Department of Homeland Security’s TRIO components—the U S  Coast Guard (Coast Guard), Transportation Security Administration (TSA), and Domestic Nuclear Detection Office (DNDO)—conducted alternatives analyses (AA) during 2012 and 2013 to determine the best alternative for transitioning to a modernized financial management system solution  We evaluated the TRIO components’ AA processes against analysis of alternatives (AOA) best practices GAO identified as necessary characteristics of a reliable, high-quality AOA process (described in app  II)  GAO’s assessment of the extent to which Coast Guard’s, TSA’s, and DNDO’s AAs met each of the 22 best practices is detailed in tables 5, 6, and 7  In addition to the contact named above, James Kernen (Assistant Director), William Brown, Courtney Cox, Eric Essig, Valerie Freeman, Matthew Gardner, Jason Lee, Jennifer Leotta, and Madhav Panwar made key contributions to this report 

ground_truth: VA spends hundreds of millions of dollars annually on medical supplies to meet the health care needs of about 7 million veterans. To provide a more efficient, cost-effective way for its medical centers to order supplies, the VA established the MSPV-NG program. The program's goals include involving clinicians in requirements development, leveraging buying power when making competitive awards, and consolidating supplies used across medical centers. VA began developing requirements in early 2015 and launched the program in December 2016. This testimony summarizes key information contained in GAO's November 2017 report, GAO-18-34 . Specifically, it addresses the extent to which VA's implementation of MSPV-NG has been effective in meeting program goals. GAO analyzed VA's requirements development and contracting processes, and identified key supply chain practices cited by four leading hospital networks. GAO also met with contracting and clinical officials at six medical centers, selected based on high dollar contract obligations in fiscal years 2014-2016 and geographic representation. The Department of Veterans Affairs (VA) established the Medical Surgical Prime Vendor-Next Generation (MSPV-NG) program to provide an efficient, cost-effective way for its facilities to order supplies, but its initial implementation did not have an overarching strategy, stable leadership, and workforce capacity that could have facilitated medical center buy-in for the change. VA also developed requirements for a broad range of MSPV-NG items with limited clinical input. Further, starting in June 2015, VA planned to award competitive contracts, but instead, 79 percent of the items available for purchase under MSPV-NG were added through non-competitive agreements. (See figure). As a result, the program did not meet the needs of medical centers, and usage remained below VA's 40 percent target. (See figure.) VA has taken steps to address some deficiencies and is developing a new approach to the program. However, VA will likely continue to face challenges in meeting its goals until it fully addresses these existing shortcomings. GAO made 10 recommendations in its November 2017 report, including that VA develop an overarching strategy, expand clinician input in requirements development, and establish a plan for awarding future competitive contracts. VA agreed with GAO's recommendations.