prompt_front: You are given two reports by the government agency.



Question: Write a one-page summary of the report 1.



Report 2: CMS has four principal programs: Medicare, Medicaid, CHIP, and the health-insurance marketplaces  See table 1 for information about the four programs  As discussed earlier, Medicare and Medicaid are CMS’s largest programs and have been growing steadily (see fig  1)  CBO projects that, in 2026, under current law, Medicare spending will reach $1 3 trillion  Medicaid is also expected to continue to grow—program spending is projected to increase 66 percent to over $950 billion by fiscal year 2025, and more than half of the states have chosen to expand their Medicaid programs by covering certain low-income adults not historically eligible for Medicaid coverage, as authorized under the Patient Protection and Affordable Care Act of 2010 (PPACA)  The two programs’ use of managed-care delivery systems to provide care has also increased  For example, the number and percentage of Medicare beneficiaries enrolled in Medicare Part C has grown steadily over the past several years, increasing from 8 7 million (20 percent of all Medicare beneficiaries) in calendar year 2007 to 17 5 million (32 percent of all Medicare beneficiaries) in calendar year 2015  As of July 1, 2015, nearly two-thirds of all Medicaid beneficiaries were enrolled in managed- care plans and about 40 percent of expenditures in fiscal year 2015 were for health-care services delivered through managed care  CMS receives appropriations to carry out antifraud activities through several funds including the Health Care Fraud and Abuse Control (HCFAC) program and the Medicaid Integrity Program  The HCFAC program was established under the Health Insurance Portability and Accountability Act of 1996 to coordinate federal, state, and local law- enforcement efforts to address health-care fraud and abuse and to conduct investigations and audits, among other things  In fiscal year 2016, CMS received $560 million through the HCFAC program appropriations  The Medicaid Integrity Program, established by the Deficit Reduction Act of 2005, supports contracts to audit and identify overpayments in Medicaid claims, and provides technical assistance for states’ program-integrity efforts  According to CMS, it received $75 million every year since fiscal year 2009 through the Medicaid Integrity Program appropriations  According to CMS, in fiscal year 2016, total program-integrity obligations to address fraud, waste, and abuse for Medicare and Medicaid were $1 45 billion  As mentioned previously, we designated Medicare and Medicaid as high- risk programs starting in 1990 and 2003, respectively, because their size, scope, and complexity make them vulnerable to fraud, waste, and abuse  Similarly, the Office of Management and Budget (OMB) designated all parts of Medicare as well as Medicaid “high-priority” programs because these programs report $750 million or more in estimated improper payments in a given year  We also highlighted challenges associated with improper payments in Medicare and Medicaid in our annual report on duplication and opportunities for cost savings in federal programs  Improper payments are a significant risk to the Medicare and Medicaid programs and can include payments made as a result of fraud  Improper payments are payments that are either made in an incorrect amount (overpayments and underpayments) or those that should not be made at all  For example, CMS estimated in fiscal year 2016 that the Medicare fee-for-service (FFS) improper payment rate was 11 percent (approximately $41 billion) and the Medicaid improper payment rate was 10 5 percent (approximately $36 billion)  Improper payment measurement does not specifically identify or estimate improper payments due to fraud  Health-care fraud can take many forms, and a single case can involve more than one scheme  Schemes may include fraudulent billing for services not provided, services provided that were not medically necessary, and services intentionally billed at a higher level than appropriate  These fraud schemes may include compensating providers, beneficiaries, or others for participating in the fraud scheme  Fraud can be regionally focused or can target particular service areas such as home-health services, or durable medical equipment such as wheelchairs  Fraud may also have nonfinancial effects  For example, patients may be subjected to harmful or unnecessary services by fraudulent providers  Fraud can be perpetrated by different actors, such as providers, beneficiaries, health-insurance plans, as well as organized crime  Fraud and “fraud risk” are distinct concepts  Fraud is challenging to detect because of its deceptive nature  Additionally, once suspected fraud is identified, alleged fraud cases may be prosecuted  If the court determines that fraud took place, then fraudulent spending may be recovered  Fraud risk exists when individuals have an opportunity to engage in fraudulent activity, have an incentive or are under pressure to commit fraud, or are able to rationalize committing fraud  When fraud risks can be identified and mitigated, fraud may be less likely to occur  Although the occurrence of one or more cases of health-care fraud indicates there is a fraud risk, a fraud risk can exist even if fraud has not yet been identified or occurred  Suspicious billing patterns, certain types of health-care providers, or complexities in program design may indicate a risk of fraud  Information to help identify potential fraud risks may come from various sources, including whistleblowers, agency officials, contractors, law-enforcement agencies, beneficiaries, or providers  According to federal standards and guidance, executive-branch agency managers are responsible for managing fraud risks and implementing practices for combating those risks  Federal internal control standards call for agency management officials to assess the internal and external risks their entities face as they seek to achieve their objectives  The standards state that as part of this overall assessment, management should consider the potential for fraud when identifying, analyzing, and responding to risks  Risk management is a formal and disciplined practice for addressing risk and reducing it to an acceptable level  In July 2015, GAO issued the Fraud Risk Framework, which provides a comprehensive set of key components and leading practices that serve as a guide for agency managers to use when developing efforts to combat fraud in a strategic, risk-based way  The Fraud Risk Framework describes leading practices in four components: commit, assess, design and implement, and evaluate and adapt, as depicted in figure 2  The Fraud Reduction and Data Analytics Act of 2015, enacted in June 2016, requires OMB to establish guidelines for federal agencies to create controls to identify and assess fraud risks and design and implement antifraud control activities  The act further requires OMB to incorporate the leading practices from the Fraud Risk Framework in the guidelines  In July 2016, OMB published guidance about enterprise risk management and internal controls in federal executive departments and agencies  Among other things, this guidance affirms that managers should adhere to the leading practices identified in the Fraud Risk Framework  Further, the act requires federal agencies to submit to Congress a progress report each year for 3 consecutive years on the implementation of the controls established under OMB guidelines, among other things  CMS’s antifraud efforts for its four principal programs are part of the agency’s broader program-integrity approach to address fraud, waste, and abuse  CMS’s Center for Program Integrity (CPI) is the agency’s focal point for program integrity across the programs  According to CMS, its approach to program-integrity allows it to “address the whole spectrum of fraud, waste, and abuse ” For example, CMS describes its program- integrity activities as addressing unintentional errors resulting from providers being unaware of recent policy changes on one end of the spectrum, through somewhat more-serious patterns of abuse such as billing for a more-expensive service than was performed (known as upcoding), and finally up to serious fraudulent activities, such as billing for services that were not provided  CMS then aims to target its corrective actions to fit the risk  See figure 3 for CMS’s description of the spectrum of fraud, waste, and abuse that its program-integrity activities aim to address  Within its program-integrity activities, CMS has established several control activities that are specific to managing fraud risks, while others serve broader program-integrity purposes  According to CMS officials, the agency’s antifraud control activities mainly focus on providers in Medicare FFS  Officials told us that when CPI began operating, its primary focus was developing program integrity for Medicare FFS and, as a result, it is the most “mature” of all of CPI’s programs  CMS’s specific fraud control activities include, for example, the Fraud Prevention System (FPS), a predictive-analytics system that helps identify potentially fraudulent payments in Medicare FFS, and the Unified Program Integrity Contractors (UPIC), which detect and investigate aberrant provider behavior and potential fraud in Medicare and Medicaid  Other control activities serve broader program-integrity purposes such as to reduce improper payments resulting from error, waste, and abuse in addition to preventing or detecting potential fraud  For example, CMS provides education and outreach to Medicare providers and beneficiaries on issues identified through data analyses in order to reduce improper payments and to increase their awareness of fraud  HHS and CMS department- and agency-wide strategic plans guide CMS’s program-integrity activities—including antifraud activities  The program-integrity goals identified in the HHS strategic plan primarily focus on improper payments and are driven by statutory requirements  For example, the HHS strategic plan for fiscal years 2014–2018 includes performance goals of reducing the percentage of improper payments made under Medicare FFS and Medicare Parts C and D  One antifraud- focused goal in the HHS strategic plan is to increase the percentage of Medicare providers and suppliers identified as high risk that receive administrative actions, such as suspending payments to providers or revoking providers’ billing privileges  HHS and CMS department- and agency-wide strategic plans also include an emphasis on fraud prevention and early detection—a leading practice in the Fraud Risk Framework—and moving away from a “pay-and-chase” model  For example, the HHS strategic plan calls for “fostering early detection and prevention of improper payments by focusing on preventing bad actors from enrolling or remaining in Medicare and Medicaid” and to “use public-private partnerships to prevent and detect fraud across the health care industry by sharing fraud-related information and data between the public and private sectors ” As a part of this emphasis on prevention, CMS developed FPS in response to the Small Business Jobs Act of 2010, which required CMS to implement predictive-analytics technologies  Also, the Patient Protection and Affordable Care Act of 2010 (PPACA) included provisions to strengthen Medicare and Medicaid’s provider enrollment standards and procedures, among other program-integrity provisions  CMS works with an extensive and complex network of stakeholders to manage fraud risks in its four principal programs  In Medicaid and CHIP, CMS partners with and oversees the 50 states and the District of Columbia  Until the Deficit Reduction Act of 2005 expanded CMS’s role in Medicaid program integrity to provide effective federal support and assistance to states’ efforts to combat fraud, waste, and abuse, states were primarily responsible for Medicaid program integrity  Each state has its own Medicaid program-integrity unit, Medicaid Fraud Control Unit (MFCU), and state audit organization  CMS also uses numerous contractors to conduct the majority of its program-integrity activities  Since the enactment of Medicare in 1965, contractors have played an integral role in the administration of the program  The original Medicare program was designed so that the federal government contracted with health insurers or similar organizations experienced in handling physician and hospital claims to pay Medicare claims  Later, the Health Insurance Portability and Accountability Act of 1996 required the Secretary of Health and Human Services to enter into contracts to promote the integrity of the Medicare program  According to CMS officials, in fiscal year 2016 contractors received 92 percent of CMS’s program-integrity funding  Medicare and Medicaid program- integrity contractors play a variety of roles: (1) processing and reviewing claims, (2) conducting site visits of providers enrolling in Medicare, (3) auditing claims and recovering overpayments, (4) performing data analysis, and (5) investigating aberrant claims and provider behaviors, among other things  States also use contractors in many of these roles for managing program integrity  Additionally, multiple private health-insurance plans in Medicare Parts C and D and over 200 health-insurance plans in Medicaid managed care also carry out program-integrity activities  For the health-insurance marketplaces, CMS is responsible for operating the federally facilitated marketplace and overseeing the state-based marketplaces  CMS also developed the Federal Data Services Hub, which acts as a portal for exchanging information between state-based marketplaces, the federally facilitated marketplace, and state Medicaid agencies, among other entities, as well as other external partners, including other federal agencies, such as the Internal Revenue Service  Finally, law- enforcement groups, including the joint Department of Justice (DOJ) and HHS OIG Medicare Fraud Strike Force Teams, identify, investigate, and prosecute instances of fraud in CMS programs  See figure 4 for a depiction of CMS’s stakeholder network for managing fraud risks  This figure illustrates approximate numbers of stakeholders (through the concentration of dots), but not the extent of individual stakeholder roles  CMS provides oversight to, or partners with, these stakeholders to manage fraud risks  For oversight, CMS creates policies and guidance to direct stakeholders’ antifraud efforts, such as Medicare and Medicaid program-integrity manuals and the Medicaid Provider Enrollment Compendium  CMS also provides technical assistance to states in areas such as provider enrollment and data analysis  In areas where CMS does not have a primary role, it acts as a partner by collaborating and coordinating program-integrity and antifraud activities  For example, CMS is directly responsible for Medicare program integrity, but, in Medicaid and CHIP, states are the first line of program-integrity efforts  Similarly, CMS maintains control over Medicare FFS program integrity, but within Medicare managed care, it provides guidance for health- insurance plans to carry out their own program-integrity activities  In the health-insurance marketplaces, CMS reviews state-based marketplaces’ procedures for verifying applicant eligibility for coverage  For example, it conducts annual reviews of the state-based marketplaces, which include a review of states’ fraud, waste, and abuse policies  See figure 5 for a further description of CMS’s and various stakeholders’ roles and responsibilities in fraud risk management  CMS also facilitates collaboration among federal, state, and private entities for managing fraud risks  In 2012, CMS created the Healthcare Fraud Prevention Partnership (HFPP) to share information with public and private stakeholders and to conduct studies related to health-care fraud, waste, and abuse  According to CMS, as of October 2017, the HFPP included 89 public and private partners, including Medicare- and Medicaid-related federal and state agencies, law-enforcement agencies, private health-insurance plans (payers), and antifraud and other health- care organizations  The HFPP has conducted studies that pool and analyze multiple payers’ claims data to identify providers with patterns of suspect billing across payers  In a recent report, participants separately told us that the HFPP’s studies helped them to identify and take action against potentially fraudulent providers and payment vulnerabilities of which they might not otherwise have been aware, and fostered both formal and informal information sharing  CMS’s relationships with stakeholders were varied in terms of maturity and extent of information sharing, according to stakeholders we interviewed  While some relationships between CMS and stakeholders have been long-standing, some are developing, and others exist on an ad hoc basis  For example, CMS has had a long-standing relationship with state Medicaid program-integrity units, by collaborating through monthly meetings of the Medicaid Fraud and Abuse Technical Advisory Group, sending fraud alerts, and offering courses through the Medicaid Integrity Institute  However, in our interviews with state program-integrity units, and as we recently reported, some state Medicaid agencies shared concerns about the communication, level of policy guidance, and technical support provided by and received from CMS for managing fraud risks in Medicaid  This concern was echoed by state audit officials, with whom CMS recently initiated coordination to build relationships that would facilitate state auditing of Medicaid programs  CMS also has varying relationships with its law-enforcement partners  For example, the relationship between CMS and DOJ’s Health Care Fraud unit, which leads the DOJ and HHS OIG Medicare Fraud Strike Force Teams, has been ad hoc  According to CMS and DOJ officials, the interactions between the agencies have been based on specific fraud cases such as coordination of national takedowns when DOJ provided CMS with the names of providers committing fraud so that CMS could suspend them consistently with the timing of the enforcement efforts  According to CMS officials, they coordinate more with HHS OIG, working together on payment suspensions and revocations for OIG cases, or working with it to take administrative actions against large providers  CMS’s antifraud efforts partially align with the Fraud Risk Framework  Consistent with the framework, CMS has demonstrated commitment to combating fraud by creating a dedicated entity to lead antifraud efforts  It has also taken steps to establish a culture conducive to fraud risk management, although it could expand its antifraud training to include all employees  CMS has taken some steps to identify fraud risks in Medicare and Medicaid; however, it has not conducted a fraud risk assessment or developed a risk-based antifraud strategy for Medicare and Medicaid as defined in the Fraud Risk Framework  CMS has established monitoring and evaluation mechanisms for its program-integrity control activities that, if aligned with a risk-based antifraud strategy, could enhance the effectiveness of fraud risk management in Medicare and Medicaid  The commit component of the Fraud Risk Framework calls for an agency to commit to combating fraud by creating an organizational culture and structure conducive to fraud risk management  This component includes establishing a dedicated entity to lead fraud risk management activities  Within CMS, the Center for Program Integrity (CPI) serves as the dedicated entity for fraud, waste, and abuse issues in Medicare and Medicaid, which is consistent with the Fraud Risk Framework  CPI was established in 2010, in response to a November 2009 Executive Order on reducing improper payments and eliminating waste in federal programs  This formalized role, according to CMS officials, elevated the status of program-integrity efforts, which previously were carried out by other parts of CMS  As an executive-level Center—on the same level with five other executive-level Centers at CMS, such as the Center for Medicare and the Center for Medicaid and CHIP Services—CPI has a direct reporting line to executive-level management at CMS  The Fraud Risk Framework identifies a direct reporting line to senior-level managers within the agency as a leading practice  According to CMS officials, this elevated organizational status offers CPI heightened visibility across CMS, attention by CMS executive leadership, and involvement in executive- level conversations  Additionally, in 2014, CMS established a Program Integrity Board that has brought together senior officials across CMS Centers on a monthly basis to coordinate on fraud and program-integrity vulnerabilities  According to CPI officials, the board is one of the mechanisms through which CPI engages other executive-level offices at CMS  CPI chairs the meetings and typically develops meeting agendas to solicit information from and disseminate information to other CMS units or stakeholders  Further, the board may establish small working groups, known as integrated project teams, to address specific vulnerabilities  For example, according to CMS officials, in 2016 the board established a Marketplace integrated project team to resolve potential fraud eligibility and enrollment issues in the federally facilitated marketplace using the Fraud Risk Framework  CPI has further demonstrated commitment to addressing fraud, waste, and abuse through several organizational changes with the goal of improving coordination and communication of program-integrity activities across Medicare and Medicaid  Most recently, in 2014, CPI reorganized its structure to align functional areas across Medicare and Medicaid, where possible  Previously, separate units within CPI administered their own program-integrity activities for Medicare and Medicaid programs  For example, CPI established a Provider Enrollment and Oversight Group, responsible for provider screening and enrollment functions in both Medicare and Medicaid  According to CMS officials, if CPI employees identify an issue in provider enrollment in Medicare, the same CPI employees also consider how this issue applies to Medicaid  According to CMS officials, the reorganization has helped CPI to look at vulnerabilities in a crosscutting way and to facilitate communication across programs  Similarly, since 2016, CPI began shifting contracting functions from separate Medicare and Medicaid regional contractors that identify and investigate cases of potential fraud and conduct audits to five regional UPICs responsible for a range of program-integrity and fraud-specific activities in both Medicare FFS and Medicaid  According to CMS, the purpose of the UPICs is to coordinate provider investigations across Medicare and Medicaid, improve collaboration with states by providing a mutually beneficial service, and increase contractor accountability through coordinated oversight  CMS officials told us that UPIC integration is a cornerstone of CMS’s contract management strategy and would help to ensure communication and coordination across Medicare and Medicaid program-integrity efforts  CMS plans to award all the UPIC contracts by the end of 2017, ultimately phasing out the ZPICs and Medicaid Integrity Contractors  The commit component of the Fraud Risk Framework also includes creating an organizational culture to combat fraud at all levels of the agency  Consistent with the Fraud Risk Framework, CMS has promoted an antifraud culture by demonstrating a senior-level commitment to combating fraud through public statements, increased resource levels, and internal and external coordination  In addition to HHS and CMS strategic documents discussed earlier, CMS and CPI leaders have testified publicly about CMS’s commitment to preventing fraud and protecting taxpayers and beneficiaries  For example, CPI’s former Director testified in May 2016 before the House Committee on Energy and Commerce’s Subcommittee on Oversight and Investigations that “CMS is deeply committed to our efforts to prevent waste, fraud and abuse in Medicare and Medicaid programs, protecting both taxpayers and the beneficiaries that we serve ” More recently, CMS’s new Administrator testified in her February 2017 confirmation hearing regarding her intent to prioritize efforts around preventing fraud and abuse  CPI’s budget and resources have increased over time to support its ongoing program-integrity mission  According to CMS, program-integrity obligations for Medicare and Medicaid increased from about $1 02 billion in fiscal year 2010 to $1 45 billion in fiscal year 2016  According to CMS officials, the Health Care Fraud and Abuse Control (HCFAC) account, one of the primary sources of CPI funding, has never received a funding reduction  Additionally, in 2015, CPI received additional funding based on a discretionary cap adjustment to HCFAC  Similarly, CPI staff resources have increased over time  According to CMS, CPI’s full-time equivalent positions increased from 177 in 2011 to 419 in 2017  Consistent with leading practices in the Fraud Risk Framework to involve all levels of the agency in setting an antifraud tone, CPI has also worked collaboratively with other CMS Centers  In addition to engaging executive-level officials of other CMS Centers through the Program Integrity Board, CPI has worked collaboratively with other Centers within CMS to incorporate antifraud features into new program design or policy development and established regular communication at the staff level  For example: Center for Medicare and Medicaid Innovation (CMMI)  When developing the Medicare Diabetes Prevention Program, CMMI officials told us they worked with CPI’s Provider Enrollment and Oversight Group and Governance Management Group to develop risk-based screening procedures for entities that would enroll in Medicare to provide diabetes-prevention services, among other activities  The program was expanded nationally in 2016, and CMS determined that an entity may enroll in Medicare as a program supplier if it satisfies enrollment requirements, including that the supplier must pass existing high categorical risk-level screening requirements  Center for Medicaid and CHIP Services (CMCS)  CMCS officials told us they worked closely with CPI to issue Medicaid guidance and best practices to states on home and community-based services that incorporate program-integrity provisions  A senior CMCS official told us that, to address fraud, CMS has requested that states include provider information on claims to determine whether providers are meeting eligibility criteria  Center for Medicare (CM)  In addition to building safeguards into programs and developing policies, CM officials told us that there are several standing meetings, on monthly, biweekly, and weekly bases, between groups within CM and CPI that discuss issues related to provider enrollment, FFS operations, and contractor management  A senior CM official also told us that there are ad hoc meetings taking place between CM and CPI: “We interact multiple times daily at different levels of the organization  Working closely is just a regular part of our business ” CMS has also demonstrated its commitment to addressing fraud, waste, and abuse to its stakeholders  Representatives of CMS’s extensive stakeholder network whom we interviewed—state officials, contractors, and officials from public and private entities—generally recognized the agency’s commitment to combating fraud  In our interviews with stakeholders, officials observed CMS’s increased commitment over time to address fraud, waste, and abuse and cited examples of specific CMS actions  State officials, for example, told us that the Medicaid Integrity Institute, a training center coordinated jointly by CMS and DOJ, has been a helpful resource for states to build capacity to address fraud and program integrity  CMS contractors told us that CMS’s commitment to combating fraud is incorporated into contractual requirements, such as requiring (1) data analysis for potential fraud leads and (2) fraud- awareness training for providers  Officials from entities that are members of the HFPP, specifically, a health-insurance plan and the National Health Care Anti-Fraud Association, added that CMS’s effort to establish the HFPP and its ongoing collaboration and information sharing reflect CMS’s commitment to combat fraud in Medicare and Medicaid  The Fraud Risk Framework identifies training as one way of demonstrating an agency’s commitment to combating fraud  Training and education intended to increase fraud awareness among stakeholders, managers, and employees, serves as a preventive measure to help create a culture of integrity and compliance within the agency  The Fraud Risk Framework discusses requiring all employees to attend training upon hiring and on an ongoing basis thereafter  To increase awareness of fraud risks in Medicare and Medicaid, CMS offers and requires training for stakeholder groups such as providers, beneficiaries, and health-insurance plans  Specifically, through its National Training Program and Medicare Learning Network, CMS makes available training materials on combating Medicare and Medicaid fraud, waste, and abuse  These materials help to identify and report fraud, waste, and abuse in CMS programs and are geared toward providers, beneficiaries, as well as trainers and other stakeholders  Separately, CMS requires health-insurance plans working with CMS to provide annual fraud, waste, and abuse training to their employees  However, CMS does not offer or require similar fraud-awareness training for the majority of its workforce  For a relatively small portion of its overall workforce—specifically, contracting officer representatives who are responsible for certain aspects of the acquisition function—CMS requires completion of fraud and abuse prevention training every 2 years  According to CMS, 638 of its contracting officer representatives (or about 10 percent of its overall workforce) completed such training in 2016 and 2017  Although CMS offers fraud-awareness training to others, the agency does not require fraud-awareness training for new hires or on a regular basis for all employees because the agency has focused on providing process-based internal controls training for its employees  While fraud-awareness training for contracting officer representatives is an important step in helping to promote fraud risk management, fraud- awareness training specific to CMS programs would be beneficial for all employees  Such training would not only be consistent with what CMS offers to or requires of its stakeholders and some of its employees, but would also help to keep the agency’s entire workforce continuously aware of fraud risks and examples of known fraud schemes, such as those identified in successful OIG investigations  Such training would also keep employees informed as they administer CMS programs or develop agency policies and procedures  Considering the vulnerability of Medicare and Medicaid programs to fraud, waste, and abuse, without regular required training CMS cannot be assured that its workforce of over 6,000 employees is continuously aware of risks facing its programs  Although CMS has shown commitment to combating fraud, at times CPI’s efforts to combat fraud compete with other mission priorities, such as (1) ensuring beneficiary access to health-care services and (2) limiting provider burden  CPI leadership has been aware of this inherent challenge  For example, at a congressional hearing in May 2016, CPI’s Director stated that “our efforts strike an important balance: protecting beneficiary access to necessary health care services and reducing the administrative burden on legitimate providers and suppliers, while ensuring that taxpayer dollars are not lost to fraud, waste, and abuse ” Beneficiary access to care  In accordance with its mission statement, providing and improving beneficiaries’ access to health care is a CMS priority  CMS’s commitment to providing access to high-quality care and coverage is reflected in the agency’s mission statement and is one of its four strategic goals  As a result, before taking administrative actions against a Medicare Part A provider, such as a hospice, or providers in rural areas, CMS officials told us that they first look at whether there is a sufficient number of providers in an area by running a provider search by provider county and adjacent counties and considering how heavily populated an area is with Medicare beneficiaries  According to these officials, rather than taking an administrative action against a provider that would limit beneficiaries’ access to services, the agency may enter into a corrective action plan with the provider  CMS officials told us that revoking a provider’s enrollment in Medicare, an option available to CMS in cases of provider noncompliance or misconduct, is rare  Administrative burden on providers  According to CMS documents and officials, concern over placing undue burden on providers—the majority of whom are presumed to be honest—provides a counterforce to implementing program-integrity control activities  CMS’s web page entitled Reducing Provider Burden states: “CMS is committed to reducing improper payments but must be mindful of provider burden because medical review is a resource-intensive process for both the healthcare provider and the Medicare review contractor ” Two CMS contractors told us that they scaled back or did not pursue audits of providers’ documentation because of provider burden or sensitivity considerations  One contractor removed providers from audit samples after some providers opposed having to supply multiple medical records  CPI officials told us that they want to reduce provider burden in a logical manner  For example, according to CMS officials, in the Medicare FFS Recovery Audit Program, CMS established limits on Additional Documentation Requests, which are requests for medical documentation supporting a claim being reviewed  CMS requires such documentation adjustments so that they align with a providers’ claim denial rates  Providers with low denial rates will have lower documentation requirements, while providers with high denial rates will have higher documentation requirements, thus adjusting provider burden based on demonstrated compliance  The assess component of the Fraud Risk Framework calls for federal managers to plan regular fraud risk assessments and to assess risks to determine a fraud risk profile  Identifying fraud risks is one of the steps included in the Fraud Risk Framework for assessing risks to determine a fraud risk profile
Report 2:  Post staff noted, for example, that security officers at overseas posts should conduct regular training and drilling exercises to evaluate their local guard force’s effectiveness in searching a vehicle entering the post compound for explosive devices  According to post staff, when these important security oversight activities are not properly and regularly conducted, the level of security risk at these overseas posts may increase  According to State officials in headquarters and staff at overseas posts, as well as reporting by State’s OIG, vacancies in information management positions at overseas posts have increased the vulnerability of posts’ computer networks to potential cybersecurity attacks and other malicious threats  State officials told us that the Foreign Service had faced chronic shortages of information management staff available to fill these positions worldwide  According to State officials, because of ongoing information management vacancies, some required tasks—such as conducting planned network maintenance—were performed infrequently or not at all  In another example, staff at overseas posts said that because of vacancies, information management staff had been unable to regularly check their computer system logs to ensure that security breaches had not taken place  Post staff added that, if a breach did occur, vacancies could increase the amount of time needed to identify an attack and deploy countermeasures, further increasing the risks to posts’ computer networks  Inspections conducted by State’s OIG from fall 2014 to spring 2016 found that information management staff at 33 percent of overseas posts had not performed various required information management duties  According to State’s OIG, neglect of these duties may leave the department vulnerable to increased cybersecurity attacks  According to staff at overseas posts, the office management specialist position at overseas posts has evolved considerably over time; these specialists increasingly play a critical role in ensuring that the work of overseas posts is effectively completed  Post staff said that office management specialists provide administrative and other support services to other Foreign Service employees and are assigned to various sections of post  For example, staff at one post noted that office management specialists assigned to the Security Officer sections at overseas posts reduce the workload of security officers by completing more routine security tasks and allowing the security officers to focus on more challenging or involved tasks necessary to secure overseas posts  Post staff told us that vacancies in office management specialist positions reduce the amount of work that can be completed by other Foreign Service employees at overseas posts  For example, when office management specialist positions assigned to the Security Officer or Information Management sections of posts are vacant, these vacancies further exacerbate the higher number of vacancies that already exist in these sections  According to staff at overseas posts, higher numbers of office management specialist vacancies require other Foreign Service employees to spend a significant amount of time on administrative tasks, reducing the amount of time these staff can spend on mission-critical activities  Officials in headquarters and at overseas posts described various State efforts to help address overseas Foreign Service vacancies  According to State officials, Foreign Service vacancies at overseas posts are a complex problem that multiple offices within State address on an individual basis  State’s various efforts to address overseas Foreign Service vacancies are not guided by an integrated action plan to reduce persistent vacancies  Our 2017 High-Risk Series report calls for agencies to, among other things, design and implement action plan strategies for closing skills gaps  The action plan should (1) define the root cause of all skills gaps within an agency and (2) provide suggested corrective measures, including steps necessary to implement solutions  This report also emphasizes the high risk that mission-critical skills gaps in the federal workforce pose to the nation  While various State offices have implemented the efforts we identified, State lacks an action plan that is integrated—or consolidated—across its relevant offices to guide its efforts to address persistent overseas Foreign Service vacancies  Moreover, some staff at overseas posts acknowledged that the efforts State has taken to help address vacancies have not reduced persistent Foreign Service vacancies, notably in specialist positions  In response to our inquiry about an action plan, State officials said that the agency does not have a single document that addresses Foreign Service staffing gaps at overseas posts  Instead, State officials directed us to State’s Five Year Workforce Plan: Fiscal Years 2016-2020, stating that it was the most comprehensive document that outlines State’s efforts to address Foreign Service vacancies at overseas posts  The workforce plan notes that it provides a framework to address State’s human capital requirements and highlights State’s challenges and achievements in recruiting, hiring, staffing, and training Foreign Service staff  However, in reviewing the portions of the workforce plan that State indicated were most relevant, we found that the workforce plan does not include an integrated action plan that defines the root causes of the persistent overseas Foreign Service vacancies we identified or suggest corrective measures to reduce vacancies in these positions, including steps necessary to implement solutions  State officials also noted that they frequently meet to discuss and address workforce issues  For example, they said they convene a multi-bureau planning group that meets biweekly to discuss strategic workforce issues such as hiring needs based on attrition and other issues  However, according to State officials, this group has not developed an action plan to reduce persistent Foreign Service vacancies at overseas posts  State lacks an integrated action plan to guide its efforts to address persistent Foreign Service vacancies that includes corrective measures to address the root causes of the vacancies  Without defining the root causes of persistent Foreign Service vacancies at overseas posts and identifying appropriate corrective measures, overseas vacancies may persist and continue to adversely affect State’s ability to achieve U S  foreign policy goals  Foreign Service generalists and specialists at overseas posts are critical to advancing U S  foreign policy and economic interests abroad  However, for at least a decade, the Foreign Service has had persistent vacancies in both generalist and specialist positions at overseas posts  In particular, large numbers of vacant positions have persisted over time in certain overseas Foreign Service positions, such as information management and security officer positions  These vacancies in critical positions at overseas posts have adversely affected State’s ability to carry out its mission effectively and threaten State’s ability to ensure the security and safety of its employees, their families, and post facilities  While State has made some efforts to address Foreign Service vacancies, addressing chronic vacancies in critical positions at overseas posts requires a thoughtful, coherent, and integrated action plan that defines the root causes of persistent Foreign Service vacancies at overseas posts along with suggested corrective measures to reduce such vacancies, following what was called for in our 2017 High-Risk Series report  Developing such an action plan would help State address its persistent staffing gaps, improve its ability to achieve U S  foreign policy goals, and help ensure secure and efficient operations  The Secretary of State should develop an integrated action plan that defines the root causes of persistent Foreign Service vacancies at overseas posts and provides suggested corrective measures to reduce such vacancies, including steps necessary to implement solutions  (Recommendation 1) We provided a draft of this report to State for review and comment  In its comments, reproduced in appendix III, State concurred with our recommendation  State also noted that it has taken actions and identified some causes of vacancies, but acknowledged that it lacks an integrated action plan and will take steps to develop such a plan  State also provided technical comments, which we incorporated as appropriate  We are sending copies of this report to the appropriate congressional committees, the Secretary of State, and other interested parties  In addition, the report is available at no charge on the GAO website at http://www gao gov  If you or your staff have any questions about this report, please contact me at (202) 512-6881 or bairj@gao gov  Contact points for our Offices of Congressional Relations and Public Affairs may be found on the last page of this report  GAO staff who made key contributions to this report are listed in appendix IV  This report examines (1) vacancies in the Department of State’s (State) Foreign Service staffing at overseas posts, (2) reported effects of Foreign Service vacancies on diplomatic readiness, and (3) State’s efforts to address Foreign Service vacancies  To address these three objectives, we interviewed State officials from the department’s Bureau of Human Resources and Bureau of Consular Affairs as well as State officials representing the Offices of the Executive Director for State’s six regional bureaus  We also interviewed staff at 10 overseas posts  We conducted in-person interviews with staff at 3 of these posts—the U S  Embassy in Beijing and the U S  Consulate in Shanghai, China, and the U S  Embassy in New Delhi, India  We conducted telephone interviews with staff at the other 7 posts—the U S  Embassies in Abuja, Nigeria; Bogota, Colombia; Kinshasa, Democratic Republic of the Congo; Kabul, Afghanistan; Mexico City, Mexico; and N’Djamena, Chad; and the U S  Consulate in Frankfurt, Germany  We used the following criteria to select overseas posts for interviews: (1) posts with larger numbers of Foreign Service vacancies; (2) posts with diversity in the types of Foreign Service positions that were vacant; (3) posts with higher relative importance to U S  economic, national security, and other foreign policy interests; and (4) posts in a range of geographic locations by State region  To examine vacancies in State’s Foreign Service staffing at overseas posts, we analyzed State’s personnel data on Foreign Service staffing at overseas posts from the department’s Global Employment Management System (GEMS), as of March 2018  Our analysis of the GEMS data includes Foreign Service positions filled by permanent Foreign Service employees as well as positions filled by nonpermanent Foreign Service employees, such as Consular Fellows  This analysis does not include the number of staffed and vacant positions at overseas posts in Libya, Syria, and Yemen, which, at the time of our review, were in suspended operations status, as well as U S  Mission Somalia, which was operating under special circumstances at a different location  To calculate vacancy rates, we divided the total number of positions by the number of positions listed as vacant in GEMS  For example, a post with 10 positions and 2 vacancies would have a vacancy rate of 20 percent  We calculated vacancy rates for each of the following categories: type (i e , generalist or specialist), function (e g , consular or information management), regional bureau (i e , Bureau of African Affairs or Bureau of Western Hemisphere Affairs), and embassy and nonembassy rankings from State’s Overseas Staffing Model (i e , Embassy 3+ or 5)  According to State officials, the data in GEMS have a number of limitations: The number of vacant positions at overseas posts listed in GEMS may be overstated, because State has not yet decided to remove some of these positions from its database  Some of the vacancies in GEMS are short-term or temporary  Foreign Service employees periodically rotate out of their positions at their overseas posts, sometimes creating temporary vacancies until the positions are filled by incoming Foreign Service employees  The GEMS data show larger numbers of vacant Foreign Service positions at posts in Afghanistan, Iraq, and Pakistan than actually were unstaffed at these posts  According to State officials, this discrepancy results from State’s relying heavily on shorter-term assignments to fill Foreign Service positions at these locations  These shorter-term assignments are not reflected in GEMS, and the positions therefore appear vacant  The GEMS data may not reflect Foreign Service employees who have been temporarily reassigned from one overseas post to another  The GEMS data may show positions as filled although the Foreign Service employee filling the position has not yet arrived at post  To assess the reliability of the GEMS database, we asked State officials whether State had made any major changes to the database since our 2012 report, when we assessed the GEMS data to be sufficiently reliable  State officials indicated that no major changes had been made  We also tested the data for completeness, confirmed the general accuracy of the data with officials at selected overseas posts, and interviewed knowledgeable officials from State’s Office of Resource Management and Organizational Analysis concerning the data’s reliability  We found the GEMS data to be reliable for the purpose of determining the numbers and percentages of vacant Foreign Service positions at overseas posts  We did not validate whether the total number of authorized overseas Foreign Service positions was appropriate or met State’s needs  We also reviewed State workforce planning documents and budget documents, such as State’s Five Year Workforce and Leadership Succession Plan: Fiscal Years 2016-2020 and Quadrennial Diplomacy and Development Review  In addition, we reviewed State Office of Inspector General reports as well as our previous reports on human capital challenges at State and effective strategic human capital management across the federal government  In particular, our report High-Risk Series: Progress on Many High-Risk Areas, While Substantial Efforts Needed on Others notes that strategic human capital management is a high-risk issue across the federal government and lists five key elements as a road map for agency efforts to improve and ultimately address such issues  For our third objective, we assessed whether State’s efforts to address vacancies were guided by a corrective action plan that identifies the root causes of persistent Foreign Service vacancies at overseas posts and suggests corrective measures to reduce such vacancies, including steps necessary to implement solutions  We conducted this performance audit from August 2017 to March 2019 in accordance with generally accepted government auditing standards  Those standards require that we plan and perform the audit to obtain sufficient, appropriate evidence to provide a reasonable basis for our findings and conclusions based on our audit objectives  We believe that the evidence obtained provides a reasonable basis for our findings and conclusions based on our audit objectives  The “Economic” generalist career track includes positions from the “Science Officer” staffing skill group in the GEMS data  170 Foreign Service employees were not staffed to one of the six regional bureaus  In addition to the contact named above, Godwin Agbara (Assistant Director), Ian Ferguson (Analyst-in-Charge), Anthony Costulas, Natalia Pena, Debbie Chung, Chris Keblitis, Reid Lowe, Justin Fisher, and Alexander Welsh made key contributions to this report 

ground_truth: GAO has designated DHS management as high risk because of challenges in building a cohesive department. PLCY supports cohesiveness by, among other things, coordinating departmentwide policy and strategy. In the past, however, questions have been raised about PLCY's efficacy. In December 2016, the NDAA codified PLCY's organizational structure, roles, and responsibilities. GAO was asked to evaluate PLCY's effectiveness. This report addresses the extent to which (1) DHS established an organizational structure and processes and procedures that position PLCY to be effective, (2) DHS and PLCY have ensured alignment of workforce with priorities, and (3) PLCY has engaged relevant component staff to help identify and respond to emerging needs. GAO analyzed the NDAA, documents describing specific responsibilities, and departmentwide policies and strategies. GAO also interviewed officials in PLCY and all eight operational components. According to our analysis and interviews with operational components, the Department of Homeland Security's (DHS) Office of Strategy, Policy, and Plans' (PLCY) organizational structure and efforts to lead and coordinate departmentwide and crosscutting strategies—a key organizational objective–have been effective. For example, PLCY's coordination efforts for a strategy and policy executive steering committee have been successful, particularly for strategies. However, PLCY has encountered challenges leading and coordinating efforts to develop, update, or harmonize policies that affect multiple DHS components. In large part, these challenges are because DHS does not have clearly-defined roles and responsibilities with accompanying processes and procedures to help PLCY lead and coordinate policy in a predictable, repeatable, and accountable manner. Until PLCY's roles and responsibilities for policy are more clearly defined and corresponding processes and procedures are in place, situations where the lack of clarity hampers PLCY's effectiveness in driving policy are likely to continue. Development of a delegation of authority, which involves reaching agreement about PLCY's roles and responsibilities and clearly documenting them, had been underway. However, it stalled due to changes in department leadership. As of May 2018, the effort had been revived, but it is not clear whether and when DHS will finalize it. PLCY does some workforce planning as part of its annual budgeting process, but does not systematically apply key principles of the DHS Workforce Planning Guide to help ensure that PLCY's workforce aligns with its and DHS's priorities and goals. According to PLCY officials, the nature of its mission requires a flexible staffing approach. As such, a portion of the staff functions as generalists who can be assigned to meet the needs of different situations, including unexpected changing priorities due to an emerging need. However, shifting short-term priorities requires tradeoffs, which may divert attention and resources from longer-term priorities. As of June 5, 2018, PLCY also had a number of vacancies in key leadership positions, which further limited attention to certain priorities. According to PLCY officials, PLCY recently began a review to identify the office's authorities in the National Defense Authorization Act for Fiscal Year 2017 (NDAA) and other statutes, compare these authorities to the current organization and operations, and address any workforce capacity gaps. Employing workforce planning principles—in particular, systematic identification of workforce demand, capacity gaps, and strategies to address them—consistent with the DHS Workforce Planning Guide could better position PLCY to use its workforce as effectively as possible under uncertain conditions and to communicate effectively with DHS leadership about tradeoffs. Officials from PLCY and DHS operational components praised existing mechanisms to coordinate and communicate at the senior level, especially about strategy, but component officials identified opportunities to better connect PLCY and component staff to improve communication flow about emerging policy and strategy needs. Among the ideas offered by component officials to enhance communication and collaboration were holding routine small-group meetings, creating forums for periodic knowledge sharing, and maintaining accurate and up-to-date contact information for all staff-level stakeholders. GAO is making four recommendations. DHS concurred with three recommendations, including that DHS finalize a delegation of authority defining PLCY's roles and responsibilities and develop corresponding processes and procedures. DHS did not concur with a recommendation to apply the DHS Workforce Planning Guide to identify and communicate workforce needs. GAO believes this recommendation is valid as discussed in the report.

prompt_front: You are given two reports by the government agency.



Question: Write a one-page summary of the report 2.

Report 1: With the passage of the NDAA in December 2016, PLCY is to be led by an Under Secretary for Strategy, Policy, and Plans, who is appointed by the President with advice and consent of the Senate  The Under Secretary is to report directly to the Secretary of Homeland Security  Prior to the NDAA, the office was headed by an assistant secretary  Since the passage of the act, the undersecretary position has been vacant, and as of June 5, 2018, the President had not nominated an individual to fill the position  According to PLCY officials, elevating the head of the office to an undersecretary was important because it equalizes PLCY with other DHS management offices and DHS headquarters components  The NDAA further authorizes, but does not require, the Secretary to establish a position of deputy undersecretary within PLCY  If the position is established, the NDAA provides that the Secretary may appoint a career employee to the position (i e , not a political appointee)  In March 2018, the Secretary named a Deputy Under Secretary, who has been performing the duties of the Deputy Under Secretary and the Under Secretary since then  As shown in figure 1, PLCY is divided into five sub- offices, each with a different focus area  As of June 5, 2018, the top position in these sub-offices was an assistant secretary and two of the five positions were vacant  As of June 5, 2018, 6 of PLCY’s 12 deputy assistant secretary positions were vacant or filled by acting staff temporarily performing the duties in the absence of permanent staff placement  The NDAA codified many of the functions and responsibilities that PLCY had been carrying out prior to the act’s enactment and, with a few exceptions as discussed later in this report, were largely consistent with the duties the office was already pursuing  According to the act and PLCY officials, one of the office’s fundamental responsibilities is to lead, conduct, and coordinate departmentwide policy development and implementation, and strategic planning  According to PLCY officials, there are four categories of policy and strategy efforts that PLCY leads, conducts, or coordinates: Statutory responsibilities: among others, the Homeland Security Act, as amended by the NDAA, includes such responsibilities as establishing standards of validity and reliability for statistical data collected by the department, conducting or overseeing analysis and reporting of such data, and maintaining all immigration statistical information of U S  Customs and Border Protection, U S  Immigration and Customs Enforcement, and U S  Citizenship and Immigration Services; the Immigration and Nationality Act includes such responsibilities as providing for a system for collection and dissemination to Congress and the public of information useful in evaluating the social, economic, environmental, and demographic impact of immigration laws, and reporting annually on trends in lawful immigration flows, naturalizations, and enforcement actions, Representing DHS in interagency efforts: coordinating or representing departmental policy and strategy positions for larger interagency efforts (e g , interagency policy committees convened by the White House), Secretary’s priorities: leading or coordinating efforts that correspond to the Secretary of Homeland Security’s priorities (e g , certain immigration or law-enforcement related issues), and Self-initiated activities: opportunities to better harmonize policy and strategy or create additional efficiencies given PLCY’s ability to see across the department  For example, PLCY officials said that DHS observed an increase in e-commerce and small businesses shipping items via carriers other than the U S  Postal Service, thus exploiting a gap in DHS monitoring, which covers the U S  Postal Service and other traditional shipping entities  PLCY officials noted that DHS’s interest in addressing e-commerce issues occurred just before opioids and other controlled substances were being mailed through small businesses and the U S  Postal Service  As a result, PLCY developed an e-commerce strategy for, among other things, the shipping of illegal items and how to provide information to U S  Customs and Border Protection before parcels are shipped to the United States from abroad  In accordance with the NDAA, as PLCY leads, conducts, and coordinates policy and strategy, it is to do so in a manner that promotes and ensures quality, consistency, and integration across DHS and applies risk-based analysis and planning to departmentwide strategic planning efforts  The NDAA further provides that all component heads are to coordinate with PLCY when establishing or modifying policies or strategic planning guidance to ensure consistency with DHS’s policy priorities  In addition to the roles PLCY plays that are directly related to leading, conducting, and coordinating policy and strategy, the office is responsible for select operational functions  For example, PLCY is charged with operating the REAL ID and Visa Waiver Programs  The NDAA also conferred responsibilities to PLCY that had not been responsibilities of the DHS Office of Policy prior to the NDAA’s enactment  Among other things, the NDAA charged PLCY with responsibility for establishing standards of reliability and validity for statistical data collected and analyzed by the department, and ensuring the accuracy of metrics and statistical data provided to Congress  In conferring this responsibility, the act also transferred to PLCY the maintenance of all immigration statistical information of the U S  Customs and Border Protection, U S  Immigration and Customs Enforcement, and U S  Citizenship and Immigration Services  PLCY has established five performance goals: build departmental policy-making capacity, coordination, and foster the Unity of Effort, mature the office as a mission-oriented, component-focused organization that is responsive to DHS leadership, effectively engage and leverage stakeholders, enhance productivity and effectiveness of policy personnel through appropriate alignment of knowledge, skills, and abilities, and accountability, transparency, and leadership  PLCY officials stated that the office established the performance goals in fiscal year 2015 and they were still in effect as of fiscal year 2018  As previously discussed, DHS has eight operational components  DHS also has six support components  Although each one has a distinct role to play in helping to secure the homeland, there are operational and support functions that cut across mission areas  For example, nearly every operational component has, as part of its security operations, a need for screening, vetting, and credentialing procedures and risk- targeting mechanisms  Likewise, nearly all operational components have some form of international engagement, deploying staff abroad to help secure the homeland before threats reach U S  borders  Finally, as shown in figure 2, different aspects of broad mission areas fall under the purview of more than one DHS operational component  PLCY is responsible for coordinating three key DHS strategic efforts: the QHSR, the DHS Strategic Plan, and the Resource Planning Guidance  The QHSR is a comprehensive examination of the homeland security strategy of the nation that is to occur every 4 years and include recommendations regarding the long-term strategy and priorities for homeland security of the nation and guidance on the programs, assets, capabilities, budget, policies, and authorities of DHS  The QHSR is to be conducted in consultation with the heads of other federal agencies, key DHS officials (including the Under Secretary, PLCY), and key officials from other relevant governmental and nongovernmental entities  The DHS Strategic Plan describes how DHS can accomplish the missions it identifies in the QHSR report, identifies high-priority mission areas within DHS, and lays the foundation for DHS to accomplish its Unity of Effort Initiative as well as various cross-agency priority goals in the strategic plan, such as cybersecurity  The Resource Planning Guidance describes DHS’s annual resource allocation process in order to execute the missions and goals of the QHSR and DHS Strategic Plan  The Resource Planning Guidance contains guidance over a 5-year period and informs several forward- looking reports to Congress, including the annual fiscal year Congressional Budget Justification as well as the Future Years Homeland Security Program Report  Although PLCY has effectively carried out key coordination functions at the senior level related to strategy, PLCY’s ability to lead and coordinate policy have been limited due to ambiguous roles and responsibilities and a lack of predictable, accountable, and repeatable procedures  According to our analysis and interviews with operational components, PLCY’s efforts to lead and coordinate departmentwide and crosscutting strategies—a key organizational objective—have been effective in providing opportunities for all relevant stakeholders to learn about and contribute to departmentwide or crosscutting strategy development  In this role, PLCY routinely serves as the executive agent for the Deputies Management Action Group and the Senior Leaders Council, which involve analytical and coordination support  PLCY also provides support for deputy- and principal-level decision making  For example, the Strategy and Policy Executive Steering Committee (S&P ESC) meetings have been used to discuss components’ implementation plans for crosscutting strategies, PLCY’s requests for information from components for an upcoming strategy, and updates on departmentwide strategic planning initiatives  According to PLCY and operational component officials, PLCY also provides leadership for the Resource Planning Guidance and Winter Studies, both of which help inform departmentwide resource decision- making  For example, officials from one operational component stated that PLCY’s leadership of the Resource Planning Guidance is a helpful practice for coordination and collaboration on departmentwide or crosscutting strategies  The officials stated that PLCY reaches out to ensure that the component is covering the Secretary’s priorities and this helps the component to ensure that its budget includes them  Furthermore, PLCY develops and coordinates policy options and opinions for the Secretary to present at the National Security Council and other White House-level meetings  For example, PLCY officials told us that, in light of allegations of Russian involvement in using poisonous nerve agents on two civilians in Great Britain, PLCY coordinated the collection of information to develop a policy recommendation for the Secretary to present at a National Security Council meeting  PLCY has encountered challenges leading and coordinating efforts to develop, update, or harmonize policy—also a key organizational objective—because it does not have clearly-defined roles, responsibilities, and mechanisms to implement these responsibilities in a predictable, repeatable, and accountable way  Standards for Internal Control in the Federal Government states that management should establish an organizational structure, assign responsibility, and delegate authority to achieve the entity’s objectives  As such, an organization’s management should develop an organizational structure with an understanding of the overall responsibilities and assign these responsibilities to discrete units to enable the organization to operate in an efficient and effective manner  An organization’s management should also implement control activities through policies  It is important that an organization’s management document and define policies and communicate those policies and procedures to personnel, so they can implement control activities for their assigned responsibilities  In addition, leading collaboration practices we have identified in our prior work include defining and articulating a common outcome, clarifying roles and responsibilities, and establishing mutually-reinforcing or joint strategies to enhance and sustain collaboration, such as the work that PLCY and the components need to do together to ensure that departmentwide and crosscutting policy is effective for all relevant parties  According to PLCY officials, in general, PLCY is responsible for leading the development of a policy when it crosses multiple components or if there is a national implication, including White House interest in the policy  However, PLCY officials acknowledged that this practice does not always make them the lead and there are no established criteria that define the circumstances under which PLCY (or another organizational unit) should lead development of policies that cut across organizational boundaries  PLCY officials said the lead entity for a policy is often announced in an email from the Secretary’s office, on a case-by-case basis  According to PLCY officials, once components have been assigned responsibility for a policy, they have generally tended to retain it, and PLCY may not have oversight for crosscutting policies that are maintained by operational components  Therefore, there is no established, coordinated system of oversight to periodically monitor the need for policy harmonization, revision, or rescission  In the absence of clear roles and responsibilities, and processes and procedures to support them, PLCY and officials in 5 of the 8 components have encountered challenges in coordinating with each other  Although PLCY and most component officials we interviewed described overall positive experiences in coordinating with each other, we identified multiple instances of (1) confusion about which parties should lead and engage in policy efforts, (2) not engaging components at the right times, (3) incompatible expectations around timelines, and (4) uncertainty about PLCY’s role and the extent to which it can and should identify and drive policy in support of a more cohesive DHS  Confusion about who should lead and engage  Officials from one operational component told us that they were tasked with leading a departmentwide policy development effort they believed was outside their area of responsibility and expertise  Officials in another operational component stated that components sometimes end up coordinating among themselves, but that policy development could be more effective and efficient if PLCY took the role of convener and facilitator to ensure the departmentwide perspective is present and all relevant stakeholders participate  Officials from a third component stated that they spent significant time and resources to develop a policy directly related to their component’s mission  As the component got ready to implement the policy, PLCY became aware of it and asked the component to stop working on the policy, so PLCY could develop a departmentwide policy  According to component officials, while they were supportive of a departmentwide policy, PLCY’s timing delayed implementation of the policy the component had developed and wasted the resources it had invested  Moreover, officials from four operational components told us that sometimes counselors from outside PLCY, such as the Secretary’s office, have led policy efforts that seem like they should be PLCY’s responsibility, which created more confusion about what PLCY’s ongoing role should be  PLCY officials agreed that, at times, it has been challenging to define PLCY’s role relative to counselors for the Secretary, and acknowledged that clear guidance to define who is leading which types of policy development and coordination would be helpful  Not engaging components at the right times  Officials from 5 of 8 operational components told us that they had not always been engaged at the right times by PLCY in departmentwide or crosscutting policies that affected their missions  For example, officials from an operational component described a crosscutting policy that had significant implications for some of its key operational resources, but the component was not made aware of the policy until it was about to be presented at the White House  Officials from another component stated that they learned of a new policy after it was in place and had to find significant training and software resources to implement it even though they viewed the policy as unnecessary for their mission  PLCY officials stated that, while they intend to identify all components that should be involved in a policy, there are times when PLCY is unaware a component is developing a policy that affects other components  PLCY officials said they will involve other components when PLCY becomes aware that a component is developing such a policy  PLCY officials stated that it would be helpful to have a process and procedures for cross-component coordination on policies to help guide engagement regardless of who is developing the policy  Incompatible expectations around timelines  Officials at 4 of 8 operational components stated that short timelines from PLCY to provide input and feedback can prevent PLCY from obtaining thoughtful and complete information from components  For example, officials from one component stated that PLCY asked them to perform an analysis that would inform major, departmental decision-making and quickly provide the analysis  Component officials told us that they did not understand why PLCY needed the analysis on such an accelerated timeline, which seemed inappropriate given the level of importance and purpose of the analysis  Officials from another component told us that PLCY had not always provided enough time to provide thoughtful feedback; therefore, component officials were not sure if PLCY really wanted their feedback  Officials from a third component stated that sometimes PLCY did not provide sufficient time for thoughtful input or feedback that had cleared the component’s legal review, so component officials elected to miss PLCY’s deadline and provide late feedback  PLCY officials told us that, frequently, timelines are not within their control, a situation that some component officials also noted during our interviews with them  However, PLCY officials agreed that a documented, predictable, and repeatable process and procedures for policies may help ensure PLCY provides sufficient comment time when in its control and may provide a basis to help negotiate timelines with DHS leadership in other situations  PLCY officials stated that, even with a documented process and procedures, there would still be circumstances when short timelines are unavoidable  Uncertainty about PLCY’s role in driving policy harmonization  Policy officials at 6 of 8 operational components told us that they were unsure or not aware of PLCY’s role in harmonizing policy across the department, and stated a desire for PLCY to be more involved in harmonizing or enhancing departmentwide and crosscutting policy or for greater clarity about PLCY’s responsibility to play this role  As previously discussed, PLCY’s policy and strategy efforts fall into four categories—statutory responsibilities, interagency efforts, Secretary’s priorities, and self- initiated activities; these activities include efforts to better harmonize policies and strategies  According to PLCY officials, the category with the lowest priority is self-initiated activities  PLCY officials stated that PLCY makes tradeoffs and rarely chooses to work on self-initiated projects over its other three categories of effort  According to the officials, PLCY’s work on the other three higher-priority categories is sufficient to ensure that the office is effectively leading, conducting, and coordinating strategy and policy across the department  Given its organizational position and strategic priorities, PLCY is uniquely situated to identify opportunities to better harmonize or enhance departmentwide and crosscutting policy, a role that is in line with its strategic priority to build departmental policymaking capacity and foster Unity of Effort  In the absence of clear articulation of the department’s expectations for PLCY in this role, it is difficult for PLCY and DHS leadership to make completely informed and deliberate decisions about the tradeoffs they make across any available resources  In addition to statutory authority that PLCY received in the NDAA, PLCY officials stated that a separate, clear delegation of authority—a mechanism by which the Secretary delegates responsibilities to other organizational units within DHS—is needed to help confront the ambiguous roles it has experienced in the past  PLCY officials stated that past efforts to finalize a delegation of authority have stalled during leadership changes and that the initiative has been a lower priority, in part, due to where PLCY is in its maturation process and DHS is in its evolution into a more cohesive department under the Unity of Effort  As of May 2018, the effort had been revived, but it is not clear whether and when DHS will finalize it  According to a senior official in the Office of the Under Secretary for Management, a delegation of authority is important for PLCY  He described the creation of a delegation of authority as a process that does more than simply delegate the Secretary’s authority  He noted that defining PLCY’s roles and responsibilities in relation to other organizational units presents an opportunity to engage all relevant components and agree on appropriate roles  He said that, earlier in the organizational life of the Office of the Under Secretary for Management, it went through a process like this, which has been vital in it being able to carry out its mission  He said now that PLCY has a deputy undersecretary in place, this is a good time to restart the process to develop the delegation of authority  Until the delegation or a similar process clearly and fully articulates PLCY’s roles and responsibilities, PLCY and the operational components are likely to continue to experience limitations in collaboration on crosscutting and departmentwide policy  PLCY determines its workforce needs through the annual budget process, but systematic identification of workforce demand, capacity gaps, and strategies to address them could help ensure that PLCY’s workforce aligns with its and DHS’s priorities and goals  To determine its workforce needs each year, PLCY officials told us that, as part of the annual budget cycle, they work with PLCY staff and operational components to determine the scope of activities required for each PLCY area of responsibility and the associated staffing needs  PLCY officials said there are three skill sets needed to carry out the office’s responsibilities: policy analysis, social science analysis, and regional affairs analysis  PLCY officials explained that the office’s priorities can change rapidly as events occur and the Secretary’s and administration’s priorities shift  Therefore, according to PLCY officials, their staffing model must be flexible  They said that, rather than a defined system of full-time equivalents with set position types and levels, PLCY officials start with their budget allotment and consider current and potential emerging needs to set position types and levels, which may fluctuate significantly from year to year  In addition, PLCY officials stated that PLCY staff are primarily generalists and, given the versatility in skill sets of their workforce, PLCY has a lot of flexibility to move staff around if there is an emerging need  For example, if there is an emerging law enforcement issue that affects all law enforcement agencies, PLCY may be tasked with developing a policy to ensure the issue is addressed quickly and that the resulting policy is harmonized across the department and with other law enforcement agencies, such as the Department of Justice  While PLCY completes some workforce planning activities as part of its annual budgeting process, PLCY does not systematically address several aspects of the DHS Workforce Planning Guide that may create more efficient operations and greater alignment with DHS priorities  According to the DHS Workforce Planning Guide, workforce planning is a process that ensures the right number of people with the right skills are in the right jobs at the right time for DHS to achieve the mission  This process provides a framework to: align workforce planning to the department’s mission and goals, predict, then assess how evolving missions, new processes, or environmental conditions may impact the way that work will be performed at DHS in the future, identify gaps in capacity, develop and implement strategies and action plans to address capacity and capability gaps, and continuously monitor the effectiveness of action plans and modify, as necessary  The DHS Workforce Planning Guide stipulates that an organization’s management should not only lead and show support during the workforce planning process, but ensure alignment with the strategic direction of the agency  Moreover, Standards for Internal Control in the Federal Government states that management should use quality information to achieve the entity’s objectives  For example, management uses an entity’s operational processes to make informed decisions and evaluate the entity’s performance in achieving key agency objectives  According to PLCY officials, the current staffing paradigm involves shifting the office’s staff when new and urgent issues arise from the Secretary or White House, and adding these unexpected tasks to staff’s existing responsibilities  However, this means that tradeoffs are made, resulting in some priority items taking longer to address or not getting attention at all  PLCY officials stated that they have been caught off-guard at times by changes in demands placed on PLCY and had to scramble to address the new needs  Additionally, PLCY officials said they have a number of vacancies, which hamper the office’s ability to meet certain aspects of its mission  For example, PLCY’s Office of Cyber, Infrastructure, and Resilience was created in 2015  According to PLCY officials, PLCY has had some resources to address cyber issues, however, there has not been funding to staff this office and an assistant secretary has not been appointed to lead it  Therefore, PLCY officials stated that PLCY has not been able to address its responsibilities for infrastructure resilience  Similarly, PLCY has limited capacity for risk analysis  A provision of the NDAA provides that PLCY is to: develop and coordinate strategic plans and long-term goals of the department with risk-based analysis and planning to improve operational mission effectiveness, including consultation with the Secretary regarding the quadrennial homeland security review under section 707 [6 U S C  § 347]  However, PLCY officials acknowledged that their focus on identifying needs for risk analyses and conducting them has been limited, in part, because DHS disbanded the risk management office  Officials from one component told us that they contribute to a report that PLCY coordinates, called Homeland Security National Risk Characteristics, which is prepared as a precursor to the DHS Strategic Plan  PLCY officials stated that, outside of these foundational documents and some risk-based analyses completed as part of specific policy development efforts, PLCY does not have the capacity to complete any additional risk analysis activities  Although PLCY officials said they conduct some analysis of potential demands as a starting point for how to allocate PLCY’s annual staffing budget, these efforts are largely informal and internal and have not resulted in a systematic analysis that provides PLCY and DHS management with the information they need to understand the effects of resource tradeoffs  Also, PLCY officials said they track accomplishments toward PLCY’s strategic priorities as part of a weekly meeting and report, however, officials acknowledged they do not analyze what role workforce decisions have played in achieving or not achieving strategic priorities  Moreover, although PLCY officials stated that they have intermittent, in- person, informal communication about resource use, they have not used the principles outlined in the DHS Workforce Planning Guide to systematically identify and communicate workforce demands, capacity gaps, and strategies to address workforce issues  According to PLCY officials, they have not conducted such analysis, in part, because the Secretary’s office has not requested it of them or the other DHS offices that are funded in the same part of the DHS budget  Regardless of whether the Secretary expects workforce analysis as part of the budgeting process, the DHS Workforce Planning Guide could be used within and outside of the budgeting process to help inform resource decision making throughout the year  PLCY officials stated that at the PLCY Deputy Under Secretary’s initiative, they recently began a review of all relevant statutory authorities, which they will map against the current organizational structure and day- to-day operations  The Deputy Under Secretary plans to use the results of the review to enhance PLCY’s efficiency and effectiveness, and the results could serve as a foundation for a more holistic and systematic analysis of workforce demand, any capacity gaps, and strategies to address them  Employing workforce planning principles—in particular, systematic identification of workforce demand, capacity gaps, and strategies to address them—consistent with the DHS Workforce Planning Guide could better position PLCY to use its workforce as effectively as possible under uncertain conditions  Moreover, using the DHS guide would help PLCY to systematically communicate information about any workforce gaps to DHS leadership, so there is transparency about how workforce tradeoffs affect PLCY’s ability to support DHS goals  As discussed earlier, officials from PLCY and DHS operational components praised existing mechanisms to coordinate and communicate at the senior level, especially about strategy  However, component officials identified opportunities for PLCY to better connect at the staff level to identify and respond to emerging policy and strategy needs  Leading practices for collaboration that we have identified in our prior work state that it is important to ensure that all relevant participants have been included in a collaborative effort, and positive working relationships among participants from different agencies or offices can bridge organizational cultures  These relationships build trust and foster communication, which facilitate collaboration  Also, as previously stated, PLCY has mechanisms like the S&P ESC to communicate and coordinate with operational components and other DHS stakeholders at the senior level (e g , Senior Executive Service officials)  However, PLCY does not have a mechanism to effectively engage in routine communication and collaboration at the staff level (e g , program and policy specialists working at operational components to oversee or implement policy and strategy functions)  Specifically, officials with responsibility for policy and strategy at 6 of 8 operational components told us that they did not have regular contact with or know who to contact at PLCY for questions about policies or strategies, or that the reason they knew who to contact was because of existing working relationships, not because of efforts PLCY had undertaken to facilitate such contacts  In addition, some component officials noted that, when they tried to use the PLCY website to coordinate, they found it to be out of date and lacking sufficient information  PLCY officials acknowledged that the website needs improvement  They stated that the office has developed improved content for the website, but does not have the necessary staff to update the website  According to the officials, the needed staff should be hired soon and improved content should be on the website by the end of summer 2018  Although officials at 5 of the 8 operational components we interviewed stated that the quality of PLCY’s coordination and collaboration has improved in the past 2 years or so, component officials offered several suggestions to enhance PLCY’s coordination and collaboration, especially at the staff level  Among these were: conduct routine information sharing meetings with staff-level officials who have policy and strategy responsibilities at each operational component, clearly articulate points of contact, their contact information, and their portfolios at PLCY as well as at other policy and strategy stakeholders, ensure the PLCY website is up-to-date with contact information for PLCY and components that work in strategy and policy areas, and with relevant information about crosscutting strategy and policy initiatives underway, host a forum—such as an annual conference—to bring together policy and strategy officials from PLCY and DHS components to share ideas and make contacts, and prepare a standard briefing for component officials with strategy and policy responsibilities to help ensure that staff at all levels understand what PLCY does, how it works, and opportunities for engagement on emerging policy and strategy needs or identified harmonization opportunities  For example, officials from one component told us that they would like PLCY officials to have in-person meetings with component staff to discuss what PLCY does, who to contact in PLCY, where to find information about policies and strategies, and other relevant information to ensure a smooth working relationship between the component and PLCY  According to PLCY officials, the office recognizes the value of creating mechanisms to connect staff, who work on policy and strategy at all levels in DHS  PLCY officials said they have historically done a better job in coordinating at the senior level, but are interested in expanding opportunities to connect other staff with policy and strategy responsibilities  PLCY officials stated that they are considering creating a working group structure that mirrors existing organizational mechanisms to coordinate at the senior level, but have not taken steps to do so  Routine collaboration among PLCY, operational components, and other DHS offices at the staff level is important to ensure that PLCY is able to carry out its functions under the NDAA, including the effective coordination of policies and strategies  A positive working relationship among these stakeholders can build trust, foster communication, and facilitate collaboration  Such enhanced communication and collaboration across PLCY and among component officials with policy and strategy responsibility could help the department more quickly and completely identify emerging, crosscutting strategy and policy needs and opportunities to enhance policy harmonization  PLCY’s efforts to lead, conduct, and coordinate departmentwide and crosscutting policies have sometimes been hampered by the lack of clearly-defined roles and responsibilities  In addition, PLCY does not have a consistent process and procedures for its strategy development and policymaking efforts  Without a delegation of authority or similar documentation from DHS leadership clearly articulating PLCY’s missions, roles, and responsibilities—along with defined processes and procedures to carry them out in a predictable and repeatable manner—there is continuing risk that confusion and uncertainty about PLCY’s authority, missions, roles, and responsibilities will limit its effectiveness  PLCY employs some workforce planning, but does not systematically apply key principles of the DHS Workforce Planning Guide to help predict workforce demand, and identify any workforce gaps and design strategies to address them  Without this analysis, PLCY faces limitations in ensuring that its workforce is aligned with its and DHS’s priorities and goals  Moreover, the results of this analysis would better position PLCY to communicate to DHS leadership any potential tradeoffs in workforce allocation that would affect PLCY’s ability to meet priorities and goals  PLCY could enhance its use of mechanisms for collaboration and communication with DHS stakeholders at the staff level  Implementation of additional mechanisms at the staff level for regular communication and coordination, including providing up-to-date information to stakeholders about the office, could help PLCY and operational components to better connect in order to identify and address emerging policy and strategy needs  We are making the following four recommendations to DHS: The Secretary of Homeland Security should finalize a delegation of authority or similar document that clearly defines PLCY’s mission, roles, and responsibilities relative to DHS’s operational and support components  (Recommendation 1) The Secretary of Homeland Security should create corresponding processes and procedures to help implement the mission, roles, and responsibilities defined in the delegation of authority or similar document to help ensure predictability, repeatability, and accountability in departmentwide and crosscutting strategy and policy efforts  (Recommendation 2) The Under Secretary for Strategy, Policy, and Plans should use the DHS Workforce Planning Guide to help identify and analyze any gaps in PLCY’s workforce, design strategies to address any gaps, and communicate this information to DHS leadership  (Recommendation 3) The Under Secretary for Strategy, Policy, and Plans should enhance the use of collaboration and communication mechanisms to connect with staff in the components with responsibilities for policy and strategy to better identify and address emerging needs  (Recommendation 4) We provided a draft of this report for review and comment to DHS  DHS provided written comments, which are reproduced in appendix I  DHS also provided technical comments, which we incorporated, as appropriate  DHS concurred with three of our recommendations and described actions planned to address them  DHS did not concur with one recommendation  Specifically, DHS did not concur with our recommendation that PLCY should use the DHS Workforce Planning Guide to help identify and analyze any gaps in PLCY’s workforce, design strategies to address any gaps, and communicate this information to DHS leadership  The letter described a number of actions, including actions that are also described in the report, which PLCY takes to help ensure alignment of its staff with organizational needs  In the letter, PLCY officials pointed to the workforce activities PLCY undertakes as part of the annual budgeting cycle  We acknowledge that the actions described to predict upcoming priorities and resource needs as part of the annual budgeting cycle are in line with the DHS workforce planning principles  However, as we noted, there are opportunities to apply the workforce planning principles outside the annual budgeting cycle to provide greater visibility and awareness of resource tradeoffs to management inside PLCY and in the Secretary’s office  In the letter, PLCY officials made note of the dynamic and changing nature of its operational environment, stating that it often required them to shift resources and priorities on a more frequent or ad hoc basis than many organizations  We acknowledged in the report that PLCY’s operating environment requires it to maintain flexibility in its staffing approach  However, PLCY has a number of important duties, including helping foster Unity of Effort throughout the department and helping to ensure the availability of risk information for departmental decision making, that require longer-term, sustained attention and strategic management  During interviews, PLCY officials acknowledged that striking a balance between these needs has been difficult and at times they have faced significant struggles  The report describes some areas where, during the time we were conducting our work, it was clear that some tasks and functions, such as risk analyses, lacked the resources or focus necessary to ensure they received sustained institutional attention  It is because of PLCY’s dynamic operating environment, coupled with the need for sustained institutional attention to other key responsibilities, that we recommended PLCY undertake workforce planning activities that would help generate better information for PLCY and DHS management to have full visibility and awareness of gaps and resource tradeoffs  Finally, the letter stated that because PLCY is a very small and flat organization, it is able to identify capacity gaps and develop action plans without obtaining all of the data collected through each recommended element, worksheet, form, and template of the model proposed in the DHS Workforce Planning Guide  We acknowledge that it would be counterproductive for PLCY to engage in data collection and analysis that are significantly more elaborate than its planning needs  Nevertheless, we continue to believe that PLCY could use the principles more robustly, outside the annual budgeting process, to help ensure that it identifies and communicates the effect that resource tradeoffs have on its ability to accomplish its multifaceted mission  We are sending copies of this report to the appropriate congressional committees and the Secretary of Homeland Security  In addition, the report is available at no charge on the GAO website at http://www gao gov  If you or your staff have any questions concerning this report, please contact me at (404) 679-1875 or CurrieC@gao gov  Contact points for our Offices of Congressional Relations and Public Affairs may be found on the last page of this report  GAO staff who made significant contributions to this report are listed in Appendix II  In addition to the contact named above, Kathryn Godfrey (Assistant Director), Joseph E  Dewechter (Analyst-in-Charge), Michelle Loutoo Wilson, Ricki Gaber, Dominick Dale, Thomas Lombardi, Ned Malone, David Alexander, Sarah Veale, and Michael Hansen made key contributions to this report 


Report 2:  CMS has taken steps to identify some fraud risks through several control activities that target areas the agency has designated as higher risk within Medicare and Medicaid, including specific provider types, such as home health agencies, and specific geographic locations  As discussed earlier, CMS officials told us that CPI initially focused on developing control activities for Medicare FFS and considers these activities to be the most mature of all CPI efforts to address fraud risks  CMS has identified fraud risks in the following selected examples, which are not an exhaustive list of its control activities  Data analytics to assist investigations in Medicare FFS  In 2011, CMS implemented FPS, a data-analytic system that screens all Medicare FFS claims to identify health-care providers with suspect billing patterns for further investigation  Medicare FFS contractors—ZPICs and UPICs— have used FPS to identify and prioritize leads for investigations of potential fraud by high-risk Medicare FFS providers  Contractors told us that FPS allows them to quickly identify and triage leads  CMS’s guidance requires contractors to prioritize investigations with the greatest program impact or urgency and identifies required criteria for prioritizing investigations, such as patient abuse or harm, multistate fraud, and high dollar amount of potential overpayments  One contractor we interviewed developed a risk-prioritization model that incorporated CMS’s required criteria, such as patient harm, as well as additional criteria, such as provider spikes in billing, into a tool that automatically creates a provider risk score to help the contractor focus and prioritize investigative resources  Prior authorization for Medicare FFS services or supplies  CMS published a final rule in December 2015 that identifies a master list of durable medical equipment, prosthetics, orthotics, and supplies for which CMS can require prior authorization before suppliers submit a Medicare FFS claim  In this rule, CMS identified 135 items that are frequently subject to unnecessary utilization and stated that the agency expects the final rule to result in savings in the form of reduced unnecessary utilization, fraud, waste, and abuse  Under this program, prior authorization is a condition of payment for claims  CMS can choose which items on the master list to subject to prior authorization  For example, in March 2017, it began requiring prior authorization for selected power wheelchairs in four states and expanded the prior authorization program for these items to all states in July 2017  CMS also began to test the use of prior authorization on a voluntary basis through a series of fixed-length demonstrations for items and services that have been associated with high levels of improper payments, including high incidences of fraud in some cases, and unnecessary utilization in certain geographic areas  For example, CMS began implementing a voluntary prior authorization demonstration in September 2012 for other power mobility devices, such as power scooters, in seven states where historically there has been extensive evidence of fraud and improper payments  CMS expanded the demonstration to an additional 12 states in October 2014, for a total of 19 states  According to the initial Federal Register notice, CMS planned to use the demonstration to develop improved methods for investigation and prosecution of fraud to protect federal funds from fraudulent actions and the resulting improper payments  Under the demonstration, providers and suppliers are encouraged—but not required—to submit a request for prior authorization for certain items before they provide the item to the beneficiary and submit a claim for payment  Revised provider screening and enrollment processes for Medicare FFS and Medicaid FFS  In response to PPACA, in 2011 CMS implemented a revised screening process for providers and suppliers who enroll in Medicare and Medicaid based on identified provider risk categories  CMS placed all Medicare provider and supplier types into one of three risk categories—limited, moderate, or high—based on its assessment of the potential risk of fraud, waste, and abuse each provider and supplier type poses  For example, CMS designated prospective (newly enrolling) home health agencies and prospective suppliers of durable medical equipment, prosthetics, orthotics, and supplies in the high-risk category  According to the final rule and our interviews with CMS officials, CMS developed these risk-based categories based on its review and synthesis of various information sources about the fraud risks posed by each provider and supplier type, including (1) the agency’s experience with claims data used to identify potentially fraudulent billing practices, (2) expertise of contractors responsible for investigating and identifying Medicare fraud, and (3) GAO and OIG reports  CMS designated specific screening activities for each risk category, with increased requirements for moderate- and high-risk provider and supplier types  For example, moderate- and high-risk providers and suppliers must receive preenrollment site visits, and high-risk providers and suppliers also are subject to fingerprint-based criminal-background checks  As part of the revised screening process, beginning in September 2011, CMS also undertook its first program-wide effort to rescreen, or revalidate, the enrollment records of about 1 5 million existing Medicare FFS providers and suppliers, to determine whether they remain eligible to bill Medicare  Temporary provider enrollment moratoriums for certain providers and geographic areas for Medicare FFS and Medicaid FFS  CMS identified certain provider types and geographic areas as high risk for fraud and used its authority under PPACA to implement temporary moratoriums to suspend enrollment of such Medicare and Medicaid providers in those areas  For example, in July 2016, CMS extended temporary moratoriums statewide on the enrollment of new Medicare Part B nonemergency ambulance suppliers and Medicare home health agencies statewide in six states, as applicable  The statewide moratoriums also apply to Medicaid  According to the Federal Register notice, CMS imposed the temporary moratoriums based on qualitative and quantitative factors suggesting a high risk of fraud, waste, or abuse, such as law-enforcement expertise with emerging fraud trends and investigations  CMS’s data analysis also confirmed the agency’s determination of a high risk of fraud, waste, and abuse for these provider and supplier types within certain geographic areas, according to the notice  Medicaid state program integrity reviews and desk reviews  CMS tailored state Medicaid program-integrity reviews to areas it identified as high risk for improper payments, such as personal care services, which may also be at high risk for fraud  In March 2017, we reported that, from fiscal years 2014 through 2016, CMS conducted focused reviews of state program-integrity efforts in 31 states, reviewing 10 or 11 states annually  For each state, CMS tailored its focused reviews to the state’s managed care plans and relevant other high-risk areas, including provider enrollment and screening, nonemergency medical transportation, and personal care services  CMS and state officials we spoke with as part of that work told us that the tailored oversight had been beneficial and helped identify areas for improvement  CMS has also initiated desk reviews of state program-integrity efforts  According to CMS, these desk reviews allow the agency to provide states with customized program- integrity oversight  Vulnerability tracking system for Medicare  CPI recently initiated an effort to centralize and formalize a vulnerability tracking process for Medicare, which could support identification of specific fraud risks, both in Medicare and possibly Medicaid  As described by CPI officials, the process aims to collect information on fraud-related vulnerabilities from CMS employees, contractors, and other sources, such as GAO and HHS OIG reports  The assess component of the Fraud Risk Framework calls for federal managers to plan regular fraud risk assessments and assess risks to determine a fraud risk profile  Furthermore, federal internal control standards call for agency management to assess the internal and external risks their entities face as they seek to achieve their objectives  The standards state that, as part of this overall assessment, management should consider the potential for fraud when identifying, analyzing, and responding to risks  The Fraud Risk Framework states that, in planning the fraud risk assessment, effective managers tailor the fraud risk assessment to the program by, among other things, identifying appropriate tools, methods, and sources for gathering information about fraud risks and involving relevant stakeholders in the assessment process  Fraud risk assessments that align with the Fraud Risk Framework involve (1) identifying inherent fraud risks affecting the program, (2) assessing the likelihood and impact of those fraud risks, (3) determining fraud risk tolerance, (4) examining the suitability of existing fraud controls and prioritizing residual fraud risks, and (5) documenting the results  (See fig  6 ) Although, as discussed earlier, CMS has identified some fraud risks posed by providers in Medicare FFS and, to a lesser degree, Medicaid FFS, the agency has not conducted a fraud risk assessment for either the Medicare or Medicaid program  Such a risk assessment would provide the detailed information and insights needed to create a fraud risk profile, which, in turn, is the basis for creating an antifraud strategy  According to CMS officials, CMS has not conducted a fraud risk assessment for Medicare or Medicaid because, within CPI’s broader approach of preventing and eliminating improper payments, its focus has been on addressing specific vulnerabilities among provider groups that have shown themselves particularly prone to fraud, waste, and abuse  With this approach, however, it is unlikely that CMS will be able to design and implement the most-appropriate control activities to respond to the full portfolio of fraud risks  A fraud risk assessment consists of discrete activities that build upon each other  Specifically: Identifying inherent fraud risks affecting the program  As discussed earlier, CMS has taken steps to identify fraud risks  However, CMS has not used a process to identify inherent fraud risks from the universe of potential vulnerabilities facing Medicare and Medicaid programs, including threats from various sources  According to CPI officials, most of the agency’s fraud control activities are focused on fraud risks posed by providers  The Fraud Risk Framework discusses fully considering inherent fraud risks from internal and external sources in light of fraud risk factors such as incentives, opportunities, and rationalization to commit fraud  For example, according to CMS officials, the inherent design of the Medicare Part C program may pose fraud risks that are challenging to detect  A fraud risk assessment would help CMS identify all sources of fraudulent behaviors, beyond threats posed by providers, such as those posed by health-insurance plans, contractors, or employees  Assessing the likelihood and impact of fraud risks and determining fraud risk tolerance  CMS has taken steps to prioritize fraud risks in some areas, but it has not assessed the likelihood or impact of fraud risks or determined fraud risk tolerance across all parts of Medicare and Medicaid  Assessing the likelihood and impact of inherent fraud risks would involve consideration of the impact of fraud risks on program finances, reputation, and compliance  Without assessing the likelihood and impact of risks in Medicare or Medicaid or internally determining which fraud risks may fall under the tolerance threshold, CMS cannot be certain that it is aware of the most-significant fraud risks facing these programs and what risks it is willing to tolerate based on the programs’ size and complexity  Examining the suitability of existing fraud controls and prioritizing residual fraud risks  CMS has not assessed existing control activities or prioritized residual fraud risks  According to the Fraud Risk Framework, managers may consider the extent to which existing control activities—whether focused on prevention, detection, or response—mitigate the likelihood and impact of inherent risks and whether the remaining risks exceed managers’ tolerance  This analysis would help CMS to prioritize residual risks and to determine mitigation approaches  For example, CMS has not established preventive fraud control activities in Medicare Part C  Using a fraud risk assessment for Medicare Part C and closely examining existing fraud control activities and residual risks, CMS could be better positioned to address fraud risks facing this growing program and develop preventive control activities  Further, without assessing existing fraud control activities and prioritizing residual fraud risks, CMS cannot be assured that its current control activities are addressing the most-significant risks  Such analysis would also help CMS determine whether additional, preferably preventive, fraud controls are needed to mitigate residual risks, make adjustments to existing control activities, and potentially scale back or remove control activities that are addressing tolerable fraud risks  Documenting the risk-assessment results in a fraud risk profile  CMS has not developed a fraud risk profile that documents key findings and conclusions of the fraud risk assessment  According to the Fraud Risk Framework, the risk profile can also help agencies decide how to allocate resources to respond to residual fraud risks  Given the large size and complexity of Medicare and Medicaid, a documented fraud risk profile could support CMS’s resource-allocation decisions as well as facilitate the transfer of knowledge and continuity across CMS staff and changing administrations  Senior CPI officials told us that the agency plans to start a fraud risk assessment for Medicare and Medicaid after it completes a separate fraud risk assessment of the federally facilitated marketplace  This fraud risk assessment for the federally facilitated marketplace eligibility and enrollment process is being conducted in response to a recommendation we made in February 2016  In April 2017, CPI officials told us that this fraud risk assessment was largely completed, although in September 2017 CPI officials told us that the assessment was undergoing agency review  CPI officials told us that they have informed CM and CMCS officials that there will be future fraud risk assessments for Medicare and Medicaid; however, they could not provide estimated timelines or plans for conducting such assessments, such as the order or programmatic scope of the assessments  Once completed, CMS could use the federally facilitated marketplace fraud risk assessment and apply any lessons learned when planning for and designing fraud risk assessments for Medicare and Medicaid  According to the Fraud Risk Framework, factors such as size, resources, maturity of the agency or program, and experience in managing risks can influence how the entity plans the fraud risk assessment  Additionally, effective managers tailor the fraud risk assessment to the program when planning for it  The large scale and complexity of Medicare and Medicaid as well as time and resources involved in conducting a fraud risk assessment underscore the importance of a well-planned and tailored approach to identifying the assessment’s programmatic scope  Planning and tailoring may involve decisions to conduct a fraud risk assessment for Medicare and Medicaid programs as a whole or divided into several subassessments to reflect their various component parts (e g , Medicare FFS, Medicaid managed care) as well as determining the timing and order of assessments (e g , concurrently or consecutively for Medicare and Medicaid)  CMS’s existing fraud risk identification efforts as well as communication channels with stakeholders could serve as a foundation for developing a fraud risk assessment for Medicare and Medicaid  The leading practices identified in the Fraud Risk Framework discuss the importance of identifying appropriate tools, methods, and sources for gathering information about fraud risks and involving relevant stakeholders in the assessment process  CMS’s fraud risk identification efforts discussed earlier could provide key information about fraud risks and their likelihood and impact  Further, existing relationships and communication channels across CMS and its extensive network of stakeholders could support building a comprehensive understanding of known and potential fraud risks for the purposes of a fraud risk assessment  For example, the fraud vulnerabilities identified through data analysis and information sharing with states, health-insurance plans, law-enforcement organizations, and contractors through the HFPP could inform a fraud risk assessment  CPI’s Command Center missions—facilitated collaboration sessions that bring together experts from various disciplines to improve the processes for fraud prevention in Medicare and Medicaid—could bring together experts to identify potential or emerging fraud vulnerabilities or to brainstorm approaches to mitigate residual fraud risks  As CMS makes plans to move forward with a fraud risk assessment for Medicare and Medicaid, it will be important to consider the frequency with which the fraud risk assessment would need to be updated  While, according to the Fraud Risk Framework, the time intervals between updates can vary based on the programmatic and operating environment, assessing fraud risks on an ongoing basis is important to ensure that control activities are continuously addressing fraud risks  The constantly evolving fraud schemes, the size of the programs in terms of beneficiaries and expenditures, as well as continual changes in Medicare and Medicaid programs—such as development of innovative payment models and increasing managed-care enrollment—call for constant vigilance and regular updates to the fraud risk assessment  The design and implement component of the Fraud Risk Framework calls for federal managers to design and implement a strategy with specific control activities to mitigate assessed fraud risks and collaborate to help ensure effective implementation  According to the Fraud Risk Framework, effective managers develop and document an antifraud strategy that describes the program’s approach for addressing the prioritized fraud risks identified during the fraud risk assessment, also referred to as a risk-based antifraud strategy  A risk- based antifraud strategy describes existing fraud control activities as well as any new fraud control activities a program may adopt to address residual fraud risks  In developing a strategy and antifraud control activities, effective managers focus on fraud prevention over detection, develop a plan for responding to identified instances of fraud, establish collaborative relationships with stakeholders, and create incentives to help effectively implement the strategy  Additionally, as part of a documented strategy, management identifies roles and responsibilities of those involved in fraud risk management activities; describes control activities as well as plans for monitoring and evaluation, creates timelines, and communicates the antifraud strategy to employees and stakeholders, among other things  As discussed earlier, CMS has some control activities in place to identify fraud risk in Medicare and Medicaid, particularly in the FFS program  However, CMS has not developed and documented a risk-based antifraud strategy to guide its design and implementation of new antifraud activities and to better align and coordinate its existing activities to ensure it is targeting and mitigating the most-significant fraud risks  Antifraud strategy  CMS officials told us that CPI does not have a documented risk-based antifraud strategy  Although CMS has developed several documents that describe efforts to address fraud, the agency has not developed a risk-based antifraud strategy for Medicare and Medicaid because, as discussed earlier, it has not conducted a fraud risk assessment that would serve as a foundation for such strategy  In 2016, CPI identified five strategic objectives for program integrity, which include antifraud elements and an emphasis on prevention  However, according to CMS officials, these objectives were identified from discussions with CMS leadership and various stakeholders and not through a fraud risk assessment process to identify inherent fraud risks from the universe of potential vulnerabilities, as described earlier and called for in the leading practices  These strategic objectives were presented at an antifraud conference in 2016, but were not announced publicly until the release of the Annual Report to Congress on the Medicare and Medicaid Integrity Programs for Fiscal Year 2015 in June 2017  Stakeholder relationships and communication  CMS has established relationships and communicated with stakeholders, but, without an antifraud strategy, stakeholders we spoke with lacked a common understanding of CMS’s strategic approach  Prior work on practices that can help federal agencies collaborate effectively calls for a strategy that is shared with stakeholders to promote trust and understanding  Once an antifraud strategy is developed, the Fraud Risk Framework calls for managers to collaborate to ensure effective implementation  Although some CMS stakeholders were able to describe various CMS program- integrity priorities and activities, such as home health being a fraud risk priority, the stakeholders could not communicate, articulate, or cite a common CMS strategic approach to address fraud risks in its programs  Incentives  The Fraud Risk Framework discusses creating incentives to help ensure effective implementation of the antifraud strategy once it is developed  Currently, some incentives within stakeholder relationships may complicate CMS’s antifraud efforts  As discussed earlier, CMS is a partner and provides oversight to states’ program-integrity functions  Officials from one state told us that they were reluctant to share their program vulnerabilities because CMS would use this information to later audit the state  Among contractors, CMS encourages information sharing through conferences and workshops; however, competition for CMS business among contractors can be a disincentive to information sharing  CMS officials acknowledged this concern and said that they expect contractors to share information related to fraud schemes, outcomes of investigations, and tips for addressing fraud, but not proprietary information such as algorithms to risk-score providers  Without developing and documenting an antifraud strategy based on a fraud risk assessment, as called for in the design and implement component of the Fraud Risk Framework, CMS cannot ensure that it has a coordinated approach to address the range of fraud risks and to appropriately target and allocate resources for the most-significant risks  Considering fraud risks to which the Medicare and Medicaid programs are most vulnerable, in light of the malicious intent of those who aim to exploit the programs, would help CMS to examine its current control activities and potentially design new ones with recognition of fraudulent behavior it aims to prevent  This focus on fraud is distinct from a broader view of program integrity and improper payments by considering the intentions and incentives of those who aim to deceive rather than well-intentioned providers who make mistakes  Also, continued growth of the programs, such as growth of Medicare Part C and Medicaid managed care, call for consideration of preventive fraud control activities across the entire network of entities involved  Further, considering the large size and complexity of Medicare and Medicaid and the extensive stakeholder network involved in managing fraud in the programs, a strategic approach to managing fraud risks within the programs is essential to ensure that a number of existing control activities and numerous stakeholder relationships and incentives are being aligned to produce desired results  Once developed, an antifraud strategy that is clearly articulated to various CMS stakeholders would help CMS to address fraud risks in a more coordinated and deliberate fashion  Thinking strategically about existing control activities, resources, tools, and information systems could help CMS to leverage resources while continuing to integrate Medicare and Medicaid program-integrity efforts along functional lines  A strategic approach grounded in a comprehensive assessment of fraud risks could also help CMS to identify future enhancements for existing control activities, such as new preventive capabilities for FPS or additional fraud factors in provider enrollment and revalidation, such as provider risk scoring, to stay in step with evolving fraud risks  The evaluate and adapt component of the Fraud Risk Framework calls for federal managers to evaluate outcomes using a risk-based approach and adapt activities to improve fraud risk management  Furthermore, according to federal internal control standards, managers should establish and operate monitoring activities to monitor the internal control system and evaluate the results, which may be compared against an established baseline  Ongoing monitoring and periodic evaluations provide assurances to managers that they are effectively preventing, detecting, and responding to potential fraud  CMS has established monitoring and evaluation mechanisms for its program-integrity activities that it could incorporate into an antifraud strategy  In Medicare, CMS has taken steps to measure the rate of fraud in a particular service area  We have previously reported that agencies may face challenges measuring outcomes of fraud risk management activities in a reliable way  These challenges include the difficulty of measuring the extent of deterred fraud, isolating potential fraud from legitimate activity or other forms of improper payments, and determining the amount of undetected fraud  Despite these challenges, CMS has taken steps to estimate a fraud baseline—meaning the rate of probable fraud—in the home health benefit  In fiscal year 2016, CMS conducted a pretest in the Miami-Dade area of Florida to evaluate its potential measurement approach that could later be used in a nationwide study of probable fraud among home health agencies  The pretest was not a random sample and was not intended to produce a rate of fraud, but instead was intended to test the interview instruments and data-collection methodology CMS might use in a study nationwide  CMS and its contractor collected information from home health agencies, the attending providers, and Medicare beneficiaries in the Miami-Dade area in order to test these interview instruments  CMS completed this pretest, but, according to CMS officials, the agency does not yet have plans to roll out a nationwide study that would estimate a probable fraud rate for the Medicare FFS home health benefit  In its 2015 annual report to Congress, CMS stated that “documenting the baseline amount of fraud in Medicare is of critical importance, as it allows officials to evaluate the success of ongoing fraud prevention activities ” CMS officials working on the pilot told us that having an estimate of the rate of fraud in home health benefits would allow CMS to reliably assess its efforts at eliminating or reducing fraud  Without a baseline, officials said, the agency cannot know whether its antifraud efforts are as effective as they could be  We previously reported that the lack of a baseline for the amount of health-care fraud that exists limits CMS’s ability to determine whether its activities are effectively reducing health care fraud and abuse  A baseline estimate could provide an understanding of the extent of fraud and, with additional information on program activities, could help to inform decision making related to allocation of resources to combat health-care fraud  As described in the Fraud Risk Framework, in the absence of a fraud baseline, agencies can gather additional information on the short-term or intermediate outcomes of some antifraud initiatives, which may be more readily measured  For example, CMS has developed some performance measures to provide a basis for monitoring its progress towards meeting the program-integrity goals set in the HHS Strategic Plan and Annual Performance Plan  Specifically, CMS measures whether it is meeting its goal of “increasing the percentage of Medicare FFS providers and suppliers identified as high risk that receive an administrative action ” CMS does not set specific antifraud goals for other parts of Medicare or Medicaid; other CMS performance measures relate to measuring or reducing improper payments in CHIP, Medicaid, and the various parts of Medicare  CMS uses return-on-investment and savings estimates to measure the effectiveness of its Medicare program-integrity activities and FPS  For example, CMS uses return-on-investment to measure the effectiveness of FPS and, in response to a recommendation we made in 2012, CMS developed outcome-based performance targets and milestones for FPS  CMS has also conducted individual evaluations of its program-integrity activities, such as an interim evaluation of the prior-authorization demonstration for power mobility devices that began in 2012 and is currently implemented in 19 states  Commensurate with greater maturity of control activities in Medicare FFS compared to other parts of Medicare and Medicaid, monitoring and evaluation activities for Medicare Parts C and D and Medicaid are more limited  For example, CMS calculates savings for its program-integrity activities in Medicare Parts C and D, but not a full return-on-investment  CMS officials told us that calculating costs for specific activities is challenging because of overlapping activities among contractors  CMS officials said they continue to refine methods and develop new savings estimates for additional program-integrity activities  According to the Fraud Risk Framework, effective managers develop a strategy and evaluate outcomes using a risk-based approach  In developing an effective strategy and antifraud activities, managers consider the benefits and costs of control activities  Ongoing monitoring and periodic evaluations provide reasonable assurance to managers that they are effectively preventing, detecting, and responding to potential fraud  Monitoring and evaluation activities can also support managers’ decisions about allocating resources, and help them to demonstrate their continued commitment to effectively managing fraud risks  As CMS takes steps to develop an antifraud strategy, it could include plans for refining and building on existing methods such as return-on- investment or savings measures, and setting appropriate targets to evaluate the effectiveness of all of CMS’s antifraud efforts  Such a strategy would help CMS to efficiently allocate program-integrity resources and to ensure that the agency is effectively preventing, detecting, and responding to potential fraud  For example, while doing so would involve challenges, CMS’s strategy could detail plans to advance efforts to measure a potential fraud rate through baseline and periodic measures  Fraud rate measurement efforts could also inform risk assessment activities, identify currently unknown fraud risks, align resources to priority risks, and develop effective outcome metrics for antifraud controls  Such a strategy would also help CMS ensure that it has effective performance measures in place to assess its antifraud efforts beyond those related to providers in Medicare FFS, and establish appropriate targets to measure the agency’s progress in addressing fraud risks  As CMS makes plans to move forward with a strategy and to further develop evaluation and monitoring mechanisms, it will be important to share its efforts with stakeholders  The Fraud Risk Framework states that effective managers communicate lessons learned from fraud risk management activities to stakeholders  For example, CMS could be a leader to states in measuring the effectiveness of program-integrity efforts  Officials in three of the four states we spoke with expressed interest in receiving CMS guidance on how to measure the effectiveness of their Medicaid program-integrity efforts, such as by providing models for how to calculate return-on-investment  Medicare and Medicaid provide health insurance to over 129 million Americans, but the size—in terms of number of beneficiaries and amount of expenditures—as well as complexity of these programs make them inherently susceptible to fraud and improper payments  CMS currently manages these risks across its programs as part of a broader approach to identifying and controlling for multiple sources of improper payments and by developing relationships with an extensive network of stakeholders  In Medicare and Medicaid specifically, we note that CMS has taken many important steps toward implementing a strategic approach for managing fraud  However, the agency could benefit by more fully aligning its efforts with the four components of the Fraud Risk Framework  CMS is well positioned to leverage its fraud risk management efforts— such as demonstrated leadership for combating fraud, existing control activities, and stakeholder relationships—to provide additional antifraud training, as well as to develop an antifraud strategy based on fraud risk assessments for Medicare and Medicaid  We recognize that the effort may be challenging, given the size and complexity of Medicare and Medicaid, and the need to balance antifraud activities with CMS’s other mission priorities  However, by not employing the actions identified in the Fraud Risk Framework and incorporating them in its approach to managing fraud risks, CMS is missing a significant opportunity to better ensure employee vigilance against fraud, and to organize and focus its many antifraud and program-integrity activities and related resources into a comprehensive strategy  Such a strategy would (1) provide reasonable assurance that CMS is targeting the most-significant fraud risks in its programs and (2) help protect the government’s substantial and growing investments in these programs  We are making the following three recommendations to CMS: The Administrator of CMS should provide fraud-awareness training relevant to risks facing CMS programs and require new hires to undergo such training and all employees to undergo training on a recurring basis  (Recommendation 1) The Administrator of CMS should conduct fraud risk assessments for Medicare and Medicaid to include respective fraud risk profiles and plans for regularly updating the assessments and profiles  (Recommendation 2) The Administrator of CMS should, using the results of the fraud risk assessments for Medicare and Medicaid, create, document, implement, and communicate an antifraud strategy that is aligned with and responsive to regularly assessed fraud risks  This strategy should include an approach for monitoring and evaluation  (Recommendation 3) We provided a draft of this report to HHS and DOJ for comment  HHS provided written comments, which are reprinted in appendix I  DOJ did not have comments  HHS and DOJ also provided technical comments, which we incorporated as appropriate  In commenting on this report, HHS agreed with our three recommendations  Specifically, in response to our first recommendation to provide required fraud-awareness training to all employees, HHS stated that it will develop and implement a fraud-awareness training plan to ensure all CMS employees receive training  Regarding our second recommendation to conduct fraud risk assessments for Medicare and Medicaid, HHS stated that it is currently conducting a fraud risk assessment on the federally facilitated marketplace and, when this assessment is complete, will apply the lessons learned in assessing this program to fraud risk assessments of Medicare and Medicaid  In response to our third recommendation to create, document, implement, and communicate an antifraud strategy that is aligned with and responsive to regularly assessed fraud risks, HHS stated that it will develop respective risk-based antifraud strategies after completing fraud risk assessments for Medicare and Medicaid  We are sending copies of this report to the Acting Secretary of Health and Human Services, the Administrator of CMS, the Assistant Attorney General for Administration at DOJ, as well as appropriate congressional committees and other interested parties  In addition, this report is available at no charge on the GAO website at http://www gao gov  If you or your staff members have any questions about this report, please contact me at (202) 512-6722 or bagdoyans@gao gov  Contact points for our Offices of Congressional Relations and Public Affairs may be found on the last page of this report  GAO staff who made contributions to this report are listed in appendix II  In addition to the contact named above, Tonita Gillich (Assistant Director), Irina Carnevale (Analyst-in-Charge), Michael Duane, Laura Sutton Elsberg, and Catrin Jones made key contributions to this report  Also contributing to the report were Lori Achman, James Ashley, Colin Fallon, Leslie V  Gordon, Maria McMullen, Sabrina Streagle, and Shana Wallace 

ground_truth: CMS, an agency within the Department of Health and Human Services (HHS), provides health coverage for over 145 million Americans through its four principal programs, with annual outlays of about $1.1 trillion. GAO has designated the two largest programs, Medicare and Medicaid, as high risk partly due to their vulnerability to fraud, waste, and abuse. In fiscal year 2016, improper payment estimates for these programs totaled about $95 billion. GAO's Fraud Risk Framework and the subsequent enactment of the Fraud Reduction and Data Analytics Act of 2015 have called attention to the importance of federal agencies' antifraud efforts. This report examines (1) CMS's approach for managing fraud risks across its four principal programs, and (2) how CMS's efforts managing fraud risks in Medicare and Medicaid align with the Fraud Risk Framework. GAO reviewed laws and regulations and HHS and CMS documents, such as program-integrity manuals. It also interviewed CMS officials and a sample of CMS stakeholders, including state officials and contractors. GAO selected states based on fraud risk and other factors, such as geographic diversity. GAO selected contractors based on a mix of companies and geographic areas served. The approach that the Centers for Medicare & Medicaid Services (CMS) has taken for managing fraud risks across its four principal programs—Medicare, Medicaid, the Children's Health Insurance Program (CHIP), and the health-insurance marketplaces—is incorporated into its broader program-integrity approach. According to CMS officials, this broader program-integrity approach can help the agency develop control activities to address multiple sources of improper payments, including fraud. As the figure below shows, CMS views fraud as part of a spectrum of actions that may result in improper payments. CMS's efforts managing fraud risks in Medicare and Medicaid partially align with GAO's 2015 A Framework for Managing Fraud Risks in Federal Programs (Fraud Risk Framework). This framework describes leading practices in four components: commit , assess , design and implement , and evaluate and adapt . CMS has shown commitment to combating fraud in part by establishing a dedicated entity—the Center for Program Integrity—to lead antifraud efforts. Furthermore, CMS is offering and requiring antifraud training for stakeholder groups such as providers, beneficiaries, and health-insurance plans. However, CMS does not require fraud-awareness training on a regular basis for employees, a practice that the framework identifies as a way agencies can help create a culture of integrity and compliance. Regarding the assess and design and implement components, CMS has taken steps to identify fraud risks, such as by designating specific provider types as high risk and developing associated control activities. However, it has not conducted a fraud risk assessment for Medicare or Medicaid, and has not designed and implemented a risk-based antifraud strategy. A fraud risk assessment allows managers to fully consider fraud risks to their programs, analyze their likelihood and impact, and prioritize risks. Managers can then design and implement a strategy with specific control activities to mitigate these fraud risks, as well as an appropriate evaluation approach consistent with the evaluate and adapt component. By developing a fraud risk assessment and using that assessment to create an antifraud strategy and evaluation approach, CMS could better ensure that it is addressing the full portfolio of risks and strategically targeting the most-significant fraud risks facing Medicare and Medicaid. GAO recommends that CMS (1) provide and require fraud-awareness training to its employees, (2) conduct fraud risk assessments, and (3) create an antifraud strategy for Medicare and Medicaid, including an approach for evaluation. HHS concurred with GAO's recommendations.