You are given two reports by the government agency.  

Report 1:
CMS has four principal programs: Medicare, Medicaid, CHIP, and the health-insurance marketplaces. See table 1 for information about the four programs. As discussed earlier, Medicare and Medicaid are CMS’s largest programs and have been growing steadily (see fig. 1). CBO projects that, in 2026, under current law, Medicare spending will reach $1.3 trillion. Medicaid is also expected to continue to grow—program spending is projected to increase 66 percent to over $950 billion by fiscal year 2025, and more than half of the states have chosen to expand their Medicaid programs by covering certain low-income adults not historically eligible for Medicaid coverage, as authorized under the Patient Protection and Affordable Care Act of 2010 (PPACA). The two programs’ use of managed-care delivery systems to provide care has also increased. For example, the number and percentage of Medicare beneficiaries enrolled in Medicare Part C has grown steadily over the past several years, increasing from 8.7 million (20 percent of all Medicare beneficiaries) in calendar year 2007 to 17.5 million (32 percent of all Medicare beneficiaries) in calendar year 2015. As of July 1, 2015, nearly two-thirds of all Medicaid beneficiaries were enrolled in managed- care plans and about 40 percent of expenditures in fiscal year 2015 were for health-care services delivered through managed care. CMS receives appropriations to carry out antifraud activities through several funds including the Health Care Fraud and Abuse Control (HCFAC) program and the Medicaid Integrity Program. The HCFAC program was established under the Health Insurance Portability and Accountability Act of 1996 to coordinate federal, state, and local law- enforcement efforts to address health-care fraud and abuse and to conduct investigations and audits, among other things. In fiscal year 2016, CMS received $560 million through the HCFAC program appropriations. The Medicaid Integrity Program, established by the Deficit Reduction Act of 2005, supports contracts to audit and identify overpayments in Medicaid claims, and provides technical assistance for states’ program-integrity efforts. According to CMS, it received $75 million every year since fiscal year 2009 through the Medicaid Integrity Program appropriations. According to CMS, in fiscal year 2016, total program-integrity obligations to address fraud, waste, and abuse for Medicare and Medicaid were $1.45 billion. As mentioned previously, we designated Medicare and Medicaid as high- risk programs starting in 1990 and 2003, respectively, because their size, scope, and complexity make them vulnerable to fraud, waste, and abuse. Similarly, the Office of Management and Budget (OMB) designated all parts of Medicare as well as Medicaid “high-priority” programs because these programs report $750 million or more in estimated improper payments in a given year. We also highlighted challenges associated with improper payments in Medicare and Medicaid in our annual report on duplication and opportunities for cost savings in federal programs. Improper payments are a significant risk to the Medicare and Medicaid programs and can include payments made as a result of fraud. Improper payments are payments that are either made in an incorrect amount (overpayments and underpayments) or those that should not be made at all. For example, CMS estimated in fiscal year 2016 that the Medicare fee-for-service (FFS) improper payment rate was 11 percent (approximately $41 billion) and the Medicaid improper payment rate was 10.5 percent (approximately $36 billion). Improper payment measurement does not specifically identify or estimate improper payments due to fraud. Health-care fraud can take many forms, and a single case can involve more than one scheme. Schemes may include fraudulent billing for services not provided, services provided that were not medically necessary, and services intentionally billed at a higher level than appropriate. These fraud schemes may include compensating providers, beneficiaries, or others for participating in the fraud scheme. Fraud can be regionally focused or can target particular service areas such as home-health services, or durable medical equipment such as wheelchairs. Fraud may also have nonfinancial effects. For example, patients may be subjected to harmful or unnecessary services by fraudulent providers. Fraud can be perpetrated by different actors, such as providers, beneficiaries, health-insurance plans, as well as organized crime. Fraud and “fraud risk” are distinct concepts. Fraud is challenging to detect because of its deceptive nature. Additionally, once suspected fraud is identified, alleged fraud cases may be prosecuted. If the court determines that fraud took place, then fraudulent spending may be recovered. Fraud risk exists when individuals have an opportunity to engage in fraudulent activity, have an incentive or are under pressure to commit fraud, or are able to rationalize committing fraud. When fraud risks can be identified and mitigated, fraud may be less likely to occur. Although the occurrence of one or more cases of health-care fraud indicates there is a fraud risk, a fraud risk can exist even if fraud has not yet been identified or occurred. Suspicious billing patterns, certain types of health-care providers, or complexities in program design may indicate a risk of fraud. Information to help identify potential fraud risks may come from various sources, including whistleblowers, agency officials, contractors, law-enforcement agencies, beneficiaries, or providers. According to federal standards and guidance, executive-branch agency managers are responsible for managing fraud risks and implementing practices for combating those risks. Federal internal control standards call for agency management officials to assess the internal and external risks their entities face as they seek to achieve their objectives. The standards state that as part of this overall assessment, management should consider the potential for fraud when identifying, analyzing, and responding to risks. Risk management is a formal and disciplined practice for addressing risk and reducing it to an acceptable level. In July 2015, GAO issued the Fraud Risk Framework, which provides a comprehensive set of key components and leading practices that serve as a guide for agency managers to use when developing efforts to combat fraud in a strategic, risk-based way. The Fraud Risk Framework describes leading practices in four components: commit, assess, design and implement, and evaluate and adapt, as depicted in figure 2. The Fraud Reduction and Data Analytics Act of 2015, enacted in June 2016, requires OMB to establish guidelines for federal agencies to create controls to identify and assess fraud risks and design and implement antifraud control activities. The act further requires OMB to incorporate the leading practices from the Fraud Risk Framework in the guidelines. In July 2016, OMB published guidance about enterprise risk management and internal controls in federal executive departments and agencies. Among other things, this guidance affirms that managers should adhere to the leading practices identified in the Fraud Risk Framework. Further, the act requires federal agencies to submit to Congress a progress report each year for 3 consecutive years on the implementation of the controls established under OMB guidelines, among other things. CMS’s antifraud efforts for its four principal programs are part of the agency’s broader program-integrity approach to address fraud, waste, and abuse. CMS’s Center for Program Integrity (CPI) is the agency’s focal point for program integrity across the programs. According to CMS, its approach to program-integrity allows it to “address the whole spectrum of fraud, waste, and abuse.” For example, CMS describes its program- integrity activities as addressing unintentional errors resulting from providers being unaware of recent policy changes on one end of the spectrum, through somewhat more-serious patterns of abuse such as billing for a more-expensive service than was performed (known as upcoding), and finally up to serious fraudulent activities, such as billing for services that were not provided. CMS then aims to target its corrective actions to fit the risk. See figure 3 for CMS’s description of the spectrum of fraud, waste, and abuse that its program-integrity activities aim to address. Within its program-integrity activities, CMS has established several control activities that are specific to managing fraud risks, while others serve broader program-integrity purposes. According to CMS officials, the agency’s antifraud control activities mainly focus on providers in Medicare FFS. Officials told us that when CPI began operating, its primary focus was developing program integrity for Medicare FFS and, as a result, it is the most “mature” of all of CPI’s programs. CMS’s specific fraud control activities include, for example, the Fraud Prevention System (FPS), a predictive-analytics system that helps identify potentially fraudulent payments in Medicare FFS, and the Unified Program Integrity Contractors (UPIC), which detect and investigate aberrant provider behavior and potential fraud in Medicare and Medicaid. Other control activities serve broader program-integrity purposes such as to reduce improper payments resulting from error, waste, and abuse in addition to preventing or detecting potential fraud. For example, CMS provides education and outreach to Medicare providers and beneficiaries on issues identified through data analyses in order to reduce improper payments and to increase their awareness of fraud. HHS and CMS department- and agency-wide strategic plans guide CMS’s program-integrity activities—including antifraud activities. The program-integrity goals identified in the HHS strategic plan primarily focus on improper payments and are driven by statutory requirements. For example, the HHS strategic plan for fiscal years 2014–2018 includes performance goals of reducing the percentage of improper payments made under Medicare FFS and Medicare Parts C and D. One antifraud- focused goal in the HHS strategic plan is to increase the percentage of Medicare providers and suppliers identified as high risk that receive administrative actions, such as suspending payments to providers or revoking providers’ billing privileges. HHS and CMS department- and agency-wide strategic plans also include an emphasis on fraud prevention and early detection—a leading practice in the Fraud Risk Framework—and moving away from a “pay-and-chase” model. For example, the HHS strategic plan calls for “fostering early detection and prevention of improper payments by focusing on preventing bad actors from enrolling or remaining in Medicare and Medicaid” and to “use public-private partnerships to prevent and detect fraud across the health care industry by sharing fraud-related information and data between the public and private sectors.” As a part of this emphasis on prevention, CMS developed FPS in response to the Small Business Jobs Act of 2010, which required CMS to implement predictive-analytics technologies. Also, the Patient Protection and Affordable Care Act of 2010 (PPACA) included provisions to strengthen Medicare and Medicaid’s provider enrollment standards and procedures, among other program-integrity provisions. CMS works with an extensive and complex network of stakeholders to manage fraud risks in its four principal programs. In Medicaid and CHIP, CMS partners with and oversees the 50 states and the District of Columbia. Until the Deficit Reduction Act of 2005 expanded CMS’s role in Medicaid program integrity to provide effective federal support and assistance to states’ efforts to combat fraud, waste, and abuse, states were primarily responsible for Medicaid program integrity. Each state has its own Medicaid program-integrity unit, Medicaid Fraud Control Unit (MFCU), and state audit organization. CMS also uses numerous contractors to conduct the majority of its program-integrity activities. Since the enactment of Medicare in 1965, contractors have played an integral role in the administration of the program. The original Medicare program was designed so that the federal government contracted with health insurers or similar organizations experienced in handling physician and hospital claims to pay Medicare claims. Later, the Health Insurance Portability and Accountability Act of 1996 required the Secretary of Health and Human Services to enter into contracts to promote the integrity of the Medicare program. According to CMS officials, in fiscal year 2016 contractors received 92 percent of CMS’s program-integrity funding. Medicare and Medicaid program- integrity contractors play a variety of roles: (1) processing and reviewing claims, (2) conducting site visits of providers enrolling in Medicare, (3) auditing claims and recovering overpayments, (4) performing data analysis, and (5) investigating aberrant claims and provider behaviors, among other things. States also use contractors in many of these roles for managing program integrity. Additionally, multiple private health-insurance plans in Medicare Parts C and D and over 200 health-insurance plans in Medicaid managed care also carry out program-integrity activities. For the health-insurance marketplaces, CMS is responsible for operating the federally facilitated marketplace and overseeing the state-based marketplaces. CMS also developed the Federal Data Services Hub, which acts as a portal for exchanging information between state-based marketplaces, the federally facilitated marketplace, and state Medicaid agencies, among other entities, as well as other external partners, including other federal agencies, such as the Internal Revenue Service. Finally, law- enforcement groups, including the joint Department of Justice (DOJ) and HHS OIG Medicare Fraud Strike Force Teams, identify, investigate, and prosecute instances of fraud in CMS programs. See figure 4 for a depiction of CMS’s stakeholder network for managing fraud risks. This figure illustrates approximate numbers of stakeholders (through the concentration of dots), but not the extent of individual stakeholder roles. CMS provides oversight to, or partners with, these stakeholders to manage fraud risks. For oversight, CMS creates policies and guidance to direct stakeholders’ antifraud efforts, such as Medicare and Medicaid program-integrity manuals and the Medicaid Provider Enrollment Compendium. CMS also provides technical assistance to states in areas such as provider enrollment and data analysis. In areas where CMS does not have a primary role, it acts as a partner by collaborating and coordinating program-integrity and antifraud activities. For example, CMS is directly responsible for Medicare program integrity, but, in Medicaid and CHIP, states are the first line of program-integrity efforts. Similarly, CMS maintains control over Medicare FFS program integrity, but within Medicare managed care, it provides guidance for health- insurance plans to carry out their own program-integrity activities. In the health-insurance marketplaces, CMS reviews state-based marketplaces’ procedures for verifying applicant eligibility for coverage. For example, it conducts annual reviews of the state-based marketplaces, which include a review of states’ fraud, waste, and abuse policies. See figure 5 for a further description of CMS’s and various stakeholders’ roles and responsibilities in fraud risk management. CMS also facilitates collaboration among federal, state, and private entities for managing fraud risks. In 2012, CMS created the Healthcare Fraud Prevention Partnership (HFPP) to share information with public and private stakeholders and to conduct studies related to health-care fraud, waste, and abuse. According to CMS, as of October 2017, the HFPP included 89 public and private partners, including Medicare- and Medicaid-related federal and state agencies, law-enforcement agencies, private health-insurance plans (payers), and antifraud and other health- care organizations. The HFPP has conducted studies that pool and analyze multiple payers’ claims data to identify providers with patterns of suspect billing across payers. In a recent report, participants separately told us that the HFPP’s studies helped them to identify and take action against potentially fraudulent providers and payment vulnerabilities of which they might not otherwise have been aware, and fostered both formal and informal information sharing. CMS’s relationships with stakeholders were varied in terms of maturity and extent of information sharing, according to stakeholders we interviewed. While some relationships between CMS and stakeholders have been long-standing, some are developing, and others exist on an ad hoc basis. For example, CMS has had a long-standing relationship with state Medicaid program-integrity units, by collaborating through monthly meetings of the Medicaid Fraud and Abuse Technical Advisory Group, sending fraud alerts, and offering courses through the Medicaid Integrity Institute. However, in our interviews with state program-integrity units, and as we recently reported, some state Medicaid agencies shared concerns about the communication, level of policy guidance, and technical support provided by and received from CMS for managing fraud risks in Medicaid. This concern was echoed by state audit officials, with whom CMS recently initiated coordination to build relationships that would facilitate state auditing of Medicaid programs. CMS also has varying relationships with its law-enforcement partners. For example, the relationship between CMS and DOJ’s Health Care Fraud unit, which leads the DOJ and HHS OIG Medicare Fraud Strike Force Teams, has been ad hoc. According to CMS and DOJ officials, the interactions between the agencies have been based on specific fraud cases such as coordination of national takedowns when DOJ provided CMS with the names of providers committing fraud so that CMS could suspend them consistently with the timing of the enforcement efforts. According to CMS officials, they coordinate more with HHS OIG, working together on payment suspensions and revocations for OIG cases, or working with it to take administrative actions against large providers. CMS’s antifraud efforts partially align with the Fraud Risk Framework. Consistent with the framework, CMS has demonstrated commitment to combating fraud by creating a dedicated entity to lead antifraud efforts. It has also taken steps to establish a culture conducive to fraud risk management, although it could expand its antifraud training to include all employees. CMS has taken some steps to identify fraud risks in Medicare and Medicaid; however, it has not conducted a fraud risk assessment or developed a risk-based antifraud strategy for Medicare and Medicaid as defined in the Fraud Risk Framework. CMS has established monitoring and evaluation mechanisms for its program-integrity control activities that, if aligned with a risk-based antifraud strategy, could enhance the effectiveness of fraud risk management in Medicare and Medicaid. The commit component of the Fraud Risk Framework calls for an agency to commit to combating fraud by creating an organizational culture and structure conducive to fraud risk management. This component includes establishing a dedicated entity to lead fraud risk management activities. Within CMS, the Center for Program Integrity (CPI) serves as the dedicated entity for fraud, waste, and abuse issues in Medicare and Medicaid, which is consistent with the Fraud Risk Framework. CPI was established in 2010, in response to a November 2009 Executive Order on reducing improper payments and eliminating waste in federal programs. This formalized role, according to CMS officials, elevated the status of program-integrity efforts, which previously were carried out by other parts of CMS. As an executive-level Center—on the same level with five other executive-level Centers at CMS, such as the Center for Medicare and the Center for Medicaid and CHIP Services—CPI has a direct reporting line to executive-level management at CMS. The Fraud Risk Framework identifies a direct reporting line to senior-level managers within the agency as a leading practice. According to CMS officials, this elevated organizational status offers CPI heightened visibility across CMS, attention by CMS executive leadership, and involvement in executive- level conversations. Additionally, in 2014, CMS established a Program Integrity Board that has brought together senior officials across CMS Centers on a monthly basis to coordinate on fraud and program-integrity vulnerabilities. According to CPI officials, the board is one of the mechanisms through which CPI engages other executive-level offices at CMS. CPI chairs the meetings and typically develops meeting agendas to solicit information from and disseminate information to other CMS units or stakeholders. Further, the board may establish small working groups, known as integrated project teams, to address specific vulnerabilities. For example, according to CMS officials, in 2016 the board established a Marketplace integrated project team to resolve potential fraud eligibility and enrollment issues in the federally facilitated marketplace using the Fraud Risk Framework. CPI has further demonstrated commitment to addressing fraud, waste, and abuse through several organizational changes with the goal of improving coordination and communication of program-integrity activities across Medicare and Medicaid. Most recently, in 2014, CPI reorganized its structure to align functional areas across Medicare and Medicaid, where possible. Previously, separate units within CPI administered their own program-integrity activities for Medicare and Medicaid programs. For example, CPI established a Provider Enrollment and Oversight Group, responsible for provider screening and enrollment functions in both Medicare and Medicaid. According to CMS officials, if CPI employees identify an issue in provider enrollment in Medicare, the same CPI employees also consider how this issue applies to Medicaid. According to CMS officials, the reorganization has helped CPI to look at vulnerabilities in a crosscutting way and to facilitate communication across programs. Similarly, since 2016, CPI began shifting contracting functions from separate Medicare and Medicaid regional contractors that identify and investigate cases of potential fraud and conduct audits to five regional UPICs responsible for a range of program-integrity and fraud-specific activities in both Medicare FFS and Medicaid. According to CMS, the purpose of the UPICs is to coordinate provider investigations across Medicare and Medicaid, improve collaboration with states by providing a mutually beneficial service, and increase contractor accountability through coordinated oversight. CMS officials told us that UPIC integration is a cornerstone of CMS’s contract management strategy and would help to ensure communication and coordination across Medicare and Medicaid program-integrity efforts. CMS plans to award all the UPIC contracts by the end of 2017, ultimately phasing out the ZPICs and Medicaid Integrity Contractors. The commit component of the Fraud Risk Framework also includes creating an organizational culture to combat fraud at all levels of the agency. Consistent with the Fraud Risk Framework, CMS has promoted an antifraud culture by demonstrating a senior-level commitment to combating fraud through public statements, increased resource levels, and internal and external coordination. In addition to HHS and CMS strategic documents discussed earlier, CMS and CPI leaders have testified publicly about CMS’s commitment to preventing fraud and protecting taxpayers and beneficiaries. For example, CPI’s former Director testified in May 2016 before the House Committee on Energy and Commerce’s Subcommittee on Oversight and Investigations that “CMS is deeply committed to our efforts to prevent waste, fraud and abuse in Medicare and Medicaid programs, protecting both taxpayers and the beneficiaries that we serve.” More recently, CMS’s new Administrator testified in her February 2017 confirmation hearing regarding her intent to prioritize efforts around preventing fraud and abuse. CPI’s budget and resources have increased over time to support its ongoing program-integrity mission. According to CMS, program-integrity obligations for Medicare and Medicaid increased from about $1.02 billion in fiscal year 2010 to $1.45 billion in fiscal year 2016. According to CMS officials, the Health Care Fraud and Abuse Control (HCFAC) account, one of the primary sources of CPI funding, has never received a funding reduction. Additionally, in 2015, CPI received additional funding based on a discretionary cap adjustment to HCFAC. Similarly, CPI staff resources have increased over time. According to CMS, CPI’s full-time equivalent positions increased from 177 in 2011 to 419 in 2017. Consistent with leading practices in the Fraud Risk Framework to involve all levels of the agency in setting an antifraud tone, CPI has also worked collaboratively with other CMS Centers. In addition to engaging executive-level officials of other CMS Centers through the Program Integrity Board, CPI has worked collaboratively with other Centers within CMS to incorporate antifraud features into new program design or policy development and established regular communication at the staff level. For example: Center for Medicare and Medicaid Innovation (CMMI). When developing the Medicare Diabetes Prevention Program, CMMI officials told us they worked with CPI’s Provider Enrollment and Oversight Group and Governance Management Group to develop risk-based screening procedures for entities that would enroll in Medicare to provide diabetes-prevention services, among other activities. The program was expanded nationally in 2016, and CMS determined that an entity may enroll in Medicare as a program supplier if it satisfies enrollment requirements, including that the supplier must pass existing high categorical risk-level screening requirements. Center for Medicaid and CHIP Services (CMCS). CMCS officials told us they worked closely with CPI to issue Medicaid guidance and best practices to states on home and community-based services that incorporate program-integrity provisions. A senior CMCS official told us that, to address fraud, CMS has requested that states include provider information on claims to determine whether providers are meeting eligibility criteria. Center for Medicare (CM). In addition to building safeguards into programs and developing policies, CM officials told us that there are several standing meetings, on monthly, biweekly, and weekly bases, between groups within CM and CPI that discuss issues related to provider enrollment, FFS operations, and contractor management. A senior CM official also told us that there are ad hoc meetings taking place between CM and CPI: “We interact multiple times daily at different levels of the organization. Working closely is just a regular part of our business.” CMS has also demonstrated its commitment to addressing fraud, waste, and abuse to its stakeholders. Representatives of CMS’s extensive stakeholder network whom we interviewed—state officials, contractors, and officials from public and private entities—generally recognized the agency’s commitment to combating fraud. In our interviews with stakeholders, officials observed CMS’s increased commitment over time to address fraud, waste, and abuse and cited examples of specific CMS actions. State officials, for example, told us that the Medicaid Integrity Institute, a training center coordinated jointly by CMS and DOJ, has been a helpful resource for states to build capacity to address fraud and program integrity. CMS contractors told us that CMS’s commitment to combating fraud is incorporated into contractual requirements, such as requiring (1) data analysis for potential fraud leads and (2) fraud- awareness training for providers. Officials from entities that are members of the HFPP, specifically, a health-insurance plan and the National Health Care Anti-Fraud Association, added that CMS’s effort to establish the HFPP and its ongoing collaboration and information sharing reflect CMS’s commitment to combat fraud in Medicare and Medicaid. The Fraud Risk Framework identifies training as one way of demonstrating an agency’s commitment to combating fraud. Training and education intended to increase fraud awareness among stakeholders, managers, and employees, serves as a preventive measure to help create a culture of integrity and compliance within the agency. The Fraud Risk Framework discusses requiring all employees to attend training upon hiring and on an ongoing basis thereafter. To increase awareness of fraud risks in Medicare and Medicaid, CMS offers and requires training for stakeholder groups such as providers, beneficiaries, and health-insurance plans. Specifically, through its National Training Program and Medicare Learning Network, CMS makes available training materials on combating Medicare and Medicaid fraud, waste, and abuse. These materials help to identify and report fraud, waste, and abuse in CMS programs and are geared toward providers, beneficiaries, as well as trainers and other stakeholders. Separately, CMS requires health-insurance plans working with CMS to provide annual fraud, waste, and abuse training to their employees. However, CMS does not offer or require similar fraud-awareness training for the majority of its workforce. For a relatively small portion of its overall workforce—specifically, contracting officer representatives who are responsible for certain aspects of the acquisition function—CMS requires completion of fraud and abuse prevention training every 2 years. According to CMS, 638 of its contracting officer representatives (or about 10 percent of its overall workforce) completed such training in 2016 and 2017. Although CMS offers fraud-awareness training to others, the agency does not require fraud-awareness training for new hires or on a regular basis for all employees because the agency has focused on providing process-based internal controls training for its employees. While fraud-awareness training for contracting officer representatives is an important step in helping to promote fraud risk management, fraud- awareness training specific to CMS programs would be beneficial for all employees. Such training would not only be consistent with what CMS offers to or requires of its stakeholders and some of its employees, but would also help to keep the agency’s entire workforce continuously aware of fraud risks and examples of known fraud schemes, such as those identified in successful OIG investigations. Such training would also keep employees informed as they administer CMS programs or develop agency policies and procedures. Considering the vulnerability of Medicare and Medicaid programs to fraud, waste, and abuse, without regular required training CMS cannot be assured that its workforce of over 6,000 employees is continuously aware of risks facing its programs. Although CMS has shown commitment to combating fraud, at times CPI’s efforts to combat fraud compete with other mission priorities, such as (1) ensuring beneficiary access to health-care services and (2) limiting provider burden. CPI leadership has been aware of this inherent challenge. For example, at a congressional hearing in May 2016, CPI’s Director stated that “our efforts strike an important balance: protecting beneficiary access to necessary health care services and reducing the administrative burden on legitimate providers and suppliers, while ensuring that taxpayer dollars are not lost to fraud, waste, and abuse.” Beneficiary access to care. In accordance with its mission statement, providing and improving beneficiaries’ access to health care is a CMS priority. CMS’s commitment to providing access to high-quality care and coverage is reflected in the agency’s mission statement and is one of its four strategic goals. As a result, before taking administrative actions against a Medicare Part A provider, such as a hospice, or providers in rural areas, CMS officials told us that they first look at whether there is a sufficient number of providers in an area by running a provider search by provider county and adjacent counties and considering how heavily populated an area is with Medicare beneficiaries. According to these officials, rather than taking an administrative action against a provider that would limit beneficiaries’ access to services, the agency may enter into a corrective action plan with the provider. CMS officials told us that revoking a provider’s enrollment in Medicare, an option available to CMS in cases of provider noncompliance or misconduct, is rare. Administrative burden on providers. According to CMS documents and officials, concern over placing undue burden on providers—the majority of whom are presumed to be honest—provides a counterforce to implementing program-integrity control activities. CMS’s web page entitled Reducing Provider Burden states: “CMS is committed to reducing improper payments but must be mindful of provider burden because medical review is a resource-intensive process for both the healthcare provider and the Medicare review contractor.” Two CMS contractors told us that they scaled back or did not pursue audits of providers’ documentation because of provider burden or sensitivity considerations. One contractor removed providers from audit samples after some providers opposed having to supply multiple medical records. CPI officials told us that they want to reduce provider burden in a logical manner. For example, according to CMS officials, in the Medicare FFS Recovery Audit Program, CMS established limits on Additional Documentation Requests, which are requests for medical documentation supporting a claim being reviewed. CMS requires such documentation adjustments so that they align with a providers’ claim denial rates. Providers with low denial rates will have lower documentation requirements, while providers with high denial rates will have higher documentation requirements, thus adjusting provider burden based on demonstrated compliance. The assess component of the Fraud Risk Framework calls for federal managers to plan regular fraud risk assessments and to assess risks to determine a fraud risk profile. Identifying fraud risks is one of the steps included in the Fraud Risk Framework for assessing risks to determine a fraud risk profile. CMS has taken steps to identify some fraud risks through several control activities that target areas the agency has designated as higher risk within Medicare and Medicaid, including specific provider types, such as home health agencies, and specific geographic locations. As discussed earlier, CMS officials told us that CPI initially focused on developing control activities for Medicare FFS and considers these activities to be the most mature of all CPI efforts to address fraud risks. CMS has identified fraud risks in the following selected examples, which are not an exhaustive list of its control activities. Data analytics to assist investigations in Medicare FFS. In 2011, CMS implemented FPS, a data-analytic system that screens all Medicare FFS claims to identify health-care providers with suspect billing patterns for further investigation. Medicare FFS contractors—ZPICs and UPICs— have used FPS to identify and prioritize leads for investigations of potential fraud by high-risk Medicare FFS providers. Contractors told us that FPS allows them to quickly identify and triage leads. CMS’s guidance requires contractors to prioritize investigations with the greatest program impact or urgency and identifies required criteria for prioritizing investigations, such as patient abuse or harm, multistate fraud, and high dollar amount of potential overpayments. One contractor we interviewed developed a risk-prioritization model that incorporated CMS’s required criteria, such as patient harm, as well as additional criteria, such as provider spikes in billing, into a tool that automatically creates a provider risk score to help the contractor focus and prioritize investigative resources. Prior authorization for Medicare FFS services or supplies. CMS published a final rule in December 2015 that identifies a master list of durable medical equipment, prosthetics, orthotics, and supplies for which CMS can require prior authorization before suppliers submit a Medicare FFS claim. In this rule, CMS identified 135 items that are frequently subject to unnecessary utilization and stated that the agency expects the final rule to result in savings in the form of reduced unnecessary utilization, fraud, waste, and abuse. Under this program, prior authorization is a condition of payment for claims. CMS can choose which items on the master list to subject to prior authorization. For example, in March 2017, it began requiring prior authorization for selected power wheelchairs in four states and expanded the prior authorization program for these items to all states in July 2017. CMS also began to test the use of prior authorization on a voluntary basis through a series of fixed-length demonstrations for items and services that have been associated with high levels of improper payments, including high incidences of fraud in some cases, and unnecessary utilization in certain geographic areas. For example, CMS began implementing a voluntary prior authorization demonstration in September 2012 for other power mobility devices, such as power scooters, in seven states where historically there has been extensive evidence of fraud and improper payments. CMS expanded the demonstration to an additional 12 states in October 2014, for a total of 19 states. According to the initial Federal Register notice, CMS planned to use the demonstration to develop improved methods for investigation and prosecution of fraud to protect federal funds from fraudulent actions and the resulting improper payments. Under the demonstration, providers and suppliers are encouraged—but not required—to submit a request for prior authorization for certain items before they provide the item to the beneficiary and submit a claim for payment. Revised provider screening and enrollment processes for Medicare FFS and Medicaid FFS. In response to PPACA, in 2011 CMS implemented a revised screening process for providers and suppliers who enroll in Medicare and Medicaid based on identified provider risk categories. CMS placed all Medicare provider and supplier types into one of three risk categories—limited, moderate, or high—based on its assessment of the potential risk of fraud, waste, and abuse each provider and supplier type poses. For example, CMS designated prospective (newly enrolling) home health agencies and prospective suppliers of durable medical equipment, prosthetics, orthotics, and supplies in the high-risk category. According to the final rule and our interviews with CMS officials, CMS developed these risk-based categories based on its review and synthesis of various information sources about the fraud risks posed by each provider and supplier type, including (1) the agency’s experience with claims data used to identify potentially fraudulent billing practices, (2) expertise of contractors responsible for investigating and identifying Medicare fraud, and (3) GAO and OIG reports. CMS designated specific screening activities for each risk category, with increased requirements for moderate- and high-risk provider and supplier types. For example, moderate- and high-risk providers and suppliers must receive preenrollment site visits, and high-risk providers and suppliers also are subject to fingerprint-based criminal-background checks. As part of the revised screening process, beginning in September 2011, CMS also undertook its first program-wide effort to rescreen, or revalidate, the enrollment records of about 1.5 million existing Medicare FFS providers and suppliers, to determine whether they remain eligible to bill Medicare. Temporary provider enrollment moratoriums for certain providers and geographic areas for Medicare FFS and Medicaid FFS. CMS identified certain provider types and geographic areas as high risk for fraud and used its authority under PPACA to implement temporary moratoriums to suspend enrollment of such Medicare and Medicaid providers in those areas. For example, in July 2016, CMS extended temporary moratoriums statewide on the enrollment of new Medicare Part B nonemergency ambulance suppliers and Medicare home health agencies statewide in six states, as applicable. The statewide moratoriums also apply to Medicaid. According to the Federal Register notice, CMS imposed the temporary moratoriums based on qualitative and quantitative factors suggesting a high risk of fraud, waste, or abuse, such as law-enforcement expertise with emerging fraud trends and investigations. CMS’s data analysis also confirmed the agency’s determination of a high risk of fraud, waste, and abuse for these provider and supplier types within certain geographic areas, according to the notice. Medicaid state program integrity reviews and desk reviews. CMS tailored state Medicaid program-integrity reviews to areas it identified as high risk for improper payments, such as personal care services, which may also be at high risk for fraud. In March 2017, we reported that, from fiscal years 2014 through 2016, CMS conducted focused reviews of state program-integrity efforts in 31 states, reviewing 10 or 11 states annually. For each state, CMS tailored its focused reviews to the state’s managed care plans and relevant other high-risk areas, including provider enrollment and screening, nonemergency medical transportation, and personal care services. CMS and state officials we spoke with as part of that work told us that the tailored oversight had been beneficial and helped identify areas for improvement. CMS has also initiated desk reviews of state program-integrity efforts. According to CMS, these desk reviews allow the agency to provide states with customized program- integrity oversight. Vulnerability tracking system for Medicare. CPI recently initiated an effort to centralize and formalize a vulnerability tracking process for Medicare, which could support identification of specific fraud risks, both in Medicare and possibly Medicaid. As described by CPI officials, the process aims to collect information on fraud-related vulnerabilities from CMS employees, contractors, and other sources, such as GAO and HHS OIG reports. The assess component of the Fraud Risk Framework calls for federal managers to plan regular fraud risk assessments and assess risks to determine a fraud risk profile. Furthermore, federal internal control standards call for agency management to assess the internal and external risks their entities face as they seek to achieve their objectives. The standards state that, as part of this overall assessment, management should consider the potential for fraud when identifying, analyzing, and responding to risks. The Fraud Risk Framework states that, in planning the fraud risk assessment, effective managers tailor the fraud risk assessment to the program by, among other things, identifying appropriate tools, methods, and sources for gathering information about fraud risks and involving relevant stakeholders in the assessment process. Fraud risk assessments that align with the Fraud Risk Framework involve (1) identifying inherent fraud risks affecting the program, (2) assessing the likelihood and impact of those fraud risks, (3) determining fraud risk tolerance, (4) examining the suitability of existing fraud controls and prioritizing residual fraud risks, and (5) documenting the results. (See fig. 6.) Although, as discussed earlier, CMS has identified some fraud risks posed by providers in Medicare FFS and, to a lesser degree, Medicaid FFS, the agency has not conducted a fraud risk assessment for either the Medicare or Medicaid program. Such a risk assessment would provide the detailed information and insights needed to create a fraud risk profile, which, in turn, is the basis for creating an antifraud strategy. According to CMS officials, CMS has not conducted a fraud risk assessment for Medicare or Medicaid because, within CPI’s broader approach of preventing and eliminating improper payments, its focus has been on addressing specific vulnerabilities among provider groups that have shown themselves particularly prone to fraud, waste, and abuse. With this approach, however, it is unlikely that CMS will be able to design and implement the most-appropriate control activities to respond to the full portfolio of fraud risks. A fraud risk assessment consists of discrete activities that build upon each other. Specifically: Identifying inherent fraud risks affecting the program. As discussed earlier, CMS has taken steps to identify fraud risks. However, CMS has not used a process to identify inherent fraud risks from the universe of potential vulnerabilities facing Medicare and Medicaid programs, including threats from various sources. According to CPI officials, most of the agency’s fraud control activities are focused on fraud risks posed by providers. The Fraud Risk Framework discusses fully considering inherent fraud risks from internal and external sources in light of fraud risk factors such as incentives, opportunities, and rationalization to commit fraud. For example, according to CMS officials, the inherent design of the Medicare Part C program may pose fraud risks that are challenging to detect. A fraud risk assessment would help CMS identify all sources of fraudulent behaviors, beyond threats posed by providers, such as those posed by health-insurance plans, contractors, or employees. Assessing the likelihood and impact of fraud risks and determining fraud risk tolerance. CMS has taken steps to prioritize fraud risks in some areas, but it has not assessed the likelihood or impact of fraud risks or determined fraud risk tolerance across all parts of Medicare and Medicaid. Assessing the likelihood and impact of inherent fraud risks would involve consideration of the impact of fraud risks on program finances, reputation, and compliance. Without assessing the likelihood and impact of risks in Medicare or Medicaid or internally determining which fraud risks may fall under the tolerance threshold, CMS cannot be certain that it is aware of the most-significant fraud risks facing these programs and what risks it is willing to tolerate based on the programs’ size and complexity. Examining the suitability of existing fraud controls and prioritizing residual fraud risks. CMS has not assessed existing control activities or prioritized residual fraud risks. According to the Fraud Risk Framework, managers may consider the extent to which existing control activities—whether focused on prevention, detection, or response—mitigate the likelihood and impact of inherent risks and whether the remaining risks exceed managers’ tolerance. This analysis would help CMS to prioritize residual risks and to determine mitigation approaches. For example, CMS has not established preventive fraud control activities in Medicare Part C. Using a fraud risk assessment for Medicare Part C and closely examining existing fraud control activities and residual risks, CMS could be better positioned to address fraud risks facing this growing program and develop preventive control activities. Further, without assessing existing fraud control activities and prioritizing residual fraud risks, CMS cannot be assured that its current control activities are addressing the most-significant risks. Such analysis would also help CMS determine whether additional, preferably preventive, fraud controls are needed to mitigate residual risks, make adjustments to existing control activities, and potentially scale back or remove control activities that are addressing tolerable fraud risks. Documenting the risk-assessment results in a fraud risk profile. CMS has not developed a fraud risk profile that documents key findings and conclusions of the fraud risk assessment. According to the Fraud Risk Framework, the risk profile can also help agencies decide how to allocate resources to respond to residual fraud risks. Given the large size and complexity of Medicare and Medicaid, a documented fraud risk profile could support CMS’s resource-allocation decisions as well as facilitate the transfer of knowledge and continuity across CMS staff and changing administrations. Senior CPI officials told us that the agency plans to start a fraud risk assessment for Medicare and Medicaid after it completes a separate fraud risk assessment of the federally facilitated marketplace. This fraud risk assessment for the federally facilitated marketplace eligibility and enrollment process is being conducted in response to a recommendation we made in February 2016. In April 2017, CPI officials told us that this fraud risk assessment was largely completed, although in September 2017 CPI officials told us that the assessment was undergoing agency review. CPI officials told us that they have informed CM and CMCS officials that there will be future fraud risk assessments for Medicare and Medicaid; however, they could not provide estimated timelines or plans for conducting such assessments, such as the order or programmatic scope of the assessments. Once completed, CMS could use the federally facilitated marketplace fraud risk assessment and apply any lessons learned when planning for and designing fraud risk assessments for Medicare and Medicaid. According to the Fraud Risk Framework, factors such as size, resources, maturity of the agency or program, and experience in managing risks can influence how the entity plans the fraud risk assessment. Additionally, effective managers tailor the fraud risk assessment to the program when planning for it. The large scale and complexity of Medicare and Medicaid as well as time and resources involved in conducting a fraud risk assessment underscore the importance of a well-planned and tailored approach to identifying the assessment’s programmatic scope. Planning and tailoring may involve decisions to conduct a fraud risk assessment for Medicare and Medicaid programs as a whole or divided into several subassessments to reflect their various component parts (e.g., Medicare FFS, Medicaid managed care) as well as determining the timing and order of assessments (e.g., concurrently or consecutively for Medicare and Medicaid). CMS’s existing fraud risk identification efforts as well as communication channels with stakeholders could serve as a foundation for developing a fraud risk assessment for Medicare and Medicaid. The leading practices identified in the Fraud Risk Framework discuss the importance of identifying appropriate tools, methods, and sources for gathering information about fraud risks and involving relevant stakeholders in the assessment process. CMS’s fraud risk identification efforts discussed earlier could provide key information about fraud risks and their likelihood and impact. Further, existing relationships and communication channels across CMS and its extensive network of stakeholders could support building a comprehensive understanding of known and potential fraud risks for the purposes of a fraud risk assessment. For example, the fraud vulnerabilities identified through data analysis and information sharing with states, health-insurance plans, law-enforcement organizations, and contractors through the HFPP could inform a fraud risk assessment. CPI’s Command Center missions—facilitated collaboration sessions that bring together experts from various disciplines to improve the processes for fraud prevention in Medicare and Medicaid—could bring together experts to identify potential or emerging fraud vulnerabilities or to brainstorm approaches to mitigate residual fraud risks. As CMS makes plans to move forward with a fraud risk assessment for Medicare and Medicaid, it will be important to consider the frequency with which the fraud risk assessment would need to be updated. While, according to the Fraud Risk Framework, the time intervals between updates can vary based on the programmatic and operating environment, assessing fraud risks on an ongoing basis is important to ensure that control activities are continuously addressing fraud risks. The constantly evolving fraud schemes, the size of the programs in terms of beneficiaries and expenditures, as well as continual changes in Medicare and Medicaid programs—such as development of innovative payment models and increasing managed-care enrollment—call for constant vigilance and regular updates to the fraud risk assessment. The design and implement component of the Fraud Risk Framework calls for federal managers to design and implement a strategy with specific control activities to mitigate assessed fraud risks and collaborate to help ensure effective implementation. According to the Fraud Risk Framework, effective managers develop and document an antifraud strategy that describes the program’s approach for addressing the prioritized fraud risks identified during the fraud risk assessment, also referred to as a risk-based antifraud strategy. A risk- based antifraud strategy describes existing fraud control activities as well as any new fraud control activities a program may adopt to address residual fraud risks. In developing a strategy and antifraud control activities, effective managers focus on fraud prevention over detection, develop a plan for responding to identified instances of fraud, establish collaborative relationships with stakeholders, and create incentives to help effectively implement the strategy. Additionally, as part of a documented strategy, management identifies roles and responsibilities of those involved in fraud risk management activities; describes control activities as well as plans for monitoring and evaluation, creates timelines, and communicates the antifraud strategy to employees and stakeholders, among other things. As discussed earlier, CMS has some control activities in place to identify fraud risk in Medicare and Medicaid, particularly in the FFS program. However, CMS has not developed and documented a risk-based antifraud strategy to guide its design and implementation of new antifraud activities and to better align and coordinate its existing activities to ensure it is targeting and mitigating the most-significant fraud risks. Antifraud strategy. CMS officials told us that CPI does not have a documented risk-based antifraud strategy. Although CMS has developed several documents that describe efforts to address fraud, the agency has not developed a risk-based antifraud strategy for Medicare and Medicaid because, as discussed earlier, it has not conducted a fraud risk assessment that would serve as a foundation for such strategy. In 2016, CPI identified five strategic objectives for program integrity, which include antifraud elements and an emphasis on prevention. However, according to CMS officials, these objectives were identified from discussions with CMS leadership and various stakeholders and not through a fraud risk assessment process to identify inherent fraud risks from the universe of potential vulnerabilities, as described earlier and called for in the leading practices. These strategic objectives were presented at an antifraud conference in 2016, but were not announced publicly until the release of the Annual Report to Congress on the Medicare and Medicaid Integrity Programs for Fiscal Year 2015 in June 2017. Stakeholder relationships and communication. CMS has established relationships and communicated with stakeholders, but, without an antifraud strategy, stakeholders we spoke with lacked a common understanding of CMS’s strategic approach. Prior work on practices that can help federal agencies collaborate effectively calls for a strategy that is shared with stakeholders to promote trust and understanding. Once an antifraud strategy is developed, the Fraud Risk Framework calls for managers to collaborate to ensure effective implementation. Although some CMS stakeholders were able to describe various CMS program- integrity priorities and activities, such as home health being a fraud risk priority, the stakeholders could not communicate, articulate, or cite a common CMS strategic approach to address fraud risks in its programs. Incentives. The Fraud Risk Framework discusses creating incentives to help ensure effective implementation of the antifraud strategy once it is developed. Currently, some incentives within stakeholder relationships may complicate CMS’s antifraud efforts. As discussed earlier, CMS is a partner and provides oversight to states’ program-integrity functions. Officials from one state told us that they were reluctant to share their program vulnerabilities because CMS would use this information to later audit the state. Among contractors, CMS encourages information sharing through conferences and workshops; however, competition for CMS business among contractors can be a disincentive to information sharing. CMS officials acknowledged this concern and said that they expect contractors to share information related to fraud schemes, outcomes of investigations, and tips for addressing fraud, but not proprietary information such as algorithms to risk-score providers. Without developing and documenting an antifraud strategy based on a fraud risk assessment, as called for in the design and implement component of the Fraud Risk Framework, CMS cannot ensure that it has a coordinated approach to address the range of fraud risks and to appropriately target and allocate resources for the most-significant risks. Considering fraud risks to which the Medicare and Medicaid programs are most vulnerable, in light of the malicious intent of those who aim to exploit the programs, would help CMS to examine its current control activities and potentially design new ones with recognition of fraudulent behavior it aims to prevent. This focus on fraud is distinct from a broader view of program integrity and improper payments by considering the intentions and incentives of those who aim to deceive rather than well-intentioned providers who make mistakes. Also, continued growth of the programs, such as growth of Medicare Part C and Medicaid managed care, call for consideration of preventive fraud control activities across the entire network of entities involved. Further, considering the large size and complexity of Medicare and Medicaid and the extensive stakeholder network involved in managing fraud in the programs, a strategic approach to managing fraud risks within the programs is essential to ensure that a number of existing control activities and numerous stakeholder relationships and incentives are being aligned to produce desired results. Once developed, an antifraud strategy that is clearly articulated to various CMS stakeholders would help CMS to address fraud risks in a more coordinated and deliberate fashion. Thinking strategically about existing control activities, resources, tools, and information systems could help CMS to leverage resources while continuing to integrate Medicare and Medicaid program-integrity efforts along functional lines. A strategic approach grounded in a comprehensive assessment of fraud risks could also help CMS to identify future enhancements for existing control activities, such as new preventive capabilities for FPS or additional fraud factors in provider enrollment and revalidation, such as provider risk scoring, to stay in step with evolving fraud risks. The evaluate and adapt component of the Fraud Risk Framework calls for federal managers to evaluate outcomes using a risk-based approach and adapt activities to improve fraud risk management. Furthermore, according to federal internal control standards, managers should establish and operate monitoring activities to monitor the internal control system and evaluate the results, which may be compared against an established baseline. Ongoing monitoring and periodic evaluations provide assurances to managers that they are effectively preventing, detecting, and responding to potential fraud. CMS has established monitoring and evaluation mechanisms for its program-integrity activities that it could incorporate into an antifraud strategy. In Medicare, CMS has taken steps to measure the rate of fraud in a particular service area. We have previously reported that agencies may face challenges measuring outcomes of fraud risk management activities in a reliable way. These challenges include the difficulty of measuring the extent of deterred fraud, isolating potential fraud from legitimate activity or other forms of improper payments, and determining the amount of undetected fraud. Despite these challenges, CMS has taken steps to estimate a fraud baseline—meaning the rate of probable fraud—in the home health benefit. In fiscal year 2016, CMS conducted a pretest in the Miami-Dade area of Florida to evaluate its potential measurement approach that could later be used in a nationwide study of probable fraud among home health agencies. The pretest was not a random sample and was not intended to produce a rate of fraud, but instead was intended to test the interview instruments and data-collection methodology CMS might use in a study nationwide. CMS and its contractor collected information from home health agencies, the attending providers, and Medicare beneficiaries in the Miami-Dade area in order to test these interview instruments. CMS completed this pretest, but, according to CMS officials, the agency does not yet have plans to roll out a nationwide study that would estimate a probable fraud rate for the Medicare FFS home health benefit. In its 2015 annual report to Congress, CMS stated that “documenting the baseline amount of fraud in Medicare is of critical importance, as it allows officials to evaluate the success of ongoing fraud prevention activities.” CMS officials working on the pilot told us that having an estimate of the rate of fraud in home health benefits would allow CMS to reliably assess its efforts at eliminating or reducing fraud. Without a baseline, officials said, the agency cannot know whether its antifraud efforts are as effective as they could be. We previously reported that the lack of a baseline for the amount of health-care fraud that exists limits CMS’s ability to determine whether its activities are effectively reducing health care fraud and abuse. A baseline estimate could provide an understanding of the extent of fraud and, with additional information on program activities, could help to inform decision making related to allocation of resources to combat health-care fraud. As described in the Fraud Risk Framework, in the absence of a fraud baseline, agencies can gather additional information on the short-term or intermediate outcomes of some antifraud initiatives, which may be more readily measured. For example, CMS has developed some performance measures to provide a basis for monitoring its progress towards meeting the program-integrity goals set in the HHS Strategic Plan and Annual Performance Plan. Specifically, CMS measures whether it is meeting its goal of “increasing the percentage of Medicare FFS providers and suppliers identified as high risk that receive an administrative action.” CMS does not set specific antifraud goals for other parts of Medicare or Medicaid; other CMS performance measures relate to measuring or reducing improper payments in CHIP, Medicaid, and the various parts of Medicare. CMS uses return-on-investment and savings estimates to measure the effectiveness of its Medicare program-integrity activities and FPS. For example, CMS uses return-on-investment to measure the effectiveness of FPS and, in response to a recommendation we made in 2012, CMS developed outcome-based performance targets and milestones for FPS. CMS has also conducted individual evaluations of its program-integrity activities, such as an interim evaluation of the prior-authorization demonstration for power mobility devices that began in 2012 and is currently implemented in 19 states. Commensurate with greater maturity of control activities in Medicare FFS compared to other parts of Medicare and Medicaid, monitoring and evaluation activities for Medicare Parts C and D and Medicaid are more limited. For example, CMS calculates savings for its program-integrity activities in Medicare Parts C and D, but not a full return-on-investment. CMS officials told us that calculating costs for specific activities is challenging because of overlapping activities among contractors. CMS officials said they continue to refine methods and develop new savings estimates for additional program-integrity activities. According to the Fraud Risk Framework, effective managers develop a strategy and evaluate outcomes using a risk-based approach. In developing an effective strategy and antifraud activities, managers consider the benefits and costs of control activities. Ongoing monitoring and periodic evaluations provide reasonable assurance to managers that they are effectively preventing, detecting, and responding to potential fraud. Monitoring and evaluation activities can also support managers’ decisions about allocating resources, and help them to demonstrate their continued commitment to effectively managing fraud risks. As CMS takes steps to develop an antifraud strategy, it could include plans for refining and building on existing methods such as return-on- investment or savings measures, and setting appropriate targets to evaluate the effectiveness of all of CMS’s antifraud efforts. Such a strategy would help CMS to efficiently allocate program-integrity resources and to ensure that the agency is effectively preventing, detecting, and responding to potential fraud. For example, while doing so would involve challenges, CMS’s strategy could detail plans to advance efforts to measure a potential fraud rate through baseline and periodic measures. Fraud rate measurement efforts could also inform risk assessment activities, identify currently unknown fraud risks, align resources to priority risks, and develop effective outcome metrics for antifraud controls. Such a strategy would also help CMS ensure that it has effective performance measures in place to assess its antifraud efforts beyond those related to providers in Medicare FFS, and establish appropriate targets to measure the agency’s progress in addressing fraud risks. As CMS makes plans to move forward with a strategy and to further develop evaluation and monitoring mechanisms, it will be important to share its efforts with stakeholders. The Fraud Risk Framework states that effective managers communicate lessons learned from fraud risk management activities to stakeholders. For example, CMS could be a leader to states in measuring the effectiveness of program-integrity efforts. Officials in three of the four states we spoke with expressed interest in receiving CMS guidance on how to measure the effectiveness of their Medicaid program-integrity efforts, such as by providing models for how to calculate return-on-investment. Medicare and Medicaid provide health insurance to over 129 million Americans, but the size—in terms of number of beneficiaries and amount of expenditures—as well as complexity of these programs make them inherently susceptible to fraud and improper payments. CMS currently manages these risks across its programs as part of a broader approach to identifying and controlling for multiple sources of improper payments and by developing relationships with an extensive network of stakeholders. In Medicare and Medicaid specifically, we note that CMS has taken many important steps toward implementing a strategic approach for managing fraud. However, the agency could benefit by more fully aligning its efforts with the four components of the Fraud Risk Framework. CMS is well positioned to leverage its fraud risk management efforts— such as demonstrated leadership for combating fraud, existing control activities, and stakeholder relationships—to provide additional antifraud training, as well as to develop an antifraud strategy based on fraud risk assessments for Medicare and Medicaid. We recognize that the effort may be challenging, given the size and complexity of Medicare and Medicaid, and the need to balance antifraud activities with CMS’s other mission priorities. However, by not employing the actions identified in the Fraud Risk Framework and incorporating them in its approach to managing fraud risks, CMS is missing a significant opportunity to better ensure employee vigilance against fraud, and to organize and focus its many antifraud and program-integrity activities and related resources into a comprehensive strategy. Such a strategy would (1) provide reasonable assurance that CMS is targeting the most-significant fraud risks in its programs and (2) help protect the government’s substantial and growing investments in these programs. We are making the following three recommendations to CMS: The Administrator of CMS should provide fraud-awareness training relevant to risks facing CMS programs and require new hires to undergo such training and all employees to undergo training on a recurring basis. (Recommendation 1) The Administrator of CMS should conduct fraud risk assessments for Medicare and Medicaid to include respective fraud risk profiles and plans for regularly updating the assessments and profiles. (Recommendation 2) The Administrator of CMS should, using the results of the fraud risk assessments for Medicare and Medicaid, create, document, implement, and communicate an antifraud strategy that is aligned with and responsive to regularly assessed fraud risks. This strategy should include an approach for monitoring and evaluation. (Recommendation 3) We provided a draft of this report to HHS and DOJ for comment. HHS provided written comments, which are reprinted in appendix I. DOJ did not have comments. HHS and DOJ also provided technical comments, which we incorporated as appropriate. In commenting on this report, HHS agreed with our three recommendations. Specifically, in response to our first recommendation to provide required fraud-awareness training to all employees, HHS stated that it will develop and implement a fraud-awareness training plan to ensure all CMS employees receive training. Regarding our second recommendation to conduct fraud risk assessments for Medicare and Medicaid, HHS stated that it is currently conducting a fraud risk assessment on the federally facilitated marketplace and, when this assessment is complete, will apply the lessons learned in assessing this program to fraud risk assessments of Medicare and Medicaid. In response to our third recommendation to create, document, implement, and communicate an antifraud strategy that is aligned with and responsive to regularly assessed fraud risks, HHS stated that it will develop respective risk-based antifraud strategies after completing fraud risk assessments for Medicare and Medicaid. We are sending copies of this report to the Acting Secretary of Health and Human Services, the Administrator of CMS, the Assistant Attorney General for Administration at DOJ, as well as appropriate congressional committees and other interested parties. In addition, this report is available at no charge on the GAO website at http://www.gao.gov. If you or your staff members have any questions about this report, please contact me at (202) 512-6722 or bagdoyans@gao.gov. Contact points for our Offices of Congressional Relations and Public Affairs may be found on the last page of this report. GAO staff who made contributions to this report are listed in appendix II. In addition to the contact named above, Tonita Gillich (Assistant Director), Irina Carnevale (Analyst-in-Charge), Michael Duane, Laura Sutton Elsberg, and Catrin Jones made key contributions to this report. Also contributing to the report were Lori Achman, James Ashley, Colin Fallon, Leslie V. Gordon, Maria McMullen, Sabrina Streagle, and Shana Wallace.

 

 Report 2:
The RAD program was authorized by Congress and signed into law by the President in November 2011 under the Consolidated and Further Continuing Appropriations Act, 2012 with amendments in 2014, 2015, 2016, and 2017. The RAD program consists of two components. The first component of the RAD program—and the focus of our review— provides PHAs the opportunity to convert units subsidized under HUD’s public housing program and owned by the PHAs to properties with long- term (typically, 15–20 years) project-based voucher (PBV) or project- based rental assistance (PBRA) contracts. These are two forms of Section 8 rental assistance that tie the assistance to the unit to provide subsidized housing to low-income residents. In a RAD conversion, PHA- owned public housing properties can be owned by the PHA, transferred to new public or nonprofit owners, or transferred to private, for-profit owners when necessary to access LIHTC financing, if the PHA preserves its interest in the property in a HUD-approved manner. The second component of RAD converts privately owned properties with expiring subsidies under old rental assistance programs to PBV or PBRA in order to preserve affordability and encourage property rehabilitation. The goals of the RAD program include preserving the affordability of federally assisted rental properties and improving their physical and financial condition. Specifically, postconversion owners (PHAs, nonprofits, or for-profit entities) can leverage the subsidy payments under the newly converted contracts to raise capital through private debt and equity investments, or conventional private debt, to make improvements. The RAD program provides added flexibility for PHAs to access private and public funding sources to supplement public housing funding. These financing sources may include debt financing through public or private lenders; mortgage financing insured by FHA; PHA operating reserves; replacement housing factor funds; seller or take-back financing; deferred developer fees; equity investment generated by the availability of 4 percent and 9 percent LIHTC; or other private or philanthropic sources. PHAs also may pursue various options for their conversions, which often depend on property needs and available financing, including property rehabilitation or new construction. Additionally, PHAs may undertake conversion involving no property rehabilitation or new construction to meet certain financial goals or for future rehabilitation or new construction, as long as the PHA can demonstrate to HUD that the property does not need immediate rehabilitation and can be physically and financially maintained for the term of the Section 8 Housing Assistance Payment contract (HAP contract). The RAD authorizing legislation and RAD Notice also specify requirements for ownership and control of converted properties. That is, converted properties must have public or nonprofit ownership or control, with limited exceptions. The RAD authorizing legislation, RAD Notice, HAP contracts, and RAD Use Agreement also establish procedures to help ensure that public housing remains a public asset should challenges arise, such as default, bankruptcy, or foreclosure. Oversight of RAD conversion and properties is primarily divided among three HUD offices. The Office of Recapitalization is responsible for administering the conversion process but generally does not oversee converted properties. Before conversion, the Office of Public and Indian Housing oversees the properties. After conversion, oversight remains with Public and Indian Housing for properties that convert to PBV contracts and transfers to the Office of Multifamily Housing Programs for PBRA. The RAD program has been implemented and expanded in phases. Since its authorization, the RAD unit cap gradually increased from 60,000 units in 2011 to 225,000 units in May 2017. The RAD program is currently fully subscribed with all 225,000 units allocated. As of September 30, 2017, 689 conversions were closed that involved a total of 74,709 units (see fig. 1 for a breakdown by fiscal year). Additionally, 706 conversions involving 79,078 units were in the process of structuring conversion plans. The remaining conversions under the cap were allocated to specific properties and in the process of having commitments issued or reserved under multi-phase or portfolio awards, according to HUD officials. RAD conversions begin with the submission of an application by PHAs after which they are notified of selection. The PHA is then required to submit a financing plan within 180 days or a later deadline based on the nature of the financing proposed. A RAD conversion is considered closed when the HAP contract is signed and financial documents are executed. The properties are considered converted to Section 8 assisted housing on the effective date of the HAP, which is generally the first day of the following month. Once the RAD conversion is closed, the PHA or ownership entity can move forward with its submitted proposals or RAD-related rehabilitation or new construction and is responsible for complying with RAD requirements and associated contracts. In some cases, rehabilitation can take place in advance of conversion closing if public housing funds are being used. Most RAD conversions involved some type of construction. Our analysis of HUD data showed that as of September 30, 2017 417 of 689 closed conversions (61 percent) involved planned rehabilitation to the property, 86 (12 percent) new construction, and 186 (27 percent) no construction; and 361 of 706 active RAD conversions (51 percent) involved planned rehabilitation, 89 (13 percent) new construction, and 256 (36 percent) no construction. HUD officials stated that they approve conversions that involve no immediate planned rehabilitation or new construction as long as the property has no immediate needs to be addressed. Such conversions allow PHAs to better position themselves to access additional capital to address future rehabilitation or construction plans. Our review of 31 conversion files also showed that the scope of proposed physical changes varied among RAD conversions. For properties that included scope of work narratives, physical changes included renovations to mitigate hazardous materials, aesthetic renovations, code and accessibility compliance, and construction of new buildings, among other changes. Financing for RAD conversions involved multiple public and private sources, but many conversions used LIHTC. Our analysis of HUD data showed that as of September 30, 2017, 173 of 689 closed RAD conversions (25 percent) utilized 4 percent LIHTC, 99 (14 percent) utilized 9-percent LIHTC, and 416 (60 percent) did not use LIHTC. By dollar amount, major financing sources were 4 percent LIHTC at $2.4 billion; new first mortgages at $1.8 billion; and 9 percent LIHTC at $1.1 billion. Construction costs constituted the highest-dollar use of financing for RAD conversions, but not all conversions incurred construction costs, as discussed earlier. On average, construction costs per closed conversion were $6.4 million (ranging from no construction costs to $236 million) and nearly $60,000 per-unit converted to RAD. Construction costs represented the highest-dollar use of financing for closed RAD conversions at $4.4 billion followed by building and land acquisition costs, and developer fees. For more information on financing sources and uses, see appendix II. PHA officials and developers we interviewed cited various factors that influence financing sources needed for RAD conversions. For example, property needs assessments help establish the level of rehabilitation or new construction that would address the capital needs of the property. In turn, needs assessments can derive from physical assessment results and incorporate federal, state, or local compliance requirements. For instance, rehabilitation or construction would need to address the accessibility requirements of the Americans with Disabilities Act and local building codes, among other requirements. PHA officials and developers we interviewed also said they had to consider competition or access to financing for RAD conversions. For example, PHAs noted that tax credit applications and other financing had to be competitive. Some PHAs we interviewed also noted that while the 9 percent LIHTC provides more equity to finance low-income units (finances 70 percent of the costs of the units), there is more competition for the 9 percent LIHTC, while the 4 percent LIHTC can be automatically awarded for certain deals involving tax exempt bonds and federally subsidized projects. Thus, while some PHAs and developers might prefer to obtain 9 percent LIHTC, they often apply for 4 percent LIHTC to increase the chances of obtaining some tax credit equity. For example, one particular PHA that had used both 4 percent and 9 percent LIHTCs noted that in one transaction it had to compete against 74 applicants for 25 available awards of 9 percent credits. The RAD authorizing statute requires HUD to assess and publish findings regarding the amount of private capital leveraged as a result RAD conversions. A leverage ratio relates the dollars other sources provide to the dollars a program provides to an institution or a project. HUD uses various quantitative, qualitative, and processing and efficiency metrics to measure conversion outcomes. To meet the RAD statutory requirement, HUD published an overall RAD leverage ratio that has fluctuated between 19:1 and 9:1 since 2014. HUD’s most recent leverage ratio in fiscal year 2017 was 19:1, nearly double what the agency reported the prior year. We asked HUD officials why the leverage ratio nearly doubled between 2016 and 2017 and received conflicting information during the course of our audit. Initially, officials noted that the ratio was intended to replicate the methodology used by PD&R in its September 2016 report. Subsequently, the officials clarified that they did not follow PD&R’s methodology for categorizing financial source data. Specifically, officials did not review or make manual adjustments to the financial data PHAs entered in open source fields to ensure sources actually represented public, private, or other funding categories when calculating the leverage ratio. Finally, they noted that they disagreed with the methodology used in the PD&R September 2016 report and stated that there are various ways to calculate leverage. For the purposes of announcing the most recent leverage ratio in 2017, HUD officials decided that a leverage ratio comparing federally appropriated public housing resources would reflect the amount of financing leveraged had RAD not existed. We found, and officials from HUD acknowledged, three limitations to the RAD leverage calculation. First, HUD generally had data on funding sources and amounts a RAD conversion proposed to use (at the time of its application to HUD and at the time of closing of construction financing) rather than data after construction is completed on funding sources and amounts. HUD officials stated that they were reviewing final closing packages to confirm that the data reflect the latest reported information on sources and uses of funds for each conversion at closing. However, sources and uses of funds and amounts at the time the RAD conversion is closed may differ from amounts upon completion of construction. In October 2017, HUD implemented procedures to verify completion of planned construction activities and costs, which we discuss later in this report. Second, HUD’s leverage ratio, published in 2017, did not manually adjust funding source data to accurately account for all sources in calculating the leverage ratio for RAD. Specifically, HUD did not isolate funding sources that were federally appropriated, contributed by the PHA, or contributed by state or local municipalities to calculate leverage. For example, among approximately $2 billion from other financial sources, HUD included Moving to Work (MTW) funding (which may include public housing capital funds, public housing operating funds, and voucher funds) and tax credit equity as leveraged sources. However, these are not necessarily private sources, which we explain later in this report. As a result, HUD’s current calculation does not reflect the amount of private- sector leveraging. HUD calculated and published a RAD leverage ratio in May of 2017 using the following formula: Total leverage ratio = (total dollars from all sources – public housing dollars) To calculate the RAD leverage ratio, HUD uses some but not all financial source data it collects (see app. II for a list of data fields collected by HUD). For example, HUD mistakenly excluded data that capture private funds, reducing the amount of total sources in the numerator. HUD calculates “public housing dollars” by adding data that capture replacement factor funds, public housing operating reserve funds, and prior-year public housing capital funds. HUD considers tax credit equity, new first mortgages, and “other funding” data to be non-public housing dollars (see app. II for a list of fields in HUD’s calculation). PHAs enter a description and amount for other funding sources in “other funding” data fields (see app. II). For example, a PHA may enter a federal financial source in one of the open-entry “other funding” data fields, requiring a manual adjustment to properly account for the financial source. According to HUD, additional fields were included in mid-2016 to better differentiate certain sources such as from the HOME Investment Partnerships Program (HOME) and seller take-back financing. Prior to this point, these financial sources were placed into “other” fields, and the standard resource desk report had not been updated until mid-2017 to include all of these fields. Third, HUD does not categorize and report its leveraging by private and public sources. According to HUD officials, informative leverage methodologies could calculate the ratio based on the leveraging of public housing program funds, the leveraging of all federally appropriated funds, or the leveraging of PHA funds (i.e., sources in the transaction that have come from the PHA itself even if not federally appropriated through the public housing program), among other methodologies. The RAD authorizing statute requires HUD to assess and publish findings on the amount of private-sector leveraging. In addition, Standards for Internal Control in the Federal Government require agencies to communicate quality information with external parties, such as other government entities, to make informed decisions and evaluate the entity’s performance in achieving key objectives. HUD also does not use final (postcompletion) funding data in another metric of RAD leveraging. Specifically, in June 2017 HUD publicly reported that RAD “has leveraged more than $4 billion in capital investment in order to make critical repairs and improvements.” HUD calculates this figure by summing the construction costs—a subcomponent of total costs—with data from the time a conversion closes and not upon completion of construction. HUD officials we spoke with clarified that this metric solely reports construction investments and does not reflect any conclusion regarding private leverage of public funds. But, HUD publically characterized this measure in different ways, including as the amount of “public-private investment in distressed public housing,” the amount of “construction achieved under RAD,” and the amount of “new private and public funds leveraged by RAD.” HUD’s 2016 interim report calculated and published multiple leverage ratios, but chose to highlight a RAD leverage ratio that is consistent with ratios used for other HUD programs. However, the ratio does not specifically follow the prescribed ratio language in the authorizing statute because the report states that the ratio represents the amount of private and public external sources invested for every dollar invested by PHAs but the statutory language only discusses private-sector leveraging. Officials further noted that the statute does not require a particular methodology and HUD relies on PD&R—and its independent contractor— to determine the appropriate methodology for purposes of compliance with the statute. Lastly, the statute does not preclude the use of other leverage metrics for other purposes, such as using the ratio to measure the amount of nonpublic housing funds leveraged in RAD transactions that would not be available to the property absent RAD. As a result, HUD’s leverage metrics announced in May 2017 do not accurately reflect the amount of private-sector leveraging achieved through RAD, do include public funding as private sources, and inconsistently measured sources that were federally appropriated or contributed by PHAs, potentially under- or over-reporting the program’s performance. Additionally, in October 2017, HUD began implementing procedures to collect data after construction is completed and is not yet able to calculate a leverage metric using final (postcompletion) financial sources rather than the financial sources collected at closing. The lack of a consistent metric for private leveraging could also lead to inconsistent reporting of the leverage ratio, as has occurred in prior years. We recalculated RAD leverage ratios in a number of different ways, including to correct errors we identified during our review. For example, HUD’s 2016 interim report noted that data on closed transactions do not provide detailed description of “other sources,” requiring a crosswalk between applications and closed transactions to develop estimates for the allocation of “other sources” across financial source categories. Abbreviated descriptions are provided in the form of notes that are not always clear and consistent; therefore public housing sources may include federally appropriated sources, as well state, city, or county sources. Through our estimates, we found that the overall leverage ratio could range from 7.44:1 for a ratio recalculating HUD’s leverage ratio to 1.23:1 for a ratio estimating private-sector leveraging. Recalculation with HUD methodology and financial source recategorization. As discussed previously, HUD’s methodology does not account for all financial data collected by HUD and includes “other” funding sources erroneously considered as leveraged funds. Thus, we manually adjusted RAD funding source data and found that nearly $1.2 billion were erroneously considered leveraged funds because they are not private funds. For example, HUD included MTW funds; public housing operating reserves; public housing capital funds; replacement housing factor funds; other federal funds; other state, local, or county funds; and take-back financing funds as leveraged financial sources. For more information, see appendix II. We obtained documentation from HUD to replicate their methodology and recategorized financial sources that corrected errors in the data, and found that the RAD leverage ratio was less than half of HUD’s most recently publicly reported leverage ratio (19:1), approximately 7.44:1 (see app. II). Recalculation to exclude LIHTC and other federal sources. We previously reported that LIHTCs are considered a federal source because tax credit equity represents foregone federal tax revenue and, therefore, are a direct cost to the government. Accordingly, we recalculated the RAD leverage ratio by excluding all federal funding sources and obtained a ratio of approximately 1.43:1 (see app. II). Recalculation of private-sector leveraging. Lastly, the RAD authorizing statute requires HUD to assess and publish findings on the amount of private-sector leveraging, but HUD’s current calculation does not present the amount of private-sector leveraging and does not include all available data (for example, the “Other Private” funds collected by HUD). We estimated the amount of private-sector leveraging by grouping public housing sources, other public sources, and private sources, resulting in a leverage ratio of approximately 1.23:1 (see app. II). In October 2017, HUD implemented procedures to certify completion after developers finish RAD-approved rehabilitation or construction. Previously, HUD had a limited ability to monitor and evaluate final (postcompletion) physical and financial changes in RAD projects with existing data. According to HUD officials, HUD did not implement completion certification procedures before October 2017 because it had been addressing what it considered to be the highest risks first (such as clarifying requirements for RAD participants, resident safeguards, and other procedural and administrative requirements). HUD’s October 2017 completion certification procedures include instructions for owners to report final construction costs and documentation on completion of repairs or construction within 45 days of the completion date recorded in the RAD Conversion Commitment. More specifically, HUD requires owners to list a final construction cost amount—a subcomponent of total costs—in the RAD resource desk, describe variances from the approved construction cost amount in a comment box, and describe how increases in costs were addressed. Additionally, a third-party must certify that the repairs in the scope of work were completed by providing an attestation to HUD. However, HUD’s procedures do not require documentation from the owners to support the final total cost figures, which include not only construction costs but also building and land acquisition costs, and developer fees, among others as noted earlier in this report. These procedures also do not require a certification from owners on all financing sources and costs recorded in the RAD Conversion Commitment. Standards for Internal Control in the Federal Government require that management implement control activities through documented policies and procedures to provide reasonable assurance that the objectives of the agency will be achieved, and also communicate quality information with external parties to make informed decisions and evaluate the entity’s performance in achieving key objectives. While HUD now has certification completion procedures in place, this process provides the agency limited financial information from owners. As a result, HUD is unable to report metrics that reflect final (postcompletion) RAD financial outcomes after construction is completed. Furthermore, HUD is limited in its ability to effectively oversee conversion budget and cost variances, and expenditures that require HUD approval. Lastly, the RAD authorizing statute requires that the Secretary of HUD demonstrate the feasibility of the RAD conversion model to recapitalize and operate public housing properties under various situations and by leveraging other sources of funding to recapitalize properties. Without metrics that reflect the final (postcompletion) financial outcomes of RAD after construction is completed, HUD and congressional decisionmakers are unable to make informed decisions concerning the RAD program. HUD has not systematically tracked or analyzed household data on residents in RAD-converted units that are available from its public housing or Section 8 databases or from PHAs or other postconversion owners—the main sources of resident data for the RAD program. In addition, HUD has not yet developed monitoring procedures for all the resident safeguards in the RAD program. Finally, residents told us of some concerns about information they received on RAD conversions, communications opportunities, and the relocation process. HUD officials told us that the agency does not systematically track or analyze household-level data on residents in RAD-converted units across existing program databases (HUD maintains household data for the public housing and Section 8 rental assistance programs in two databases). In particular, HUD does not track changes in household characteristics before and after conversion, such as changes in rent, as well as relocations or displacement of individual households. However, according to HUD officials, their databases are not designed to track the impact of RAD conversion on residents and they are unable to electronically link household information submitted before RAD conversion to information submitted after conversion. Once a property is converted, the property and corresponding household information are removed from the public housing database. Owners of converted properties are to use software to manually enter household information into the databases for the Section 8 program when submitting tenant certifications and information for assistance payments. This procedure is the standard for administration of all project-based Section 8 properties. HUD officials stated that they have explored the possibility of transferring household data from one system to another at the time of a property’s conversion. While HUD has not systematically analyzed household information from its public housing and Section 8 databases, we were able to perform a limited analysis. We requested and received data from HUD on the households affected by RAD. Using the data provided that were current as of June 2017, we were able to identify about 26,000 households that lived in units that were converted to a PBV subsidy, but we were unable to identify the total number of households converted to a PBRA subsidy. Based on our analysis of 26,000 PBV households, we found about 2,700 (about 11 percent of) households were headed by an about 6,800 (about 26 percent of) households were headed by an individual with a disability; about 2,700 households (about 10 percent of) households were headed by an elderly person who also had a disability; over half (about 14,000 or 54 percent) of the households were headed by an individual identified as black; close to 11,000 households (about 41 percent) were identified as white; and about 1,000 households (about 4 percent) were identified as Asian. Close to 3,100 households (about 12 percent) were headed by an individual identified as Hispanic; about half (about 49 percent) of the PBV households were single- person households; the median annual income of PBV households both before and after RAD conversion was about $10,000; and about 5,300 (about 20 percent) of households were paying a flat rent rather than income-based rent before RAD conversion. However, the data on PBV households were not comprehensive. For example, while about 10,000 residents (about 57 percent) experienced a rent increase following RAD conversion under PBV, we could not determine if the rent increase was the result of an increase in resident income. We also could not determine changes in location among the PBV households following RAD conversion. Rather than relying on the public housing and Section 8 databases for tracking household information during conversion, HUD officials indicated that the agency will rely on locally maintained resident logs, which contain household information collected by property owners, as the starting point when HUD determines a compliance review is warranted. The logs will be the primary way the agency collects household information for compliance reviews under the RAD program, according to HUD officials. In November 2016, HUD issued a notice, which requires the PHA or other postconversion owner to maintain a log about every household at a converting project, including information on race and ethnicity, household size, and disability. The notice also requires owners to track residence status throughout the relocation process, including whether the resident has returned, moved elsewhere, was permanently relocated or evicted; relocation dates; and details on any temporary housing and moving assistance provided. Owners are required to make the information available to HUD upon request for audits and other purposes. According to HUD officials, the agency expects the information in the resident logs to be more robust than what they would collect through the public housing and Section 8 databases, which do not track residents while they are relocated. HUD officials stated that the agency plans to review selected resident logs as part of an ongoing limited compliance review of about 90 RAD conversion projects. HUD officials told us they are developing procedures for performing compliance reviews—such as developing a mechanism to review a sample of logs on a periodic basis—but they have not yet done so because they have been focusing on developing procedures for activities that present a high risk to the program as described in the following section. HUD has not established a time frame for developing these procedures. However, HUD officials indicated that they plan to select resident logs for review based on risk of noncompliance and do not plan to analyze program-wide information currently collected in the public housing and Section 8 databases for program monitoring. HUD officials also noted that that PD&R is planning to track a sample of residents through its evaluation of the program, which we previously mentioned. While HUD has decided to rely on resident logs because of the difficulty of tracking household information across its program databases, using resident logs to assess the effects of the RAD program on residents has limitations. While the resident logs would contain detailed household information, they were not required prior to November 2016 and may not contain information on households converted before that date (RAD conversions started in 2013). HUD’s public housing and Section 8 databases contain information on such households. Second, as previously mentioned, HUD plans to review resident logs only when there is a risk of noncompliance, but they collect household information in their databases on a rolling basis. Standards for Internal Control in the Federal Government require agencies to use quality information to achieve their objectives, and obtain and evaluate relevant and reliable data in a timely manner for use in effective monitoring. Without a comprehensive review of household information—one based on information in HUD data systems as well as resident logs—HUD cannot reasonably assess the effects of ongoing and completed RAD conversions on residents and compliance with resident safeguards, as discussed in the next section. HUD has not yet developed monitoring procedures for certain resident safeguards under the RAD program. RAD requirements include those intended to ensure that residents whose units are converted through RAD are informed about the conversion process; can continue to live in a converted property following RAD conversion; are afforded certain protections carried over from the public housing are afforded a phase-in of any rent increases under Section 8 program requirements. Currently, based on HUD notice requirements, PHAs must document compliance with three safeguards (PHA plan amendments, resident notification, and procedural rights) in their RAD application and other conversion paperwork. For example, PHAs must submit comprehensive written responses to resident comments received in connection with the required resident meetings with their RAD application. For one safeguard, PHAs are not required to report to HUD but must retain documentation of compliance to be made available to HUD as part of the monitoring for the program. For others, the HUD notice does not specify reporting and monitoring requirements. Based on our review of files for selected conversions, which we previously discussed, we found PHAs generally submitted documentation of their efforts to inform residents about RAD conversion, such as providing evidence to HUD of meetings with residents and written responses to resident questions as required. However, the specific documents for these requirements were not available from HUD in all cases. HUD’s review of amendments to PHA plans was documented in all but one of the conversions we reviewed. Documentation requirements for resident relocations have changed since RAD was introduced, which made the documentation more difficult to assess. HUD developed and started implementing procedures in October 2017 that require owners to certify and provide data supporting compliance with the resident right-to-return requirements. For example, owners must certify the number of residents who exercised their right to return to a converted property compared with the number of residents who did not return. HUD is also developing standard operating procedures to review each conversion for compliance with RAD relocation provisions. Specifically, the procedures would describe the review steps required at different stages of the conversion process, a process for identifying risks, and how to address instances of noncompliance with RAD requirements. Additionally, HUD noted that they have 2 compliance reviews under way including 1 involving a set of HUD requirements that affect relocations of more than 1 year and the limited compliance review of 90 projects that we previously described. HUD officials noted that they are developing additional guidance in other areas. First, HUD officials indicated that as part of an overall update of RAD standard operating procedures, they are developing additional protocols on resident notification and how residents’ comments are addressed through conversion planning. Second, the agency had not been consistently collecting required documentation on “house rules,” which describe the conditions and procedures for evicting residents and terminating assistance at RAD PBRA properties, so it has developed and implemented additional legal review procedures as part of the implementation of RAD resident eviction and grievance procedural rights requirements. According to HUD officials, they have been focusing primarily on right-to-return and relocation requirements because they represent areas of highest risk. HUD has not developed separate monitoring procedures for other resident safeguards—the phase-in of tenant rent increases, resident representation through tenant organizations, and choice mobility requirements. However, HUD officials told us that they plan to assess how administrative data can be used to monitor choice mobility as part of the planning for a separate PD&R evaluation of this safeguard. HUD officials also indicated that there are procedures for residents to report complaints to HUD if resident representation and organization requirements are not met. Standards for Internal Control in the Federal Government require agencies to implement control activities through documented policies and procedures to provide reasonable assurance that agency objectives will be achieved. These standards also require agencies to design procedures to achieve goals and objectives, and identify, analyze, and respond to risks related to achieving the defined objectives. Table 1 includes a description and information on implementation of resident safeguards that most directly affect residents’ experience with the conversion process and ability to live at the property following conversion. Appendix III describes these and other RAD resident safeguards. HUD officials indicated that the safeguards for the phase-in of tenant rent increases, resident representation, procedural rights, and choice mobility presented a lower risk than the right-to-return requirements, so they were a lower priority, and in some cases were addressed through general monitoring of the Section 8 program. For choice mobility options, HUD indicated that its data systems are not designed to track whether residents are able to exercise these options, such as tracking whether residents left a property to exercise choice mobility or for other reasons. All but two of the resident safeguards do not take effect until after a property has been converted and is part of the Section 8 program. For example, residents are only eligible to use vouchers through choice mobility after they have lived in the converted property for 1 or 2 years depending on the assistance contract involved (PBV or PBRA). Moreover, certain RAD safeguards are not typically available for Section 8 residents. For example, RAD establishes resident representation provisions and procedural rights that are more in line with public housing rather than Section 8 requirements. While HUD has indicated that the Section 8 program has experience administering different types of assistance contracts, RAD nonetheless creates separate requirements for certain provisions from the public housing and Section 8 programs. As previously mentioned, RAD conversions have been completed at an increasing pace in the last 5 years. However, because HUD has not yet developed separate monitoring procedures for certain requirements—the phase-in of tenant rent increases, resident representation through tenant organizations, and choice mobility requirements, many of which take effect after a conversion—and without using all available household data, the agency will not be able to reasonably ensure that these safeguards were implemented. Residents who participated in our focus groups expressed some concerns about information they received on RAD conversions, communications opportunities, and the relocation process. Residents indicated that they were notified about RAD conversion in a variety of ways. Residents in 5 of 14 focus groups found the information presented to them on RAD to be helpful. Residents in 7 of 14 focus groups indicated that the information they received was not helpful. Across these focus groups, a range of concerns was expressed, including that the information provided was not always clear or reflective of the final changes resulting from RAD conversion, and that the PHA and management were not always forthcoming with information about the RAD changes. Residents in some focus groups also indicated that they were not involved in the RAD conversion. Residents in 5 of 14 groups indicated that they were not given the opportunity to provide input into the RAD changes, while residents in 6 of 14 groups indicated that their concerns were not addressed and their suggestions were not incorporated. Residents also described problems with relocations. Some of the concerns expressed by resident focus groups on relocation related to the location of the temporary units (3 of 14 focus groups), the timing of relocation or amount of notice given (7 of 14 focus groups), and moving issues (such as items damaged during moves). Residents were asked to describe ways in which RAD conversion improved or harmed their living conditions. Residents in several focus groups indicated that RAD improved their living conditions, including both the condition (7 of 14 focus groups) and appearance of their units or the property in which they lived (6 of 14 focus groups). Some of the changes residents liked included the installation of new appliances, mold and pest removal, and safety and energy efficiency improvements. However, residents in several of the focus groups identified problems with their living conditions following RAD conversion. The problems residents identified included security concerns (10 of 14 focus groups); renovations that were of poor quality (6 of 14 focus groups); and other problems with the units (10 of 14 focus groups), such as pest problems; decreased amenities (8 of 14 focus groups), such as the removal of common areas or in-unit washing machines; and issues with property management (11 of 14 focus groups). For example, in several instances, residents stated that new managers or owners in place following RAD conversion were not responsive to their needs or concerns. During our site visits, residents described other experiences with RAD conversion. Residents in all of the groups identified being notified about RAD. Residents in 9 of 14 focus groups indicated that their rent was the same following RAD conversion. Residents in a few focus groups indicated that their rent had increased because of changes in their income or conversion from a flat rent. However, residents in a few focus groups experienced challenges in how their income was certified for the purpose of calculating rents, such as problems with requests for information (2 of 14 focus groups) and other issues with the process (4 of 14 focus groups). For example, residents reported having to provide the same paperwork multiple times. No instances in which residents were permanently involuntarily displaced were reported. One resident organization expressed concerns about fewer eviction protections and resident representation after RAD conversion. We spoke with 18 PHAs, some of which cited benefits as well as several challenges of RAD participation and some noted HUD responsiveness to their circumstances and concerns. According to many of the PHAs we spoke with, benefits of participating in the RAD program included reducing administrative requirements in Section 8 programs and opening avenues for additional sources of funding. In particular, many of the PHAs noted that RAD allowed them to access tax credit equity and other funding to complete the bulk of their repairs and renovations at once. Over half of the PHAs we spoke with also found HUD to be flexible and responsive to individual PHA circumstances. The majority of PHAs we spoke with indicated that remaining in the public housing program was not tenable because funding for the public housing program was not enough to meet their long-term capital needs. PHAs we contacted also noted several challenges of participating in RAD: financing constraints, timing challenges, and evolving requirements. Financing constraints. Some PHAs noted that program rent requirements can limit PHA participation in RAD. Each year, HUD calculates a contract rent—the total rent for a unit, including operating subsidy and resident contribution. PHAs must use the contract rent to calculate Section 8 subsidies for properties converting under RAD. According to HUD and several PHAs, contract rents for RAD-converted Section 8 units are lower than rents in traditional Section 8 assisted units, and are almost always lower than market-rate rents. Several PHAs and HUD officials have described the difficulty of converting units from the public housing program with this rent limitation. For example, when the cost of needed rehabilitation or construction is high, low allowable contract rents might not be sufficient to access appropriate capital for the conversion. In certain localities, PHAs have found solutions to augment rents and have used RAD flexibilities to allow them to convert and plan for operating expenses. For example, the PHA in Tacoma, Washington, used the Moving to Work program flexibilities to increase contract rents and housing officials in San Francisco used an allowable procedure to transfer RAD assistance from converted buildings to properties throughout its portfolio (each is a blend of traditional project-based vouchers with higher contract rents and RAD assistance). In Montgomery County, Maryland, the PHA similarly included RAD assistance in some mixed-finance properties that contain other high-rent subsidies and market-rate rents. Timing challenges. Some PHAs said they faced major challenges in coordinating RAD timelines with HUD, lenders, or other parties or with the requirements of the LIHTC process. HUD officials acknowledged that PHAs with more complex transactions, including those involved in the LIHTC process, struggle to implement their conversion plans within RAD time frames. HUD officials noted that because there is a statutory cap on the number of units that can be converted under RAD, they have established time frames to stay under the cap and ensure that PHAs that are planning to convert are ready to participate in the program. Additionally, according to HUD, it has made technical assistance available to all PHAs that receive a Commitment to enter into a Housing Assistance Payment contract during the RAD process to help ensure their readiness for RAD closing and to meet remaining conversion deadlines. On the other hand, some PHAs expressed concern to us about delays in the conversion process that put them at risk for missing state LIHTC deadlines. HUD officials described putting conversions on a fast-track on a case-by-case basis to meet LIHTC deadlines. For example, in one case a PHA relocated residents before closing and without HUD approval. HUD required the PHA to fund an escrow account until it was able to determine any payments that might need to be made to residents and any other necessary corrective action. This was done so that HUD could look into the issue while mitigating additional harm to the residents and continuing to move the PHA toward closing and aligned with tax credit application deadlines. The timing of conversion can also create gaps in the payment of Section 8 funds to PHAs. Section 8 funding should begin in January of the year following conversion. PHAs rely on annual public housing subsidies for the conversion year—public housing program funds are paid to PHAs annually and are not recaptured by HUD following RAD conversion. However, according to some PHAs we interviewed, Section 8 funding did not begin on time. For example, in Baltimore, Maryland, subsidy flow after conversion had not begun as of June of the following year. HUD officials told us inadequate guidance from HUD and confusion from PHAs regarding the necessary steps to request payment in a timely manner have been the major cause of the problems. HUD has tried to remedy delays and updated its notice to provide clearer guidance on the timing of subsidy flow around the time of conversion to Section 8. Moreover, HUD officials indicated that there has been confusion among PHAs on how to request funds, so HUD is currently revising and updating the guidance on steps PHAs must take to request payment under the PBRA program. HUD officials also indicated that it has begun monitoring whether new participants are taking the steps needed well before their first request for funding. Some PHAs we contacted also mentioned difficulty in coordinating with HUD on fulfilling internal RAD requirements and reviews. According to some, the different offices involved in RAD conversions within HUD were not well aligned and had different interpretations of the rules. For example, some RAD conversions require a civil rights review by HUD’s Office of Fair Housing and Equal Opportunity Office, including those transactions that require new construction or resident relocations. Some PHAs indicated that such reviews occurred too late in the conversion process even after other HUD offices had approved the conversion. HUD officials acknowledge that different HUD offices have different objectives in the RAD process. HUD officials indicated that the agency is trying to coordinate more effectively among these offices and streamline the conversion process as much as possible. Evolving requirements. While the majority of PHAs with which we spoke said that HUD provided clear, sufficient, and timely information, some PHAs noted that it also was challenging to adapt to evolving requirements. Some PHAs noted that as HUD identified problems in the early years of the program, it would change the guidance in response. For example, HUD officials explained that it had clarified fair housing review requirements in response to PHA concerns that the fair housing review occurred too late in the process and could affect successful conversion of projects. The most recent RAD notice (effective January 2017) is the third version since 2013 and revisions have involved substantial changes. For example, this notice provided PHAs with greater flexibilities on the funding sources they can use to raise initial contract rents and the ways they can demonstrate ownership and control of a converted property. In addition, HUD introduced a notice in November 2016 to strengthen resident protections. Some PHAs told us they found the pace or timing of the evolving requirements difficult to manage and also noted confusion about conversion instructions and guidance due to changing requirements. For example, one PHA indicated that the agency had problems reporting information into a new RAD data field in HUD’s Voucher Management System because there was no guidance at the time on how to complete this field. However, HUD has since included additional instructions in the user’s manual that became effective in April 2017. The Committee has included language to establish procedures that will ensure that public housing remains a public asset in the that event that the project experiences problems, such as default or foreclosure. In each RAD conversion, HUD and the property owner execute a use agreement, which specifies affordability and use restrictions for the property. The use agreement generally exists concurrently with the HAP contract, which is executed to govern the provision of either the PBRA or PBV subsidy for the unit. The use agreement must be recorded in a superior position to new or existing financing or other encumbrances on the converted property. Under a Section 8 HAP contract, residents pay 30 percent of adjusted household income. In the absence of the HAP contract, the use agreement is set up to control the amount paid: If the HAP contract is removed due to breach, noncompliance, or insufficiency of appropriations, under the use agreement new households in all units previously covered under the HAP contract must have incomes at or below 80 percent of the area median income for households of the size occupying an appropriately sized unit for their family size at the time of admission, and rents may not exceed 30 percent of 80 percent of area median income for the remainder of the term of the use agreement. For new residents at or below 80 percent of the area median income, under the use agreement the resident rent contribution without a HAP contract generally would be higher than that paid under a HAP contract, which is based on household income instead of the universally determined area median income. Although the use agreement maintains some level of affordability, the owner receives no subsidy under PBRA or PBV without a HAP contract and resident rent contribution is not tied to individual household income but rather based on a universal area income calculation (see fig. 3). According to HUD officials, other program requirements support the goal of long-term preservation: HAP contracts are executed for 20 years for PBRA or 15–20 years for PBV properties and compliance with all affordability requirements in the HAP and statute and regulation governing the PBRA and PBV programs must be maintained while the contract is in force. According to the authorizing statute, PHAs (for PBV contracts) and HUD (for PBRA contracts) shall offer and project owners shall accept a renewal contract at the expiration of the initial HAP contract and at each subsequent renewal. Each renewal contract will be subject to a RAD use agreement, governing the use of the property consistent with HUD requirements. According to the RAD notice, the project owner also is to establish and maintain a replacement reserve to aid in funding extraordinary maintenance and repair and replacement of capital items. The reserve account must be built up to and maintained at a level determined by HUD to be sufficient to meet projected requirements. According to HUD officials, during the conversion, HUD staff review each capital needs assessment to try to determine whether a property’s capital needs can be addressed over the forthcoming 20-year period. We reviewed 31 completed conversion files, the set of documentation required by HUD to enable a PHA to convert units from public housing to a Section 8 subsidy, and associated RAD contracts. In each file, key contractual protections appeared consistent with program requirements. Specifically, in all cases executed use agreements (which included requirements to limit residency eligibility to households making less than 80 percent of area median income) were included and not altered from the HUD template. In most files we reviewed, we found foreclosure riders were included and that they stated that use agreements would survive foreclosure, meaning that any new owners would take ownership subject to the agreements. Executed HAP contracts, requiring that residents’ contributions be set at 30 percent of adjusted household income, also were present in all files we reviewed. According to HUD officials, PHAs, and two housing groups we spoke with, provisions in the RAD use agreement to keep units affordable appear to be strong, with use and affordability protections designed to survive foreclosure, but the strength of provisions cannot yet be fully determined because the provisions have not yet been tested in foreclosure proceedings or in courts. According to HUD officials, as of October 2017 no RAD properties had entered foreclosure. The RAD authorizing statute requires that ownership be transferred to a capable public entity or, if not one, a capable entity as determined by HUD, or if necessary to fulfill LIHTC requirements for the property, to a HUD-approved for-profit entity (provided the PHA retained sufficient interest in the property). HUD also subjects any subsequent transfer of the property to HUD review and requires the successor ownership to meet these same requirements. As stated in the use agreement, a lien holder must give HUD notice prior to declaring a default and provide HUD concurrent notice with any written filing of foreclosure (providing that the foreclosure sale must not be sooner than 60 days after the notice), but the use agreement does not prohibit a lien holder from foreclosing on the lien or accepting a deed in lieu of foreclosure. The RAD use agreement, which is recorded superior to other liens and places use and affordability restrictions on the property, survives foreclosure. With or without a HAP contract in place, the lender or new owner must maintain the units for low- income households according to the terms of the use agreement. Therefore, according to HUD officials, the lender or new owner has an incentive to identify an appropriate owner and secure HUD approval to avoid a default under the HAP contract, which provides a Section 8 subsidy to the owner. That is, if no HAP contract were in place, the owner would collect only the tenant rent contribution (30 percent of 80 percent of area median income), rather than the tenant rent contribution plus the subsidy. HUD has discretion to enforce or waive certain use and affordability protections. According to the authorizing statute, in the case of foreclosure, bankruptcy, or termination and transfer of assistance for material violation or substantial default, the priority for ownership or control must be provided to a capable public entity, or, if no such entity can be found, to a capable entity as determined by the Secretary of HUD. Additionally, the statute allows the transfer of property to for-profit entities to facilitate the use of LIHTC financing, with requirements to maintain the PHA’s interest, which was discussed above. As of September 30, 2017, about 40 percent of RAD conversions involved LIHTC financing. According to the RAD notice, in the event of a default of a property’s use agreement or HAP contract, HUD may terminate the HAP contract and transfer assistance to another location to retain affordable units. HUD will determine the appropriate location and owner entity for the transferred assistance consistent with statutory goals and requirements for RAD. The RAD use agreement will remain in effect even in the case of abatement or termination of the HAP contract for the term the contract would have run, unless HUD agreed differently in writing. In this case, the RAD notice limits HUD discretion to terminate the use agreement to only cases involving a transfer of assistance to another property. HUD has not yet developed procedures to monitor RAD projects for risks to long-term affordability of units, including default or foreclosure. HUD officials described an ongoing effort to develop oversight procedures it would need to reasonably ensure compliance with RAD agreements and avoid risks to long-term affordability once conversions closed and units moved to Section 8 but, as previously discussed, the agency has not yet completed this effort or fully implemented a monitoring system. HUD officials told us they also planned to develop protocols to more closely monitor properties at risk of foreclosure, including developing indicators, procedures, roles, and responsibilities within HUD, but they have not finalized the design of procedures or fully implemented them. To develop protocols, HUD created an asset management working group in September 2016. The officials also stressed that no one can take possession of or foreclose on a property without HUD involvement and approval. For example, HUD officials said they expect few foreclosures among RAD-converted properties because lenders tend to communicate with the agency early so that it can become involved to prevent foreclosure. HUD officials pointed to a robust structure to oversee program properties in the PBRA program, but stated PBV property oversight continues to be developed by the Office of Public and Indian Housing. According to Standards for Internal Control in the Federal Government, agencies should design procedures to achieve goals and objectives, such as the preservation of unit affordability, and respond to risks, in this case the risk of default or foreclosure or noncompliance with program requirements. Additionally, management should identify, analyze, and respond to risks related to achieving its goals and objectives. According to HUD officials, the agency had not yet fully developed and implemented oversight procedures for postconversion monitoring because since 2012, the agency has focused on RAD start-up and review and oversight procedures for the conversion process. HUD officials also said that many projects would receive ongoing monitoring from other parties, which also could serve as a safeguard for unit affordability and help ensure the appropriate financial and physical condition of the property after RAD conversion. For example, just under half of all RAD properties use LIHTC financing as part of financing packages, which can also include local and state bonds. According to HUD officials, oversight by tax credit allocating agencies, investors, and lenders, while not alone sufficient, helps secure affordable units in a property for the long-term. However, tax credit allocating agencies, investors, and lenders are not signatories to the HAP contract or use agreement and have no formal role in reasonably ensuring that properties meet requirements exclusive to RAD. Although other entities may exercise some oversight of properties, by not developing and implementing procedures for ongoing oversight, HUD in its role as program administrator will not be able to reasonably ensure that properties adhere to requirements or meet basic program goals. Furthermore, without such monitoring HUD would be limited in its ability to identify and assist with properties at risk of foreclosure. RAD was created to demonstrate the feasibility of converting public housing units to other rental assistance programs to help preserve affordable rental units and address the significant backlog of capital needs in the public housing program. However, demonstrating the feasibility of RAD conversion is contingent on collecting and assessing quality information about the conversion projects. HUD has an opportunity to improve the demonstration’s metrics. For instance, implementing robust postclosing oversight and collecting information on financial outcomes upon completion of construction would not only improve HUD’s oversight capabilities but also allow it to report quality information. Moreover, limitations in HUD’s methodology for calculating leverage ratios for RAD may obscure the effect of funding sources used to help fund RAD conversions, potentially under- or over-reporting the program’s capital leveraging. By collecting comprehensive information on final (postcompletion) financing sources and costs and developing quality metrics, HUD would be better positioned to more accurately report the results of the demonstration program. Additionally, a focus on the conversion process itself (and less on its results), and limitations in HUD’s data have contributed to limited monitoring by HUD in other areas. Specifically, by not developing and implementing monitoring procedures to assess the effect of RAD on residents HUD cannot ensure compliance with resident safeguards. Further, HUD collects and maintains household data for the public housing and Section 8 programs, yet it does not systematically use this information to ensure that resident safeguards are in place. Finally, HUD could benefit from additional procedures to assess RAD properties for risks to long-term preservation to be able to respond to property default or foreclosure. We are making the following five recommendations to HUD: HUD’s Assistant Secretary for Housing should include provisions in its postclosing monitoring procedures to collect comprehensive high quality data on financial outcomes upon completion of construction, which could include requiring third-party certification of and collecting supporting documentation for all financing sources and costs. (Recommendation 1) HUD’s Assistant Secretary for Housing should improve the accuracy of RAD leverage metrics—such as better selecting inputs to the leverage ratio calculation and clearly identifying what the leverage ratio measures—and calculate a private-sector leverage ratio. (Recommendation 2) HUD’s Assistant Secretary for Housing should prioritize the development and implementation of monitoring procedures to ensure that resident safeguards are implemented. (Recommendation 3) HUD’s Assistant Secretary for Housing should determine how it can use available program-wide data from public housing and Section 8 databases, in addition to resident logs, for analysis of the use and enforcement of RAD resident protections. (Recommendation 4) HUD’s Assistant Secretary for Housing should prioritize the development and implementation of procedures to assess risks to the preservation of unit affordability. (Recommendation 5) We provided a draft of this report to HUD for comment. HUD provided written comments on the draft report, which are summarized below and reproduced in appendix IV. HUD also provided technical comments, which we incorporated as appropriate. In its comment letter, HUD stated that it agreed with our findings that HUD can improve metrics used to assess program impact and build on existing oversight structures. HUD described actions it intends to take to implement our recommendations to the extent possible and consistent with resource limitations. More specifically, HUD agreed with our first recommendation to ensure it collects comprehensive quality data on financial outcomes in its postclosing monitoring procedures (which could include supporting documentation for all financing sources and costs). HUD agreed it should routinely collect an updated list of funding sources and uses and related documentation when projects had cost overruns or other significant changes. HUD intends to review and revise, as appropriate, required postcompletion certifications. HUD added that in most cases, funding sources and uses do not materially change between closing and construction completion. HUD stated that securing the postclosing information in such cases might be of minimal benefit relative to the additional reporting burden. However, it is not clear how HUD would determine if projects had significant changes in costs or uses because HUD lacks postcompletion information that would show the magnitude of changes. In relation to reporting burden, HUD already has implemented procedures to collect limited financial information following the completion of construction in October 2017. We believe any additional reporting would not be disproportionate to the benefits of improving HUD's oversight capabilities through project completion and enhancing its reporting to more accurately reflect the results of the demonstration program. For our second recommendation to improve the accuracy of RAD leverage metrics and calculate a private-sector leverage ratio, HUD agreed that RAD leverage metrics can be improved. HUD will ensure that the private-sector leverage ratio required by statute is clearly identified and included in its RAD evaluation. HUD also intends to identify a small number of relevant leverage ratios with distinct methodologies and will routinely publish these ratios with clear identification and explanations. In relation to our finding of misidentified funding sources, HUD plans to re- examine its chart of accounts and review prior transaction records to address errors and properly classify transaction sources. In response to our third recommendation to prioritize the development and implementation of monitoring procedures for resident safeguards, HUD agreed that it is important to better document and expedite development and implementation of monitoring procedures. HUD also agreed that additional monitoring was needed to ensure the right of residents to request and move with a tenant-based voucher after a period of residency (choice-mobility). HUD noted that its Office of Policy Development and Research is seeking funding for additional research on RAD with a focus on the use and effect of choice-mobility options, which would inform HUD's monitoring efforts. Finally, while HUD said that we did not find the safeguards to be weak or inadequate, we did not perform an audit designed to assess the safeguards and therefore cannot opine on their adequacy. On the basis of our findings, we found that HUD’s implementation of these safeguards could be strengthened. Regarding our fourth recommendation that HUD determine how it can use available program-wide data and resident logs for analysis of RAD resident protections, HUD agreed to examine how it could use its existing data systems to further enhance its monitoring efforts. HUD added that the systems have limitations, so that the agency also uses other mechanisms to track and monitor implementation of resident protections. For our fifth recommendation to prioritize the development and implementation of procedures to assess risks to the preservation of unit affordability, HUD agreed that it is important to assess and mitigate risks to unit affordability. HUD stated that it employs robust underwriting standards prior to permitting conversion, and relies on existing procedures to conduct ongoing oversight of Project-Based Rental Assistance (PBRA) properties, which we discussed in the draft. However, as we noted, HUD has not yet developed procedures to more closely monitor RAD properties at risk of foreclosure, though it plans to establish indicators of foreclosure risk and oversight roles and responsibilities within HUD. HUD said that since the summer of 2017, it has been evaluating what additional oversight procedures might be needed for RAD Project-Based Voucher properties. HUD also described plans to augment its existing oversight procedures to preserve affordable units in the event of foreclosure by developing protocols in the following areas: transfer of property ownership to a capable entity, transfer of the rental assistance to another site, and protection of residents in the event a Housing Assistance Payment contract was terminated. As agreed with your office, unless you publicly announce the contents of this report earlier, we plan no further distribution until 30 days from the report date. At that time, we will send copies to the Secretary of Housing and Urban Development and other interested parties. In addition, the report will be available at no charge on the GAO website at http://www.gao.gov. If you or your staff have any questions about this report, please contact me at (202) 512-8678 or garciadiazd@gao.gov. Contact points for our Offices of Congressional Relations and Public Affairs are listed on the last page of this report. GAO staff who made major contributions to this report are listed in appendix IV. This report examines aspects of the Department of Housing and Urban Development’s (HUD) Rental Assistance Demonstration (RAD) program. More specifically, this report addresses (1) HUD’s assessment of the physical and financial outcomes of RAD conversion to date; (2) how RAD conversions affected residents and what safeguards were in place to protect them, including while temporarily relocated and during conversion; (3) what challenges, if any, public housing agencies (PHA) faced in implementing RAD; and (4) the extent to which RAD provisions are designed to help preserve the long-term affordability of units. To address all four objectives, we analyzed agency documentation and interviewed officials from HUD. The documentation we reviewed included policies and procedures for RAD; manuals describing HUD data systems; draft policies and procedures for implementing postclosing oversight; and reports on RAD performance. We interviewed HUD headquarters officials from the Office of Recapitalization within the Office of Housing, which oversees the administration of RAD, and the Office of Policy Development and Research (PD&R). We also interviewed PHA officials and developers involved in RAD transactions, as well as selected experts and other stakeholders to obtain their perspectives on RAD. Additionally, we conducted a literature search to identify publications related to RAD. We visited a nonprobability sample of eight PHAs in Maricopa County, Arizona; Alameda County, California; Montgomery County, Maryland; and in the cities of San Francisco, California; Baltimore, Maryland; New Bern, North Carolina; El Paso, Texas; and Tacoma, Washington, to observe housing units before, during, or after renovation when possible as well as common areas that had planned or undergone renovation. We selected sites to include varying PHA sizes, RAD subsidy types, planned rehabilitation and resident relocation, numbers and sizes of RAD transactions, closing dates, constructions costs, and geographic locations across the United States. At each site, we conducted semistructured interviews with PHA officials and, when available, developers (5 sites). We also conducted one or two focus-group interviews with groups of 6– 15 residents who lived at the converted properties to obtain their perspectives and experiences. In each location, we asked the PHAs to invite residents to participate in the focus groups based on their availability. We also met with the Resident Advisory Board in each location that had one. For 7 of 8 site visits, we selected two RAD properties to conduct resident focus groups (in Alameda County, California we held one focus group). We conducted a content analysis based on resident focus group interviews to describe resident experiences and the RAD program’s effects on residents. Utilizing the selection criteria noted above, we conducted semistructured telephonic interviews with an additional nonprobability sample of 10 PHAs in Fresno, California; Fort Collins, Colorado; Dekalb County, Georgia; Chicago, Illinois; Ypsilanti, Michigan; Cuyahoga County, Ohio; Philadelphia; Pennsylvania; Spartanburg, South Carolina; McKinney, Texas; and Yakima, Washington. Because we selected a non-probability sample of PHAs to visit and interview, the information we obtained cannot be generalized more broadly to all PHAs. However, it provides context on RAD particularly on implementation challenges and perspectives on physical and financial impacts, long-term affordability, and resident protections. We also selected the following 11 individuals and organizations as experts and stakeholders: 1. Council of Large Public Housing Authorities 2. National Association of Housing and Redevelopment Officials 3. Center on Budget and Policy Priorities 4. Public Housing Authorities Directors Association 5. National Housing Law Project 6. Community Legal Services of Philadelphia 7. Maryland Legal Aid 8. Disability Rights Maryland 9. Jaime Alison Lee, Associate Professor of Law and Director, Community Development Clinic, University of Baltimore School of Law 10. Yumiko Aratani, Assistant Professor, Columbia University Mailman 11. University of California, Berkeley, Terner Center for Housing We interviewed experts and stakeholders on resident impacts and implementation challenges associated with RAD. The entities may not represent all views on these topics, but their views provide insights on RAD. To select these individuals and groups, we met with three major PHA associations and two resident advocacy groups, and asked for referrals for organizations or individuals with expertise in RAD. We also selected a nonprobability, random sample of 31 RAD conversion files to review. Utilizing HUD RAD Resource Desk data, we randomly selected 31 RAD files for properties that had closed conversion as of June 30, 2017 and that planned to incur construction costs. We used the files to help us determine physical changes to RAD conversions and the impacts of RAD on residents through, for example, relocation. We excluded RAD conversions with no construction costs from the random sample because they would not have physical changes and no resident relocation would occur before or during our review. To address our first objective on the physical and financial outcomes of RAD conversion to date and how HUD measured these outcomes, we first obtained and analyzed HUD data on RAD conversions since RAD’s authorization (from fiscal years 2013 through 2017). We assessed the reliability of these data by reviewing system documentation, interviewing knowledgeable officials about system controls, and conducting electronic testing. We determined that the data were sufficiently reliable for the purposes of describing rehabilitation and new construction in RAD projects and evaluating RAD leveraging metrics. We included in our analysis all RAD conversions that were active or closed. We used these data to determine the number of closed RAD conversions, associated financial sources and uses, subsidy types, and type of construction (rehabilitation, new construction, and no rehabilitation or new construction). In addition, during our interviews with PHAs and developers, we obtained their perspectives on potential contributing factors to financial decisions and type of construction pursued through RAD conversion. As noted earlier, we also reviewed 31 randomly selected files of converted properties with construction costs to describe property physical changes in RAD conversions. Furthermore, we reviewed HUD documents, such as HUD and PD&R evaluations, publications, and policies and procedures to gain additional context for how HUD measures RAD outcomes. We also interviewed HUD officials, including PD&R and Office of Recapitalization officials, on RAD data and metrics, as well as other performance monitoring activities. We further analyzed data from the HUD RAD Resource Desk to determine how these data support HUD’s metrics and performance monitoring activities. As previously mentioned, we determined that these HUD data were sufficiently reliable for the purposes of this report. Specifically, we assessed and calculated RAD leverage ratio and construction activity. We assessed HUD’s performance monitoring activities and reporting against the RAD authorizing statute, Standards for Internal Control in the Federal Government. To recalculate estimates of the RAD leverage metric, we obtained documentation from the Office of Recapitalization to review the methodology used to calculate their most recent leverage ratio. We aligned the methodology they provided with RAD Resource Desk Transaction Log data that was downloaded on August 7, 2017. We replicated HUD’s methodology and matched the data utilized with the descriptors from the Transaction Log. To isolate financial sources and manually adjust the “other source” data, we compiled matched descriptors and funding amounts and categorized each observation based on the funding source description, as a federal source, state/county/city source, or PHA source, among others. For additional information and results, see appendix II. To determine how RAD affected residents in converted units, we analyzed HUD public housing and Section 8 household data before and after conversion (demographic characteristics of residents and changes in rent, income, and location). Specifically, we examined data from 2013— when the first transactions closed—through June 30, 2017. HUD compiled and provided custom extracts of data on households in RAD- converted properties from the Inventory Management System/Public and Indian Housing Information Center (IMS/PIC) (public housing and Section 8 PBV) and Tenant Rental Assistance Certification System (Section 8 PBRA). We assessed the reliability of the data extracts provided by HUD by (1) performing electronic testing of required data elements, (2) reviewing existing information about the data and the system that produced them, and (3) interviewing agency officials knowledgeable about the data. We determined the data on PBV households were sufficiently reliable for the purposes of our reporting objectives, but that the data on PBRA households was not sufficiently reliable for purposes of describing some characteristics of RAD households. For example, in trying to determine participation in the RAD program by year, we received several thousand PBRA entries that preceded the establishment of the RAD program. Moreover, as we previously mentioned, the postconversion household data for PBRA conversions is in a separate data system, so some variables, such as those related to race, ethnicity, rent, and income, differ from the other household data for that program. Because of these limitations, the data for PBRA households were not reliable for purposes of comparing RAD household characteristics before and after conversion as we had intended. To describe safeguards for residents and help ascertain how HUD implemented protections, we reviewed legal protections and requirements in HUD notices, reviewed selected conversion files, and interviewed HUD officials about monitoring and compliance processes. Finally, as previously described, we held focus groups with residents to better understand any effects on their living conditions and quality of life. To determine challenges PHAs faced in implementing RAD, we reviewed HUD guidance and related documents for PHAs in the program. We also interviewed eight PHAs during our site visits and spoke with another 10 PHAs by telephone about the benefits and challenges of participating in the RAD program. To examine provisions designed to help preserve long-term affordability of units, we reviewed the RAD authorizing statute and amendments and HUD notices and interviewed HUD staff to verify our understanding of agency affordability protections. For a sample of 31 randomly selected properties, we examined templates for contractual agreements for RAD closings and analyzed closing documents and contracts to determine if agreements matched program requirements. We interviewed HUD staff and staff of 18 PHAs to obtain viewpoints on the potential strengths or weaknesses of preservation in the case of default or foreclosure. We conducted this performance audit from February 2016 to February 2018 in accordance with generally accepted government auditing standards. Those standards require that we plan and perform the audit to obtain sufficient, appropriate evidence to provide a reasonable basis for our findings and conclusions based on our audit objectives. We believe that the evidence obtained provides a reasonable basis for our findings and conclusions based on our audit objectives. The Department of Housing and Urban Development’s (HUD) Office of Recapitalization collects financial sources and use data from Rental Assistance Demonstration (RAD) participants. Table 2 lists the financial source fields collected by HUD. Table 3 lists the financial cost fields collected by HUD. Table 4 provides additional financial source detail pertaining to HUD’s leverage ratio calculation. Table 5 and Table 6 show the total financial source amounts collected by HUD. Specifically, Table 5 shows total financial source amounts prior to recategorization, while Table 6 shows total financial source amounts after manual adjustments. Manual adjustments included isolating funding source observations in “other funding” fields 1-6 and incorporating them into existing fields, as appropriate. Table 7 replicates HUD’s methodology for calculating the RAD leverage metrics after manual adjustments in HUD data. See Table 4, above, to compare changes in each category. Table 8 recalculates the leverage ratio by deducting federal sources as leveraged sources. Table 9 recalculates the leverage ratio by deducting public sources as leveraged sources (compare to Table 8 above). The Rental Assistance Demonstration (RAD) program has numerous requirements intended to ensure residents whose units are converted through RAD receive certain protections. The following is a description of these safeguards and their reporting and monitoring requirements. The Government Accountability Office, the audit, evaluation, and investigative arm of Congress, exists to support Congress in meeting its constitutional responsibilities and to help improve the performance and accountability of the federal government for the American people. GAO examines the use of public funds; evaluates federal programs and policies; and provides analyses, recommendations, and other assistance to help Congress make informed oversight, policy, and funding decisions. GAO’s commitment to good government is reflected in its core values of accountability, integrity, and reliability. The fastest and easiest way to obtain copies of GAO documents at no cost is through GAO’s website (https://www.gao.gov). Each weekday afternoon, GAO posts on its website newly released reports, testimony, and correspondence. To have GAO e-mail you a list of newly posted products, go to https://www.gao.gov and select “E-mail Updates.” The price of each GAO publication reflects GAO’s actual cost of production and distribution and depends on the number of pages in the publication and whether the publication is printed in color or black and white. Pricing and ordering information is posted on GAO’s website, https://www.gao.gov/ordering.htm. Place orders by calling (202) 512-6000, toll free (866) 801-7077, or TDD (202) 512-2537. Orders may be paid for using American Express, Discover Card, MasterCard, Visa, check, or money order. Call for additional information. Connect with GAO on Facebook, Flickr, Twitter, and YouTube. Subscribe to our RSS Feeds or E-mail Updates. Listen to our Podcasts. Visit GAO on the web at https://www.gao.gov. James-Christian Blockwood, Managing Director, spel@gao.gov, (202) 512-4707 U.S. Government Accountability Office, 441 G Street NW, Room 7814, Washington, DC 20548 Please Print on Recycled Paper. In addition to the individual named above, Paul Schmidt (Assistant Director), Julie Trinder-Clements (Analyst in Charge), Meghana Acharya, Enyinnaya David Aja, Alyssia Borsella, Juan J. Garcia, Ron La Due Lake, Amanda Miller, Marc Molino, Barbara Roesmann, Jessica Sandler, MaryLynn Sergent, Rachel Stoiko, and William Woods made major contributions to this report.

Question: Write a one-page summary of the report 1.

Answer: CMS, an agency within the Department of Health and Human Services (HHS), provides health coverage for over 145 million Americans through its four principal programs, with annual outlays of about $1.1 trillion. GAO has designated the two largest programs, Medicare and Medicaid, as high risk partly due to their vulnerability to fraud, waste, and abuse. In fiscal year 2016, improper payment estimates for these programs totaled about $95 billion. GAO's Fraud Risk Framework and the subsequent enactment of the Fraud Reduction and Data Analytics Act of 2015 have called attention to the importance of federal agencies' antifraud efforts. This report examines (1) CMS's approach for managing fraud risks across its four principal programs, and (2) how CMS's efforts managing fraud risks in Medicare and Medicaid align with the Fraud Risk Framework. GAO reviewed laws and regulations and HHS and CMS documents, such as program-integrity manuals. It also interviewed CMS officials and a sample of CMS stakeholders, including state officials and contractors. GAO selected states based on fraud risk and other factors, such as geographic diversity. GAO selected contractors based on a mix of companies and geographic areas served. The approach that the Centers for Medicare & Medicaid Services (CMS) has taken for managing fraud risks across its four principal programs—Medicare, Medicaid, the Children's Health Insurance Program (CHIP), and the health-insurance marketplaces—is incorporated into its broader program-integrity approach. According to CMS officials, this broader program-integrity approach can help the agency develop control activities to address multiple sources of improper payments, including fraud. As the figure below shows, CMS views fraud as part of a spectrum of actions that may result in improper payments. CMS's efforts managing fraud risks in Medicare and Medicaid partially align with GAO's 2015 A Framework for Managing Fraud Risks in Federal Programs (Fraud Risk Framework). This framework describes leading practices in four components: commit , assess , design and implement , and evaluate and adapt . CMS has shown commitment to combating fraud in part by establishing a dedicated entity—the Center for Program Integrity—to lead antifraud efforts. Furthermore, CMS is offering and requiring antifraud training for stakeholder groups such as providers, beneficiaries, and health-insurance plans. However, CMS does not require fraud-awareness training on a regular basis for employees, a practice that the framework identifies as a way agencies can help create a culture of integrity and compliance. Regarding the assess and design and implement components, CMS has taken steps to identify fraud risks, such as by designating specific provider types as high risk and developing associated control activities. However, it has not conducted a fraud risk assessment for Medicare or Medicaid, and has not designed and implemented a risk-based antifraud strategy. A fraud risk assessment allows managers to fully consider fraud risks to their programs, analyze their likelihood and impact, and prioritize risks. Managers can then design and implement a strategy with specific control activities to mitigate these fraud risks, as well as an appropriate evaluation approach consistent with the evaluate and adapt component. By developing a fraud risk assessment and using that assessment to create an antifraud strategy and evaluation approach, CMS could better ensure that it is addressing the full portfolio of risks and strategically targeting the most-significant fraud risks facing Medicare and Medicaid. GAO recommends that CMS (1) provide and require fraud-awareness training to its employees, (2) conduct fraud risk assessments, and (3) create an antifraud strategy for Medicare and Medicaid, including an approach for evaluation. HHS concurred with GAO's recommendations.