GAO 

United States Government Accountability Office

Report to Congressional Requesters

CENTERS FOR 

MEDICARE AND 

MEDICAID SERVICES

Deficiencies in 

Contract Management 

Internal Control Are 

Pervasive 

October 2009 

GAO-10-60 
What GAO Found

United States Government Accountability Office

Why GAO Did This Study

Highlights

Accountability Integrity Reliability

October 2009

CENTERS FOR MEDICARE AND MEDICAID 

SERVICES 

Deficiencies in Contract Management Internal Control 

Are Pervasive Highlights of GAO-10-60, a report to 

congressional requesters 

As a result of internal control 

deficiencies discussed in GAO’s 

2007 report on certain contracts at 

the Centers for Medicare and 

Medicaid Services (CMS), GAO was 

asked to identify the extent to 

which CMS (1) implemented 

effective control procedures over 

contract actions, and (2) 

established a strong control 

environment for contract 

management. GAO used a 

statistical random sample of 2008 

CMS contract actions (including 

contract awards and modifications) 

to assess CMS internal control 

procedures. The results were 

projected to the population of 2008 

CMS contract actions. GAO also 

determined the extent to which 

CMS implemented 

recommendations GAO made in 

2007 to improve internal control 

over contracting and payments to 

contractors. GAO reviewed 

contract file documentation and 

interviewed senior acquisition 

management officials.

What GAO Recommends

GAO makes 10 recommendations 

for developing policies to improve 

oversight and strengthen CMS’s 

control environment. It also 

reaffirms 7 prior recommendations 

that CMS has not fully 

implemented. CMS concurred with 

the new recommendations, but 

generally disagreed with GAO’s 

assessment of progress on the prior 

recommendations. GAO’s analysis 

confirmed the need for additional 

efforts on these recommendations. 

Pervasive deficiencies in CMS contract management internal control increase 

the risk of improper payments or waste. Specifically, based on our statistical 

random sample of 2008 CMS contract actions, GAO estimates that at least 84.3 

percent of fiscal year 2008 contract actions contained at least one instance 

where a key control was not adequately implemented. GAO also estimates 

that at least 37.2 percent of fiscal year 2008 contract actions had three or more 

instances in which a key control was not adequately implemented. The 

contract actions GAO evaluated were generally subject to the Federal 

Acquisition Regulation. For example, CMS used cost reimbursement contracts 

without first ensuring that the contractor had an adequate accounting system. 

Also, project officers did not always certify invoices for payment. These 

deficiencies were due in part to a lack of agency-specific policies and 

procedures to help ensure proper contracting expenditures. 

These control deficiencies also stem from a weak overall control environment 

as characterized primarily by inadequate strategic planning for staffing and 

funding resources. CMS also did not accurately capture data on the nature and 

extent of its contracting, which hinders CMS’s ability to manage its acquisition 

function by identifying areas of risk, due to a lack of quality assurance 

procedures over data entry. CMS also has not substantially addressed seven of 

the nine recommendations made by GAO in 2007 to improve internal control 

over contracting and payments to contractors. For example, CMS has not 

made progress in clarifying the roles and responsibilities for implementing 

certain contractor oversight responsibilities and, as of July 2009, CMS still had 

a backlog of contacts that were overdue for closeout, putting CMS at 

increased risk of not identifying or recovering improper payments or waste. 

GAO Assessment of CMS Actions to Address Prior Recommendations

GAO recommendation GAO assessment 

1 Develop policies for pre-award contract activities. No action taken 

2 Develop policies regarding cognizant federal agency responsibilities. Actions insufficient 

3 

Develop policies that clarify roles and responsibilities during the 

invoice review process. Completed 

4 

Develop guidelines regarding sufficient detail to support contractor 

invoices. No action taken 

5 Establish criteria for negative certification for payment of invoices. No action taken 

6 Provide training on the invoice review policies. Actions insufficient 

7 Develop a centralized tracking mechanism for employee training. Completed 

8 

Develop a plan to reduce the backlog of contracts eligible for 

closeout. Actions insufficient 

9 Review the questionable payments identified in GAO’s 2007 report. Actions insufficient 

Source: GAO. 

The continuing weaknesses in contracting activities and limited progress in 

addressing known deficiencies will continue to put billions of taxpayer dollars 

at risk of improper payments or waste. View GAO-10-60 or key components. 

For more information, contact Kay Daly at 

(202) 512-9095 or dalykl@gao.gov. 
Page i GAO-10-60 

Contents 

Letter 1

Background 3 

Pervasive Deficiencies in Control Procedures at the Contract Level 

Increase the Risk of Improper Payments or Waste 10 

Weak Control Environment Hinders CMS’s Ability to Manage its 

FAR-based Acquisition Process 20 

Conclusion 31 

Recommendations for Executive Action 32 

Agency Comments and Our Evaluation 34 

Appendix I Scope and Methodology 39 

Appendix II Status of Prior Recommendations 47 

Appendix III Comments from the Centers for Medicare and 

Medicaid Services 50 

Appendix IV GAO Contact and Staff Acknowledgments 60 

Tables 

Table 1: GAO Assessment of Status of CMS Actions Taken to 

Address 2007 Recommendations 24 

Table 2: Contract Actions in the Sample 40 

Table 3: Control Procedures and Detailed Results 41 

Figure 

Figure 1: CMS Contracting Trends between 1998 and 2008 4 

 CMS Contract Management 
Abbreviations 

ACMIS Acquisition Career Management Information System 

CAS Cost Accounting Standards 

CFA cognizant federal agency 

CMS Centers for Medicare and Medicaid Services 

CRB Contract Review Board 

DCAA Defense Contract Audit Agency 

DCIS Departmental Contracts Information System 

FAR Federal Acquisition Regulation 

FPDS-NG Federal Procurement Data System Next Generation 

FTE full time equivalents 

HHS Department of Health and Human Services 

HHSAR Health and Human Services Acquisition Regulations 

MMA Medicare Prescription Drug, Improvement, and 

Modernization Act of 2003 

NIH National Institutes of Health 

T&M time and materials 

OAGM Office of Acquisition and Grants Management 

OFM Office of Financial Management 

OIG Office of the Inspector General 

OMB Office of Management and Budget 

SBA Small Business Administration 

V&V Verification and Validation

This is a work of the U.S. government and is not subject to copyright protection in the 

United States. The published product may be reproduced and distributed in its entirety 

without further permission from GAO. However, because this work may contain 

copyrighted images or other material, permission from the copyright holder may be 

necessary if you wish to reproduce this material separately. 

Page ii GAO-10-60 CMS Contract Management
Page 1 GAO-10-60 

 

United States Government Accountability Office

Washington, DC 20548 

 

October 23, 2009 

Congressional Requesters 

The Centers for Medicare and Medicaid Services (CMS), a component of 

the Department of Health and Human Services (HHS), administers the 

high-risk programs of Medicare and Medicaid,1

 and other programs such as 

the State Children’s Health Insurance Program. CMS relies extensively on 

contractors to assist in carrying out its basic mission, including program 

administration, management, and oversight of its health programs. In fiscal 

year 2008, CMS reported that it obligated $3.6 billion under contracts for a 

variety of goods and services. CMS’s acquisitions include contracts to 

administer, oversee, and audit claims made under the Medicare program; 

provide information technology systems; provide program management 

and consulting services; and operate the 1-800 Medicare help line. 

In November 2007, we reported2

 significant deficiencies in internal control 

over certain contracts used by CMS for start-up administrative services to 

implement programs enacted under the Medicare Prescription Drug, 

Improvement, and Modernization Act of 2003 (MMA).3

 Internal control—

the plans, methods, and procedures used to meet missions, goals, and 

objectives—is the first line of defense in safeguarding assets and 

preventing and detecting fraud and errors and helps government program 

managers achieve desired results through effective stewardship of public 

resources. We reported that CMS’s internal control deficiencies resulted in 

millions of dollars of questionable payments to contractors, primarily 

because CMS did not obtain adequate support for billed costs from certain 

contractors. 

Because of concerns about the implications that these weaknesses may 

have on all CMS contracts generally subject to the requirements of the 

Federal Acquisition Regulation (FAR),4

 you asked us to perform a 

1

 GAO, High Risk Series: An Update, GAO-09-271 (Washington, D.C.: Jan. 22, 2009). 

2

 GAO, Centers for Medicare and Medicaid Services: Internal Control Deficiencies 

Resulted in Millions of Dollars of Questionable Contract Payments, GAO-08-54 

(Washington, D.C.: Nov. 15, 2007). 

3

 Pub. L. No. 108-173, 117 Stat. 2066 (Dec. 8, 2003). 

4

 48 C.F.R. ch. 1. 

 CMS Contract Management 
 

comprehensive, in-depth review of CMS’s contract management practices. 

This report addresses the extent to which (1) CMS implemented effective 

internal control procedures over contract actions to help ensure proper 

contracting expenditures and (2) CMS established a strong control 

environment for contract management. 

To address the extent to which CMS implemented control procedures over 

contract actions, we focused on contracts that were generally subject to 

the FAR (i.e., FAR-based),5

 which represented about $2.5 billion, or about 

70 percent, of total obligations awarded in fiscal year 2008. The FAR is the 

governmentwide regulation containing the rules, standards, and 

requirements for the award, administration, and termination of 

government contracts. Based on the standards for internal control,6

 FAR 

requirements, and agency policies, we identified and evaluated 11 key 

internal control procedures over contract actions, ranging from ensuring 

contractors had adequate accounting systems prior to the use of a cost 

reimbursement contract to certifying invoices for payment. Contract 

actions include new contract awards and modifications to existing 

contracts. We conducted our tests on a statistically random sample7

 of 102 

FAR-based contract actions CMS made in fiscal year 2008 and projected 

the results of our statistical sample conservatively by reporting the lower 

bound of our two-sided, 95 percent confidence interval. We tested a 

variety of contract actions including a range of dollars obligated, different 

contract types (fixed price, cost reimbursement, etc.), and the types of 

goods and services procured. The actions in the sample ranged from a 

$1,000 firm-fixed price contract for newspapers to a $17.5 million 

modification of an information technology contract valued at over $500 

million. For each contract action in the sample, we determined if the 11 

key internal control procedures were implemented by reviewing the 

contract file supporting the action and, where applicable, by obtaining 

additional information from the contracting officer or specialist or senior 

 

5

 Certain CMS contracts, such as the claims administration contracts referred to as fiscal 

intermediaries and carriers, generally are not subject to FAR requirements. CMS is 

transitioning these contracts to FAR-based acquisitions in response to requirements in the 

MMA. This transition, referred to as Medicare contracting reform, should be completed by 

2011. 

6

 GAO, Standards for Internal Control in the Federal Government, GAO/AIMD-00-21.3.1

(Washington, D.C.: November 1999). 

7

 We selected a stratified random sample of 102 contract actions from a population of 2,441 

total contract actions recorded in CMS’s procurement system, PRISM, during fiscal year 

2008. See app. I for additional sample details. 

Page 2 GAO-10-60 CMS Contract Management
 

acquisition management. We also tested the reliability of the data 

contained in CMS’s two acquisition databases. Basic attributes of its 

contract actions, such as contractor name and obligation amount, which 

we found to be reliable for purposes of this report, were used to produce 

the historical obligation information presented in the background section.8

To address the extent to which CMS established a strong control 

environment for contract management, we obtained and reviewed 

documentation regarding contract closeout, acquisition planning, and 

other management information and interviewed officials in the Office of 

Acquisition and Grants Management (OAGM) about its contract 

management processes. We also evaluated whether CMS had addressed 

recommendations we made in our prior report.9

 We used the internal 

control standards as a basis for our evaluation of CMS’s contract 

management control environment. 

Appendix I provides additional details of our scope and methodology. We 

conducted this performance audit from July 2008 to September 2009 in 

accordance with generally accepted government auditing standards. Those 

standards require that we plan and perform the audit to obtain sufficient, 

appropriate evidence to provide a reasonable basis for our findings and 

conclusions based on our audit objectives. We believe that the evidence 

obtained provides a reasonable basis for our findings and conclusions 

based on our audit objectives. 

Background 

Nature and Extent of CMS 

Contracting 

CMS reported total obligations for CMS contracts in fiscal year 2008 were 

$3.6 billion. This amount includes obligations against contracts that 

process Medicare claims as well as obligations to other contractors such 

as those that operate the 1-800 Medicare help line, provide program 

management and consulting services, and support information technology. 

 

8

 An obligation is a definite commitment that creates a legal liability of the government for 

the payment of goods and services ordered or received, or a legal duty on the part of the 

United States that could mature into a legal liability by virtue of actions on the part of the 

other party beyond the control of the United States. Payment may be made immediately or 

in the future. 

9 GAO-08-54. 

Page 3 GAO-10-60 CMS Contract Management
 

The $3.6 billion obligated in 2008 represents a 71 percent increase since 

1998, when $2.1 billion was obligated. 

Since 1998, obligations to fiscal intermediaries, carriers, and Medicare 

Administrative Contractors (contractors that primarily process Medicare 

claims) have decreased approximately 16 percent. Obligations for otherthan-claims processing activities, such as the 1-800 help line, information 

technology and financial management initiatives, and program 

management and consulting services, have increased 466 percent, as 

shown in figure 1. These trends may be explained in part by recent 

changes to the Medicare program, including the movement of functions, 

such as the help line, data centers, and certain financial management 

activities, from the fiscal intermediaries and carriers to specialized 

contractors. These specialized contractors, such as beneficiary contact 

center contractors and enterprise data center contractors, are categorized 

below as other-than-claims processing contractors. 

Figure 1: CMS Contracting Trends between 1998 and 2008 

Source: GAO analysis of CMS-provided obligation data from the PRISM database.

0.0

0.5

1.0

1.5

2.0

2.5

3.0

0

100

-100

200

300

400

500

FY98

FY99

FY00

FY01

FY02

FY03

FY04

FY05

FY06

FY07

FY08

FY98

FY99

FY00

FY01

FY02

FY03

FY04

FY05

FY06

FY07

FY08

Dollars in billions

Percent increase (based on 1998)

Non-claims processing

Claims processing

Non-claims processing

Claims processing

-16%

466%

Page 4 GAO-10-60 CMS Contract Management
 

MMA required CMS to transition its Medicare claims processing contracts, 

which generally did not follow the FAR, to the FAR environment through 

the award of contracts to Medicare Administrative Contractors. CMS 

projected that the transition, referred to as Medicare contracting reform, 

would produce administrative cost savings due to the effects of 

competition and contract consolidation as well as produce Medicare trust 

fund savings due to a reduction in the amount of improper benefit 

payments. Additionally, the transition would subject millions of dollars of 

CMS acquisitions to the rules, standards, and requirements for the award, 

administration, and termination of government contracts in the FAR. 

Obligations to the new Medicare Administrative Contractors were first 

made in fiscal year 2007. CMS is required to complete Medicare 

contracting reform by 2011. As of September 1, 2009, 19 contracts have 

been awarded10 to Medicare Administrative Contractors, totaling about $1 

billion in obligations to date. 

Except for certain Medicare claims processing contracts,11 CMS contracts 

are generally required to be awarded and administered in accordance with 

general government procurement laws12 and regulations such as the FAR; 

the Health and Human Services Acquisition Regulations (HHSAR);13 the 

Cost Accounting Standards (CAS);14 and the terms of the contract. 

Overview of CMS Contract 

Management 

At CMS, OAGM manages contracting activities and is responsible for, 

among other things, (1) developing policy and procedures for use by 

acquisition staff; (2) coordinating and conducting acquisition training; and 

 

10 Of the 19 contracts awarded, 6 are under protest and are not yet operational. 

11 CMS contracts with fiscal intermediaries and carriers for Medicare claims processing 

generally do not follow the FAR. 

12 Title 41, United States Code. 

13 48 C.F.R. ch. 3. 

14 48 C.F.R. ch. 99. These standards are mandatory for use by all executive agencies and by 

contractors and subcontractors in estimating, accumulating, and reporting costs in 

connection with pricing and administration of, and settlement of disputes concerning, all 

negotiated prime contract and subcontract procurements with the U.S. government in 

excess of $500,000. Certain contracts or subcontracts are exempt from CAS, such as those 

that are fixed price or those with a small business. Additionally, contractors that received 

less than $50 million in net awards in the prior accounting period are subject to only 

certain CAS standards, known as modified coverage. The FAR incorporates the CAS, see 48 

C.F.R. §30.101(b). 

Page 5 GAO-10-60 CMS Contract Management
 

(3) negotiation, award, administration, and termination of contracts. 

Multiple key players work together to monitor different aspects of 

contractor performance and execute pre-award and post-award contract 

oversight. All but one of the key roles described below are managed 

centrally in OAGM. The last, project officers, are assigned from CMS 

program offices. 

• Contracting officers are responsible for ensuring performance of all 

necessary actions for effective contracting, overseeing contractor 

compliance with the terms of the contract, and safeguarding the 

interests of the government in its contractual relationships. The 

contracting officer is authorized to enter into, modify, and terminate 

contracts. According to OAGM’s invoice review policy, contracting 

officers, with the assistance of the contract specialists, review 

contractor invoices for compliance with contract terms, among other 

things. 

• Contract specialists represent and assist the contracting officers with 

the contract, but are generally not authorized to commit or bind the 

government. The contract specialist assists with the invoice review 

process. 

• The cost/price team serves as an in-house consultant to others 

involved in the contracting process at CMS. By request, the team, 

which consists of four contract auditors, provides support for 

contract administration including reviewing cost proposals, 

consultations about the allowability of costs billed on invoices, and 

assistance during contract closeout. 

• Project officers serve as the contracting officer’s technical 

representative designated to monitor the contractor’s progress, 

including the surveillance and assessment of performance and 

compliance with project objectives. According to OAGM invoice 

review policy, project officers review certain invoice elements, such 

as labor and direct costs, and are required to certify whether the 

invoice is approved for payment by signing a Payments and Progress 

Certification Form. They may also conduct periodic analyses of 

contractor performance and cost data. 

CMS utilizes two different databases of acquisition information for a 

variety of internal and external reporting on its acquisition activities. The 

PRISM database contains basic information such as contract number, 

vendor name, and amount obligated. PRISM is used to develop contract 

Page 6 GAO-10-60 CMS Contract Management
 

documents and for internal reporting and acquisition planning. The 

Enhanced Departmental Contracts Information System (DCIS) is an HHS 

database that is used for department-level acquisition management and to 

satisfy external reporting requirements. DCIS collects and forwards 

information to the Federal Procurement Data System Next Generation 

(FPDS-NG), which is a publicly available database of governmentwide 

acquisition information. Likewise, FPDS-NG feeds into 

www.usaspending.gov, a Web site created in response to the Federal 

Funding Accountability and Transparency Act of 2006,15 which required a 

single searchable Web site, accessible by the public for free, that reports 

key information for each federal award. 

Federal Acquisition, 

Contract Types, and 

Cognizant Federal Agency 

Responsibilities 

The contract life cycle includes many acquisition and administrative 

activities. Prior to award, an agency identifies a need; develops a 

requirements package; determines the method of contracting; solicits and 

evaluates bids or proposals; and ultimately awards a contract. After 

contract award, the agency performs contract administration and contract 

closeout. Contract administration involves monitoring the contractor’s 

performance as well as reviewing and approving (or disapproving) the 

contractor’s request for payment. Other tasks may include audits or 

reviews of the contractor’s costs and compliance with CAS. The contract 

closeout process involves verifying that the goods or services were 

provided and that administrative matters are completed, including a 

contract audit of costs billed to the government and adjusting for any overor underpayments based on the final invoice. 

Agencies may choose among different contract types to acquire goods and 

services. This choice is the principal means that agencies have for 

allocating risk between the government and the contractor. Contract types 

can be grouped into three broad categories: fixed price contracts, cost 

reimbursement contracts, and time and materials (T&M) contracts. 

Although the FAR places limitations on the use of cost reimbursement and 

T&M contract types, these contract types may be used to provide the 

flexibility needed by the government to acquire the large variety and 

volume of supplies and services it needs. As discussed below, these three 

types of contracts place different levels of risk on the government and the 

contractor. Generally, the government manages its risk, in part, through 

oversight activities. 

 

15 Pub. L. No. 109-282, 120 Stat. 1186 (Sept. 26, 2006). 

Page 7 GAO-10-60 CMS Contract Management
 

• For fixed price contracts, the government agrees to pay a set price for 

goods or services regardless of the actual cost to the contractor. A 

fixed price contract is ordinarily in the government’s interest when 

the risk involved is minimal or can be predicted with an acceptable 

degree of certainty and a sound basis for pricing exists, as the 

contractor assumes the risk for cost overruns. 

• Under cost reimbursement contracts, the government agrees to pay 

those costs of the contractor that are allowable, reasonable, and 

allocable to the extent prescribed by the contract. The government 

assumes most of the cost risk because the contractor is only required 

to provide its best effort to meet contract objectives within the 

estimated cost. If this cannot be done, the government can provide 

additional funds to complete the effort, decide not to provide 

additional funds, or terminate the contract. Cost reimbursement 

contracts may be used only when the contractor’s accounting system 

is adequate for determining costs applicable to the contract and 

appropriate government surveillance during performance will provide 

reasonable assurance that efficient methods and effective cost 

controls are used.16 In order to determine if the contractor has 

efficient methods and effective cost controls, contracting officers and 

other contracting oversight personnel may perform a comprehensive 

review of contractor invoices to determine if the contractor is billing 

costs in accordance with the contract terms and applicable 

government regulations. In addition, the establishment of provisional 

and final indirect cost rates helps to ensure that the government 

makes payments for costs that are allowable, reasonable, and 

allocable to the extent prescribed by the contract. 

• For T&M contracts, the government agrees to pay fixed per-hour labor 

rates and to reimburse other costs directly related to the contract, 

such as materials, equipment, or travel, based on cost. Like cost 

reimbursement contracts, the government assumes the cost risk 

because the contractor is only required to make a good faith effort to 

meet the government’s needs within a ceiling price. A T&M contract 

may be used only if the contracting officer prepares a determination 

and findings that no other contract type is suitable and if the contract 

includes a ceiling price that the contractor exceeds at its own risk.17 In 

addition, since these contracts provide no positive profit incentive for 

 

16 48 C.F.R. §§ 16.104(h), 16.301-3(a). 

17 48 C.F.R. § 16.601(d). 

Page 8 GAO-10-60 CMS Contract Management
 

the contractor to control costs or use labor efficiently, the 

government must conduct appropriate surveillance of contractor 

performance to ensure efficient methods and effective cost controls 

are being used. 

The FAR defines cognizant federal agency (CFA) as the agency 

responsible for establishing forward pricing rates,18 final indirect cost rates 

(when not accomplished by a designated contract auditor), and 

administering cost accounting standards for all contracts in a business 

unit.19 Generally, the CFA is the agency with the largest dollar amount of 

negotiated contracts, including options, with the contractor. In addition, 

the CFA may be responsible for establishing provisional indirect cost rates 

(also known as “billing rates”)20 based on recent reviews, previous rate 

audits, experience, or similar reliable data to ensure that estimates are as 

close as possible to final indirect cost rates anticipated. 

Internal Control The Standards for Internal Control in the Federal Government provide 

the overall framework for establishing and maintaining internal control 

and for identifying and addressing areas at greatest risk of fraud, waste, 

abuse, and mismanagement. These standards provide that—to be 

effective—an entity’s management should establish both a supportive 

overall control environment and specific control activities directed at 

carrying out its objectives. As such, an entity’s management should 

establish and maintain an environment that sets a positive and supportive 

attitude towards control and conscientious management. A positive 

control environment provides discipline and structure as well as a climate 

supportive of quality internal control, and includes an assessment of the 

risks the agency faces from both external and internal sources. Control 

activities are the policies, procedures, techniques, and mechanisms that 

enforce management’s directives and help ensure that actions are taken to 

address risks. The standards further provide that information should be 

recorded and communicated to management and oversight officials in a 

form and within a time frame that enables them to carry out their 

responsibilities. Finally, an entity should have internal control monitoring 

 

18 Forward pricing rates represent an agreement negotiated between a contractor and the 

government to make certain rates available during a specified period for use in pricing 

contracts or modifications. 

19 48 C.F.R. §§ 2.101. See 48 C.F.R. §§ 42.302(a), 42.703-1, 30.601. 

20 48 C.F.R. § 42.704(a) and (b). 

Page 9 GAO-10-60 CMS Contract Management
 

activities in place to assess the quality of performance over time and 

ensure that the findings of audits and other reviews are promptly resolved. 

Control activities include both preventive and detective controls. 

Preventive controls—such as invoice review prior to payment—are 

controls designed to prevent errors, improper payments, or waste, while 

detective controls—such as incurred cost audits—are designed to identify 

errors or improper payments after the payment is made. A sound system 

of internal control contains a balance of both preventive and detective 

controls that is appropriate for the agency’s operations. While detective 

controls are beneficial in that they identify funds that may have been 

inappropriately paid and should be returned to the government, preventive 

controls such as accounting system reviews and invoice reviews help to 

reduce the risk of improper payments or waste before they occur. A key 

concept introduced in our standards is that control activities selected for 

implementation be cost beneficial. Generally it is more effective and 

efficient to prevent improper payments. A control activity can be 

preventive, detective, or both based on when the control occurs in the 

contract life cycle. 

We found pervasive deficiencies in internal control over contracting and 

payments to contractors. The internal control deficiencies occurred 

throughout the contracting process, that is both pre- and post-award, and 

increase the risk of improper payments or waste. These deficiencies were 

due in part to a lack of agency-specific policies and procedures to ensure 

that FAR requirements and other control objectives were met. CMS also 

did not take appropriate steps to ensure that existing policies were 

properly implemented nor maintain adequate documentation in its 

contract files. Further, the Contract Review Board was not effective in 

ensuring proper contract award actions. These internal control 

deficiencies are a manifestation of CMS’s weak overall control 

environment, which is discussed later. 

Pervasive 

Deficiencies in 

Control Procedures at 

the Contract Level 

Increase the Risk of 

Improper Payments 

or Waste 

As a result of our work, we estimate that at least 84.3 percent21 of FARbased contract actions made by CMS in fiscal year 2008 contained at least 

one instance in which a key control was not adequately implemented. (See 

table 3 in app. I for a list of the 11 controls we tested, which ranged from 

 

21 Based on the results of our work, we are 95 percent confident that the percentage of 

contract actions that did not meet at least one control test is at least 84.3 percent. 

Page 10 GAO-10-60 CMS Contract Management
 

ensuring contractors had adequate accounting systems prior to the use of 

a cost reimbursement contract to certifying invoices for payment.) Not 

only was the number of internal control deficiencies widespread, but also 

many contract actions had more than one deficiency. We also estimate 

that at least 37.2 percent22 of FAR-based contract actions made in fiscal 

year 2008 had three or more instances in which a key control was not 

adequately implemented. The high percentage of deficiencies indicates a 

serious failure of control procedures over FAR-based acquisitions, thereby 

creating a heightened risk of making improper payments or waste. We 

determined a control to be “key” based on our review of the standards for 

internal control as well as the FAR, HHSAR, and agency policies and 

whether inadequate implementation would significantly increase the risk 

of improper payments or waste. We also took into consideration prior 

audit findings and the contract types CMS most frequently used. See 

appendix I for additional details on the controls we tested and the 

statistical sample results. We project the results of our statistical sample 

conservatively by reporting the lower bound of our two-sided, 95 percent 

confidence interval. 

CMS’s Lack of Policies and 

Procedures Resulted in 

Numerous Control 

Deficiencies 

The control deficiencies we found were primarily caused by a lack of 

agency-specific policies and procedures that would help ensure that 

applicable FAR requirements, agency policies, and other control 

objectives were met. CMS did not always meet FAR requirements for 

specific contract types that were awarded, nor maintain adequate support 

for approved provisional indirect cost rates, which are necessary to 

determine the reasonableness of indirect costs billed on invoices. 

Additionally, CMS did not timely perform or request audits of incurred 

direct and indirect costs, which provide assurance that costs billed by the 

contractor are allowable and reasonable under the terms of the contract 

and applicable government regulations. These control deficiencies are 

discussed in detail below and the results of the other control procedures 

we tested can be found in appendix I. 

• We estimate that at least 46.0 percent of fiscal year 2008 CMS 

contract actions did not meet the FAR requirements applicable 

 

22 Based on the results of our work, we are 95 percent confident that the percentage of 

contract actions that did not meet three or more control tests is at least 37.2 percent. 

Page 11 GAO-10-60 CMS Contract Management
 

to the specific contract type awarded.23 Sixteen contract actions 

we tested had deficiencies—of which 1 related to a letter contract,24 9 

related to cost reimbursement contracts, and 6 related to T&M 

contracts. In the case of the letter contract, the contract file did not 

contain the authorization for use of the letter contract, which is 

required by HHSAR.25 In the case of cost reimbursement contracts, the 

FAR states that a cost reimbursement contract may be used only 

when the contractor’s accounting system is adequate for determining 

costs applicable to the contract.26 Of the contract awards in our 

sample, we found 9 cases in which cost reimbursement contracts 

were used without first ensuring that the contractor had an adequate 

accounting system. An adequate contractor accounting system is key 

to the government’s ability to perform the various contract oversight 

activities required by the FAR for cost reimbursement contracts. In 

particular, contracting officers and other members of the federal 

agency acquisition workforce rely on the contractors’ contract 

proposals, interim billings, provisional indirect cost rates, and reports 

of actual costs incurred (which are used to finalize the direct and 

indirect costs billed) all of which are generated from data maintained 

in the contractor’s accounting system. In addition to the 9 cases 

above, during our review of modifications we observed another 6 

cases in which cost reimbursement contracts were used even though 

CMS was aware that the contractor’s accounting system was 

inadequate at the time of award. In one instance, the contracting 

officer was aware that a contractor had an inadequate accounting 

system resulting from numerous instances of noncompliance with 

CAS. Using a cost reimbursement contract when a contractor does 

not have an adequate accounting system hinders the government’s 

ability to fulfill its oversight duties throughout the contract life cycle. 

Additionally, it increases risk of improper payments and the risk that 

costs billed can not be substantiated during an audit. 

 

23 We identified 25 contract actions to which FAR requirements specific to the contract 

type awarded applied, of which 16 contract actions did not meet the control test. Based on 

the results of our work, we are 95 percent confident that the total percentage of contract 

actions that did not meet the control test is at least 46.0 percent. 

24 A letter contract is a written preliminary contractual instrument that authorizes the 

contractor to begin immediately manufacturing supplies or performing services. 

25 48 C.F.R. § 316.603-3. 

26 48 C.F.R. §§ 16.104(h), 16.301-3. The lack of evidence of an adequate accounting system 

on a cost reimbursement contract may also indicate that a prospective contractor is not 

responsible. See 48 C.F.R. § 9.104-1(e) and B-239114, Matter of: Henry G. Kirschenmann, 

Jr., July 23, 1990. 

Page 12 GAO-10-60 CMS Contract Management
 

When choosing to use T&M contracts, the FAR requires contracting 

officers to prepare and sign a determination and finding that no other 

contract type is suitable for the acquisition.27 The justification is 

required to set forth enough facts and circumstances to clearly and 

convincingly justify the specific determination made.28 We found that 

the determination and finding was either not documented or 

insufficient in six T&M contract awards we reviewed. In cases when 

the justification memorandum was prepared, contracting officers 

merely quoted language from the FAR but did not set forth clear and 

convincing findings—that is, the particular circumstances, facts, or 

reasoning essential to support the determination—for why other 

contract types could not be used. When the contracting officer does 

not clearly and convincingly document the findings that support using 

a T&M contract type, OAGM does not have assurance that the 

appropriate contract type was used. In addition, for three of the 

contract actions, the contract specialist told us that the actions the 

document listed to mitigate the risk of awarding a T&M contract were 

not performed. Because CMS did not carry out the stated mitigation 

strategies used to justify the selection of the T&M contract type, it 

increased its exposure to the risk of improper payments or waste. 

• We estimate that for at least 40.4 percent of fiscal year 2008 

contract actions, CMS did not have sufficient support for 

provisional indirect cost rates nor did it identify instances 

when a contractor billed rates higher than the rates that were 

approved for use.29 Specifically, for 17 contract actions that utilized 

indirect cost rates, CMS did not have documentation supporting what 

would be the appropriate provisional indirect cost rates for the 

contractor. For an additional 19 contract actions, the provisional rates 

either did not match the indirect rates billed on the invoices or could 

not be matched because the invoice did not provide sufficient detail.30

The FAR states that provisional indirect cost rates shall be used in 

 

27 48 C.F.R. § 16.601(d). 

28 48 C.F.R. § 1.704. 

29 We identified 62 contract actions to which provisional indirect cost rates applied, of 

which 36 contract actions did not meet the control test. Based on the results of our work, 

we are 95 percent confident that the total percentage of contract actions that did not meet 

the control test is at least 40.4 percent. 

30 In some cases, the contractor billed indirect costs following a different structure or the 

contractor did not provide sufficient detail on the invoice (such as the rate and base to 

which the rate is applied) to allow a match to the approved provisional indirect cost rates. 

Page 13 GAO-10-60 CMS Contract Management
 

reimbursing indirect costs such as fringe benefits or overhead costs 

under cost reimbursement contracts31 and are used to prevent 

substantial overpayment or underpayment of indirect costs.32 These 

rates are generally established by the CFA, contracting officer, or 

auditor on the basis of reliable data or previous rate audits and should 

be set as close as possible to the anticipated final indirect cost rates.33

Provisional indirect cost rates provide agencies with a mechanism by 

which to determine if the indirect costs billed on invoices are 

reasonable for the services provided until such time that final indirect 

cost rates can be established, generally at the end of the contractor’s 

fiscal year. Approval of provisional indirect cost rates is important 

given the fact that indirect costs can be more than 50 percent of the 

total invoice amount. When the agency does not maintain adequate 

support for provisional indirect rates, it increases its risk of making 

improper payments. 

• We estimate that for at least 52.6 percent of fiscal year 2008 

contract actions, CMS did not have support for final indirect 

cost rates.34 Specifically, 23 contract actions we tested did not have 

documentation of final indirect cost rates or support for the prompt 

request of an audit of indirect costs.35 The FAR states that final 

indirect cost rates, which are based on the actual indirect costs 

incurred during a given fiscal year, shall be used in reimbursing 

 

31 48 C.F.R. § 42.703-1(b). Provisional indirect cost rates, sometimes called a materials 

handling rate, may also be used on some T&M contracts. 48 C.F.R. §§ 16.307(a)(1), 52.216-7. 

32 48 C.F.R. § 52.216-7(e)(2). 

33 48 C.F.R. § 42.704(b). 

34 We identified 34 contract actions to which final indirect cost rates applied, of which 23 

contract actions did not meet the control test. Based on the results of our work, we are 95 

percent confident that the total percentage of contract actions that did not meet the control 

test is at least 52.6 percent. 

35 48 C.F.R. § 52.216-7(d)(2)(i) and (ii) requires that contractors submit a report of their 

incurred costs (both direct and indirect) to the government no later than 6 months after the 

end of their fiscal year. The FAR states that the government should establish final indirect 

cost rates as “promptly as practical” after the receipt of the contractor’s report of incurred 

costs. For purposes of this report, we defined “promptly” as an audit or request for an audit 

within 12 months of the due date of the incurred cost report, or a total of 18 months from 

the end of the contractor’s fiscal year. In our view, 12 months from the due date of the 

incurred cost report allows sufficient time for the agency to determine the financial 

resources necessary to perform the audit or pay another agency, such as the Defense 

Contract Audit Agency (DCAA), to perform the audit. 

Page 14 GAO-10-60 CMS Contract Management
 

indirect costs under cost reimbursement contracts.36 The amounts a 

contractor billed using provisional indirect cost rates are adjusted 

annually for final indirect cost rates providing a mechanism for the 

government to timely ensure that indirect costs are allowable and 

allocable to the contract. Final indirect cost rates are generally 

negotiated by the government’s negotiating team that includes the 

CFA following an audit of a statement of incurred costs submitted by 

the contractor.37 CMS officials told us that they generally adjust for 

final indirect cost rates during contract closeout at the end of the 

contract performance rather than annually mainly due to the cost and 

effort the adjustment takes. Moreover, since final indirect cost rates 

are established by the CFA, when CMS is not the CFA, CMS must wait 

on the CFA to perform the necessary audit work required to establish 

the final indirect cost rates. Not annually adjusting for final indirect 

cost rates increases the risk that CMS is paying for costs that are not 

allowable or allocable to the contract. Furthermore, putting off the 

control activity until the end of contract performance increases the 

risk of overpaying for indirect costs during contract performance and 

may make identification or recovery of any unallowable costs during 

contract closeout more difficult due to the passage of time. 

• We estimate that for at least 54.9 percent of fiscal year 2008 

contract actions, CMS did not promptly perform or request an 

audit of direct costs.38 We found that 25 contract actions for which 

this control applied did not have an audit of direct costs promptly39

performed or requested. Similar to the audit of indirect costs, audits 

of direct costs allow the government to verify that the costs billed by 

the contractor were allowable, reasonable, and allocable to the 

contract. The audit of direct costs is the responsibility of the 

 

36 48 C.F.R. § 42.703-1(b). 

37 48 C.F.R. § 42.705-1(a) and (b)(1). 

38 We identified 36 contract actions to which an audit of direct costs applied, of which 25 

contract actions did not meet the control test. Based on the results of our work, we are 95 

percent confident that the total percentage of contract actions that did not meet the control 

test is at least 54.9 percent. 

39 For purposes of this report, we defined “promptly” as an audit or request for an audit 

within 12 months of the due date of the incurred cost report, or a total of 18 months from 

the end of the contractor’s fiscal year. In our view, 12 months from the due date of the 

incurred cost report allows sufficient time for the agency to determine the financial 

resources necessary to perform the audit or pay another agency, such as DCAA, to perform 

the audit. 

Page 15 GAO-10-60 CMS Contract Management
 

contracting officer; however, the contracting officer may request, for 

a fee, that the CFA for the contractor perform the audit work. The 

FAR does not provide time frames or other requirements for when the 

audit of direct costs should be performed except that such an audit 

may be necessary for closing out the contract at the end of contract 

performance.40 Not annually auditing direct costs increases the risk 

that CMS is paying for costs that are not allowable or allocable to the 

contract. 

CMS Did Not Follow 

Existing Policies on 

Invoice Certification and 

Purchase Card Oversight 

CMS had policies for invoice certification and purchase card oversight; 

however, these policies were not consistently followed. The failure to 

follow established agency policy increases CMS’s risk of improperly 

paying contractor invoices or purchase card transactions. 

• We estimate that for at least 59.0 percent of fiscal year 2008 

contract actions, the project officer did not always certify the 

invoices.41 CMS’s Acquisition Policy Notice 16-01 requires the project 

officer to review each contractor invoice and recommend payment 

approval or disapproval to the contracting officer. This review is to 

determine, among other things, if the expenditure rate is 

commensurate with technical progress and whether all direct cost 

elements are appropriate, including subcontracts, travel, and 

equipment. Based on his or her review, the project officer is then to 

approve the invoice for payment by signing a Payments and Progress 

Certification Form or disapprove by issuing a suspension notice. In 

one case, although a contractor submitted over 100 invoices for fiscal 

year 2008,42 only 8 were certified by the project officer. The total value 

of the contract through January 2009 was about $64 million. 

After the project officer’s review, the contracting officer or specialist 

is also required to review invoices for critical elements such as 

compliance with the terms of the contract—including indirect cost 

rates—and mathematical accuracy. Based on a cursory review of the 

 

40 48 C.F.R. § 4.804-5(a)(7) and (12). 

41 We identified 90 contract actions to which certification of invoices applied, of which 61 

contract actions did not meet the control test. Based on the results of our work, we are 95 

percent confident that the total percentage of contract actions that did not meet the control 

test is at least 59.0 percent. 

42 The contractor submitted separate invoices for different contract line items, which 

resulted in the high number of invoices in one fiscal year. 

Page 16 GAO-10-60 CMS Contract Management
 

fiscal year 2008 invoices submitted for payment, we found instances 

in which the contracting officer or specialist did not identify items 

that were inconsistent with the terms of the contract. For example, 

facilities capital cost of money is generally disallowed by HHSAR.43

However, we found two instances where the contractor billed, and 

CMS paid, this cost. Another contractor submitted invoices under its 

fixed price contract that were contrary to the payment schedule 

stipulated in the contract terms. The contract required the contractor 

to submit four invoices of equal amount every 3 months during the 1-

year performance period. However, the contractor submitted one 

invoice for the entire amount of the contract. Moreover, the invoice 

was dated prior to the start date of the contract period of 

performance. CMS increases its risk of making improper payments 

when it does not properly review and approve invoices prior to 

payment. 

• OAGM also did not perform required audits and reviews of 

CMS purchase cards to identify fraud or waste.44 These audits 

and reviews are particularly important because of the authorized 

spending limits. As of July 15, 2009, OAGM’s purchase card program 

had issued 123 cards with 20 percent having monthly spending limits 

of at least $50,000. Eight card holders had monthly spending limits of 

$100,000, the highest spending limit authorized by CMS. Without 

sufficient oversight of the purchase card program, CMS does not have 

assurance that only allowable transactions are procured through 

purchase cards and that the purchase cards are not being used to 

circumvent FAR competition requirements. 

The HHS purchase card policy guidance provides that the purchase 

card coordinator, which at CMS is within OAGM, is required to 

conduct surveillance of the purchase card program by annually 

auditing cardholder transactions using such methods as statistical and 

nonstatistical sampling, data mining, and spot checks; monitoring 

 

43 48 C.F.R. § 315.404-4(d)(4). The HHSAR generally disallows facilities capital cost of 

money. In cases when the contractor includes the cost in its proposal, the agency is 

required to reduce the amount of the profit objective by an equivalent amount. In the two 

instances where CMS paid facilities capital cost of money, the cost was either expressly 

disallowed by 48 C.F.R. § 52.215-17 or the profit objective was not reduced. 

44 The government purchase card program offers substantial benefits, but not without risk 

of fraud, waste, or misuse. 48 C.F.R. § 13.201(b) states that the governmentwide purchase 

card is the preferred method for making purchases below the micropurchase threshold, 

which currently is set by FAR at $3,000 for most types of purchases. 

Page 17 GAO-10-60 CMS Contract Management
 

purchase card usage; and deactivitating purchase cards when 

appropriate, among other things. The OAGM purchase card 

coordinator’s supervisor told us that OAGM did not perform the 

oversight activities because the supervisor viewed those activities as 

the responsibility of the Office of Financial Management (OFM). We 

spoke with an OFM official who stated that OFM does not review 

purchase card transactions for fraud or inappropriate use, but instead 

pays the purchase card invoice based on the authorizing official’s 

approval. 

CMS Did Not Maintain 

Adequate Documentation 

in Its Contract Files 

During the tests of control procedures, we observed that the contract files 

did not always contain all required documentation to support the contract 

actions we reviewed. Standards for internal control call for transactions 

and other significant events to be clearly documented, and the 

documentation should be readily available for examination. In addition, 

the FAR provides that the documentation in the contract files shall be 

sufficient to constitute a complete history of the contract action for the 

purpose of providing a basis for informed decisions at each step in the 

acquisition process, and providing information for reviews and 

investigations, among other things.45 Clearly documenting the history of a 

contract action is an important tool that provides management with 

assurance that the agency has complied with applicable regulations and 

has made well-informed decisions for efficient contract management. 

Incomplete or inadequate contract files and documentation hinder the 

ability of the contracting officers to perform their oversight duties, 

especially those who assume responsibility for contracts that have 

changed hands during the life of the contract. 

CMS contract files did not always contain documentation necessary to 

support the action and that would provide contracting officers with the 

tools they needed to adequately perform their oversight functions. 

Specifically, we found a contract file was missing a statement of work and 

another file was missing a copy of the actual contract. In addition, two 

contract files did not maintain any information regarding the General 

Services Administration schedule contract that was valid at the time of the 

award of the task order. In numerous instances, we determined that the 

letter delegating duties to the project officer and the training certificate for 

the project officer—both of which are required by OAGM policies—were 

not in the file. Also, a chronological list of contracting officers and their 

 

45 48 C.F.R. § 4.801(b). 

Page 18 GAO-10-60 CMS Contract Management
 

dates of responsibility, which provides an important tool for establishing 

accountability for contract files over time, was consistently absent. 

Additionally, we found that CMS’s use of negotiation memorandums was 

inconsistent. The HHSAR provides46 that the negotiation memorandum is a 

complete record of all actions leading to the award of a contract and 

should be in sufficient detail to explain and support the rationale, 

judgments, and authorities upon which all actions were predicated and 

should be signed by the contract negotiator. However, we found that 

negotiation memorandums were not always prepared for actions in which 

they were clearly required, and were prepared for actions in which they 

may not be required, according to HHSAR. Moreover, while many 

negotiation memorandums we reviewed had signature blocks for both the 

contract specialist and the contracting officer (generally the preparer and 

reviewer, respectively) the memorandums were not always signed by the 

contracting officer. 

Contract Review Board 

Not Effective in Ensuring 

Proper Contract Award 

Actions 

CMS’s OAGM established the Contract Review Board (CRB) reviews as a 

key control procedure to help ensure contract award actions are in 

conformance with law, established policies and procedures, and sound 

business practices. However, our review of the CRB process found that 

the process had not been properly or fully implemented. For example, of 

the 22 contracts selected to be reviewed by the CRB in 2008, only 7 were 

actually reviewed. Similarly, for fiscal year 2009, 22 contracts were 

selected for the CRB but only 2 have been reviewed as of the end of the 

third quarter. Also, the contracting officer for the contract action being 

reviewed is neither required to reach consensus with the CRB on the 

resolution of issues identified nor to document the justification for not 

resolving CRB issues. Moreover, CMS is not following its policies for 

selecting the contracts to be reviewed by the CRB. While OAGM’s policies 

require that all contracts above $10 million be subjected to the CRB, CMS 

confirmed that only contracts nominated by division directors are 

reviewed. If used correctly, the CRB can be an effective tool for risk-based 

quality assurance and for reviewing the internal controls throughout the 

contract award and administration process. However, because CMS 

policies do not require issues to be resolved and documented and because 

CMS is not fully implementing the CRB, opportunities to identify and fix 

 

46 48 CFR § 315.372. 

Page 19 GAO-10-60 CMS Contract Management
 

deficiencies in the contract administration process and to improve internal 

controls may be missed. 

In addition to the deficiencies in contract-level control procedures as 

discussed previously, CMS’s FAR-based contract management was 

impaired by a weak control environment. CMS’s control environment is 

characterized by the lack of strategic planning to identify necessary 

staffing and funding, a lack of reliable data for effectively carrying out 

contract management responsibilities, very limited actions taken on the 

recommendations we made in 2007 related to contracting and payments to 

contractors, and a lack of procedures for managing contract audits which 

are essential to managing and overseeing the growing value of contracting 

activities. A positive control environment sets the tone for the overall 

quality of an entity’s internal control, and provides the foundation for an 

entity to effectively manage contracts and payments to contractors. 

Without a strong control environment, the control deficiencies we 

identified during this review will likely persist. 

Weak Control 

Environment Hinders 

CMS’s Ability to 

Manage its FAR-based 

Acquisition Process 

OAGM Management Has 

Not Determined CMS 

Contract Management 

Staffing and Funding 

Resource Requirements 

OAGM management has not analyzed its contract management workforce 

and related funding needs through a comprehensive, strategic acquisition 

workforce plan. Such a plan is critical to help manage the increasing 

acquisition workload and meet its contracting oversight needs. We 

reported in November 200747 that staff resources allocated to contract 

oversight had not kept pace with the increase in CMS contract awards. A 

similar trend continued into 2008. While the obligated amount of contract 

awards has increased 71 percent since 1998, OAGM staffing resources—its 

number of full time equivalents (FTE)—has increased 26 percent. This 

trend presents a major challenge to contract award and administration 

personnel who must deal with a significantly increased workload without 

additional support and resources. 

While CMS has data on its workforce changes since January 2007 

(attritions and additions), documentation requesting additional FTEs for a 

specific project, and, in its fiscal year 2010 budget, a request to hire 

contract support staff to help meet contract and grant administration 

needs, CMS has not yet determined the amount of total FTEs needed for 

the fiscal year and beyond. For example, the documentation did not 

 

47 GAO-08-54, p. 18. 

Page 20 GAO-10-60 CMS Contract Management
 

contain an analysis of the workload anticipated for the year, such as the 

total number of new awards, the number of active contracts by contract 

type, the number of CMS contracts under HHS’s cognizance, or the 

number and type of audits needed. The documents did not contain 

information on CMS’s current FTE level, skill mix, or analysis of any skill 

gaps. Without this information, OAGM has limited insight into appropriate 

solutions, such as the use of contractor support staff. While the use of 

contractor support staff has in recent years become commonplace in the 

federal government, we have previously reported48 that using contractors 

for contract administrative functions may increase the risk of establishing 

unauthorized personal services contracts or the risk of contractors 

performing inherently governmental functions, both of which are 

prohibited by FAR.49

According to its staff and management, OAGM is challenged to meet the 

various audit requirements necessary to ensure adequate oversight of 

contracts that pose more risk to the government, specifically cost 

reimbursement contracts, as well as perform the activities required of a 

CFA. While officials told us they could use more audit funding, we found 

that OAGM management had yet to determine what an appropriate funding 

level should be. Without knowing for which contractors additional CFA 

oversight is needed, CMS does not know with certainty the number of 

audits and reviews that must be performed annually or the depth and 

complexity of those audits. Without this key information, CMS can not 

estimate an adequate level of audit funding that it needs. 

During interviews and our on-site review of contract files, we were told by 

OAGM senior management and contracting officers and specialists that 

the first set of activities that the contracting officers and specialists tend to 

neglect under resource constraints was post-award administration and 

contract closeout. Moreover, while OAGM management told us that staff 

worked hard to comply with its instructions to follow all applicable FAR 

requirements, CMS staff told us they take shortcuts due to resource 

constraints. For example, one contract specialist told us she prepared the 

Independent Government Cost Estimate based on the winning contractor’s 

proposed costs instead of conducting her own independent research to 

determine the government’s benchmark for the reasonableness of the 

costs of the scope of work. Additionally, as previously discussed, CMS 

 

48 GAO-08-360. 

49 48 C.F.R. §§ 37.104(b) and 37.102(c). 

Page 21 GAO-10-60 CMS Contract Management
 

officials told us that incurred cost audits are not performed annually 

primarily due to insufficient resources. A shortage of financial and human 

resources creates an environment that introduces vulnerabilities to the 

contracting process, hinders management’s ability to sustain an effective 

overall control environment, and ultimately increases risk in the 

contracting process. 

CMS Lacks Reliable Data 

Needed to Effectively 

Carry Out Contract 

Management 

Responsibilities 

Although CMS has generally reliable information on basic attributes of 

each contract action, such as vendor name and obligation amount, CMS 

lacks reliable management information on other key aspects of its FARbased contracting operations, including the number of certain contract 

types awarded, the extent of competition achieved, and total contract 

value. Standards for internal control provide that for an agency to manage 

its operations, it must have relevant, reliable, and timely information 

relating to the extent and nature of its operations, including both 

operational and financial data, that should be recorded and communicated 

to management and others within the agency who need it and in a form 

and within a time frame that enables them to carry out their internal 

control and operational responsibilities. The acquisition data errors are 

due in part to a lack of sufficient quality assurance activities over the data 

entered into the acquisition databases. Without accurate data, CMS 

program managers do not have adequate information to identify and 

monitor areas that pose a high risk of improper payments or waste. 

Moreover, inaccurate or incomplete data hinder CMS’s ability to mitigate 

through additional policies or enhanced oversight any high-risk areas, 

such as the frequent use of cost reimbursement contracts, that would be 

identified based on reports or analysis of the databases. The errors in 

DCIS, including the unrecorded actions, also impact governmentwide 

reporting. The Office of Management and Budget (OMB) requires agencies 

to submit their acquisition data to the Federal Procurement Database 

System-Next Generation (FDPS-NG). Since HHS submits DCIS data to the 

FDPS-NG, which in turn feeds into OMB’s publicly available database at 

www.usaspending.gov, the DCIS errors noted above are provided to the 

public and limit the usefulness and transparency of this important tool. 

• We estimate that for at least 34.9 percent of fiscal year 2008 

contract actions,50 PRISM contained at least one error in the 

 

50 Based on the results of our work, we are 95 percent confident that the total percentage of 

contract actions that did not meet the control test is at least 34.9 percent. 

Page 22 GAO-10-60 CMS Contract Management
 

selected critical fields we reviewed. In particular, we found that 

PRISM contained 16 errors in a field we reviewed that designated the 

extent to which the contract was competed, for example, full and 

open competition or not competed as a result of being a logical 

follow-on to a previous contract. Additionally, we determined that the 

award type field in PRISM did not capture consistent information. For 

example, the field had prepopulated options associated with both 

award type (basic ordering agreement, delivery order, letter contract, 

etc.) and contract type (cost reimbursement, fixed price, and T&M). 

Combining these options into one data field prevents CMS from 

determining the total number of each award type and each contract 

type, making it difficult to accurately determine CMS’s contracting 

trends. OAGM officials told us that the data entered into PRISM are 

not subjected to a secondary review in which the data entered are 

compared to the information in the contract file. 

• We estimate that for at least 54.2 percent of fiscal year 2008 

contract actions,51 DCIS contained at least one error in the 

selected critical fields we reviewed. DCIS contained errors in 

current contract value and ultimate contract value fields,52 as well as 

the extent of competition, contract type, and award type fields. 

Further, 11 sample items, or approximately 10 percent of the sample, 

were not in DCIS. Our high-level data analysis on the population of 

fiscal year 2008 contract actions identified that certain required fields, 

such as contract type and competition, contained blank responses and 

“nulls”. We also noted obvious errors. For example, CMS entered 

codes for “potato farming” and “tortilla manufacturing” in the industry 

code field for two contract actions. 

Prior to calendar year 2008, CMS did not have quality assurance 

activities, such as formal data entry reviews or database training, over 

the data contained in the DCIS database. In December 2007, OAGM 

established a Verification and Validation Plan for DCIS Accuracy 

Improvements (V&V). The V&V plan contained several actions, 

including a secondary review of data entered into DCIS for every 50th 

contract action. The V&V plan lacks key elements and controls to 

 

51 Based on the results of our work, we are 95 percent confident that the total percentage of 

contract actions that did not meet the control test is at least 54.2 percent. 

52 The current contract value field is supposed to capture the cumulative obligated amounts 

on the contract to date and ultimate contract value is supposed to capture the current 

contract value plus anticipated future obligations, i.e., option years. 

Page 23 GAO-10-60 CMS Contract Management
 

ensure that the resolution of potential errors is properly documented 

and errors are corrected in a timely manner. For example, OAGM 

officials could not determine if all errors identified during the file 

reviews were properly resolved and the appropriate adjustments to 

DCIS were made. Additionally, while staff training was provided in 

January 2008, the DCIS data entry instructions were later modified 

with new information. In one instance, we noted that the DCIS 

preparer and the reviewer were using different versions of the 

instructions resulting in confusion over what would be the 

appropriate DCIS entry. OAGM officials provided us with the results 

for the V&V plan for 2008, which showed that 23 of the total 2,031 

contract actions entered into DCIS in 2008 were reviewed for 

accuracy, which is approximately every 88th action. 

Seven of Nine GAO 2007 

Recommendations Remain 

Substantially Unresolved 

As of July 22, 2009, CMS management had not taken substantial actions to 

address our prior recommendations to improve internal control in the 

contracting process. Only two of GAO’s nine 2007 recommendations had 

been fully addressed. Table 1 summarizes, and appendix II provides 

additional detail on, our assessment of the status of CMS’s actions to 

address our recommendations. The seven substantially unresolved 

recommendations represent a lack of action on the part of CMS 

management to resolve key control deficiencies. 

Table 1: GAO Assessment of Status of CMS Actions Taken to Address 2007 Recommendations 

GAO recommendation GAO assessment of status 

(1) Develop policies and criteria for pre-award contract activities. No action taken. 

(2) Develop policies and procedures to help ensure that cognizant 

federal agency responsibilities are performed. 

Actions insufficient. No policies or procedures developed. 

See discussion below. 

(3) Develop agency-specific policies and procedures for the review of 

contractor invoices so that key players are aware of their roles and 

responsibilities. 

Completed. 

(4) Prepare guidelines to contracting officers on what constitutes 

sufficient detail to support amounts billed on contractor invoices to 

facilitate the review process. 

No action taken. 

(5) Establish criteria for the use of negative certification in the 

payment of a contractor’s invoices to consider potential risk 

factors. 

No action taken. 

Page 24 GAO-10-60 CMS Contract Management
 

 GAO recommendation GAO assessment of status 

(6) Provide training on the invoice review policies and procedures to 

key personnel responsible for executing the invoice review 

process. 

Actions taken do not achieve intent of recommendation. 

Training was provided; however, invoice review policies 

have not yet been sufficiently revised to address our 

recommendations. 

(7) Create a centralized tracking mechanism that records the training 

taken by personnel assigned to contract oversight activities. 

Completed. 

(8) Develop a plan to reduce the backlog of contracts awaiting 

closeout. 

Actions insufficient. See discussion below. 

(9) Review the questionable payments identified in this report to 

determine whether CMS should seek reimbursement from 

contractors. 

Actions insufficient. See discussion below. 

Source: GAO. 

• Policies and criteria for pre-award contract activities have not 

been developed. In our 2007 report, we recommended that CMS 

develop policies for certain pre-award contract activities, such as 

analysis to justify the contract type selected and verification of the 

adequacy of the contractor’s accounting system prior to the award of 

a cost reimbursement contract. However, no new policies or guidance 

were developed, because in CMS’s view, policies and criteria are 

already established in the FAR and HHSAR. While the FAR provides 

requirements for federal acquisitions, it is up to the agencies to 

develop and provide their contracting workforce with specific policies 

and day-to-day procedures that guide them in implementing those 

requirements and to tailor the policies to address the specific 

operational environment. Agency-specific policy may include 

guidance on applicable approval levels, time frames, agency forms, 

and routing processes. Also, while the HHSAR provides additional 

guidance and policies specific to HHS, the HHSAR does not 

specifically address all of the pre-award contract activities that we 

identified as needing improvement, nor does it delineate the roles and 

responsibilities of the different staff involved in the contracting 

process or establish time frames for when certain pre-award contract 

activities should be performed. The deficiencies identified in this 

report, especially those associated with FAR requirements unique to 

specific contract types, further highlight the need for additional 

guidance for contracting officers. 

• Roles and responsibilities for implementation of CFA 

responsibilities not clearly defined. The FAR requires that CFAs 

perform certain oversight and monitoring activities. The CFA concept 

provides an efficient way for contractors to receive a streamlined set 

of audits and reviews, thereby enabling them to receive and perform 

government contracts. In our 2007 report, we found that CFA 

Page 25 GAO-10-60 CMS Contract Management
 

responsibilities were inadequately fulfilled and recommended that 

CMS develop policies and procedures to ensure that CFA 

responsibilities were performed. In a recommendation resolution 

report, HHS stated that policies and procedures were needed at both 

the department level and at CMS. As of July 2009, neither HHS nor 

CMS had developed such policies and procedures or a mechanism to 

track the CMS contractors for which additional oversight is needed. 

Moreover, roles and responsibilities for the performance of CFA 

duties were not clear among HHS and its components, including CMS. 

During an interview with CMS, HHS, NIH, and HHS Office of 

Inspector General (OIG) officials, HHS officials stated that CFA 

responsibilities lie at the HHS department level. However, HHS 

officials also said that certain CFA responsibilities are delegated to 

HHS components and to contracting officers. Specifically, NIH was 

assigned responsibility to establish indirect rates for the contractors 

under HHS’s cognizance, but contracting officers within HHS 

components are responsible for other CFA duties. However, during 

the meeting, the officials could not clearly explain how the 

performance of these duties was monitored to ensure that CFA 

oversight takes place. HHS officials said that they did not have a 

process to identify the contractors, including CMS contractors, for 

which HHS would be the CFA. Without a list that is periodically 

updated for the contractors’ portfolio of federal government 

contracting activity, HHS and its components do not know the 

contractors for which CFA oversight is needed. 

NIH officials acknowledged their centralized role in determining 

indirect rates, but noted that NIH did not have the resources 

necessary to determine the indirect rates for the contractors under 

HHS’s cognizance. CMS officials told us that when NIH can not 

perform the reviews within the needed time frames to make timely 

contract awards, CMS’s cost/price team establishes the rates. The 

confusion over roles and responsibilities increases the risk that CFA 

responsibilities are not being timely performed, if at all. Without 

effective coordination, contractors may not receive the necessary 

oversight and the government may not be positioned to protect itself 

from the risk of improper payments or waste. The risks of not 

performing CFA duties are exacerbated by the fact that other federal 

agencies that use the same contractors rely on the oversight and 

monitoring work of the CFA. 

Page 26 GAO-10-60 CMS Contract Management
 

• CMS policies did not provide guidance on what constitutes 

sufficient detail to support amounts billed on contractor 

invoices to facilitate the review process. Despite our prior 

recommendation, CMS had not prepared guidelines or revised its 

invoice review policy to specify or provide examples of sufficient 

detail that would be needed to support contractor invoices to 

facilitate an adequate review. In fact, most of the invoices we 

reviewed were not sufficiently supported. We identified invoices 

missing payroll detail, travel receipts, and subcontractor invoices, all 

of which are necessary to provide the reviewers adequate information 

to confirm if the amounts billed were compliant with the terms of the 

contract or otherwise allowable and allocable to that contract. In one 

instance, invoices reported labor costs based on labor categories, but 

did not show hours worked by employees or their respective labor 

rates. In another example, a contractor submitted an invoice in 2008 

for services that were provided in 2003. The contractor did not 

provide supporting documentation for the $36,944 billed. Neither the 

invoice paid in 2008, nor the related file included evidence that the 

charge was investigated or further evaluated by either the project 

officer or contracting specialist. While different levels of review may 

be required based on the complexity of individual invoices and 

associated contract type, inadequately reviewing invoices increases 

the risk of improper payments. 

• CMS has not set criteria for the use of negative certification.

We recommended in our 2007 report that CMS establish criteria for 

the use of negative certification in the payment of contractor invoices 

which would consider potential risk factors. CMS uses negative 

certification—a process whereby it pays contractor invoices without 

knowing whether they were reviewed and approved—in order to 

ensure invoices are paid in a timely fashion. This approach, however, 

significantly reduces the incentive for contracting officers, specialists, 

and project officers to review the invoice prior to payment. Reviewing 

invoices prior to payment is a preventive control which may result in 

the identification of unallowable billings, especially on cost 

reimbursement and T&M invoices, before the invoices are paid. In 

light of the importance of this preventive control, we recommended 

that CMS establish criteria for when to use negative certification; such 

criteria may be based on considerations of potential risk factors such 

as contract type, the adequacy of the contractor’s accounting system, 

and prior history with the contractor. We found, however, that 

OAGM’s invoice review policy was not revised to address this 

recommendation and OAGM officials confirmed that negative 

Page 27 GAO-10-60 CMS Contract Management
 

certification is still the primary method for paying invoices regardless 

of risks. 

• Training on invoice review procedures still needed. As discussed 

earlier, project officers did not always certify invoices for approval 

and contracting officers or specialists did not always identify 

instances where invoices did not comply with contract terms and 

conditions. We also found that invoices were not always maintained in 

the file, as required by CMS’s invoice review policy. In light of these 

continuing deficiencies, and the need for further revisions to its 

invoice review policy described above, further training on invoice 

review procedures will be necessary. 

• Continuing backlog of contracts overdue for closeout. In 2007, 

we reported that CMS did not timely perform contract closeout 

procedures resulting in a backlog of 1,300 contracts, of which 407 

were overdue for closeout as of September 30, 2007. We 

recommended that CMS develop a plan to reduce the number of 

contracts in the backlog. CMS did not provide us a closeout plan for 

fiscal year 2008 and the fiscal year 2009 plan was insufficient. 

Specifically, the plan did not include a comprehensive strategy to 

reduce the backlog of contracts that are eligible and overdue for 

closeout nor did it contain a workload analysis, such as a list of 

contracts eligible for closeout by contracting officer or specialist or 

an estimate of the number of hours or audit funds it would need to 

close the contracts. 

The FAR establishes time standards for closing out a contract after 

the work is physically completed (i.e., goods or services are 

provided).53 The contract closeout process is an important internal 

control, in part, because it is generally the last opportunity for the 

government to detect and recover any improper payments. The 

complexity and length of the closeout process can vary with the 

extent of oversight performed by the agency during the period of 

performance and the contract type.54

 

53 48 C.F.R. § 4.804. 

54 48 C.F.R. § 4.804 states that firm fixed price contracts should be closed within 6 months; 

contracts requiring the settlement of indirect costs rates, such as cost reimbursement 

contracts, should be closed within 36 months; and all other contracts should be closed 

within 20 months. These time frames begin in the month in which the contracting official 

receives evidence of physical completion of the contract. Generally, files for contracts 

using simplified acquisition procedures should be considered closed when the contracting 

officer receives evidence of receipt of property and final payment. 

Page 28 GAO-10-60 CMS Contract Management
 

CMS officials told us that during fiscal year 2008, OAGM closed 581 

contracts and reduced the overdue backlog to 400 contracts (from the 

407 reported at the end of fiscal year 2007).55 Yet OAGM officials could 

not provide support for these closures or a list of the contracts 

overdue for closeout. Additionally, CMS officials stated that as of July 

29, 2009, the total backlog of contracts eligible for closeout was 1,611, 

with 594 overdue based on FAR timing standards. This is a substantial 

increase over the balances at the end of fiscal year 2007. Moreover, 

the total contract value of contracts eligible for closeout has 

increased from $3 billion to at least $3.8 billion. 

Insufficient progress has been made to reduce the backlog of 

contracts eligible for closeout. The closeout process is particularly 

important for cost reimbursement contracts because a contractor is 

allowed to bill costs it incurred to provide the good or service. During 

the closeout process, the government audits these billed costs to 

determine if they were allowable and allocable to the contract, and 

processes the final invoice with an adjustment for any over- or 

underpayments. The failure to perform contract closeouts in a timely 

manner puts CMS at increased risk of improper payments or waste, 

and may make identification and recovery of any such improper 

payments more difficult due to the passage of time. 

• CMS has not taken sufficient actions to investigate and 

recover questionable payments. CMS described several actions it 

has taken to investigate payments made to 3 of the 12 contractors for 

which we identified questionable payments. The actions CMS has 

taken to date are insufficient to fully resolve the issues identified and 

more remains to be done to recover funds that may have been 

inappropriately paid to contractors. 

For example, CMS highlighted $67 million in questionable payments 

that were related to one specific contractor and stated that these 

questionable payments are being investigated via a fiscal year 2008 

incurred cost audit. However, the $67 million related to costs incurred 

in fiscal years 2004, 2005, and 2006 and therefore would not be 

covered or investigated in an audit of fiscal year 2008 incurred costs. 

Additionally, CMS said it had resolved the questionable payments 

made to another contractor; however, CMS’s actions did not relate to 

the $1.4 million in payments CMS made in fiscal year 2006 that we 

 

55 GAO-08-54, p. 31. 

Page 29 GAO-10-60 CMS Contract Management
 

questioned. Regarding a third contractor, CMS issued a demand letter 

in April 2007 to recover funds the contractor billed and CMS paid in 

excess of contract ceiling limits; however, no resolution has yet been 

reached. CMS could not tell us whether it had recovered any of the 

questioned amounts. 

CMS’s resolution of questionable payments of the magnitude we 

identified ($88.8 million) in the prior report should be performed 

expeditiously. As a steward of taxpayer dollars, CMS is accountable 

for how it spends and safeguards funds as well as having mechanisms 

in place to recoup those funds when improper payments are 

identified. CMS relies on incurred cost audits that are conducted at 

the end of contract performance when the contract is closed to 

validate the overall propriety of payments. As discussed earlier, 

incurred cost audits are best conducted annually, rather than at the 

end of contract performance. CMS’s backlog of contracts eligible for 

closeout delays investigations and makes recovery more difficult. 

CMS Does Not Track, 

Investigate, and Resolve 

Contract Audit and 

Evaluation Findings to Aid 

Decision Making 

CMS does not track, investigate, and resolve contract audit and evaluation 

findings for purposes of cost recovery and future award decisions. 

Tracking audit and evaluation findings strengthens the control 

environment in part because it can help assure management that the 

agency’s objectives are being met through the efficient and effective use of 

the agency’s resources. It can also help management determine whether 

the entity is complying with applicable acquisition laws and regulations. 

Contract audits and evaluations can add significant value to an 

organization’s oversight and accountability structure, but only if 

management ensures that the results of these audits and evaluations are 

promptly investigated and resolved. 

During our review of the contract files, we noted that audits and 

evaluations CMS requested of organizations such as DCAA or performed 

by the CMS cost/price team identified questionable payments, accounting 

system deficiencies, and other significant weaknesses or deficiencies 

associated with certain CMS contractors. However, we could not 

consistently determine how the contracting officer or other OAGM staff 

followed up on the results of these audits and noted that CMS was not 

always taking the results of these audits and evaluations into 

consideration when making decisions relating to future contract awards. 

For example, in an audit report dated September 30, 2008, DCAA 

questioned approximately $2.1 million of costs that CMS paid to a 

contractor in fiscal year 2006. OAGM management confirmed that no 

Page 30 GAO-10-60 CMS Contract Management
 

action has been taken to investigate and recover the challenged costs. In 

another instance, the contracting officer—based on the results of a 

cost/price team evaluation of a contractor’s technical capability and 

negative results of DCAA audits—deemed the contractor “risky” during 

the pre-award contract proposal evaluation process. Nevertheless, the 

contracting officer awarded the cost reimbursement contract to this 

“risky” contractor. We found no evidence of any plans or procedures that 

would mitigate the identified risks. 

CMS has not established a formal procedure or system for tracking and 

pursuing the results of contract or contractor audits and had not provided 

its contracting officers guidance or procedures for when to request the 

assistance of internal and external audit and evaluation services. For 

example, OAGM did not provide direction on when (what stage(s) in the 

contract life cycle and under what circumstances) the contracting officer 

should utilize the service of the cost/price team or other contract auditors. 

By not timely acting on audit results or fully incorporating knowledge 

identified by cost/price evaluations or other audits into award decisions, 

CMS is forgoing the potential benefits from those audits and evaluations. A 

well-established tenet for recovery of improper payments is that it 

becomes increasingly more difficult with the passage of time. Careful and 

prompt consideration of audit results, including tracking and pursuing 

findings, helps to reduce the risk of improper payments or waste, and 

making other-than-the-best award decisions. 

The contract-level and overall control environment weaknesses we found 

significantly increase CMS’s vulnerability to improper or wasteful contract 

payments. To address these deficiencies, CMS will need to develop and 

implement CMS-specific policies and procedures to ensure that contract 

actions are properly administered and comply with applicable 

requirements. CMS also needs to strengthen its overall contract 

management control environment, including developing strategic 

workforce plans, establishing appropriate contract management oversight 

procedures, and maintaining reliable management information. 

Conclusion 

In addition, CMS management has made limited progress in substantively 

addressing most of the broad-based recommendations from our 2007 

report. We found that many of our findings in this review could be, at least 

in part, attributed to CMS management’s lack of attention given to 

resolving the control deficiencies. Consequently, we are reiterating our 

previous recommendations to (1) develop policies for pre-award 

contracting activities, (2) develop policies to help ensure CFA 

Page 31 GAO-10-60 CMS Contract Management
 

responsibilities are performed, (3) prepare guidelines on what constitutes 

sufficient detail to support contractor invoices, (4) establish criteria for 

the use of negative certification, (5) provide training on revised invoice 

review policies, (6) develop a plan to reduce the backlog of contracts 

eligible for closeout, and (7) review the questionable payments identified 

in the prior report to determine if payments are recoverable. 

The continuing weaknesses in contracting activities and limited progress 

in addressing known deficiencies raise questions concerning whether CMS 

management has established an appropriate “tone at the top” regarding 

contracting activities. Until CMS management addresses our previous 

recommendations in this area, along with taking action to address the 

additional deficiencies identified in this report, its contracting activities 

will continue to pose significant risk of improper payments, waste, and 

mismanagement. Further, the deficiencies we identified are likely to be 

exacerbated by the rise in obligations for non-claims processing contract 

awards as well as CMS’s extensive reliance on contractors to help achieve 

its mission objectives. It is imperative that CMS take immediate action to 

address its serious contract-level control deficiencies and take action on 

our previous recommendations to improve contract-level and overall 

environment controls or CMS will continue to place billions of taxpayer 

dollars at risk of fraud, or otherwise improper contract payments. 

We make the following nine recommendations to the Administrator of 

CMS to develop and implement policies and procedures to ensure that 

FAR requirements and other control objectives are met. Policies and 

procedures should: 

Recommendations for 

Executive Action 

• Document compliance with FAR requirements for different contract 

types. At a minimum, enhance current documentation, such as the 

contract checklist, to ensure the contract file documents 

authorizations for letter contracts, adequacy of the contractors 

accounting systems, and determination and findings for time and 

materials contracts, when applicable. 

• Document in the contract file provisional indirect cost rates used as a 

basis for reviewing the reasonableness of the indirect costs billed on 

the contractor invoices. 

• Specify what constitutes timely performance of (or request for) audits 

of contractors’ statements of incurred cost for cost reimbursement 

and T&M contracts, including circumstances when OAGM should 

Page 32 GAO-10-60 CMS Contract Management
 

perform the audit itself or request another organization to perform the 

service. 

• Specify circumstances under which negotiation memorandums should 

be used and the content of such, and any required secondary reviews, 

in light of HHSAR requirements and current OAGM practice. 

• Specify Contract Review Board review documentation to include, at a 

minimum, documentation of the number of contracts reviewed each 

year, the issues identified by the CRB reviewer(s), and resolution of 

issues identified during the CRB reviews. 

• Require Division Directors to periodically assess, document, and 

report to senior management on the results of their review of whether 

the contract files contain documentation that invoices were properly 

reviewed by both the project officer and contracting officer or 

specialist. 

To strengthen the control environment, we recommend that OAGM 

management: 

• Develop and implement a comprehensive strategic acquisition 

workforce plan. The plan should include, at a minimum, elements 

such as performance goals, time frames, implementation actions, and 

resource requirements, and address issues such as OAGM workload, 

full time equivalents needed, and a workforce skills analysis, as well 

as an estimate of the amount of resources OAGM needs to fulfill the 

audit and other FAR requirements for comprehensive oversight, 

including those required of a CFA. 

• Revise the Verification and Validation Plan for DCIS Accuracy and 

Improvements policy to require all relevant errors be corrected and 

their resolution documented. 

• Develop and implement policies and procedures for tracking contract 

audit requests, monitoring the results of contract audits and 

evaluations, and resolving the audit findings, to include roles and 

responsibilities of the contracting officer, specialist, and members of 

the cost/price team. 

Page 33 GAO-10-60 CMS Contract Management
 

We make the following recommendation to the Secretary of HHS to 

improve the department’s fulfillment of CFA duties as described in FAR. 

• Develop policies and procedures that clearly assign roles and 

responsibilities for the timely fulfillment of CFA duties, and that 

include the preparation of and periodic update of a list of contractors 

for which the department is the CFA. 

In written comments on a draft of this report (reprinted in their entirety in 

appendix III), CMS and HHS agreed with each of our 10 new 

recommendations and described steps planned to address them. CMS also 

stated that the recommendations will serve as a catalyst for improvements 

to the internal controls for its contracting function. In its comments, CMS 

also expressed concerns about the scope and timing of our work with 

respect to our November 2007 recommendations and disagreed with our 

assessment of the status of 5 of the 7 recommendations we made in that 

report. We address the concerns CMS raised in its comment letter below 

and include additional information at the end of appendix III. 

Agency Comments 

and Our Evaluation 

In its comments, CMS stated its belief that the 11 internal controls we 

reviewed did not provide a complete picture of its internal controls over 

contract management activities. We acknowledge that there are many 

internal controls that are and can be instituted by agencies to help 

safeguard assets, prevent and detect fraud and errors, and help 

government program managers achieve desired results through effective 

stewardship of public resources. As described in appendix I, we selected 

11 controls that we determined to be “key” based on GAO’s standards for 

internal control, the FAR and HHSAR, CMS’s policies and procedures, and 

other factors including our prior audit findings regarding CMS’s 

acquisition controls and the nature of CMS’s acquisition function. 

CMS stated its belief that “virtually all” of the errors we identified related 

to “perceived documentation deficiencies.” CMS stated it was encouraged 

that the errors we found did not involve more substantive departures from 

the FAR or HHSAR. We disagree with CMS’s overall assessment of our 

findings and message of the report. The internal controls we tested are key 

to ensuring that contracting activities, both pre-award and post-award, 

mitigate risks to the federal government. A number of the findings we 

identified during the testing of a statistically valid sample of contract files 

involved the lack of documentation that the controls were performed. 

Lack of documentation reduces management’s ability to ascertain whether 

these important controls were appropriately implemented and therefore is 

Page 34 GAO-10-60 CMS Contract Management
 

a serious internal control deficiency. OAGM management’s downplaying of 

the overall message of the report—that control deficiencies are 

pervasive—further illustrates the weak internal control environment. 

Setting an appropriate control environment, especially “tone at the top,” is 

key to ensuring that staff take all appropriate steps to mitigate risk and 

protect tax dollars from fraud, waste, and abuse. 

CMS also stated that a reasonable amount of time had not yet elapsed 

since the issuance of our November 2007 report to allow for corrective 

actions to have taken place. A significant number of our current report 

findings, including weaknesses in the control environment, were based on 

observations and interviews with OAGM officials and reviews of related 

documentation such as policies and strategic plans. Our current review 

was completed in September 2009, nearly 2 years after the issuance of our 

November 2007 report. While CMS also stated that the contract actions we 

reviewed took place in fiscal year 2008, it is important to note that we 

considered the timing of CMS’s corrective actions when evaluating the 

controls we tested. For example, CMS’s Acquisition Policy 02-03, which 

identifies level of approvals required by agency officials based on the 

estimated dollar value for acquisitions awarded through other than full 

and open competition, was implemented in April 2008. We applied these 

approval levels only to the awards and modifications in our sample that 

were made after the policy was implemented. Furthermore, our 

observations and recommendations related to CMS’s control environment 

are based on conditions that continued to exist in September 2009. 

CMS disagreed with our determination that their actions to address five of 

the seven prior recommendations were not sufficient. These prior 

recommendations were aimed at improving preventive controls. 

Preventive controls, such as policies and criteria for pre-award activities 

and a sound invoice review process prior to payment, are the first line of 

defense in reducing the risk of improper payments or waste. We continue 

to believe that the limited actions OAGM management has taken, and in 

some cases, management’s inaction, fall short of expectations and miss the 

intent of improving CMS’s overall system of control over its acquisition 

activities. 

For example, CMS asserted that its Acquisition Policy 16-01 entitled 

“Invoicing Payment Procedures” satisfies two of the prior 

recommendations. The intent of these two recommendations was to 

ensure that contractors provided adequate support to facilitate an 

appropriate detailed review of the invoiced costs prior to payment and 

that CMS develop clear risk-based criteria for the use of negative 

Page 35 GAO-10-60 CMS Contract Management
 

certification. CMS uses negative certification—a process whereby it pays 

contractor invoices without knowing whether they were reviewed and 

approved—in order to ensure invoices are paid in a timely fashion. We 

examined this policy during our review and found it to be unresponsive to 

the recommendations because it did not provide the recommended 

additional guidelines on what the contractor should provide that would 

constitute sufficient detail to support amounts billed on contractor 

invoices. It also did not describe under what circumstances or in what 

situations it was acceptable for CMS to use negative certification. 

With regard to a third prior recommendation that CMS review the 

questionable payments we identified, CMS described in its comment letter 

specific actions taken to investigate some of the questionable payments 

and subsequently provided documentation of actions it had taken to 

investigate the questionable payments we identified for three contractors. 

After reviewing this information, we revised our assessment of the status 

of efforts taken by CMS from “No Actions Taken” to “Actions Insufficient.” 

While CMS had taken some action, the steps have not resolved the 

questionable payments we identified. For example, CMS highlighted $67 

million that we previously questioned that was related to one specific 

contractor and stated that these questionable payments are being 

investigated via a fiscal year 2008 incurred cost audit. The $67 million we 

questioned related to costs incurred in fiscal years 2004, 2005, and 2006 

and therefore would not be covered or investigated in an audit of fiscal 

year 2008 incurred costs. Moreover, as of the date of the report, CMS could 

not tell us whether it had recovered any of the questioned amounts. We 

continue to believe that CMS’s actions to date are insufficient and more 

actions are needed to investigate and recover the questionable payments 

we identified. 

No other changes were made to the report as a result of agency comments. 

See appendix III for a discussion of the remaining two prior 

recommendations (points 2, 3, and 4) for which CMS disagreed with our 

assessment of its progress and our analysis of comments CMS made on 

our new recommendations. 

As agreed with your offices, unless you publicly announce its contents 

earlier, we plan no further distribution of this report until 30 days from its 

date. At that time, we will send copies to the Secretary of Health and 

Human Services, Administrator of the Centers for Medicare and Medicaid 

Services, and interested congressional committees. Copies will also be 

Page 36 GAO-10-60 CMS Contract Management
 

available to others on request. In addition, the report will be available at 

no charge on the GAO Web site at http://www.gao.gov. 

If you or your staff have any questions about this report, please contact me 

at (202) 512-9095 or dalykl@gao.gov. Contact points for our Offices of 

Congressional Relations and Public Affairs may be found on the last page 

of this report. Major contributors to this report are acknowledged in 

Kay L. Daly 

appendix IV. 

Director 

Financial Management and Assurance 

Page 37 GAO-10-60 CMS Contract Management
 

List of Requesters 

The Honorable Max Baucus 

Chairman 

The Honorable Charles E. Grassley 

Ranking Member 

Committee on Finance 

United States Senate 

The Honorable Henry A. Waxman 

Chairman 

Committee on Energy and Commerce 

House of Representatives 

The Honorable Edolphus Towns 

Chairman 

Committee on Oversight and Government Reform 

House of Representatives 

The Honorable Claire McCaskill 

Chairman 

Ad Hoc Subcommittee on Contracting Oversight 

Committee on Homeland Security and Government Affairs 

United States Senate 

Page 38 GAO-10-60 CMS Contract Management
Appendix I: Scope and Methodology Appendix I: Scope and Methodology 

To determine the extent to which the Centers for Medicare and Medicaid 

Services (CMS) implemented effective internal control procedures over 

contract actions, we focused on contracts that were generally subjected to 

the Federal Acquisition Regulation. We also interviewed senior 

management of CMS’s Office of Acquisition and Grants Management 

(OAGM), contracting officers and specialists, and cost/price team 

members as well as officials in the Office of Acquisition Management and 

Policy at the Department of Health and Human Services (HHS). We 

selected 11 internal controls over contracting and payments to contractors 

to test for this report, ranging from ensuring contractors had adequate 

accounting systems prior to the use of a cost reimbursement contract to 

certifying invoices for payment. We selected controls to test based on our 

review of GAO’s standards for internal control,1

 the Federal Acquisition 

Regulation requirements, and agency policies and procedures, taking into 

consideration prior audit findings and the contract types most frequently 

awarded. The controls we tested are key to effective administration of the 

contract in that the lack of implementation would significantly increase 

the risk of improper payments or waste. 

To test internal control procedures over contract actions, we selected a 

stratified random sample of 102 contract actions totaling $140.7 million in 

fiscal year 2008 obligations from a population of 2,441 contract actions 

totaling $2.5 billion in fiscal year 2008 obligations. We stratified the 

contract actions by type of action, namely contract awards and contract 

modifications, recorded in CMS’s PRISM database from October 1, 2007, 

through September 30, 2008. Each contract action was either a new 

contract award or modification to an existing contract. With this 

probability sample, each contract action in the sample frame had a nonzero probability of being included and that probability could be computed 

from any contract action. Each stratum was subsequently weighted in the 

analysis to account statistically for all the contract actions in the sample 

frame, including those that were not selected. Results from this statistical 

sample were projected to the population of contract actions made from 

October 1, 2007, through September 30, 2008. See table 2 for specific 

details related to contract actions selected in the sample. 

 

1

 GAO, Standards for Internal Control in the Federal Government, GAO/AIMD-00-21.3.1

(Washington, D.C.: November 1999). 

Page 39 GAO-10-60 CMS Contract Management 
Appendix I: Scope and Methodology 

Table 2: Contract Actions in the Sample 

Contract type Awards Modifications Total 

Cost 

reimbursement 

14 $19,343,733 39 $71,718,383 53 $91,062,116

Fixed price 17 $2,527,049 6 $1,054,274 23 $3,581,323

Time and materials 11 $11,590,778 10 $6,921,590 21 $18,512,367

Combination10 $0 5 $27,593,568 5 $27,593,568

42 $33,461,560 60 $107,287,815 102 $140,749,375

Source Selection 

Full and open 14 $15,443,355 40 $98,426,529 54 $113,869,884

Logical follow-on 4 $2,177,215 6 $2,354,367 10 $4,531,582

Only one supplier 9 $2,130,305 6 $1,427,131 15 $3,557,436

8(a)23 $2,096,448 2 $421,958 5 $2,518,406

Other3 12 $11,614,238 6 $4,657,829 18 $16,272,067

42 $33,461,560 60 $107,287,815 102 $140,749,375

Source: PRISM. 

1

 “Combination” represents contracts that are a combination of multiple contract types. 

2

 “8(a)” represents a source selection made to a contractor in the Small Business Administration’s 

(SBA) 8(a) program. Contracts awarded to 8(a) contractors do not require competition if the award is 

below certain dollar thresholds and is approved by an SBA official. 

3

 “Other” represents other source selections, such as acquisitions that are authorized by statute (not 

competed). 

We evaluated contract actions that varied in amount of dollars obligated, 

contract type (fixed price, cost reimbursement, etc.), and the type of 

goods and services procured. The actions in the sample ranged from a 

$1,000 firm-fixed price contract for newspapers to a $17.5 million 

modification of an information technology contract valued at over $500 

million. We reviewed the contract files supporting actions in the sample 

and, as needed, interviewed and solicited further information from the 

contracting officer or specialist, CMS’s cost/price team, and senior 

management. Controls were considered to be implemented if the 

performance of the control was documented in either the contract file or 

centrally with the cost/price team or if the contracting officer or specialist 

provided us with supplementary documentation or other evidence that the 

control was performed. The 11 controls we tested may not apply to all 

contract actions selected in the sample. For example, having support for 

provisional indirect cost rates is required for cost reimbursement 

contracts but not for other contract types, such as fixed price contracts. In 

these instances, we designated the control to be “not applicable” to the 

Page 40 GAO-10-60 CMS Contract Management
Appendix I: Scope and Methodology 

sample item. Table 3 provides further details on the control procedures we 

tested, the criteria or source for the procedure, and detailed results. 

Table 3: Control Procedures and Detailed Results 

Internal controls Criteria/source 

Number 

of errors 

in the 

sample 

Number 

of sample 

items to 

which the 

control 

applied1

Estimated lower 

error limit of all 

FY 2008 CMS 

contract actions 

that did not meet 

the control test2

1 If the contract action 

relates to a modification, 

did CMS properly 

support and justify the 

action (e.g., was the new 

action within the scope 

of the underlying 

contract)? 

It is important for agencies to determine if a 

modification is within the general scope of the contract 

to help ensure compliance with Federal Acquisition 

Regulation (FAR) 43-201(a), FAR 6.001(c), and 

applicable contract funding rules. Further, contract file 

documentation shall be sufficient to constitute a 

complete history of the contract for the purpose of: (1) 

providing a complete background as a basis for 

informed decisions at each step in the acquisition 

process, (2) supporting actions taken, (3) providing 

information for reviews and investigations, and (4) 

furnishing essential facts in the event of litigation or 

congressional inquiries. FAR 4.801(b); see also FAR 

4.803(a)(26)(iii). 

5 60 3.4 %

2 For contracts awarded 

through other than full 

and open competition, 

was the justification 

documented, approved 

by the appropriate 

official, and does it meet 

the FAR criteria (e.g., 

FAR 6.302) for using 

other than full and open 

competition? 

FAR 6.303-1 through 6.304. 

FAR 16.505(b)(5) 

FAR 13.106-1(b)(1) 

CMS’s Acquisition Policy Notice 02-03 

5 19 11.3%

3 Is there evidence that 

the contracting officer 

reviewed the 

contractor’s proposals 

for price 

reasonableness? 

FAR 15.404-1(a)(1) 

FAR 15.305 (a)(1) 

FAR 4.803(a)(19) 

11 40 16.5%

4 Did CMS include 

documentation in the 

file that supports its 

determination that the 

contractor is 

“responsible” to 

perform under the 

contract? 

FAR 9.103(a) 

FAR 9.105-2(b) 

FAR 4.803(a)(14) 

16 39 28.0%

Page 41 GAO-10-60 CMS Contract Management
Appendix I: Scope and Methodology 

 Internal controls Criteria/source 

Number 

of errors 

in the 

sample 

Number 

of sample 

items to 

which the 

control 

applied1

Estimated lower 

error limit of all 

FY 2008 CMS 

contract actions 

that did not meet 

the control test2

5 Did CMS comply with 

and document the 

requirements unique to 

the contract type 

awarded? 

FAR 16.301-3(a)(1) 

FAR 16.104(h) 

FAR 16.601(d)(1) 

FAR 1.704 

Health and Human Services Acquisition Regulations 

(HHSAR) 316.603-71 

FAR 4.803(a)(2) and (22) 

16 25 46.0%

6 When applicable, did 

CMS conduct a 

technical panel? If 

issues were identified 

by the technical panel or 

during the price 

reasonableness 

evaluation under control 

# 3 in this table, did CMS 

clearly and sufficiently 

document how the 

issues were addressed 

prior to the award of the 

contract? 

Per FAR 15.304(c)(2), agency acquisition officials are 

required to evaluate the quality of the product or 

service for every contract source selection. See FAR 

15.305(a)(3) and 15.308 for specific documentation 

requirements. In addition, HHSAR 

315.305(a)(3)(ii)(A)(1) requires a technical evaluation 

panel for all acquisitions subject to the HHSAR 

Subpart 315.3—Source Selection which are expected 

to exceed $500,000 and in which technical evaluation 

is considered a key element in the award decision. 

Furthermore, standards for internal control provide that 

internal control and all transactions and other 

significant events need to be clearly documented and 

that managers are required to complete all actions that 

correct or otherwise resolve the matters brought to 

management’s attention during the course of a review. 

See also FAR 4.801(b). 

4 27 5.4%

7 For cost reimbursement 

and time and materials 

contracts (where 

applicable), are there 

approved provisional 

indirect cost rates on 

file? If so, do the rates 

claimed on the 

contractor’s invoice(s) 

match the approved 

provisional indirect cost 

rates? 

FAR 42.703-1(b) and 42.704. See also FAR 4.803(c). 

CMS’s Acquisition Policy Notice 16-01 

36 62 40.4%

Page 42 GAO-10-60 CMS Contract Management
Appendix I: Scope and Methodology 

 Internal controls Criteria/source 

Number 

of errors 

in the 

sample 

Number 

of sample 

items to 

which the 

control 

applied1

Estimated lower 

error limit of all 

FY 2008 CMS 

contract actions 

that did not meet 

the control test2

8 If the contract is subject 

to an annual incurred 

cost audit of indirect 

costs, did CMS adjust 

the contractor’s billed 

indirect rates for final 

indirect rates? 

The government is required to adjust the provisional 

indirect cost rates used by the contractors for the 

interim reimbursement of indirect costs based on final 

indirect rates, which are generally established by 

auditing the contractor’s report of incurred costs (both 

direct and indirect costs). The FAR requires 

contractors to submit its report of incurred costs to the 

government no later than 6 months after the end of its 

fiscal year. A contract clause prescribed by the FAR 

commits the government to establishing final indirect 

cost rates as “promptly as practical” after the receipt of 

the contractor’s report of incurred costs. For purposes 

of this report, we defined “promptly” as an audit or 

request for an audit within 12 months of the due date 

of the contractor’s incurred cost report, or a total of 18 

months from the end of the contractor’s fiscal year 

end. Twelve months from the due date of the incurred 

cost report allows sufficient time for the agency to 

determine the financial resources necessary to 

perform the audit or pay another agency, such as the 

Defense Contract Audit Agency (DCAA), to perform 

the audit. 

FAR 42.705-2(b)(2) 

FAR 42.702(b) 

FAR 52.216-7(d)(2)(i) and (ii) 

23 34 52.6%

Page 43 GAO-10-60 CMS Contract Management
Appendix I: Scope and Methodology 

 Internal controls Criteria/source 

Number 

of errors 

in the 

sample 

Number 

of sample 

items to 

which the 

control 

applied1

Estimated lower 

error limit of all 

FY 2008 CMS 

contract actions 

that did not meet 

the control test2

9 If the contract is subject 

to an annual incurred 

cost audit of indirect 

costs, did CMS timely 

perform or request that 

the relevant cognizant 

federal agency perform 

an audit of direct costs 

to CMS contracts as part 

of the incurred cost 

audit; and were any 

overbillings recovered? 

The audit of direct costs provides agencies with 

reasonable assurance that the direct costs billed to the 

government are allowable, reasonable, and allocable 

to the government contracts. Therefore, direct cost 

audits are an important control activity to help ensure 

a proper accountability for stewardship of government 

resources. In addition, the audit of direct costs is 

important for the establishment of final indirect rates. 

In order to establish final indirect rates, the 

government audits the contractor’s allocation bases—

which include direct costs—used for calculating and 

applying the indirect rates. Direct costs are generally 

audited by the government as part of the audit of the 

contractor’s final indirect rates. For example, DCAA’s 

Information for Contractors Pamphlet, DCAAP 

7641.90 (Jan. 2005), § 6-301.b, states that the audit of 

the contractors’ incurred cost proposal includes an 

evaluation of both direct and indirect costs. As such, 

for purposes of this report, we evaluated whether CMS 

requested an audit of direct costs using the same 

timing criteria for the audit of indirect costs, that is, 18 

months from the end of the contractor’s fiscal year. 

Twelve months from the due date of the incurred cost 

report allows sufficient time for the agency to 

determine the financial resources necessary to 

perform the audit or pay another agency, such as 

DCAA, to perform the audit. See control #8, above. 

25 36 54.9%

Page 44 GAO-10-60 CMS Contract Management
Appendix I: Scope and Methodology 

 Internal controls Criteria/source 

Number 

of errors 

in the 

sample 

Number 

of sample 

items to 

which the 

control 

applied1

Estimated lower 

error limit of all 

FY 2008 CMS 

contract actions 

that did not meet 

the control test2

10 Is there sufficient 

support for the costs 

claimed on the invoices 

to enable CMS to 

sufficiently review the 

contractor’s invoices? 

According to FAR 52.216-7(a)(1), the government will 

make payments to the contractor under cost 

reimbursement and time and materials contracts in 

amounts determined to be allowable by the contracting 

officer in accordance with the contract cost principles 

and procedures in FAR Subpart 31.2. In addition, FAR 

states that the government pays contractors under 

fixed price contracts based on the submission of 

proper invoices or vouchers (FAR 52.232-1 and 

52.232-2). In order to determine whether an invoice is 

proper or complies with FAR cost principles, 

contracting officers need to obtain sufficient support 

that will provide the basis for such determination. 

According to the Treasury Financial Manual, effective 

control over disbursements requires a preaudit and 

approval of vouchers before they are certified for 

payment (Vol. I, Part 4, §§ 2020.10, 2020.30, and 

2025.10). This process will include determining 

whether the payment and the goods received or 

services performed were in accordance with the 

agreement. In addition, standards for internal control 

provide that “internal control and all transactions and 

other significant events need to be clearly 

documented.” 

53 90 49.9%

11 Is there sufficient 

evidence that the project 

officer approved all 

invoices? 

CMS’s Acquisition Policy Notice 16-01 61 90 59.0%

Source: GAO. 

1

 The specific control we tested may not apply to all items in the sample. For example, the 

establishment of provisional indirect cost rates is required for cost reimbursement contracts but would 

not apply to other contract types such as fixed price contracts. 

2

 Based on the results of our work, we are 95 percent confident that the total percentage of contract 

actions that did not meet the control test is at least the percentage indicated for each control, which is 

the estimated lower error limit. 

To determine the extent to which CMS established a strong control 

environment for contract management, we interviewed CMS officials and 

reviewed agency documentation to determine the actions CMS took to 

address prior recommendations.2

 We also obtained information from 

 

2

 GAO, Centers for Medicare and Medicaid Services: Internal Control Deficiencies 

Resulted in Millions of Dollars of Questionable Contract Payments, GAO-08-54 

(Washington, D.C.: Nov. 15, 2007), p. 45. 

Page 45 GAO-10-60 CMS Contract Management
Appendix I: Scope and Methodology 

agency officials regarding contract closeout, cognizant federal agency 

responsibilities, audit funding, and staff resources. We used the internal 

control standards as a basis for our evaluation of CMS’s contract 

management control environment. 

We assessed the reliability of CMS’s two acquisition databases, 

Departmental Contracts Information System (DCIS) and PRISM by (1) 

performing electronic testing of required data elements, and (2) 

interviewing both CMS and HHS officials on quality assurance activities 

performed on the databases. In addition, we used a statistically random 

sample selected to test the application of controls to also test the accuracy 

of the data in the systems. We determined that only basic contract 

information maintained in the PRISM database, such as vendor name and 

obligation amount, was reliable for purposes of this report. The historical 

obligation amounts presented in the background section of the report 

come primarily from CMS’s PRISM database. 

We requested comments on a draft of this report from HHS and CMS. We 

received written comments on October 2, 2009, and have summarized 

those comments in the Agency Comments and Our Evaluation section of 

this report. Our response to certain specific CMS comments appears in the 

GAO Comments section of appendix III. We conducted this performance 

audit in accordance with generally accepted government auditing 

standards. Those standards require that we plan and perform the audit to 

obtain sufficient, appropriate evidence to provide a reasonable basis for 

our findings and conclusions based on our audit objectives. We believe 

that the evidence obtained provides a reasonable basis for our findings 

and conclusions based on our audit objectives. We conducted our audit 

work in Washington, D.C. and Baltimore, Maryland from July 2008 through 

September 2009. 

Page 46 GAO-10-60 CMS Contract Management
Appendix II: Status of Prior 

Recommendations 

GAO recommendation Progress and GAO evaluation GAO-determined status

(1) Develop policies and criteria 

for pre-award contract 

activities, including (1) 

appropriate use of competition 

exemptions such as logical 

follow-on agreements, unusual 

and compelling urgency, and 

the Small Business 

Administration’s (SBA) 8(a) 

program; (2) analysis to justify 

contract type selected, as well 

as, if applicable, verification of 

the adequacy of the 

contractor’s accounting system 

prior to the award of a cost 

reimbursement contract; and 

(3) consideration of the extent 

to which work will be 

subcontracted. 

Progress: 

The Department of Health and Human Services (HHS) reported that 

(a) the policy and criteria for pre-award contracting activities are 

already established in the Federal Acquisition Regulation (FAR) and 

the Health and Human Services Acquisition Regulation (HHSAR), 

(b) that existing policies would be reviewed and changes would be 

made as appropriate, and (c) certain pre-award activities, such as 

the need for adequate accounting systems for cost reimbursement 

contracts, would be reviewed with staff at internal training sessions. 

GAO evaluation: 

While the Office of Acquisition and Grants Management (OAGM) did 

conduct internal training on various pre-award activity topics, such 

as the proper circumstances to use sole source contracts, the 

Centers for Medicare and Medicaid Service’s (CMS) actions are 

unresponsive to the recommendation. OAGM still has not developed 

policies and criteria that provide clear procedures for staff to follow 

during the pre-award stage, such as applicable approval levels, time 

frames, agency forms, and routing processes. Furthermore, while 

FAR and HHSAR provide regulations agencies must follow, it is up 

to agency management to develop agency-specific policies and 

other guidance that implement those regulations. 

No action taken. 

(2) Develop policies and 

procedures to help ensure that 

cognizant federal agency 

(CFA) responsibilities are 

performed, including (1) 

monitoring compliance with the 

Cost Accounting Standards, (2) 

a mechanism to track 

contractors for which CMS is 

the cognizant federal agency, 

and (3) coordination efforts 

with other agencies. 

Progress: 

HHS reported that while HHS is the CFA for CMS’s contractors, 

policies and procedures need to be developed both at the 

department level and at CMS. Further it stated that to the extent 

CMS is designated to perform functions supporting HHS as the 

CFA, CMS will develop appropriate procedures for monitoring Cost 

Accounting Standards compliance and for coordinating efforts with 

other agencies. 

GAO evaluation: 

Neither HHS nor CMS has developed policies that clearly define key 

areas of authority and duties for the CFA responsibilities. Moreover, 

neither HHS nor CMS has developed a list of contractors for which 

HHS is the CFA. 

Actions insufficient. No 

policies and procedures 

developed. 

Appendix II: Status of Prior 

Recommendations 

Page 47 GAO-10-60 CMS Contract Management 
Appendix II: Status of Prior 

Recommendations 

 GAO recommendation Progress and GAO evaluation GAO-determined status

(3) Develop agency-specific 

policies and procedures for the 

review of contractor invoices 

so that key players are aware 

of their roles and 

responsibilities, including (1) 

specific guidance on how to 

review key invoice elements, 

(2) methods to document 

review procedures performed, 

and (3) consideration to 

circumstances that may 

increase risk, such as contract 

type or complex subcontractor 

agreements. 

Progress: 

HHS reported that CMS revised its invoice review policy to better 

define roles and responsibilities. 

GAO evaluation: 

We reviewed the CMS revised invoice review policy and determined 

that new invoice payment procedures contain clear roles and 

responsibilities. 

Completed. 

(4) Prepare guidelines to 

contracting officers on what 

constitutes sufficient detail to 

support amounts billed on 

contractor invoices to facilitate 

the review process. 

Progress: 

HHS reported that CMS revised its invoice review policy. 

GAO evaluation: 

CMS’s actions are unresponsive to the recommendation. The 

revised policy does not specify the documentation the contractors 

would be required to submit to support the invoices or what would 

be needed for the project officer, contracting specialist, or 

contracting officer to validate information in the invoices. 

No action taken. 

(5) Establish criteria for the use of 

negative certification in the 

payment of a contractor’s 

invoices to consider potential 

risk factors, such as contract 

type, the adequacy of the 

contractor’s accounting and 

billing systems, and prior 

history with the contractor. 

Progress: 

HHS reported that CMS revised its invoice review policy. 

GAO evaluation: 

CMS’s actions are unresponsive to the recommendation. The 

revised policy still contains the use of negative certification as a 

default. This policy does not provide criteria to consider potential risk 

factors for the use of negative certification in the review of 

contractor’s invoices and discuss circumstances that warrant the 

use of this method. 

No action taken. 

(6) Provide training on the invoice 

review policies and procedures 

to key personnel responsible 

executing the invoice review 

process. 

Progress: 

HHS reported that CMS provided invoice review training to the 

OAGM staff and project officers on May 7 and May 15, 2008. 

GAO evaluation: 

According to the OAGM Internal Training schedule, they provided 

training on invoice review procedures. However, since CMS has not 

addressed two of the three recommendations on invoice review—

specifically, guidelines to contracting officers on what constitutes 

sufficient detail to support amounts billed and establishing criteria for 

the use of negative certification (see above)—actions taken do not 

achieve the intent of the recommendation. 

Actions insufficient. 

Actions taken do not 

achieve intent of 

recommendation. 

Page 48 GAO-10-60 CMS Contract Management
Appendix II: Status of Prior 

Recommendations 

 GAO recommendation Progress and GAO evaluation GAO-determined status

(7) Create a centralized tracking 

mechanism that records the 

training taken by personnel 

assigned to contract oversight 

activities. 

Progress: 

HHS reported that they have implemented the Acquisition Career 

Management Information System (ACMIS). ACMIS is a centralized 

tracking mechanism that maintains training records for the personnel 

assigned to contract activities. 

GAO evaluation: 

HHS’s implementation of the centralized system to track training 

addressed our recommendation. 

Completed. 

(8) Develop a plan to reduce the 

backlog of contracts awaiting 

closeout. 

Progress: 

HHS reported that CMS developed a plan to reduce the backlog of 

contracts overdue awaiting closeout and that CMS reduced this 

backlog by the end of fiscal year 2007 from 581 to 407 contracts. 

GAO evaluation: 

CMS provided its fiscal year 2009 contract closeout plan; however, 

the plan did not include a comprehensive strategy to reduce the 

backlog of contracts that are eligible and overdue for closeout. For 

example, it did not contain a workload analysis, such as a list of 

contracts eligible for closeout by contracting officer or specialist or 

an estimate of the number of hours or audit funds it would need to 

close the contracts. 

The fiscal year 2009 plan only contained three bullets stating that 

OAGM would provide quarterly reports to the division directors and 

training to OAGM staff. It also stated that OAGM would establish “a 

contract closeout day.” Furthermore, as discussed in the body of this 

report, the backlog of contracts overdue for closeout persists. 

Actions insufficient. 

(9) Review the questionable 

payments identified in this 

report to determine whether 

CMS should seek 

reimbursement from 

contractors. 

Progress: 

HHS reported that CMS will review the questionable payments 

identified in GAO-08-54 to determine whether CMS should seek 

reimbursement from the contractors. It further stated that the 

questionable costs will be identified in the course of incurred cost 

audits which CMS will obtain in the course of closing out the 

contracts. Additionally, CMS described specific actions taken to 

investigate some of the questionable payments. 

GAO evaluation: 

The actions taken to investigate questionable payments were either 

insufficient or incomplete. CMS’s approach to delay investigation 

and recovery to the end of the contract performance period does not 

result in timely resolution of questionable payments of this 

magnitude. Audits and inquiries into the issues we identified in our 

report should be made as soon as possible. 

Actions insufficient. 

Source: GAO analysis, based on a CMS-provided report (dated December 3, 2008) used by HHS to track the resolution of GAO audit 

findings, interviews, and other documentation such as agency policies.

Page 49 GAO-10-60 CMS Contract Management
Appendix III: Comments from the Centers for Appendix III: Comments from the Centers for Medicare and Medicaid Services 

Medicare and Medicaid Services 

Note: GAO comments 

supplementing those in 

the report text appear at 

the end of this appendix. 

See comment 1. 

See comment 1. 

Page 50 GAO-10-60 CMS Contract Management 
Appendix III: Comments from the Centers for 

Medicare and Medicaid Services 

See comment 2. 

See comment 3. 

Page 51 GAO-10-60 CMS Contract Management
Appendix III: Comments from the Centers for 

Medicare and Medicaid Services 

See comment 1. 

See comment 1. 

Page 52 GAO-10-60 CMS Contract Management
Appendix III: Comments from the Centers for 

Medicare and Medicaid Services 

See comment 4. 

See comment 1. 

Page 53 GAO-10-60 CMS Contract Management
Appendix III: Comments from the Centers for 

Medicare and Medicaid Services 

See comment 5. 

Page 54 GAO-10-60 CMS Contract Management
Appendix III: Comments from the Centers for 

Medicare and Medicaid Services 

See comment 6. 

Page 55 GAO-10-60 CMS Contract Management
Appendix III: Comments from the Centers for 

Medicare and Medicaid Services 

See comment 7. 

Page 56 GAO-10-60 CMS Contract Management
Appendix III: Comments from the Centers for 

Medicare and Medicaid Services 

Page 57 GAO-10-60 CMS Contract Management
Appendix III: Comments from the Centers for 

Medicare and Medicaid Services 

Page 58 GAO-10-60 

1. See “Agency Comments and Our Evaluation” section. GAO Comments 

2. As we stated in our November 2007 report1

, we acknowledge that the 

time frames for implementing the Medicare Prescription Drug, 

Improvement, and Modernization Act of 2003 added schedule pressures for 

the Centers for Medicare and Medicaid Services (CMS). At the same time, 

the compressed time frames and resulting contracting practices added risk 

to the contracting process. Many of the findings in the November 2007 

report were a result of the increased risk together with inadequate 

compensating controls to mitigate risk. 

3. While the Virtual Acquisition Office, which is an off-the-shelf acquisition 

software that provides Web links to acquisition regulation and templates to 

aid in completion of common acquisition activities, can be a useful tool for 

contracting officers, specialists, and the Office of Acquisition and Grants 

Management (OAGM) management, it does not represent the agencyspecific policies and criteria we recommended that CMS implement for 

pre-award activities. As such, CMS’s actions are unresponsive to the 

recommendation. Agency-specific policies provide guidance on how CMS 

staff are expected to perform their day-to-day duties. 

4. As discussed in the report, we continue to believe the contract closeout 

plan does not sufficiently address our recommendation because it did not 

include a comprehensive strategy to reduce the backlog of contracts that 

are eligible and overdue for closeout, nor did it contain a workload 

analysis. The plan was for fiscal year 2009; no other plans were developed. 

Additionally, CMS stated that it achieved a 30 percent reduction in the 

number of contracts eligible for closeout since 2007. However, CMS could 

not fully support the analysis it provided and it related only to the time 

period between April 2007 and September 30, 2007.2

 According to data 

provided to us by CMS during this current review, since September 30, 

2007, the number of contracts eligible for closeout has increased by 24 

percent, from 1,300 in 2007 to 1,611 in 2009. Additionally, the number of 

contracts overdue for closeout has increased from 407 in 2007 to 594 in 

2009, a 46 percent increase. 

 

1

 GAO, Centers for Medicare and Medicaid Services: Internal Control Deficiencies 

Resulted in Millions of Dollars of Questionable Contract Payments, GAO-08-54 

(Washington, D.C.: Nov. 15, 2007). 

2

 The number of contracts eligible for closeout and overdue for closeout as of September 

30, 2007, was reported in our November 2007 report. 

 CMS Contract Management 
Appendix III: Comments from the Centers for 

Medicare and Medicaid Services 

5. The contract file document checklist employed by CMS at the time of 

our review identified key documents that may be included in a contract 

file. This checklist is usually completed by either the contract specialist or 

contracting officer. While such a checklist is useful for ensuring that 

certain documents are contained in a contract file, it did not reflect certain 

requirements in which we found CMS to be deficient, such as ensuring 

contractors had adequate accounting systems prior to the use of a cost 

reimbursement contract. We are encouraged that CMS is taking additional 

actions to implement the checklists developed by the Department of 

Health and Human Services to be used in fiscal year 2010. 

6. During our review and as a result of multiple conversations with OAGM 

staff including the team of contract auditors, we revised our testing 

procedures to consider and accept provisional indirect cost rates that were 

not maintained in the individual contract file but were maintained by the 

cost/price team in its central files. Therefore, all provisional indirect cost 

rate determinations that were maintained by OAGM, regardless of location, 

were considered during our review. The steps CMS described that it plans 

to take will be important for ensuring that contract office staff have the 

information needed readily available to manage contracts throughout the 

contract life cycle. 

7. As stated in the report, CMS’s current procedures regarding the 

accuracy of data entered into the Departmental Contracts Information 

System (DCIS) do not include procedures that would ensure that the 

resolution of potential errors are properly documented and errors are 

corrected in a timely manner. We further found that OAGM was not fully 

implementing its policy because it reviewed every 88th action, rather than 

every 50th as provided for in the plan. However, we are encouraged by the 

recent initiatives described in CMS’s comments, such as the scorecard, and 

OAGM’s commitment to review current policies and procedures and to 

make improvements where necessary. 

Page 59 GAO-10-60 CMS Contract Management
Appendix IV: 

A

GAO Contact and Staff 

cknowledgments 

Page 60 GAO-10-60 

Appendix IV: GAO Contact and Staff 

Acknowledgments 

Kay L. Daly, (202) 512-9095, or dalykl@gao.gov 

Staff members who made key contributions to this report include Marcia 

Carlsen and Phil McIntyre (Assistant Directors), Sharon Byrd, Richard 

Cambosos, Abe Dymond, Patrick Frey, Jason Kelly, John Lopez, Ron 

Schwenn, Omar Torres, Ruth Walk, and Danietta Williams. 

 CMS Contract Management 

GAO Contact 

Acknowledgments 

(194763) 
GAO’s Mission The Government Accountability Office, the audit, evaluation, and 

investigative arm of Congress, exists to support Congress in meeting its 

constitutional responsibilities and to help improve the performance and 

accountability of the federal government for the American people. GAO 

examines the use of public funds; evaluates federal programs and policies; 

and provides analyses, recommendations, and other assistance to help 

Congress make informed oversight, policy, and funding decisions. GAO’s 

commitment to good government is reflected in its core values of 

accountability, integrity, and reliability. 

The fastest and easiest way to obtain copies of GAO documents at no cost 

is through GAO’s Web site (www.gao.gov). Each weekday afternoon, GAO 

posts on its Web site newly released reports, testimony, and 

correspondence. To have GAO e-mail you a list of newly posted products, 

go to www.gao.gov and select “E-mail Updates.” 

Obtaining Copies of 

GAO Reports and 

Testimony 

Order by Phone The price of each GAO publication reflects GAO’s actual cost of 

production and distribution and depends on the number of pages in the 

publication and whether the publication is printed in color or black and 

white. Pricing and ordering information is posted on GAO’s Web site, 

http://www.gao.gov/ordering.htm. 

Place orders by calling (202) 512-6000, toll free (866) 801-7077, or 

TDD (202) 512-2537. 

Orders may be paid for using American Express, Discover Card, 

MasterCard, Visa, check, or money order. Call for additional information. 

Contact: 

Web site: www.gao.gov/fraudnet/fraudnet.htm

E-mail: fraudnet@gao.gov

Automated answering system: (800) 424-5454 or (202) 512-7470 

Ralph Dawn, Managing Director, dawnr@gao.gov, (202) 512-4400 

U.S. Government Accountability Office, 441 G Street NW, Room 7125 

Washington, DC 20548 

To Report Fraud, 

Waste, and Abuse in 

Federal Programs 

Congressional 

Relations 

Chuck Young, Managing Director, youngc1@gao.gov, (202) 512-4800 

U.S. Government Accountability Office, 441 G Street NW, Room 7149 

Washington, DC 20548 

Public Affairs 

Please Print on Recycled Paper