Medicare Advantage: Required Audits of Limited Value
Published: 2007-07-30T00:00:00

Fast Facts:

Highlights:
section_title: Why GAO Did This Study
paragraphs: In fiscal year 2006, the Centers for Medicare & Medicaid Services (CMS) spent over $51 billion on the Medicare Advantage program, which serves as an alternative to the traditional fee-for-service program. Under the Medicare Advantage program, companies wishing to participate must annually submit bids (effective with contract year 2006) that identify the health services the company will provide to Medicare members and the estimated cost and revenue requirements for providing those services. For 2001 through 2005, the submissions were called Adjusted Community Rate (ACR) Proposals. The Balanced Budget Act (BBA) of 1997 requires CMS to annually audit the financial records supporting the submissions of at least one-third of participating organizations. BBA also requires that GAO monitor the audits. In this report, GAO examined (1) whether CMS met the one-third requirement for 2001 through 2006, (2) what information the ACR audits provided and how CMS used it, and (3) what information the bid audits provided and how CMS used it.
section_title: What GAO Found
paragraphs: CMS did not document its process to determine whether it met the requirement for auditing ACRs for one-third of the participating Medicare Advantage organizations for contract years 2001-2005. CMS is planning to conduct other financial reviews of organizations to meet the audit requirement for contract year 2006, but by the end of our fieldwork in June 2007, CMS had not finalized its plans. Further, CMS does not plan to complete the financial reviews until almost 3 years after the bid submission date each contract year. This will affect its ability to address deficiencies in a timely manner. CMS did not consistently ensure that the audit process for contract years 2001-2005 provided information to assess the impact on beneficiaries. After contract year 2003 audits were completed, CMS took steps to determine such impact and identified about $34 million from those audits that beneficiaries could have received in additional benefits. However, in late May 2007, CMS officials told us they were planning to close out the audits without pursuing financial recoveries because the agency does not have the legal authority to do so. According to our assessment of the statutes, CMS had the authority to pursue financial recoveries, but its rights under contracts for 2001-2005 are limited because its implementing regulations did not require that each contract include provisions to inform organizations about the audits and about the steps that CMS would take to address identified deficiencies, including pursuit of financial recoveries. CMS audited contract year 2006 bids for 80 organizations, and 18 had a material finding that affected amounts in approved bids. CMS officials said that they will use the audit results to help improve bids in subsequent years but took limited action to follow-up on contract year 2006 findings. CMS will not pursue financial recoveries based on audit results because it maintains that it does not have the legal authority to do so. However, according to our assessment of the statutes, CMS has the authority to include terms in bid contracts that would allow it to pursue financial recoveries. CMS also has the authority to sanction organizations but has not identified instances where sanctions are warranted. We also noted that CMS did not document steps taken to mitigate conflicts of interest for the firms performing audits.

section_title: Letter
paragraphs: In fiscal year 2006, the Centers for Medicare & Medicaid Services (CMS)  estimated it spent over $51 billion on the Medicare Advantage program,  which serves as an alternative to Medicare’s traditional fee-for-service  (FFS) program. Under the Medicare Advantage program, CMS approves  private companies to offer health plan options to Medicare enrollees that  include all Medicare-covered services. In addition, many plans under the  program provide supplemental benefits, such as a reduction in required  cost sharing (e.g., beneficiaries’ Part B premiums) or coverage for items  and services not included under the traditional FFS program, like dental  care. According to CMS, in fiscal year 2006, over 16 percent, or about 7  million of the approximately 43 million Medicare members, were enrolled  in a Medicare Advantage plan.
Before 2006, companies choosing to participate in the Medicare Advantage  program were required to annually submit an Adjusted Community Rate  Proposal (ACRP) to CMS for review and approval for each plan it intended  to offer. The ACRP consisted of two parts—a plan benefit package and  the Adjusted Community Rate (ACR). The plan benefit package contained  a detailed description of the benefits offered by the plan, and the ACR  contained a detailed description of the costs that the plan estimated it  would incur in providing a package of benefits to an enrolled Medicare  beneficiary. These costs were to be calculated based on how much a plan  would charge a commercial customer to provide the same benefit package  if its members had the same expected use of services as Medicare  beneficiaries. For each plan offered, the ACR was to provide an estimate  of expected per person payments from Medicare, based on published  Medicare+Choice payment rates and the characteristics of the plan’s  expected enrollees. If the estimated ACR costs were greater than the  estimated payment rate, and if the organization still chose to participate, it  agreed to accept the CMS payment rate in accordance with its ACRP.  However, if the estimated ACR costs were less than the estimated payment  rate, the organization had to (1) provide additional services, (2) reduce  beneficiary premiums or copayments, (3) distribute the excess to a benefit  stabilization fund, or (4) use a combination of these methods. CMS made  payments to the companies monthly in advance of rendering services.
In 2003, Congress enacted the Medicare Prescription Drug, Improvement  and Modernization Act of 2003 (MMA). Among other things, MMA  established a bid submission process to replace the ACRP submission  process and authorized a new prescription drug benefit, both effective for  2006. Under the bid process, private companies—called Medicare  Advantage (MA) organizations—choosing to participate in the program are  required to annually submit bids for review and approval for each plan  they intend to offer. The bid submission includes a bid form that provides  each MA organization’s estimate of the cost of delivering services to an  enrolled Medicare beneficiary and a plan benefit package that provides a  detailed description of the benefits offered in each plan. Additionally, each  MA organization and prescription drug plan that offers prescription drug  benefits under Part D is required to submit a separate prescription drug  bid form, a formulary, and a plan benefit package to CMS for its review  and approval. Within the bid forms, MA organizations include an estimate  of the per person cost of providing Medicare-covered services. Unlike the  cost estimates under the ACRP process, organizations develop CMS bid  cost estimates by relying on reasonable projection methods that may  include reliance on incurred costs for a base year, adjustments for  estimated utilization, and other factors to project costs to the bid contract  period. CMS compares the bid amounts to geographic-specific  benchmarks to determine the total payment to the MA organization. If a  bid amount is above the benchmark, the MA organization must require  enrollees to pay the difference in the form of a premium. If the bid amount  is below its benchmark, 75 percent of the difference (or savings), termed a  rebate, must be provided to enrollees as extra benefits in the form of cost  sharing reductions, premium reductions, or additional covered services.  The remaining 25 percent of the savings is retained by the Federal  Treasury. After bids are approved and payments are established, CMS  makes payments to the companies monthly in advance of rendering  services.
Until the passage of the Balanced Budget Act of 1997 (BBA), which  required CMS to annually audit the supporting financial records (including  data relating to Medicare utilization, costs, and computation of the ACR)  of at least one-third of the participating organizations, there was limited  oversight by CMS of the ACR process. BBA also required that GAO  monitor the audit activities mandated by the act. In fulfilling our  responsibility, we first reviewed CMS’s process for auditing ACRs  approved for contract year 2000. This was CMS’s first effort to meet the  audit requirement. We reported that the audits were of limited usefulness  because CMS did not follow up on the audit results. In continuing to fulfill  our audit monitoring responsibility, this report addresses the following  questions:  1.  Has CMS met the requirement for auditing the financial records of at least  one-third of the participating MA organizations for contract years 2001- 2005 as required by the Balanced Budget Act of 1997 and bid submissions  for contract year 2006?  2.  Did the ACRP audit process provide CMS sufficient information to assess  potential impacts on beneficiaries and identify actions to address those  impacts?  3.  How did CMS conduct audits of bids for 2006, what information did the  bid audit process provide CMS, and how did CMS use that information?
To determine whether CMS met requirements for auditing the financial  records of at least one-third of the MA organizations for contract years  2001-2005 and the bid submissions for contract year 2006, we obtained  from CMS a listing of the organizations that had their ACRPs or bids  audited each year and compared it with the total number of approved  ACRP and bid submissions for each year obtained from CMS’s ACRP and  bid management database, the Health Plan Management System (HPMS).  We also interviewed CMS staff and officials.
To determine whether information provided by the ACRP audit process  was sufficient for CMS to assess potential impacts on beneficiaries and  address those impacts, we obtained and reviewed audit reports for  contract years 2001-2004 and reports prepared by a contractor that  reviewed and analyzed the audits for contract year 2003. We interviewed  CMS staff and officials about what they did with the audit results, and we  discussed CMS’s review of an analysis of contract year 2003 ACR audits  performed by the contractor.
To determine how CMS conducted bid audits for contract year 2006, what  information the bid audit process provided CMS, and how CMS used that  information, we obtained and reviewed CMS’s instructions and guidance  for bid auditors, bid audit reports for contract year 2006, planned audit  procedures, and bid certifications records. We interviewed the bid audit  firms and CMS staff and officials about the bid audit process and  discussed with CMS how it used the results of the contract year 2006  audits and its plans for future use.
See appendix I for details about our scope and methodology. We requested  written comments on a draft of this report from the Secretary of Health  and Human Services (HHS) or his designee. We conducted our review  from November 2006 to June 2007 in accordance with generally accepted  government auditing standards.
subsections: section_title: Background
paragraphs: The Medicare program has a long-standing history of offering its  beneficiaries managed care coverage through private plans as an  alternative to the traditional FFS program. In 1997, Congress passed the  Balanced Budget Act of 1997, which replaced an existing managed care  program with the Medicare+Choice program in an effort to expand  beneficiaries’ managed care options. For oversight of the program, the act  also required that CMS annually audit the financial records of at least one- third of the organizations participating in the Medicare+Choice program,  including the organizations’ data relating to Medicare utilization, costs,  and computation of the ACR.
In 2003, Congress enacted the Medicare Prescription Drug, Improvement,  and Modernization Act of 2003 to expand the role of private entities in  providing benefits to Medicare beneficiaries. Among its changes, the law  renamed the Medicare+Choice program the Medicare Advantage program.  Medicare+Choice organizations were renamed MA organizations. MMA  also authorized new prescription drug benefits to Medicare beneficiaries  beginning in 2006 and created new types of private health plans such as  “regional” MA plans, special needs plans, and prescription drug plans that  could be offered in addition to the plan types already being offered such as  health maintenance organizations (HMO), preferred provider  organizations (PPO), provider-sponsored organizations (PSO), medical  savings accounts, and private FFS plans.
MMA established a bid submission process to replace the ACRP  submission process used under the Medicare+Choice program to annually  approve the benefit packages and costs that organizations estimated they  would incur in providing benefits to enrolled Medicare beneficiaries. MMA  specified that organizations wishing to offer health benefits as part of the  MA program and drug benefits must annually submit bids. The bid  submission includes a MA bid form indicating each MA organization’s  estimate of the cost of delivering services to Medicare beneficiaries and a  plan benefit package for each plan. Additionally, each organization that  offers prescription drug benefits under Part D is required to submit a  separate prescription drug bid form, a formulary, and a plan benefit  package to CMS for its review and approval.
MMA made changes to the methodology that MA organizations use in  estimating the costs of benefits. Under the ACRP process, MA  organizations were required to include an estimate of their per person cost  of providing benefits based on how much they would charge a commercial  customer to provide the same benefit package if their members had the  same expected use of services as Medicare beneficiaries. The chief  executive officer, chief financial officer, and the head marketing official of  the MA organization were required to certify that the ACRP contained  accurate information.
Under the bid process, cost estimates are not based on commercial  experience. Under CMS’s bid submission instructions, organizations are  required to include an estimate of the per person cost of providing  Medicare-covered services by relying on reasonable projection methods  that may include reliance on incurred costs for a base year, adjustments  for estimated utilization, and other factors to project costs to the bid  contract period. The allowed costs and additional cost sharing information  are to be used to determine net medical costs. To this, nonmedical  expenses, such as indirect administration and gain/loss margins, are to be  added to establish the required revenue for the contract year for each plan  offered. The assumptions, data, and models used in developing cost  estimates are prepared by the organizations’ actuaries. CMS requires that  the actuary who prepared the bid must submit a certification stating that  the bid complies with laws, regulations, and the bid instructions and that  the actuary has followed the appropriate actuarial standards in completing  the bid.
To determine the payments under the bid process, CMS compares the bid  amounts to geographic-specific benchmarks. If a bid is above the  benchmark, the enrollee must pay the difference in the form of a premium,  referred to as the basic beneficiary premium. If a bid is below its  benchmark, 75 percent of the difference (or savings), termed the rebate,  must be provided to enrollees as extra benefits in the form of cost sharing  reductions, premium reductions for Part B or Part D, or additional covered  services. The remaining 25 percent of the savings is retained by the  Federal Treasury.
By law, organizations are required to submit bids for each contract year by  the first Monday in June before the contract year begins. For contract year  2006, organizations had to submit bids to CMS by June 6, 2005. The bids  are submitted through HPMS. CMS subjects the bid forms to a desk review  prior to approval. In contract year 2006, CMS contracted with six actuarial  consulting firms to assist in reviewing the bid forms. The objective of the  bid review was to determine whether the bid was reasonable and fair to  the organization, the beneficiary, and CMS. In contract year 2006, the  review of the bid forms consisted of a series of structured subreviews that  examined the individual cost elements that collectively comprised each  bid. CMS’s OACT developed metrics for each bid and identified statistical  outliers based on “acceptable thresholds” it defined. The contract  reviewers investigated the outliers, requesting additional documentation  from the organization as necessary, to assess the assumptions and  methods supporting the bid elements and their reasonableness to support  the overall bid. From early June 2005 through mid-September 2005, CMS  contractors reviewed the bids, and CMS approved them. CMS awarded  contracts for approved bids by mid-September 2005.
After approval of the bids, CMS selects bids for audit. For audits of the  contract year 2006 bid forms, OACT contracted with six firms in  September 2005. CMS specified audit guidance for the auditors. This  included procedures for reviewing the accuracy of organizations’ financial  data supporting the bid submissions and the reasonableness of  assumptions used in the contract year financial projections. Auditors were  also instructed to consider whether the bids were developed consistent  with the Actuarial Standards of Practice (ASOP) designated by CMS and  CMS’s bid preparation instructions. (See appendix II for a description of  the ASOPs.) Auditors generally reported preliminary findings by April 2006  and issued final reports by August 2006.
In contract year 2006, OACT required MA organizations to report incurred  revenue and expense information for contract year 2004. CMS calls this a  2-year look back. As of June 2007, OACT had made limited use of this 2- year look back information, but intends to use such information to assess  the credibility of projected revenue and expenses reported by MA  organizations. This would include a review of data to identify possible  biases or inaccuracies in a MA organization’s bid estimations.
section_title: GAO Analysis Shows CMS Has Not Met the Audit Requirement for Contract Years 2001- 2005 and Has Not Yet Met It for Contract Year 2006
paragraphs: CMS did not document its process to determine whether it met the one- third audit requirement. However, according to our analysis of available  CMS data, CMS has not met the statutory requirement to audit the  financial records of at least one-third of the participating MA organizations  for contract years 2001-2005, nor has it done so yet for the contract year  2006 bid submissions. We performed an analysis to determine if CMS had  met the requirement because CMS could not provide documentation to  support the method it used to select the ACRs and bids for audit and to  demonstrate that it had met the audit requirement for those years. With  respect to contract year 2006, CMS officials acknowledged the one-third  requirement, but they stated that they did not intend for the audits of  contract year 2006 bid submissions to meet the one-third audit  requirement. They explained that they plan to conduct other reviews of  the financial records of MA organizations and prescription drug plans to  meet the requirement for contract year 2006. However, CMS has not  clearly laid out how these reviews will be conducted to meet the one-third  requirement. Further, CMS is not likely to complete these other financial  reviews until almost 3 years after the bid submission date for each  contract year, in part because it must first reconcile payment data that  prescription drug plans are not required to submit to CMS until 6 months  after the contract year is over. Such an extended cycle for conducting  these reviews to meet the one-third requirement limits their usefulness to  CMS and hinders CMS’s ability to timely identify any identified  deficiencies in MA organizations’ and prescription drug plans’ bid  processes that require corrective action.
subsections: section_title: CMS Has Not Met Audit Requirement
paragraphs: The Secretary of Health and Human Services is required to provide for the  annual auditing of the financial records (including data relating to  Medicare utilization and costs) of at least one-third of the MA  organizations. In defining what constituted an organization for the  purpose of selecting one-third for audit, CMS officials explained that they  determined the number of participating organizations based on the  number of contracts that they awarded. Under each contract an  organization can offer multiple plans. When CMS selects an organization  for audit, some, but not all, of the plans offered under the organization’s  contract are audited.
CMS did not document its approach for selecting ACRs for audit or how its  approach was to meet the one-third annual audit requirement.  Consequently, we performed an analysis comparing the organizations and  plans audited as a percentage of organizations and plans that CMS  approved under the Medicare+Choice, Medicare Advantage, and Part D  programs from contract year 2001 through contract year 2006. We  obtained data on the total number of organizations and plans from CMS’s  HPMS and data on the audited organizations from the audit reports. We  determined that between 18.6 and 23.6 percent, or fewer than one-third, of  the MA organizations offering plans for contract years 2001-2005 were  audited. Similarly, we determined that only 13.9 percent of the MA  organizations and prescription drug plans with approved bids for contract  year 2006 were audited. Table 1 summarizes our results.
Although CMS selects organizations to meet the one-third audit  requirement based on the number of organizations and not the total  number of plans offered by organizations, we also analyzed the percentage  of plans audited of the total number of plans offered by each audited  organization. Our analysis shows that with the exception of contract year  2002, the level of audit coverage achieved by CMS audits has progressively  decreased in terms of the percentage of plans audited for those  organizations that were audited. Audit coverage has also decreased in  terms of the percentage of plans audited of all plans offered by  participating organizations each contract year. In contract year 2006, a  large increase in the number of bid submissions meant that the 159 plans  audited reflected only about 3 percent of all the plans offered. Table 2  summarizes our analysis.
Regarding how CMS selected the organizations that were audited for  contract years 2001-2004, CMS officials told us they did not know how the  MA organizations were selected, and the documentation supporting the  selections was either not created or not retained. For contract year 2005  audits, CMS officials told us that the selection criteria included several  factors other than simply selecting one-third of the participating MA  organizations that were awarded contracts. They said that the criteria  considered whether the MA organization had a negative balance in the  benefit stabilization fund and the MA organization had been audited  previously and had significant issues. Late in June, CMS’s OFM staff  provided us a summary of the criteria used to select the 59 organizations  participating in the MA program that it selected for contract year 2005  ACR audits. However, the number of organizations used by the OFM staff  in selecting the 59 organizations did not agree with the number CMS  provided us from the HPMS that we used in our analysis. For this reason,  we did not rely on the new information.
For the audits of the contract year 2006 bids, CMS officials explained that  they did not intend for the audits of contract year 2006 bid submissions to  meet the one-third audit requirement and that they plan to conduct other  reviews of the financial records of organizations to meet the requirement  for contract year 2006. However, CMS has not clearly laid out how these  reviews will be conducted to meet the one-third requirement. OACT  officials explained that in selecting the bids for audit they (1) considered  whether the organization had been audited within the last 12 months and  excluded those because CMS did not want to burden the organization with  another audit, (2) selected 25 percent of the organizations based on  information collected through the initial bid review process, and (3)  randomly selected organizations from the remaining 75 percent.
section_title: CMS Has Not Yet Met the Audit Requirement for Contract Year 2006 and Has Not Determined How It Will Do So
paragraphs: As we just discussed, CMS has not yet met the one-third audit requirement  for the contract year 2006 bid submissions. Further, CMS has not finalized  its approach for how it will meet the requirement for contract year 2006  and beyond. During the course of our review, CMS officials provided  differing information about CMS’s plans for meeting the one-third audit  requirement. Officials from CBC, OACT, and OFM initially told us in  January and February 2007 that their plans for meeting the one-third  requirement will likely include the bid audits currently directed by OACT  and other reviews by OFM of financial records of organizations. In June  2007, however, OFM officials said the requirement will be met solely  through their efforts. OFM is currently working with a contractor to  develop the agency’s overall approach to conducting reviews to meet the  one-third audit requirement. But as of June 2007, CMS had not specified  how these reviews will meet the one-third audit requirement. Draft audit  procedures prepared by the contractor indicate that OFM plans to review  solvency, risk scores, related parties, direct medical and administrative  costs, and, where relevant, regional PPO cost reconciliation reports for  MA bids. For Part D bids, OFM also plans to review other areas, including  beneficiaries’ true out-of-pocket costs. Appendix IV summarizes the  reviews that CMS is currently planning to do for contract year 2006 and  beyond, along with the objectives of those reviews.
CMS will not complete the proposed financial reviews until almost 3 years  after the bids are submitted for each contract year, as shown in figure 1, in  part because it must first reconcile Part D payment data that prescription  drug plans are not required to submit to CMS until 6 months after the  contract year is over. Contract year 2006 bids were submitted in June  2005. OFM officials said that they planned to start some of the reviews for  MA organizations in August 2007 to test their audit approach. However,  review of RPPOs and prescription drug plans will not start until later  because RPPO risk-sharing cost reconciliations that OFM says it will  review are not due to CMS until December 2007. OFM also plans to use  Part D payment reconciliations that CBC will not be able to complete until  June or July of 2007 because prescription drug plans are not required to  submit payment data to CMS until June 2007. This means that reviews of  financial records intended to meet the one-third audit requirement for  contract year 2006 will not start until the fall of 2007 and will not be  completed until sometime in 2008. Results of these reviews might be  available to CMS before reviewing and approving bids for contract year  2009 that organizations must submit in June 2008. CMS has not yet  developed its approach for following up on the results of these reviews.  Such an extended cycle for conducting reviews of financial records to  meet the one-third requirement will affect CMS’s ability to recommend and  implement actions needed to address any identified deficiencies in MA  organizations’ and prescription drug plans’ bid processes in a timely  manner.
section_title: CMS’s ACR Audit Process Was Ineffective
paragraphs: CMS contracted with accounting firms to audit the contract year 2001-2005  ACRs for a selected number of MA organizations, but did not consistently  ensure that the audit process provided information to assess the potential  impact on beneficiaries’ benefits or the payments CMS makes to MA  organizations. The auditors reported findings ranging from lack of  supporting documentation to overstating or understating certain costs, but  did not identify how the errors affected beneficiary benefits, copayments,  or premiums. In 2001, we reported that CMS planned to require auditors,  where applicable, to quantify in their audit reports the overall impact of  errors. Further, during our prior work, CMS officials stated that they  were in the process of determining the impact on beneficiaries and  crafting a strategy for audit follow-up and resolving the audit results. CMS  did not initiate any actions to attempt to determine such impact until after  the audits for contract year 2003 were completed, when CMS contracted  with a firm to review all of the 2003 ACR audits to identify any errors from  the audits that would affect beneficiaries. The contractor reported to CMS  that it had identified errors in ACRs that would have resulted in  approximately $59 million that beneficiaries could have received in  additional benefits, lower copayments, or lower premiums. CMS also  contracted with a firm to review the 2004 ACR audits, but the work is not  to be completed until August 31, 2007. The OFM staff reviewed the 2003  audit reports and the contractor’s analysis of the audit reports. OFM  revised the amount identified by the contractor’s analysis from $59 million  to $35 million and concluded that it would make recommendations to CBC  on whether corrective action plans or sanctions against MA organizations  were warranted. However, in late May 2007, CMS informed us that its legal  counsel had determined that the agency does not have the legal authority  to recover funds from MA organizations based on the findings from the  ACR audits. On the basis of our assessment of the statutes, CMS had the  authority to pursue financial recoveries, but its rights under the contracts  for 2001–2005 are limited because its implementing regulations did not  require that each contract include provisions to inform organizations  about the audits and about the steps that CMS would take to address  identified deficiencies, including pursuit of financial recoveries.
subsections: section_title: The ACR Audit Process Did Not Consistently Quantify Impacts on Beneficiaries
paragraphs: CMS contracted with audit firms at a cost of $15.2 million to audit ACRs  for contract years 2001-2005, but did not ensure that the audit process  consistently provided information to assess the potential impact on  beneficiaries. The instructions and guidance that CMS provided to the  auditors of the ACRs generally were not clear that the auditors should  quantify and report on how errors identified in the ACRs would affect  beneficiary benefits, copayments, or premiums. In our October 2001  report, we reported that for contract year 2001, CMS had planned to  require auditors, where applicable, to do so. We recommended that CMS  fully implement its plans to calculate the net effect of ACR audit findings  and adjustments. Computing the net effect of the errors identified by the  ACR audits is key to assessing the magnitude of the impact on  beneficiaries and could aid in developing an appropriate follow-up  protocol. In September 2001, CMS stated that it was already addressing  this recommendation.
Although CMS indicated it was planning to obtain a calculation of the net  effect (i.e., impact on beneficiaries) of errors identified by auditors, the  audit guidance and instructions provided by CMS for contract years 2001  and 2002 did not specify that the auditors should quantify the impact of the  errors on beneficiary benefits, copayments, or premiums. Consequently,  the audit reports did not quantify the impact on the beneficiaries.
The audit guidance and instructions for contract years 2003 and 2004 also  did not contain a directive to quantify the impact on beneficiaries of the  auditors’ findings, and the audit reports did not contain this information.  CMS contracted with a firm to review all of the 2003 ACR audit reports to  identify any errors from the audits that would affect beneficiaries. The  auditors categorized their results as findings and observations, with  findings being more significant, depending on their materiality to the  average payment rate reported in the ACR. The distinction between  findings and observations, however, was based on judgment, and therefore  varied among the different auditors. CMS asked the contractor to analyze  the audit reports, including both findings and observations, and supporting  documentation. After reviewing the ACR reports for the 49 organizations  audited and related documentation, the contractor reported in December  2005 that it had identified errors for 41 of the 49 organizations that would  have resulted in approximately $59 million that beneficiaries could have  received in additional benefits, lower copayments, or lower premiums.
OFM staff reviewed the contract year 2003 audit reports along with the  contractor’s analysis of the 2003 ACR audits to evaluate the amount  reported by the contractor that would affect beneficiaries. After reviewing  all 49 audit reports and the contractor’s analysis, OFM staff determined  that there were errors for 32 of the 49 organizations audited that would  have resulted in approximately $35 million that beneficiaries could have  received in additional benefits, lower copayments, or lower premiums.  OFM staff told us they had identified what they considered errors in some  of the contractor’s work, such as misapplication of the instructions, and  revised the amount of the beneficiary impact that the contractor had  identified. OFM staff concluded that they would make recommendations  to CBC on whether corrective action plans or sanctions against MA  organizations were warranted. In September 2006, CMS also contracted  with a firm to quantify the overall net effect resulting from the contract  year 2004 ACR audits. CMS officials told us that OFM staff were still  working with the contractor on this project, which is not to be completed  until August 31, 2007.
For the contract year 2005 ACR audits, CMS’s instructions to the auditors  required them to clearly identify the net effect or impact of their findings.  However, as of June 2007, we had not yet received the contract year 2005  audit reports, and therefore we cannot confirm whether these reports  included information on the impact on beneficiaries of identified errors.  According to CMS, the audits were delayed because management decided  instead to allocate funds intended for this purpose to OACT for the audits  of the contract year 2006 bids.
section_title: CMS Did Not Act to Recover Funds from or Sanction MA Organizations Based on ACR Audit Results and Has Not Determined How to Close Out the Audits
paragraphs: In our 2001 report, we noted that CMS did not have a formal process in  place to resolve the specific problems identified in the audits, and  therefore the usefulness of the audit process was undermined. We  recommended that CMS develop and implement a follow-up mechanism to  address the audit findings in a timely manner and that CMS communicate  to each MA organization specific corrective actions. In September 2001,  CMS responded that such a process was under development. CMS told us  it provided copies of the final audit reports to the MA organizations and  instructed them to institute remedial actions in their subsequent ACR  submissions and that CMS’s intent was to follow up on the audit findings  during subsequent audits. For this report, we reviewed audit reports for  contract years 2001-2004 and discussed CMS’s audit follow-up process  with CMS officials and staff. The audit reports did not refer to past audit  findings, so it is unclear whether the auditors had followed up on the past  findings. The only action that CMS has taken was to provide copies of the  audit reports to the MA organizations and instruct the organizations to  take action in subsequent ACR filings.
In late May 2007, CBC officials explained that they were responsible for  resolving the issues resulting from the ACR audit reports and stated that  they were working with OFM to develop an approach to address the  results from the audit reports for contract years 2003 through 2005, but  had not yet decided on a plan of action. They also informed us that their  legal counsel had determined that the agency does not have the legal  authority to recover funds from MA organizations based on results of ACR  audits. Subsequently, HHS legal counsel explained to us the department’s  position that CMS lacks the legal authority or the contractual right to  pursue financial recoveries when audits determine that approved ACRs  reflect errors, incorrect or unreasonable assumptions, or other  misstatements. We were told that, based on a determination of the  Secretary, general federal contract laws do not apply to the payments  made under MA contracts. Instead, according to HHS, the contractual  rights of CMS and the contracting MA organizations are limited to those  set out in statute and the CMS implementing regulations. Those statutes  and regulations do not expressly provide for corrective action based on  CMS’s ACR audits, such as returning funds to CMS or beneficiaries based  on errors found during ACR audits when the audits indicate that each  beneficiary in a plan should have received a certain amount of additional  benefits. On the basis of our assessment of the statutes, CMS had the  authority to include terms in its contracts with MA organizations that  would allow it to pursue financial recoveries based on the ACR audit  results. However, CMS’s rights under the contracts for contract years  2001–2005 are limited because its implementing regulations for the  Medicare+Choice Program did not require that each contract include  provisions to inform organizations and plans about the audits and about  the steps that CMS would take to address identified deficiencies, including  pursuit of financial recoveries.
CMS officials acknowledged that they can impose sanctions in cases  where an organization misrepresents information that is furnished under  the program and for other reasons. Intermediate sanction provisions  allow for suspension of enrollment of individuals in MA plans, suspension  of payments to MA organizations, and civil penalties in the amount of up  to $100,000 for misrepresenting or falsifying information to CMS.  However, CMS has never sanctioned an MA organization based on findings  from the ACR audits and did not say why it has not. CMS officials told us  that they plan to close out the audits without pursuing financial  recoveries. They said that they are considering options, such as  determining whether findings are applicable to the current bid process,  that could be a basis for current action. CMS officials also stated that they  are compiling a list of MA organizations whose contract year 2003 ACR  audits resulted in significant findings and will refer the MA organizations  to the HHS Office of Inspector General (OIG) for appropriate action,  including assessing civil monetary penalties. However, CMS officials  acknowledged that the opportunity to take corrective action may have  passed, given the amount of time since the audits were completed.
In the past, the OIG has audited ACRs and recommended in some cases  that MA organizations return unsupported or unallowable payments to  CMS. For example, the OIG conducted 53 of the 80 ACR audits for  contract year 2000, the first year of such audits that we reported on in our  previous report. The OIG reported findings that quantified the impact of  ACR errors on beneficiaries in 7 of the 53 reports. However, CMS did not  take action on the findings. CMS also did not take action on findings from  other audits of ACRs that the OIG did under its authority. For example, the  OIG audited the modifications to the contract year 2001 ACRPs for six MA  organizations to determine whether additional funding provided by the  Benefits Improvement Protection Act (BIPA) of 2000 was used in a  manner consistent with BIPA requirements and whether the modifications  were adequately supported. The OIG also audited modifications to the  contract year 2004 ACRPs for six MA organizations to determine whether  the use of payment increases provided under MMA were adequately  supported and allowable under MMA. In five of the BIPA audits and one of  the MMA audits, the OIG found that the MA organizations did not support  how they used the additional funds, or they determined that MA  organizations did not use the funds in a manner consistent with the  applicable law. In its reports dated June 2004 through January 2006, the  OIG recommended that the six MA organizations return to CMS a total of  almost $29 million or deposit the funds in a benefit stabilization fund for  use in future years.
In CMS’s December 2006 management response to the OIG’s  recommendations, CMS’s CBC stated that CMS did not concur with the  OIG’s recommendations to collect the funds and make them available for  benefits because (1) the benefit stabilization fund was abolished with  implementation of MMA, (2) a significant time has elapsed since the  benefit year in question (2001), (3) the Medicare+Choice program no  longer exists, and (4) the basis for payment has changed from reviews of  ACRPs to bids.
section_title: Bid Audits Report Findings That Would Affect Premiums and Payments for Contract Year 2006, But CMS Does Not Address the Findings
paragraphs: CMS contracted with six firms to audit a selected number of contract year  2006 bids and plans to do so for subsequent years. In reviewing the 2006  bid audit reports, we determined that 18 (about 23 percent) of the 80  organizations audited had material findings that have an impact on  beneficiaries or plan payments approved in bids. CMS defined material  findings as those that would result in changes in the total bid amount of 1  percent or more or in the estimate for the costs per member per month of  10 percent or more for any bid element. OACT officials responsible for  the bid audit process explained that they will use the audit results to help  organizations improve their methods in preparing bids in subsequent  years, but their audit follow-up process does not involve taking action to  recover funds from organizations based on audit results because they  maintain that CMS does not have the legal authority to do so. However,  according to our assessment of the statute, CMS has the authority to  include terms in contracts with MA organizations and prescription drug  plan sponsors that would allow it to pursue financial recoveries based on  the bid audit results. Another weakness that we noted in CMS’s bid audit  process was the lack of documentation to support steps taken to mitigate  conflict of interest situations for the actuarial firms conducting the bid  audits. Using available information, we were able to confirm that the  actuarial firms did not audit the same bids that the firms had acted as a  consultant in preparing. However, we were not able to confirm the steps  taken by CMS to avoid assigning actuarial firms to audit the same bids that  the firms had reviewed because information was not available by the end  of our fieldwork in June 2007.
subsections: section_title: Contract Year 2006 Bid Audit Results Identified Significant Impacts on Member Premiums and Medicare Payments
paragraphs: According to requirements in the audit contracts, the auditors were  required to categorize the severity of the issues identified in the audits as  either significant/material findings or nonsignificant observations. CMS  defined material findings as those that would result in changes in the total  bid amount of 1 percent or more or in the estimate for the costs per  member per month of 10 percent or more for any bid element, which, if  corrected, would be expected to result in (1) reduced payments from CMS  to the organization, (2) additional benefits to enrollees, and (3) reduced  enrollee premiums or copayments. CMS defined nonsignificant  observations as deficiencies that are not considered material.
The contract year 2006 bid audits covered 80 organizations. For 18 of these  organizations (about 23 percent), auditors identified at least one material  finding that affected the total bid amount or a particular bid element in an  approved bid. Errors in the total bid amount or a bid element can affect  the accuracy of Medicare payments. Errors can also affect members’  premiums, copayments, and the level of services they are provided. The  material findings arose from deficiencies identified by the auditors in how  bid estimates were developed, including projected costs, risk scores, trend  assumptions, cost sharing, manual rates, and utilization estimates among  others.
For the other 62 audited organizations, the auditors reported observations  primarily relating to departures from CMS’s detailed bid preparation  instructions, including use of questionable data, assumptions, and  methods, and inadequate documentation. CMS provides detailed  instructions for organizations to prepare each of the seven spreadsheets  that are part of the MA bid form. The instructions are a line-by-line  description of the bid spreadsheets that identifies where user inputs are  required. They also contain a glossary and identify the required supporting  documentation, including a requirement for a completed certification  executed by a qualified actuary. Similarly, CMS provides detailed line-by- line instructions for organizations to prepare each of the six spreadsheets  that are part of the prescription drug plan bid form.
section_title: CMS’s Follow-up on Bid Audits Is Similar to Follow-up on the ACR Audits
paragraphs: OACT officials responsible for the bid audit process explained that they  will use the audit results to help organizations improve their methods in  preparing bids in subsequent years and to help OACT improve the overall  bid process. Specifically, they told us they could improve the bid forms,  bid instructions, training, and bid review process. OACT’s audit follow-up  process does not involve pursuing financial recoveries from organizations  based on audit results because CMS maintains that, as with ACRPs, it does  not have the legal authority to do so. As stated earlier, CMS officials  believe that CMS lacks the statutory or contractual right to pursue  financial recoveries based on audit findings. However, according to our  assessment of the statute, CMS has the authority to include terms in its  contracts with MA organizations and prescription drug plan sponsors that  would allow it to pursue financial recoveries based on the bid audit  results. However, CMS’s contractual rights are limited because its  implementing regulations do not require that each contract include  provisions to inform organizations and plans about the audits and about  the steps that CMS will take to address identified deficiencies, including  pursuit of financial recoveries. Such changes would be needed for CMS to  be able to adjust the bid amounts after bid approval and pursue financial  recoveries.
CMS has authority to sanction organizations but did not identify any  findings from the contract year 2006 bid audits where a sanction would be  warranted. OACT officials believe the bid audits provide a “sentinel or  deterrent effect” for organizations to properly prepare their bids since they  do not know when the bids may be selected for a detailed audit. However,  the officials acknowledged that the bid process relies heavily on certifying  actuaries and that there is a low probability of the bid audits identifying  intentional misrepresentations.
Given the current audit coverage, CMS is unlikely to achieve significant  deterrent effect, as only 14 percent of participating organizations for  contract 2006 have been audited. Further, for those organizations that  were audited, CMS’s follow-up on the audit findings may not deter those  organizations from making similar errors in future bids. For example,  preliminary findings for most of the 2006 audits came out by April 2006,  and according to OACT, organizations started preparing their bids for  contract year 2007 by April 2006, which would have allowed them time to  take corrective actions to address the audit findings. OACT officials noted  that they updated the contract year 2007 instructions for bid preparation  as a result of audit results and other factors. However, they could not  identify any specific revision arising out of the contract year 2006 audit  results. Without a more targeted follow-up process to ensure that every  finding and observation from the audits is addressed before approving the  next year’s bid, the value of the audits is limited. OACT officials said that  their process for following up on the audit results will become more  focused as each year’s audits are conducted. Officials stated that CMS’s  2007 notification letter to organizations requires the contract year 2008 bid  submissions to document how the findings of the prior year audits were  addressed in the subsequent bid submission. They also said the 2008 bid  review process includes a process for reviewing the prior year’s audit  findings for all bids that were audited in the prior year.
CMS is currently developing an approach intended to ensure that one-third  of the MA organizations and prescription drug plans are audited each year.  As mentioned earlier, CMS plans to review financial issues including plan  solvency, risk scores, related parties, direct medical and administrative  costs, and beneficiaries’ true out-of-pocket costs for prescription drug  plans. However, CMS’s approach does not clearly identify how it will  follow up with organizations to ensure that issues identified in the  financial reviews are addressed. Also, it is not clear if these financial  reviews are being designed to identify misrepresentations and  falsifications in the information furnished by organizations in order to  impose sanctions, and CMS has not defined what it might consider to be a  misrepresentation or falsification. As currently planned, CMS will not  complete these financial reviews for contract year 2006 until sometime in  2008. Results might be available before CMS approves bids for contract  year 2009 that must be submitted in June 2008. As we mentioned earlier,  such an extended cycle for conducting reviews to meet the one-third  requirement will affect CMS’s ability to recommend and implement actions  needed to address any identified deficiencies in bid processes in a timely  manner.
section_title: CMS Did Not Document Steps Taken to Mitigate Conflicts of Interest for Contractors That Audited Bids
paragraphs: As part of its contracting process for the audits of contract year 2006 bids,  CMS OACT officials said they took several steps to mitigate actual and  potential conflicts of interests for the actuarial firms that completed the  bid audits. For example, OACT officials considered whether the actuarial  firms had acted as consultants in preparing bids or had other relationships  with the organizations that they would be auditing. Information about  organizations that the firms had prepared bids for, had other relationships  with, or had reviewed their bids came from several sources, including the  bid certifications, which identify the actuary that certified each bid  submission. OACT officials also said that they asked the firms to self- report conflicts of interest at two phases in their process: (1) as part of the  request for proposal, when firms were bidding for the audit contracts, and  (2) after contracts were awarded, when firms were asked to respond to a  list of organizations that that they were assigned to audit. CMS required  that as part of the request for proposal, the firms include a listing of  organizations for which the firms had a conflict of interest, including  organizations for which the firm had prepared bids or had another non- Medicare relationship within the prior 12 months. After contracts were  awarded to the six actuarial firms, OACT officials said that they obtained  information from the firms regarding conflicts that they used to make  audit reassignments. OACT maintains information to identify the actuary  that performed the bid reviews in the HPMS database.
OACT officials did not have documentation to support the statement that  they took steps to avoid assigning actuarial firms to audit the same bids  that the firms had prepared. However, we used the bid certifications and  audit reports to confirm whether the actuarial firms had audited bids that  the firms had also acted as a consultant in preparing. We compared the  names of the actuaries on the bid certifications and their organizational  affiliations and the names of the actuaries that provided audit opinions  and their organizational affiliations as identified in the audit reports for the  80 organizations that were audited in contract year 2006. We found no  instances where the bid preparer and the bid auditor were the same  individuals or companies.
To confirm whether the actuarial firms audited bids for organizations with  which the firms reported having a relationship, we obtained and reviewed  the self-reported conflict of interest information submitted in response to  the request for proposal by five of the six actuarial firms. OACT did not  have the information for the other firm. We also requested the conflict of  interest information that OACT said it obtained from the firms to make  audit reassignments. However, OACT could not provide this information  because it said it collected this information through an informal process  and did not have documentation supporting the information it obtained.  Using the available conflict of interest information, we found no instances  where the five actuarial firms audited a bid when it reported having a  relationship.
Finally, OACT officials did not have documentation to support the steps  they took to avoid assigning actuarial firms to audit the same bids that the  firms had reviewed. Four of the six actuarial firms that performed the  contract year 2006 bid audits also reviewed bids as part of CMS’s bid  review process. We were not able to confirm the steps OACT officials said  they took because the information was not available by the end of our field  work in June 2007.
section_title: Conclusions
paragraphs: When CMS falls short in meeting the statutory audit requirement and in a  timely manner resolving the findings arising from those audits, the  intended oversight is not achieved and opportunities to determine if  organizations have reasonably estimated the costs to provide benefits to  Medicare enrollees are lost. Inaction or untimely audit resolution also  undermines the presumed deterrent effect of audit efforts.
CMS will continue to invest resources in its current bid audits and its  planned reviews of the financial records of MA organizations and  prescription drug plans that will likely have limited value in improving the  programs if it does not implement a structured process for following up  with organizations to make sure that they address deficiencies identified  from the audits before approving subsequent year bids. The current bid  audits provide CMS with information in a timely manner to address  identified deficiencies. These bid audits identify how beneficiaries are  adversely affected by errors, incorrect or unreasonable assumptions, or  other misstatements in the information furnished to CMS and indicate how  funds due to the Treasury are affected.
While the statutory audit requirement does not expressly state the  objective of the audits or how CMS should address the results of the  audits, the statute does not preclude CMS from including terms in its  contracts that allow it to pursue financial recoveries based on audit  results. If CMS maintains the view that statute does not allow it to take  certain actions, the utility of CMS’s efforts is questionable. Further, if CMS  cannot provide assurance that the firms performing the audits are free  from potential or actual conflicts of interest, the integrity of the audit  process is also threatened.
section_title: Recommendations for Executive Action
paragraphs: To help fulfill CMS’s responsibilities, we recommend that the  Administrator of CMS take the following five actions:    Finalize a decision and establish implementing procedures on how the  prior ACRP audit results will be addressed and closed.
Finalize an approach for meeting the one-third audit requirement for  contract year 2006 and subsequent years. This approach should clearly  address:  the procedures for annually identifying the organizations whose bid  submissions and supporting financial records will be audited as part of  the current OACT bid audits and those that will be reviewed as part of  the planned financial reviews,  the supporting documentation that must be retained to show that the  audit requirement was met, and  the procedures for conducting planned financial reviews that clearly  identify how the reviews will provide results in a timely manner and  how the reviews will be designed to identify misrepresentations and  falsifications in the information furnished under the program.
Amend the implementing regulations for the Medicare Advantage Program  and Prescription Drug Program to provide that all contracts CMS enters  into with Medicare Advantage organizations and prescription drug plan  sponsors include terms that inform these organizations of the audits and  give CMS authority to address identified deficiencies, including pursuit of  financial recoveries. If CMS does not believe it has the authority to amend  its implementing regulations for these purposes, it should ask Congress for  express authority to do so.
Develop, as part of its approach for meeting the one-third audit  requirement, additional procedures for following up on results of the  OACT bid audits and results of the financial reviews. These procedures  should clearly address:    how CMS will annually ensure that findings and observations from the  bid audits are addressed before the next year’s bids are approved,    how CMS will annually ensure that findings from the financial reviews  are addressed before the subsequent year’s bids are approved,  the supporting documentation that must be retained to show that the  findings and observations from bid audits and findings from the  financial reviews were addressed, and    how CMS reviews audit findings to determine if intermediate sanctions  are warranted.
Develop procedures to formalize the reviews and supporting  documentation that must be retained to show that conflicts of interest  arising from individuals or firms preparing, reviewing, or auditing the  same bid have been addressed.
section_title: Agency Comments and Our Evaluation
paragraphs: We received written comments on a draft of this report from CMS, which  are reprinted in appendix V. CMS concurred with our recommendations  and stated that it is in the process of implementing some of them.  Specifically, CMS concurred with our recommendation to finalize an  approach for meeting the one-third audit requirement that includes  procedures for identifying and documenting the organizations that will be  audited annually. CMS also commented it has modified and documented  its procedures for selecting the MA organizations and Medicare  prescription drug plans for audit and begun documenting standard  operating procedures for the financial audit process (including procedures  for contracting with audit firms, selecting the MA organizations and  prescription drug plans for audit, and addressing audit findings.)
CMS provided additional comments on several issues we reported on,  including financial recoveries based on the bid audit and the timeliness of  its planned audit process. Specifically, CMS noted that the ability to obtain  financial recoveries based on the bid audits is extremely complicated and  can result in future payments by CMS rather than reimbursements by the  plans. We believe that these are issues CMS should address as it takes  steps to amend its contractual rights with MA organizations and  prescription drug plans. CMS also noted that we did not explain why the  audit process can take up to 3 years to be completed. CMS stated that the  normal cycle for a contract year is over 2 years, followed by an additional  6 months for plans to submit data for reconciliation. We revised our report  to acknowledge that CMS’s financial reviews depend on data that is not  required to be submitted until 6 months after the end of the contract year.  However, the point remains that CMS’s decision to develop an audit  approach based solely on testing financial records that are not available  until 6 months after the contract year and must be reconciled before  testing can begin, will result in a 3-year cycle to complete reviews that will  affect its ability to recommend and implement any actions needed to  address identified audit deficiencies in a timely manner.
We are sending copies of this report to interested congressional  committees, the Secretary of Health and Human Services, the Acting  Administrator of CMS, the Inspector General of HHS, and other interested  parties. We will also make copies available to others upon request. In  addition, this report will be available at no charge on GAO’s Web site at  http://www.gao.gov. Should you or your staff have any questions about  this report, please contact Jeffrey Steinhoff at (202) 512-2600 or by e-mail  at steinhoffj@gao.gov, or Kimberly Brooks, Assistant Director, at (202)  512-9038 or by e-mail at brooksk@gao.gov. Contact points for our Offices  of Congressional Relations and Public Affairs can be found on the last  page of this report. GAO staff who made major contributions to this report  are listed in appendix VI.
section_title: Appendix I: Scope and Methodology
paragraphs: To determine whether the Centers for Medicare & Medicaid Services  (CMS) met the requirement for auditing Adjusted Community Rates  (ACRs) for one-third of the Medicare Advantage (MA) organizations for  contract years 2001 through 2005 and one-third of the bid submissions for  contract year 2006, we first requested the criteria and analysis from CMS  to show how it met the requirement. However, because CMS did not  prepare or retain this information, we instead obtained from CMS a  compilation of organizations that were audited for contract years 2001  through 2006. We also obtained from CMS’s Health Plan Management  System (HPMS) a population of organizations and plans for which CMS  had approved contracts to participate in the Medicare Advantage and Part  D programs for contract years 2001-2006.
To obtain reasonable assurance with respect to the completeness of CMS’s  compilation of audited organizations, we compared the organizations  listed in CMS’s compilation to lists of organizations assigned to each  auditor that were contained in the contract files at CMS for contract years  2002 through 2005, where available. Because all of the contract files were  not provided to us, we also compared the compilation to the audit reports  we obtained from CMS.
CMS provided us with a data extract from HPMS in an Excel spreadsheet.  We took several steps to assess the reliability of the HPMS data provided  by CMS, although we were not able to independently verify the  completeness of the population files. To assess the reliability of the HPMS  data provided by CMS, we tested specific data elements for  reasonableness (e.g., contract year, contract identifier, and plan  identifier). Our tests resulted in no exceptions. We also made inquiries  with CMS officials to confirm the source of the data. We compared the  contract numbers of organizations that were audited with contract  numbers in the population files to determine if the audited organizations  were included in the population. We found several audited organizations  that were not included in the population files CMS originally sent us of  organizations participating in the Medicare Advantage program for  contract years 2001 through 2005. We communicated these differences to  CMS and it responded by sending us new population files that included the  MA organizations we identified plus additional MA organizations. CMS did  not explain the increase in the number of MA organizations in the revised  population files. On the basis of the revised population number, we  performed an analysis comparing the number of organizations and plans  audited as a percentage of organizations and plans that CMS approved to  determine if CMS had met the requirement to audit one-third of  participating organizations. On the basis of the collective information and  interviews with CMS officials, we determined these data were adequate for  assessing whether CMS had met the one-third auditing requirement.
To determine whether information provided by the ACR audit process was  sufficient for CMS to assess potential impacts on beneficiaries and address  those impacts, we obtained and reviewed the following documents:    audit reports for contract years 2001 through 2004,  reports prepared by the contractor that reviewed and analyzed the 2003  audit results,    CMS’s analysis of the work performed by the contractor that reviewed and  analyzed the 2003 audit results,    Statements of work from the contracts awarded to the firms to audit the    CMS’s instructions to the auditors (called Uniform Examination Program).
To assess the reliability of the audit reports, we used guidance in GAO’s  Financial Audit Manual Section 650, Using the Work of Others, which  focused on assessing the auditors’ independence, objectivity, and  qualifications. We reviewed contract files at CMS for the firms awarded  contracts to audit ACRs. Specifically, in the contract files, we reviewed  representations as to the firms’ independence and objectivity that the  firms submitted in response to CMS’s requests for proposal and  evaluations of the firms by technical evaluation panels.
We also interviewed CMS staff and officials about (1) the audit process,  (2) CMS’s review of the reviewing contractor’s analysis of 2003 audit  results, and (3) actions planned by CMS to address the audit findings.
To determine how CMS conducted bid audits, what information the bid  audit process provided CMS, and how CMS used that information, we  obtained and reviewed related documentation including:    CMS’s instructions and guidance for preparing bids for 2006 and 2007,    CMS’s instructions and guidance for bid reviewers for 2006 and 2007,    CMS’s instructions and guidance for bid auditors for 2006,    bid audit reports for contract year 2006,    certifications by actuaries that helped MA organizations prepare their bids,    draft agreed-upon procedures for the financial audit of MA organizations  and prescription drug plans.
We discussed with Office of Actuary (OACT) officials and five of the six  bid auditors (for the 2006 bids) their roles and views of the bid audit  process. To identify the information the bid audit process provided CMS,  we reviewed the bid audit reports and summarized the nature and number  of findings and observations identified by the bid auditors.
We performed some limited testing to identify whether potential conflicts  of interest existed among actuaries who helped organizations and plan  sponsors prepare bids and those actuaries who audited the bids. Using (1)  the bid certifications, which identified the actuaries and organizations that  helped organizations prepare their bids; (2) self-reported conflicts of  interest, which were transmitted to CMS with the responses to the request  for proposal offers; and (3) bid audit reports, which identified the lead  actuary performing the bid audit, we identified which particular actuaries  (firms and individuals) helped prepare and audit bids. We compared the  information on bid preparers to information on bid auditors to determine  whether the actuarial consultants who assisted organizations in preparing  their bids had also audited the same bids, which would create a conflict of  interest. Our tests resulted in no exceptions.
We interviewed CMS staff and officials from CMS’s Center for Beneficiary  Choices (CBC), Office of the Actuary (OACT), and Office of Financial  Management (OFM) about the bid review and audit processes and  discussed actions planned to address the bid audit findings. We also  discussed actions CMS planned to take to fulfill the requirement for  auditing bid submissions for contract year 2006 and beyond. In particular,  we discussed OFM’s plans for testing solvency, direct medical and  administrative costs, risk scores, related party transactions, and other  related testing for MA organizations and prescription drug plans.
To assess the reliability of the bid audit reports, we used guidance in  GAO’s Financial Audit Manual Section 650, Using the Work of Others,  which focused on assessing the auditors’ independence, objectivity, and  qualifications. We reviewed contract files at CMS for the firms awarded  contracts to review bids and audit bids. Specifically, in the contract files,  we reviewed representations as to the firms’ independence and objectivity  that the firms submitted in response to CMS’s requests for proposal and  evaluations of the firms by technical evaluation panels.
We briefed officials from CMS on our findings and their implications. We  requested written comments on a draft of this report from the Secretary of  Health and Human Services or his designee on July 9, 2007. We received  comments from CMS on July 19, 2007. We conducted our review from  November 2006 to June 2007 in accordance with generally accepted  government auditing standards.
section_title: Appendix II: Actuarial Standards Applicable to Bid Preparers
paragraphs: The Centers for Medicare & Medicaid Services requires an actuarial  certification to accompany each bid. In preparing the actuarial  certification, the actuary must consider whether the actuarial work  supporting the bid conforms to Actuarial Standards of Practice (ASOP), as  promulgated by the Actuarial Standards Board. While other ASOPs apply,  CMS’s instructions for the contract year 2006 bids placed particular  emphasis on the following ASOPs.
ASOP No. 5, Incurred Health and Disability Claims    ASOP No. 5 provides guidance to actuaries preparing or reviewing  financial reports, claims studies, rates, or other actuarial communications  involving incurred claims within a valuation period under a health benefit  plan.
ASOP No. 8, Regulatory Filings for Rates and Financial Projections  for Health Plans  (Particular focus is placed on the sections dealing with the Recognition of  Benefit Plan Provisions, Consistency of Business Plan and Assumptions,  Reasonableness of Assumptions, and Use of Past Experience to Project  Future Results.)
This standard sets forth recommended practices for actuaries involved in  the preparation or the review of actuarial memorandums or similar  documents in connection with the filing of rates and financial projections  for health plans. This standard applies to filings submitted to state  insurance departments and other regulatory bodies for benefits provided  by individual and group health plans and contracts and to filings made in  conjunction with applications for licensure and rates for health  maintenance organizations, hospitals, and medical service organizations.
ASOP No. 16, Actuarial Practice Concerning Health Maintenance  Organizations and Other Managed-Care Health Plans    ASOP No. 16 sets forth recommended practices for actuaries dealing with  health maintenance organizations (HMO) and other managed-care health  plans (MCHP). This standard was intended to provide guidance on several  important areas requiring special consideration for HMOs and other  MCHPs. According to the Actuarial Standards Board, this standard was  repealed for work performed on or after April 26, 2007, because much of  the information in the standard was dated, and in general, it is believed  that the guidance provided in the standard is covered, either explicitly or  implicitly, in other ASOPs.
ASOP No. 23, Data Quality  (Particular focus is placed on the sections dealing with Analysis of Issues  and Recommended Practices and Communications and Disclosures.)
This ASOP gives guidance to the actuary in the areas of (1) selecting data  that underlie the actuarial work product, (2) relying on data supplied by  others, (3) reviewing data, (4) using data, and (5) making appropriate  disclosures with regard to data quality.
ASOP No. 25, Credibility Procedures Applicable to Accident and  Health, Group Term Life, and Property/Casualty Coverage    The purpose of this ASOP is to provide guidance to actuaries in the  selection of a credibility procedure and the assignment of credibility  values to sets of data including subject experience and related experience.  Credibility procedures are an integral part of rate making and prospective  experience rating, and may be used for other purposes. This standard of  practice is applicable to accident and health, group term life,  property/casualty coverage, and other forms of nonlife coverage.
ASOP No. 31, Documentation in Health Benefit Plan Rate Making    The purpose of this standard is to define the documentation  responsibilities of an actuary in health benefit plan rate making. This  standard does not apply to the establishment or documentation of prices,  i.e., the amounts charged to the purchaser. Rather, it is limited to  documentation related to the development of rates, i.e., the estimates of  the expected value of future costs. This standard does not address other  considerations that may affect price, such as marketing goals, competition,  and legal restrictions.
section_title: Appendix III: Description of Bid Worksheets
paragraphs: This worksheet summarizes the base period data and the key assumptions  used to calculate the projected allowed costs for the MA plan. It also  includes general plan information, base period background information, a  summary of the base period data, and an illustration of the factors used to  project the base period data to the contract period.
This worksheet calculates the projected allowed costs for the contract year.  For plans without fully credible experience, CMS requires plans to provide  manual rate information.
These worksheets summarize the expected MA cost sharing for the  contract year. Worksheet 3A summarizes the plan’s in-network cost  sharing, such as copayments and coinsurance, whereas worksheet 3B  summarizes the plan’s out-of-network cost sharing. Further, the plans must  provide plan-level deductible information, if applicable. The value of all cost  sharing items must be reflected in the total per member per month amount.
This worksheet uses the information from other worksheets to determine  net medical costs. Nonmedical expenses and gain/loss margins are added  to establish the required revenue for the contract year. Values are also  allocated between Medicare-covered benefits and A/B Mandatory  Supplemental Benefits.
This worksheet calculates the A/B benchmark and evaluates whether the  plan realizes a savings or needs to charge a basic member premium.  Specifically, this worksheet outlines the development of the benchmarks  and bids, outlines the development of the savings or basic member  premium, blend of risk and demographic payment methodologies, and  provides a summary of Statutory Component of Regional Benchmark and  projected (plan-specific) information for counties within the service area.
This worksheet contains the results of calculations from the bid forms.
This worksheet contains the actuarial pricing elements for any optional  supplemental benefit packages to be offered during the contract year.  While supplemental benefits (either prescription drug or A/B) offered by the  plan may be viewed as a single package of supplemental benefits, the two  types of supplemental benefits are considered separately for bidding  purposes.
Prescription Base-Period Experience—This worksheet should be  completed for plans that have appropriate base-period experience for  modeling the Part D benefit. The determination of the appropriateness of a  plan’s experience should include the evaluation of whether the group  included in the experience is consistent with the group that the plan  expects to cover. In addition, the experience should be representative of  the benefits that will be offered in the contract period. Plans without  appropriate base-period experience need to develop manual rates to be  used in the pricing tool. Development of these manual rates should include  the use of available data adjusted to reflect the expected population and  the benefit design that will be offered.
PDP Projection of Allowed/Non-Pharmacy—This worksheet identifies the  components of trend in the allowed prescription cost for covered Part D  drugs and for nonpharmacy expenses between the base period and the  contract period, and blends in manual rate information for plans that do not  have fully credible base-period experience data.
Contract Period Projection for Defined Standard Coverage—This  worksheet is used to develop the Defined Standard Bid Amount. All plans  are required to fill out this worksheet.
Standard Coverage with Actuarially Equivalent Cost Sharing—This  worksheet is used only if the benefit plan being bid is for standard coverage  with actuarially equivalent cost sharing. The two tests that must be met to  demonstrate actuarial equivalence are:    The average coinsurance percentage for amounts between the  deductible and the initial coverage limit must be actuarially equivalent to  25 percent.
The average coinsurance percentage above the catastrophic limit must  be actuarially equivalent to the percentage for defined standard  coverage.
The amount of the bid must be determined since the bid is based upon the  cost of the proposed plan rather than the defined standard plan.
Alternative Coverage—This worksheet is used if the plan is offering  alternative coverage. Basic alternative coverage would result in no  supplemental premiums. The worksheet also calculates the supplemental  premium for enhanced alternative coverage.
Script Projections for Defined Standard, Actuarially Equivalent or  Alternative Coverage—This worksheet illustrates the underlying  assumptions that are being used in the demonstration of the actuarial  equivalence tests in Worksheets 4 and 5. The submitted data support an  actuarial comparison of the proposed benefit to the defined standard  benefit; it is not expected to be a detailed model of the cost sharing of the  proposed plan design. All plans are required to develop projected utilization  and costs for their proposed Defined Standard Benefit. In addition, plans  submitting a bid for an actuarially equivalent or alternative benefit are  required to report projected utilization and costs.
section_title: Appendix IV: Other Reviews of Financial Records CMS Plans to Do to Meet Audit Requirement
section_title: Appendix V: Comments from the Department of Health and Human Services
section_title: Appendix VI: GAO Contacts and Staff Acknowledgments
subsections: section_title: Acknowledgments
paragraphs: Staff members who made key contributions to this report include Robert  Martin (Director), Kimberly Brooks (Assistant Director), Paul Caban  (Assistant Director), Abe Dymond, Jason Kirwan, Tarunkant N. Mithani,  and Diane Morris.
section_title: Related GAO Products
paragraphs: Department of Health and Human Services, Centers for Medicare &  Medicaid Services: Medicare Program; Establishment of the Medicare  Advantage Program. GAO-05-315R. Washington, D.C.: February 9, 2005.
Medicare+Choice: Selected Program Requirements and Other Entities’  Standards for HMOs. GAO-03-180. Washington, D.C.: October 31, 2002.
Medicare+Choice: Recent Payment Increases Had Little Effect on  Benefits or Plan Availability in 2001. GAO-02-202. Washington, D.C.:  November 21, 2001.
Medicare+Choice Audits: Lack of Audit Follow-up Limits  Usefulness. GAO-02-33. Washington, D.C.: October 9, 2001.
Medicare: Program Designed to Inform Beneficiaries and Promote  Choice Faces Challenges. GAO-01-1071. Washington, D.C.: September 28,  2001.
Medicare+Choice: Oversight Lapses in HCFA’s Review of Humana’s  1998 Florida Contract. GAO-01-176R. Washington, D.C.: November 27,  2000.
Medicare+Choice: Plan Withdrawals Indicate Difficulty of Providing  Choice While Achieving Savings. GAO/HEHS-00-183. Washington, D.C.:  September 7, 2000.
Medicare+Choice: Payments Exceed Cost of Fee-for-Service Benefits,  Adding Billions to Spending. GAO/HEHS-00-161. Washington, D.C.:  August 23, 2000.