Centers for Medicare and Medicaid Services: Pervasive Internal Control Weaknesses Hindered Effective Contract Management
Published: 2010-04-28T00:00:00

Fast Facts:

Highlights:
section_title: Why GAO Did This Study
paragraphs: In November 2007, GAO reported significant deficiencies in internal control over certain contracts the Centers for Medicare and Medicaid Services (CMS) awarded under the Federal Acquisition Regulation (FAR). This Subcommittee and others in Congress asked GAO to perform an in-depth review of CMS's contract management practices. This testimony is based on GAO's October 2009 report on these issues and summarizes GAO's findings on the extent to which CMS (1) implemented effective control procedures over contract actions, (2) established a strong contract management control environment, and (3) implemented GAO's 2007 recommendations. GAO used a statistical random sample of 2008 CMS contract actions to assess CMS internal control procedures. The results were projected to the population of 2008 CMS contract actions. GAO reviewed contract file documentation and interviewed senior acquisition management officials.
section_title: What GAO Found
paragraphs: GAO reported in October 2009 that pervasive deficiencies in CMS contract management internal control increased the risk of improper payments or waste. Specifically, based on a statistical random sample of 2008 CMS contract actions, GAO estimated that at least 84.3 percent of fiscal year 2008 contract actions contained at least one instance where a key control was not adequately implemented. For example, CMS used cost reimbursement contracts without first ensuring that the contractor had an adequate accounting system, as required by the FAR. These deficiencies were due in part to a lack of agency-specific policies and procedures to help ensure proper contracting expenditures. These control deficiencies stemmed from a weak overall control environment characterized primarily by inadequate strategic planning for staffing and funding resources. CMS also did not accurately capture data on the nature and extent of its contracting, hindering CMS's ability to manage its acquisition function by identifying areas of risk. Finally, CMS did not track, investigate, and resolve contract audit and evaluation findings for purposes of cost recovery and future award decisions. A positive control environment sets the tone for the overall quality of internal control and provides the foundation for effective contract management. Without a strong control environment, the specific control deficiencies GAO identified will likely persist. As of the date of GAO's October 2009 report, CMS had not substantially addressed seven of the nine recommendations made by GAO in 2007 to improve internal control over contracting and payments to contractors. To the extent that CMS has continuing weaknesses in contracting activities, it will continue to put billions of taxpayer dollars at risk of improper payments or waste.

section_title: Letter
paragraphs: I am pleased to be here today to discuss contract management at the  Centers for Medicare and Medicaid Services (CMS), a component of the  Department of Health and Human Services (HHS). CMS administers  Medicare and Medicaid, two programs included on our high-risk list, and  other programs such as the State Children’s Health Insurance Program.  CMS relies extensively on contractors to assist in carrying out its basic  mission, including program administration, management, and oversight of  its health programs. In fiscal year 2008, the most recent fiscal year for  which data were available at the time we completed our work, CMS  reported that it obligated $3.6 billion under contracts for a variety of goods  and services. CMS’s acquisitions include contracts to administer, oversee,  and audit claims made under the Medicare program; provide information  technology systems; provide program management and consulting  services; and operate the 1-800 Medicare help line.
In November 2007, we reported pervasive deficiencies in internal control  over certain contracts used by CMS for start-up administrative services to  implement programs enacted under the Medicare Prescription Drug,  Improvement, and Modernization Act of 2003 (MMA). We reported that  CMS’s internal control deficiencies resulted in millions of dollars of  questionable payments to certain contractors, primarily because CMS did  not obtain adequate support for billed costs. Internal control—the plans,  methods, and procedures used to meet missions, goals, and objectives—is  the first line of defense in safeguarding assets and preventing and  detecting fraud and errors and helps government program managers  achieve desired results through effective stewardship of public resources.
Because of concerns about the implications that these weaknesses may  have on all CMS contracts generally subject to the requirements of the  Federal Acquisition Regulation (FAR), we were asked to perform a  comprehensive, in-depth review of internal controls over CMS’s contract  management practices. My remarks today are based on the findings and  recommendations included in our subsequent report issued in October  2009. That report addressed the extent to which (1) CMS implemented  effective internal control procedures over contract actions to help ensure  proper contracting expenditures and (2) CMS established a strong control  environment for contract management. Our report also discussed the  extent to which CMS implemented the recommendations we made in 2007  to improve internal control over contracting and payments to contractors.  For this testimony, because of the relatively short time between the  request to testify and the hearing date, we did not have sufficient time to  update the status of CMS’s actions to implement our prior  recommendations.
subsections: section_title: Scope and Methodology
paragraphs: To address the extent to which CMS implemented control procedures over  contract actions, we focused on contracts that were generally subject to  the FAR (i.e., FAR-based), which represented about $2.5 billion, or about  70 percent, of total obligations awarded in fiscal year 2008. The FAR is the  governmentwide regulation containing the rules, standards, and  requirements for the award, administration, and termination of  government contracts. Based on the standards for internal control, FAR  requirements, and agency policies, we identified and evaluated 11 key  internal control procedures over contract actions, ranging from ensuring  contractors had adequate accounting systems prior to the use of a cost  reimbursement contract to certifying invoices for payment. Contract  actions include new contract awards and modifications to existing  contracts. We conducted our tests on a statistically random sample of 102  FAR-based contract actions CMS made in fiscal year 2008 and projected  the results of our statistical sample conservatively by reporting the lower  bound of our two-sided, 95 percent confidence interval. We tested a  variety of contract actions including a range of dollars obligated, different  contract types (fixed price, cost reimbursement, etc.), and the types of  goods and services procured. The actions in the sample ranged from a  $1,000 firm-fixed price contract for newspapers to a $17.5 million  modification of an information technology contract valued at over $500  million. For each contract action in the sample, we determined if the 11  key internal control procedures were implemented by reviewing the  contract file supporting the action and, where applicable, by obtaining  additional information from the contracting officer or specialist or senior  acquisition management. We also tested the reliability of the data  contained in CMS’s two acquisition databases.
To address the extent to which CMS established a strong control  environment for contract management, we obtained and reviewed  documentation regarding contract closeout, acquisition planning, and  other management information and interviewed officials in the Office of  Acquisition and Grants Management (OAGM) about its contract  management processes. We also evaluated the extent to which CMS had  addressed recommendations we made in our 2007 report. We used the  internal control standards as a basis for our evaluation of CMS’s contract  management control environment. Appendix I of our October 2009 report  provides additional details of our scope and methodology.
This testimony is based on our October 2009 performance audit, which  was conducted from July 2008 to September 2009 in accordance with  generally accepted government auditing standards. Those standards  require that we plan and perform the audit to obtain sufficient, appropriate  evidence to provide a reasonable basis for our findings and conclusions  based on our audit objectives. We believe that the evidence obtained  provides a reasonable basis for our findings and conclusions based on our  audit objectives.
section_title: Background
paragraphs: Except for certain Medicare claims processing contracts, CMS contracts  are generally required to be awarded and administered in accordance with  general government procurement laws and regulations such as the FAR;  the Health and Human Services Acquisition Regulations (HHSAR); the  Cost Accounting Standards (CAS); and the terms of the contract.
Since 1998, CMS’s obligations to fiscal intermediaries, carriers, and  Medicare Administrative Contractors (contractors that primarily process  Medicare claims) have decreased approximately 16 percent. In contrast,  obligations for other-than-claims processing contract activities, such as  the 1-800 help line, information technology and financial management  initiatives, and program management and consulting services, have  increased 466 percent. These trends may be explained in part by recent  changes to the Medicare program, including the movement of functions,  such as the help line, data centers, and certain financial management  activities, from the fiscal intermediaries and carriers to specialized  contractors.
MMA required CMS to transition its Medicare claims processing contracts,  which generally did not follow the FAR, to the FAR environment through  the award of contracts to Medicare Administrative Contractors. CMS  projected that the transition, referred to as Medicare contracting reform,  would produce administrative cost savings due to the effects of  competition and contract consolidation as well as produce Medicare trust  fund savings due to a reduction in the amount of improper benefit  payments. Additionally, the transition would subject millions of dollars of  CMS acquisitions to the rules, standards, and requirements for the award,  administration, and termination of government contracts in the FAR.  Obligations to the new Medicare Administrative Contractors were first  made in fiscal year 2007. CMS is required to complete Medicare  contracting reform by 2011. As of September 1, 2009, 19 contracts had  been awarded to Medicare Administrative Contractors, totaling about $1  billion in obligations.
The Standards for Internal Control in the Federal Government provide  the overall framework for establishing and maintaining internal control  and for identifying and addressing areas at greatest risk of fraud, waste,  abuse, and mismanagement. These standards provide that—to be  effective—an entity’s management should establish both a supportive  overall control environment and specific control activities directed at  carrying out its objectives. As such, an entity’s management should  establish and maintain an environment that sets a positive and supportive  attitude towards control and conscientious management. A positive  control environment provides discipline and structure as well as the  climate supportive of quality internal control, and includes an assessment  of the risks the agency faces from both external and internal sources.  Control activities are the policies, procedures, techniques, and  mechanisms that enforce management’s directives and help ensure that  actions are taken to address risks. The standards further provide that  information should be recorded and communicated to management and  oversight officials in a form and within a time frame that enables them to  carry out their responsibilities. Finally, an entity should have internal  control monitoring activities in place to assess the quality of performance  over time and ensure that the findings of audits and other reviews are  promptly resolved.
Control activities include both preventive and detective controls.  Preventive controls—such as invoice review prior to payment—are  controls designed to prevent errors, improper payments, or waste, while  detective controls—such as incurred cost audits—are designed to identify  errors or improper payments after the payment is made. A sound system  of internal control contains a balance of both preventive and detective  controls that is appropriate for the agency’s operations. While detective  controls are beneficial in that they identify funds that may have been  inappropriately paid and should be returned to the government, preventive  controls such as accounting system reviews and invoice reviews help to  reduce the risk of improper payments or waste before they occur. A key  concept in the standards is that control activities selected for  implementation be cost beneficial. Generally it is more effective and  efficient to prevent improper payments. A control activity can be  preventive, detective, or both based on when the control occurs in the  contract life cycle.
Additional, detailed background information is available in our related  report, GAO-10-60.
section_title: Pervasive Deficiencies in Control Procedures at the Contract Level Increase the Risk of Improper Payments or Waste
paragraphs: Our October 2009 report identified pervasive deficiencies in internal  control over contracting and payments to contractors. Specifically, as a  result of our work, we estimated that at least 84.3 percent of FAR-based  contract actions made by CMS in fiscal year 2008 contained at least one  instance in which 1 of 11 key controls was not adequately implemented.  Not only was the number of internal control deficiencies widespread, but  also many contract actions had more than one deficiency. We estimated  that at least 37.2 percent of FAR-based contract actions made in fiscal  year 2008 had three or more instances in which a key control was not  adequately implemented. The internal control deficiencies occurred  throughout the contracting process and increased the risk of improper  payments or waste. These deficiencies were due in part to a lack of  agency-specific policies and procedures to ensure that FAR requirements  and other control objectives were met. CMS also did not take appropriate  steps to ensure that existing policies were properly implemented or  maintain adequate documentation in its contract files. Further, CMS’s  Contract Review Board process had not been properly or effectively  implemented to help ensure proper contract award actions. These  internal control deficiencies are a manifestation of CMS’s weak overall  control environment, which is discussed later. Additional, detailed  information on our testing of key internal controls is available in our  October 2009 report.
The high percentage of deficiencies indicates a serious failure of control  procedures over FAR-based acquisitions, thereby creating a heightened  risk of improper payments or waste. Highlights of the control deficiencies  we noted included the following.
We estimated that at least 46.0 percent of fiscal year 2008 CMS  contract actions did not meet the FAR requirements applicable to  the specific contract type awarded. For example, we found that CMS  used cost reimbursement contracts without first ensuring that the  contractor had an adequate accounting system. According to the FAR, a  cost reimbursement contract may be used only when the contractor’s  accounting system is adequate for determining costs applicable to the  contract. To illustrate, of the contract awards in our sample, we found  nine cases in which cost reimbursement contracts were used without first  ensuring that the contractor had an adequate accounting system. In  addition to these nine cases, during our review of contract modifications  we observed another six cases in which cost reimbursement contracts  were used even though CMS was aware that the contractor’s accounting  system was inadequate at the time of award. In one instance, the  contracting officer was aware that a contractor had an inadequate  accounting system resulting from numerous instances of noncompliance  with applicable Cost Accounting Standards. Using a cost reimbursement  contract when a contractor does not have an adequate accounting system  hinders the government’s ability to fulfill its oversight duties throughout  the contract life cycle and increases risk of improper payments and the  risk that costs billed cannot be substantiated during an audit.
We estimated that for at least 40.4 percent of fiscal year 2008  contract actions, CMS did not have sufficient support for  provisional indirect cost rates nor did it identify instances when a  contractor billed rates higher than the rates that were approved  for use. Provisional indirect cost rates provide agencies with a  mechanism by which to determine if the indirect costs billed on invoices  are reasonable for the services provided until such time that final indirect  cost rates can be established, generally at the end of the contractor’s fiscal  year. When the agency does not maintain adequate support for provisional  indirect rates, it increases its risk of making improper payments.
We estimated that for at least 52.6 percent of fiscal year 2008  contract actions, CMS did not have support for final indirect cost  rates or support for the prompt request of an audit of indirect  costs. The FAR states that final indirect cost rates, which are based on a  contactor’s actual indirect costs incurred during a given fiscal year, shall  be used in reimbursing indirect costs under cost reimbursement  contracts. The amounts a contractor billed using provisional indirect cost  rates are adjusted annually for final indirect cost rates, thereby providing a  mechanism for the government to timely ensure that indirect costs are  allowable and allocable to the contract. CMS officials told us that they  generally adjust for final indirect cost rates during contract closeout at the  end of the contract performance rather than annually mainly due to the  cost and effort the adjustment takes. However, CMS did not promptly  close out its contracts and had not made progress in reducing the backlog  of contracts eligible for closeout. Specifically, in 2007, we reported that  CMS’s backlog was 1,300 contracts, of which 407 were overdue for  closeout as of September 30, 2007. This backlog continued to increase, and  CMS officials stated that as of July 29, 2009, the total backlog of contracts  eligible for closeout was 1,611, with 594 overdue based on FAR timing  standards. Not annually adjusting for final indirect cost rates increases  the risk that CMS is paying for costs that are not allowable or allocable to  the contract. Furthermore, putting off the control activity until the end of  contract performance increases the risk of overpaying for indirect costs  during contract performance and may make identification or recovery of  any unallowable costs during contract closeout more difficult due to the  passage of time.
We estimated that for at least 54.9 percent of fiscal year 2008  contract actions, CMS did not promptly perform or request an  audit of direct costs. Similar to the audit of indirect costs, audits of  direct costs allow the government to verify that the costs billed by the  contractor were allowable, reasonable, and allocable to the contract. Not  annually auditing direct costs increases the risk that CMS is paying for  costs that are not allowable or allocable to the contract.
We estimated that for at least 59.0 percent of fiscal year 2008  contract actions, the project officer did not always certify the  invoices. CMS’s Acquisition Policy Notice 16-01 requires the project  officer to review each contractor invoice and recommend payment  approval or disapproval to the contracting officer. This review is to  determine, among other things, if the expenditure rate is commensurate  with technical progress and whether all direct cost elements are  appropriate, including subcontracts, travel, and equipment. We noted in  our 2007 report that CMS used negative certification—a process whereby  it paid contractor invoices without knowing whether they were reviewed  and approved—in order to ensure invoices were paid in a timely fashion.  In October 2009 we reported that negative certification continued to be  CMS’s policy to process contractor invoices for payment. This approach,  however, significantly reduces the incentive for contracting officers,  specialists, and project officers to review the invoice prior to payment. For  example, in one case, although a contractor submitted over 100 invoices  for fiscal year 2008, only 8 were certified by the project officer. The total  value of the contract through January 2009 was about $64 million. In  addition, based on a cursory review of the fiscal year 2008 invoices  submitted for payment, we found instances in which the contracting  officer or specialist did not identify items that were inconsistent with the  terms of the contract or acquisition regulations. For example, we found  two instances where the contractor billed, and CMS paid, for items  generally disallowed by HHSAR. Reviewing invoices prior to payment is a  preventive control that may result in the identification of unallowable  billings, especially on cost reimbursement and time and materials invoices,  before the invoices are paid. CMS increases its risk of improper payments  when it does not properly review and approve invoices prior to payment.
section_title: Weak Control Environment Hindered CMS’s Ability to Manage Its FAR-based Acquisition Process
paragraphs: The control deficiencies we identified in the statistical sample discussed in  our October 2009 report stemmed from a weak overall control  environment. CMS’s control environment was characterized by the lack of  (1) strategic planning to identify necessary staffing and funding;   (2) reliable data for effectively carrying out contract management  responsibilities; and (3) follow-up to track, investigate, and resolve  contract audit and evaluation findings for purposes of cost recovery and  future award decisions. A positive control environment sets the tone for  the overall quality of an entity’s internal control, and provides the  foundation for an entity to effectively manage contracts and payments to  contractors. Without a strong control environment, the control  deficiencies we identified will likely persist. Following is a summary of the  weaknesses we found in CMS’s overall control environment:    Limited analysis of contract management workforce and related  funding needs. OAGM management had not analyzed its contract  management workforce and related funding needs through a  comprehensive, strategic acquisition workforce plan. Such a plan is  critical to help manage the increasing acquisition workload and meet its  contracting oversight needs. We reported in November 2007 that staff  resources allocated to contract oversight had not kept pace with the  increase in CMS contract awards. In our 2009 report, we found a similar  trend continued into 2008. While the obligated amount of contract awards  had increased 71 percent since 1998, OAGM staffing resources—its  number of full time equivalents (FTE)—had increased 26 percent. This  trend presents a major challenge to contract award and administration  personnel who must deal with a significantly increased workload without  additional support and resources. In addition, according to its staff and  management, OAGM faced challenges in meeting the various audit  requirements necessary to ensure adequate oversight of contracts that  pose more risk to the government, specifically cost reimbursement  contracts, as well as in performing the activities required of a cognizant  federal agency (CFA).
Although officials told us they could use more audit funding, we found that  OAGM management had yet to determine what an appropriate funding  level should be. Without knowing for which contractors additional CFA  oversight was needed, CMS did not have reliable information on the  number of audits and reviews that must be performed annually or the  depth and complexity of those audits. Without this key information, CMS  could not estimate an adequate level of needed audit funding. The risks of  not performing CFA duties are increased by the fact that other federal  agencies that use the same contractors rely on the oversight and  monitoring work of the CFA. A shortage of financial and human resources  creates an environment that introduces vulnerabilities to the contracting  process, hinders management’s ability to sustain an effective overall  control environment, and ultimately increases risk in the contracting  process.
Lack of reliable contract management data. Although CMS had  generally reliable information on the basic attributes of each contract  action, such as vendor name and obligation amount, CMS lacked reliable  management information on other key aspects of its FAR-based  contracting operations. For example, in our October 2009 report we  identified acquisition data errors related to the number of certain contract  types awarded, the extent of competition achieved, and total contract  value. Standards for internal control provide that for an agency to manage  its operations, it must have relevant, reliable, and timely information  relating to the extent and nature of its operations, including both  operational and financial data, and such information should be recorded  and communicated to management and others within the agency who  need it and in a form and within a time frame that enables them to carry  out their internal control and operational responsibilities. The acquisition  data errors were due in part to a lack of sufficient quality assurance  activities over the data entered into the acquisition databases. Without  accurate data, CMS program managers did not have adequate information  to identify, monitor, and correct or mitigate areas that posed a high risk of  improper payments or waste.
Lack of follow-up to resolve contract audit and evaluation findings.
CMS did not track, investigate, and resolve contract audit and evaluation  findings for purposes of cost recovery and future award decisions.  Tracking audit and evaluation findings strengthens the control  environment in part because it can help assure management that the  agency’s objectives are being met through the efficient and effective use of  the agency’s resources. It can also help management determine whether  the entity is complying with applicable acquisition laws and regulations.  Contract audits and evaluations can add significant value to an  organization’s oversight and accountability structure, but only if  management ensures that the results of these audits and evaluations are  promptly investigated and resolved. For example, in an audit report dated  September 30, 2008, the Defense Contract Audit Agency questioned  approximately $2.1 million of costs that CMS paid to a contractor in fiscal  year 2006. As discussed in our October 2009 report, OAGM management  confirmed that no action had been taken at that time to investigate and  recover the challenged costs.
section_title: GAO Has Made Numerous Recommendations to Improve CMS’s Contract Management Controls
subsections: section_title: Seven of Nine GAO 2007 Recommendations Were Substantially Unresolved
paragraphs: As we reported in October 2009, CMS management had not taken  substantial actions to address our 2007 recommendations to improve  internal control in the contracting process. Only two of GAO’s nine 2007  recommendations had been fully addressed. Table 1 summarizes our  assessment of the status of CMS’s actions to address our  recommendations.
section_title: GAO Made 10 Additional Recommendations in October 2009 to Further Improve CMS Contract Management
paragraphs: In addition to reaffirming the 7 substantially unresolved 2007  recommendations, our October 2009 report included 10 recommendations  to further improve oversight and strengthen CMS’s control environment.  Specifically, we made recommendations for additional procedures or  plans to address the following 10 areas:    document compliance with FAR requirements for different contract types;    document provisional indirect cost rates in the contract file;    specify what constitutes timely performance of (or request for) audits of  contractors’ billed costs;    specify circumstances for the use and content of negotiation  memorandums, including any required secondary reviews;    specify Contract Review Board documentation, including resolution of  issues identified during the CRB reviews;    conduct periodic reviews of contract files to ensure invoices were  properly reviewed by both the project officer and contracting officer or  specialist;    develop a comprehensive strategic acquisition workforce plan, with  resource needs to fulfill FAR requirements for comprehensive oversight,  including CFA duties;  revise the verification and validation plan to require all relevant  acquisition data errors be corrected and their resolution documented;    develop procedures for tracking contract audit requests and the resolution  of audit findings; and    develop procedures that clearly assign roles and responsibilities for the  timely fulfillment of CFA duties.
In commenting on a draft of our October 2009 report, CMS and HHS  agreed with each of our 10 new recommendations and described steps  planned to address them. CMS also stated that the recommendations will  serve as a catalyst for improvements to the internal controls for its  contracting function. CMS also expressed concerns about our assessment  of key internal controls and disagreed with our conclusions on the status  of CMS’s actions to address our November 2007 recommendations. CMS  stated its belief that “virtually all” of the errors we identified in our  statistical sample related to “perceived documentation deficiencies.” CMS  also expressed concern that a reasonable amount of time had not yet  elapsed since the issuance of our November 2007 report to allow for  corrective actions to have taken place.
However, as discussed in greater detail in our October 2009 report  response to agency comments, nearly 2 years had elapsed between our  November 2007 and October 2009 reports and CMS had made little  progress in addressing the recommendations from our November 2007  report. Further, a significant number of our October 2009 report findings,  including weaknesses in the control environment, were based on  observations and interviews with OAGM officials and reviews of related  documentation such as policies and strategic plans. Finally, the  deficiencies we identified negatively impact the key controls intended to  help ensure compliance with agency acquisition regulations and the FAR.
In conclusion, Madam Chairman, while we have not updated the status of  any CMS actions to address our October 2009 findings and  recommendations, the extent to which control weaknesses in CMS’s  contracting activities continue, raises questions concerning whether CMS  management has established an appropriate “tone at the top” to effectively  manage these key activities. Until CMS management addresses our  previous recommendations in this area, along with taking action to  address the additional deficiencies identified in our October 2009 report,  its contracting activities will continue to pose significant risk of improper  payments, waste, and mismanagement. Further, the deficiencies we  identified are likely to be exacerbated by the rise in obligations for non- claims processing contract awards as well as CMS’s extensive reliance on  contractors to help achieve its mission objectives. It is imperative that  CMS address its serious contract-level control deficiencies and take action  on our recommendations to improve overall environment controls or CMS  will continue to place billions of taxpayer dollars at risk of fraud, or  otherwise improper contract payments. We commend the Subcommittee  for its continuing oversight and leadership in this important area and  believe that hearings such as the one being held today will be critical to  ensuring that CMS’s continuing contract management weaknesses are  resolved without further delay and that overall risks to the government are  substantially reduced.
Madam Chairman and Members of the Subcommittee, this concludes my  prepared statement. I would be happy to answer any questions that you  may have at this time.
section_title: GAO Contacts and Acknowledgements
paragraphs: For further information regarding this testimony, please contact Kay L.  Daly at (202) 512-9095 or dalykl@gao.gov. In addition, contact points for  our Offices of Congressional Relations and Public Affairs may be found on  the last page of this statement. Individuals who made key contributions to  this testimony are Marcia Carlsen and Phil McIntyre (Assistant Directors),  Sharon Byrd, Richard Cambosos, Francine DelVecchio, Abe Dymond, John  Lopez, Ron Schwenn, Omar Torres, Ruth Walk, and Danietta Williams.
This is a work of the U.S. government and is not subject to copyright protection in the  United States. The published product may be reproduced and distributed in its entirety  without further permission from GAO. However, because this work may contain  copyrighted images or other material, permission from the copyright holder may be  necessary if you wish to reproduce this material separately.