Centers for Medicare and Medicaid Services: Deficiencies in Contract Management Internal Control Are Pervasive
Published: 2009-10-23T00:00:00

Fast Facts:

Highlights:
section_title: Why GAO Did This Study
paragraphs: As a result of internal control deficiencies discussed in GAO's 2007 report on certain contracts at the Centers for Medicare and Medicaid Services (CMS), GAO was asked to identify the extent to which CMS (1) implemented effective control procedures over contract actions, and (2) established a strong control environment for contract management. GAO used a statistical random sample of 2008 CMS contract actions (including contract awards and modifications) to assess CMS internal control procedures. The results were projected to the population of 2008 CMS contract actions. GAO also determined the extent to which CMS implemented recommendations GAO made in 2007 to improve internal control over contracting and payments to contractors. GAO reviewed contract file documentation and interviewed senior acquisition management officials.
section_title: What GAO Found
paragraphs: Pervasive deficiencies in CMS contract management internal controlincrease the risk of improper payments or waste. Specifically, based on our statistical random sample of 2008 CMS contract actions, GAO estimates that at least 84.3 percent of fiscal year 2008 contract actions contained at least one instance where a key control was not adequately implemented. GAO also estimates that at least 37.2 percent of fiscal year 2008 contract actions had three or more instances in which a key control was not adequately implemented. The contract actions GAO evaluated were generally subject to the Federal Acquisition Regulation. For example, CMS used cost reimbursement contracts without first ensuring that the contractor had an adequate accounting system. Also, project officers did not always certify invoices for payment. These deficiencies were due in part to a lack of agency-specific policies and procedures to help ensure proper contracting expenditures. These control deficiencies also stem from a weak overall control environment as characterized primarily by inadequate strategic planning for staffing and funding resources. CMS also did not accurately capture data on the nature and extent of its contracting, which hinders CMS's ability to manage its acquisition function by identifying areas of risk, due to a lack of quality assurance procedures over data entry. CMS also has not substantially addressed seven of the nine recommendations made by GAO in 2007 to improve internal control over contracting and payments to contractors. For example, CMS has not made progress in clarifying the roles and responsibilities for implementing certain contractor oversight responsibilities and, as of July 2009, CMS still had a backlog of contacts that were overdue for closeout, putting CMS at increased risk of not identifying or recovering improper payments or waste. The continuing weaknesses in contracting activities and limited progress in addressing known deficiencies will continue to put billions of taxpayer dollars at risk of improper payments or waste.

section_title: Letter
paragraphs: The Centers for Medicare and Medicaid Services (CMS), a component of  the Department of Health and Human Services (HHS), administers the  high-risk programs of Medicare and Medicaid, and other programs such as  the State Children’s Health Insurance Program. CMS relies extensively on  contractors to assist in carrying out its basic mission, including program  administration, management, and oversight of its health programs. In fiscal  year 2008, CMS reported that it obligated $3.6 billion under contracts for a  variety of goods and services. CMS’s acquisitions include contracts to  administer, oversee, and audit claims made under the Medicare program;  provide information technology systems; provide program management  and consulting services; and operate the 1-800 Medicare help line.
In November 2007, we reported significant deficiencies in internal control  over certain contracts used by CMS for start-up administrative services to  implement programs enacted under the Medicare Prescription Drug,  Improvement, and Modernization Act of 2003 (MMA). Internal control— the plans, methods, and procedures used to meet missions, goals, and  objectives—is the first line of defense in safeguarding assets and  preventing and detecting fraud and errors and helps government program  managers achieve desired results through effective stewardship of public  resources. We reported that CMS’s internal control deficiencies resulted in  millions of dollars of questionable payments to contractors, primarily  because CMS did not obtain adequate support for billed costs from certain  contractors.
Because of concerns about the implications that these weaknesses may  have on all CMS contracts generally subject to the requirements of the  Federal Acquisition Regulation (FAR), you asked us to perform a  comprehensive, in-depth review of CMS’s contract management practices.  This report addresses the extent to which (1) CMS implemented effective  internal control procedures over contract actions to help ensure proper  contracting expenditures and (2) CMS established a strong control  environment for contract management.
To address the extent to which CMS implemented control procedures over  contract actions, we focused on contracts that were generally subject to  the FAR (i.e., FAR-based), which represented about $2.5 billion, or about  70 percent, of total obligations awarded in fiscal year 2008. The FAR is the  governmentwide regulation containing the rules, standards, and  requirements for the award, administration, and termination of  government contracts. Based on the standards for internal control, FAR  requirements, and agency policies, we identified and evaluated 11 key  internal control procedures over contract actions, ranging from ensuring  contractors had adequate accounting systems prior to the use of a cost  reimbursement contract to certifying invoices for payment. Contract  actions include new contract awards and modifications to existing  contracts. We conducted our tests on a statistically random sample of 102  FAR-based contract actions CMS made in fiscal year 2008 and projected  the results of our statistical sample conservatively by reporting the lower  bound of our two-sided, 95 percent confidence interval. We tested a  variety of contract actions including a range of dollars obligated, different  contract types (fixed price, cost reimbursement, etc.), and the types of  goods and services procured. The actions in the sample ranged from a  $1,000 firm-fixed price contract for newspapers to a $17.5 million  modification of an information technology contract valued at over $500  million. For each contract action in the sample, we determined if the 11  key internal control procedures were implemented by reviewing the  contract file supporting the action and, where applicable, by obtaining  additional information from the contracting officer or specialist or senior  acquisition management. We also tested the reliability of the data  contained in CMS’s two acquisition databases. Basic attributes of its  contract actions, such as contractor name and obligation amount, which  we found to be reliable for purposes of this report, were used to produce  the historical obligation information presented in the background section.
To address the extent to which CMS established a strong control  environment for contract management, we obtained and reviewed  documentation regarding contract closeout, acquisition planning, and  other management information and interviewed officials in the Office of  Acquisition and Grants Management (OAGM) about its contract  management processes. We also evaluated whether CMS had addressed  recommendations we made in our prior report. We used the internal  control standards as a basis for our evaluation of CMS’s contract  management control environment.
Appendix I provides additional details of our scope and methodology. We  conducted this performance audit from July 2008 to September 2009 in  accordance with generally accepted government auditing standards. Those  standards require that we plan and perform the audit to obtain sufficient,  appropriate evidence to provide a reasonable basis for our findings and  conclusions based on our audit objectives. We believe that the evidence  obtained provides a reasonable basis for our findings and conclusions  based on our audit objectives.
subsections: section_title: Background
subsections: section_title: Nature and Extent of CMS Contracting
paragraphs: CMS reported total obligations for CMS contracts in fiscal year 2008 were  $3.6 billion. This amount includes obligations against contracts that  process Medicare claims as well as obligations to other contractors such  as those that operate the 1-800 Medicare help line, provide program  management and consulting services, and support information technology.
The $3.6 billion obligated in 2008 represents a 71 percent increase since  1998, when $2.1 billion was obligated.
Since 1998, obligations to fiscal intermediaries, carriers, and Medicare  Administrative Contractors (contractors that primarily process Medicare  claims) have decreased approximately 16 percent. Obligations for other- than-claims processing activities, such as the 1-800 help line, information  technology and financial management initiatives, and program  management and consulting services, have increased 466 percent, as  shown in figure 1. These trends may be explained in part by recent  changes to the Medicare program, including the movement of functions,  such as the help line, data centers, and certain financial management  activities, from the fiscal intermediaries and carriers to specialized  contractors. These specialized contractors, such as beneficiary contact  center contractors and enterprise data center contractors, are categorized  below as other-than-claims processing contractors.
MMA required CMS to transition its Medicare claims processing contracts,  which generally did not follow the FAR, to the FAR environment through  the award of contracts to Medicare Administrative Contractors. CMS  projected that the transition, referred to as Medicare contracting reform,  would produce administrative cost savings due to the effects of  competition and contract consolidation as well as produce Medicare trust  fund savings due to a reduction in the amount of improper benefit  payments. Additionally, the transition would subject millions of dollars of  CMS acquisitions to the rules, standards, and requirements for the award,  administration, and termination of government contracts in the FAR.  Obligations to the new Medicare Administrative Contractors were first  made in fiscal year 2007. CMS is required to complete Medicare  contracting reform by 2011. As of September 1, 2009, 19 contracts have  been awarded to Medicare Administrative Contractors, totaling about $1  billion in obligations to date.
Except for certain Medicare claims processing contracts, CMS contracts  are generally required to be awarded and administered in accordance with  general government procurement laws and regulations such as the FAR;  the Health and Human Services Acquisition Regulations (HHSAR); the  Cost Accounting Standards (CAS); and the terms of the contract.
section_title: Overview of CMS Contract Management
paragraphs: At CMS, OAGM manages contracting activities and is responsible for,  among other things, (1) developing policy and procedures for use by  acquisition staff; (2) coordinating and conducting acquisition training; and  (3) negotiation, award, administration, and termination of contracts.  Multiple key players work together to monitor different aspects of  contractor performance and execute pre-award and post-award contract  oversight. All but one of the key roles described below are managed  centrally in OAGM. The last, project officers, are assigned from CMS  program offices.
Contracting officers are responsible for ensuring performance of all  necessary actions for effective contracting, overseeing contractor  compliance with the terms of the contract, and safeguarding the  interests of the government in its contractual relationships. The  contracting officer is authorized to enter into, modify, and terminate  contracts. According to OAGM’s invoice review policy, contracting  officers, with the assistance of the contract specialists, review  contractor invoices for compliance with contract terms, among other  things.
Contract specialists represent and assist the contracting officers with  the contract, but are generally not authorized to commit or bind the  government. The contract specialist assists with the invoice review  process.
The cost/price team serves as an in-house consultant to others  involved in the contracting process at CMS. By request, the team,  which consists of four contract auditors, provides support for  contract administration including reviewing cost proposals,  consultations about the allowability of costs billed on invoices, and  assistance during contract closeout.
Project officers serve as the contracting officer’s technical  representative designated to monitor the contractor’s progress,  including the surveillance and assessment of performance and  compliance with project objectives. According to OAGM invoice  review policy, project officers review certain invoice elements, such  as labor and direct costs, and are required to certify whether the  invoice is approved for payment by signing a Payments and Progress  Certification Form. They may also conduct periodic analyses of  contractor performance and cost data.
CMS utilizes two different databases of acquisition information for a  variety of internal and external reporting on its acquisition activities. The  PRISM database contains basic information such as contract number,  vendor name, and amount obligated. PRISM is used to develop contract  documents and for internal reporting and acquisition planning. The  Enhanced Departmental Contracts Information System (DCIS) is an HHS  database that is used for department-level acquisition management and to  satisfy external reporting requirements. DCIS collects and forwards  information to the Federal Procurement Data System Next Generation  (FPDS-NG), which is a publicly available database of governmentwide  acquisition information. Likewise, FPDS-NG feeds into  www.usaspending.gov, a Web site created in response to the Federal  Funding Accountability and Transparency Act of 2006, which required a  single searchable Web site, accessible by the public for free, that reports  key information for each federal award.
section_title: Federal Acquisition, Contract Types, and Cognizant Federal Agency Responsibilities
paragraphs: The contract life cycle includes many acquisition and administrative  activities. Prior to award, an agency identifies a need; develops a  requirements package; determines the method of contracting; solicits and  evaluates bids or proposals; and ultimately awards a contract. After  contract award, the agency performs contract administration and contract  closeout. Contract administration involves monitoring the contractor’s  performance as well as reviewing and approving (or disapproving) the  contractor’s request for payment. Other tasks may include audits or  reviews of the contractor’s costs and compliance with CAS. The contract  closeout process involves verifying that the goods or services were  provided and that administrative matters are completed, including a  contract audit of costs billed to the government and adjusting for any over-  or underpayments based on the final invoice.
Agencies may choose among different contract types to acquire goods and  services. This choice is the principal means that agencies have for  allocating risk between the government and the contractor. Contract types  can be grouped into three broad categories: fixed price contracts, cost  reimbursement contracts, and time and materials (T&M) contracts.  Although the FAR places limitations on the use of cost reimbursement and  T&M contract types, these contract types may be used to provide the  flexibility needed by the government to acquire the large variety and  volume of supplies and services it needs. As discussed below, these three  types of contracts place different levels of risk on the government and the  contractor. Generally, the government manages its risk, in part, through  oversight activities.
For fixed price contracts, the government agrees to pay a set price for  goods or services regardless of the actual cost to the contractor. A  fixed price contract is ordinarily in the government’s interest when  the risk involved is minimal or can be predicted with an acceptable  degree of certainty and a sound basis for pricing exists, as the  contractor assumes the risk for cost overruns.
Under cost reimbursement contracts, the government agrees to pay  those costs of the contractor that are allowable, reasonable, and  allocable to the extent prescribed by the contract. The government  assumes most of the cost risk because the contractor is only required  to provide its best effort to meet contract objectives within the  estimated cost. If this cannot be done, the government can provide  additional funds to complete the effort, decide not to provide  additional funds, or terminate the contract. Cost reimbursement  contracts may be used only when the contractor’s accounting system  is adequate for determining costs applicable to the contract and  appropriate government surveillance during performance will provide  reasonable assurance that efficient methods and effective cost  controls are used. In order to determine if the contractor has  efficient methods and effective cost controls, contracting officers and  other contracting oversight personnel may perform a comprehensive  review of contractor invoices to determine if the contractor is billing  costs in accordance with the contract terms and applicable  government regulations. In addition, the establishment of provisional  and final indirect cost rates helps to ensure that the government  makes payments for costs that are allowable, reasonable, and  allocable to the extent prescribed by the contract.
For T&M contracts, the government agrees to pay fixed per-hour labor  rates and to reimburse other costs directly related to the contract,  such as materials, equipment, or travel, based on cost. Like cost  reimbursement contracts, the government assumes the cost risk  because the contractor is only required to make a good faith effort to  meet the government’s needs within a ceiling price. A T&M contract  may be used only if the contracting officer prepares a determination  and findings that no other contract type is suitable and if the contract  includes a ceiling price that the contractor exceeds at its own risk. In  addition, since these contracts provide no positive profit incentive for  the contractor to control costs or use labor efficiently, the  government must conduct appropriate surveillance of contractor  performance to ensure efficient methods and effective cost controls  are being used.
The FAR defines cognizant federal agency (CFA) as the agency  responsible for establishing forward pricing rates, final indirect cost rates  (when not accomplished by a designated contract auditor), and  administering cost accounting standards for all contracts in a business  unit. Generally, the CFA is the agency with the largest dollar amount of  negotiated contracts, including options, with the contractor. In addition,  the CFA may be responsible for establishing provisional indirect cost rates  (also known as “billing rates”) based on recent reviews, previous rate  audits, experience, or similar reliable data to ensure that estimates are as  close as possible to final indirect cost rates anticipated.
section_title: Internal Control
paragraphs: The Standards for Internal Control in the Federal Government provide  the overall framework for establishing and maintaining internal control  and for identifying and addressing areas at greatest risk of fraud, waste,  abuse, and mismanagement. These standards provide that—to be  effective—an entity’s management should establish both a supportive  overall control environment and specific control activities directed at  carrying out its objectives. As such, an entity’s management should  establish and maintain an environment that sets a positive and supportive  attitude towards control and conscientious management. A positive  control environment provides discipline and structure as well as a climate  supportive of quality internal control, and includes an assessment of the  risks the agency faces from both external and internal sources. Control  activities are the policies, procedures, techniques, and mechanisms that  enforce management’s directives and help ensure that actions are taken to  address risks. The standards further provide that information should be  recorded and communicated to management and oversight officials in a  form and within a time frame that enables them to carry out their  responsibilities. Finally, an entity should have internal control monitoring  activities in place to assess the quality of performance over time and  ensure that the findings of audits and other reviews are promptly resolved.
Control activities include both preventive and detective controls.  Preventive controls—such as invoice review prior to payment—are  controls designed to prevent errors, improper payments, or waste, while  detective controls—such as incurred cost audits—are designed to identify  errors or improper payments after the payment is made. A sound system  of internal control contains a balance of both preventive and detective  controls that is appropriate for the agency’s operations. While detective  controls are beneficial in that they identify funds that may have been  inappropriately paid and should be returned to the government, preventive  controls such as accounting system reviews and invoice reviews help to  reduce the risk of improper payments or waste before they occur. A key  concept introduced in our standards is that control activities selected for  implementation be cost beneficial. Generally it is more effective and  efficient to prevent improper payments. A control activity can be  preventive, detective, or both based on when the control occurs in the  contract life cycle.
section_title: Pervasive Deficiencies in Control Procedures at the Contract Level Increase the Risk of Improper Payments or Waste
paragraphs: We found pervasive deficiencies in internal control over contracting and  payments to contractors. The internal control deficiencies occurred  throughout the contracting process, that is both pre- and post-award, and  increase the risk of improper payments or waste. These deficiencies were  due in part to a lack of agency-specific policies and procedures to ensure  that FAR requirements and other control objectives were met. CMS also  did not take appropriate steps to ensure that existing policies were  properly implemented nor maintain adequate documentation in its  contract files. Further, the Contract Review Board was not effective in  ensuring proper contract award actions. These internal control  deficiencies are a manifestation of CMS’s weak overall control  environment, which is discussed later.
As a result of our work, we estimate that at least 84.3 percent of FAR- based contract actions made by CMS in fiscal year 2008 contained at least  one instance in which a key control was not adequately implemented. (See  table 3 in app. I for a list of the 11 controls we tested, which ranged from  ensuring contractors had adequate accounting systems prior to the use of  a cost reimbursement contract to certifying invoices for payment.) Not  only was the number of internal control deficiencies widespread, but also  many contract actions had more than one deficiency. We also estimate  that at least 37.2 percent of FAR-based contract actions made in fiscal  year 2008 had three or more instances in which a key control was not  adequately implemented. The high percentage of deficiencies indicates a  serious failure of control procedures over FAR-based acquisitions, thereby  creating a heightened risk of making improper payments or waste. We  determined a control to be “key” based on our review of the standards for  internal control as well as the FAR, HHSAR, and agency policies and  whether inadequate implementation would significantly increase the risk  of improper payments or waste. We also took into consideration prior  audit findings and the contract types CMS most frequently used. See  appendix I for additional details on the controls we tested and the  statistical sample results. We project the results of our statistical sample  conservatively by reporting the lower bound of our two-sided, 95 percent  confidence interval.
subsections: section_title: CMS’s Lack of Policies and Procedures Resulted in Numerous Control Deficiencies
paragraphs: The control deficiencies we found were primarily caused by a lack of  agency-specific policies and procedures that would help ensure that  applicable FAR requirements, agency policies, and other control  objectives were met. CMS did not always meet FAR requirements for  specific contract types that were awarded, nor maintain adequate support  for approved provisional indirect cost rates, which are necessary to  determine the reasonableness of indirect costs billed on invoices.  Additionally, CMS did not timely perform or request audits of incurred  direct and indirect costs, which provide assurance that costs billed by the  contractor are allowable and reasonable under the terms of the contract  and applicable government regulations. These control deficiencies are  discussed in detail below and the results of the other control procedures  we tested can be found in appendix I.
We estimate that at least 46.0 percent of fiscal year 2008 CMS  contract actions did not meet the FAR requirements applicable  to the specific contract type awarded. Sixteen contract actions  we tested had deficiencies—of which 1 related to a letter contract, 9  related to cost reimbursement contracts, and 6 related to T&M  contracts. In the case of the letter contract, the contract file did not  contain the authorization for use of the letter contract, which is  required by HHSAR. In the case of cost reimbursement contracts, the  FAR states that a cost reimbursement contract may be used only  when the contractor’s accounting system is adequate for determining  costs applicable to the contract. Of the contract awards in our  sample, we found 9 cases in which cost reimbursement contracts  were used without first ensuring that the contractor had an adequate  accounting system. An adequate contractor accounting system is key  to the government’s ability to perform the various contract oversight  activities required by the FAR for cost reimbursement contracts. In  particular, contracting officers and other members of the federal  agency acquisition workforce rely on the contractors’ contract  proposals, interim billings, provisional indirect cost rates, and reports  of actual costs incurred (which are used to finalize the direct and  indirect costs billed) all of which are generated from data maintained  in the contractor’s accounting system. In addition to the 9 cases  above, during our review of modifications we observed another 6  cases in which cost reimbursement contracts were used even though  CMS was aware that the contractor’s accounting system was  inadequate at the time of award. In one instance, the contracting  officer was aware that a contractor had an inadequate accounting  system resulting from numerous instances of noncompliance with  CAS. Using a cost reimbursement contract when a contractor does  not have an adequate accounting system hinders the government’s  ability to fulfill its oversight duties throughout the contract life cycle.  Additionally, it increases risk of improper payments and the risk that  costs billed can not be substantiated during an audit.
When choosing to use T&M contracts, the FAR requires contracting  officers to prepare and sign a determination and finding that no other  contract type is suitable for the acquisition. The justification is  required to set forth enough facts and circumstances to clearly and  convincingly justify the specific determination made. We found that  the determination and finding was either not documented or  insufficient in six T&M contract awards we reviewed. In cases when  the justification memorandum was prepared, contracting officers  merely quoted language from the FAR but did not set forth clear and  convincing findings—that is, the particular circumstances, facts, or  reasoning essential to support the determination—for why other  contract types could not be used. When the contracting officer does  not clearly and convincingly document the findings that support using  a T&M contract type, OAGM does not have assurance that the  appropriate contract type was used. In addition, for three of the  contract actions, the contract specialist told us that the actions the  document listed to mitigate the risk of awarding a T&M contract were  not performed. Because CMS did not carry out the stated mitigation  strategies used to justify the selection of the T&M contract type, it  increased its exposure to the risk of improper payments or waste.
We estimate that for at least 40.4 percent of fiscal year 2008  contract actions, CMS did not have sufficient support for  provisional indirect cost rates nor did it identify instances  when a contractor billed rates higher than the rates that were  approved for use. Specifically, for 17 contract actions that utilized  indirect cost rates, CMS did not have documentation supporting what  would be the appropriate provisional indirect cost rates for the  contractor. For an additional 19 contract actions, the provisional rates  either did not match the indirect rates billed on the invoices or could  not be matched because the invoice did not provide sufficient detail.  The FAR states that provisional indirect cost rates shall be used in  reimbursing indirect costs such as fringe benefits or overhead costs  under cost reimbursement contracts and are used to prevent  substantial overpayment or underpayment of indirect costs. These  rates are generally established by the CFA, contracting officer, or  auditor on the basis of reliable data or previous rate audits and should  be set as close as possible to the anticipated final indirect cost rates.  Provisional indirect cost rates provide agencies with a mechanism by  which to determine if the indirect costs billed on invoices are  reasonable for the services provided until such time that final indirect  cost rates can be established, generally at the end of the contractor’s  fiscal year. Approval of provisional indirect cost rates is important  given the fact that indirect costs can be more than 50 percent of the  total invoice amount. When the agency does not maintain adequate  support for provisional indirect rates, it increases its risk of making  improper payments.
We estimate that for at least 52.6 percent of fiscal year 2008  contract actions, CMS did not have support for final indirect  cost rates. Specifically, 23 contract actions we tested did not have  documentation of final indirect cost rates or support for the prompt  request of an audit of indirect costs. The FAR states that final  indirect cost rates, which are based on the actual indirect costs  incurred during a given fiscal year, shall be used in reimbursing  indirect costs under cost reimbursement contracts. The amounts a  contractor billed using provisional indirect cost rates are adjusted  annually for final indirect cost rates providing a mechanism for the  government to timely ensure that indirect costs are allowable and  allocable to the contract. Final indirect cost rates are generally  negotiated by the government’s negotiating team that includes the  CFA following an audit of a statement of incurred costs submitted by  the contractor. CMS officials told us that they generally adjust for  final indirect cost rates during contract closeout at the end of the  contract performance rather than annually mainly due to the cost and  effort the adjustment takes. Moreover, since final indirect cost rates  are established by the CFA, when CMS is not the CFA, CMS must wait  on the CFA to perform the necessary audit work required to establish  the final indirect cost rates. Not annually adjusting for final indirect  cost rates increases the risk that CMS is paying for costs that are not  allowable or allocable to the contract. Furthermore, putting off the  control activity until the end of contract performance increases the  risk of overpaying for indirect costs during contract performance and  may make identification or recovery of any unallowable costs during  contract closeout more difficult due to the passage of time.
We estimate that for at least 54.9 percent of fiscal year 2008  contract actions, CMS did not promptly perform or request an  audit of direct costs. We found that 25 contract actions for which  this control applied did not have an audit of direct costs promptly  performed or requested. Similar to the audit of indirect costs, audits  of direct costs allow the government to verify that the costs billed by  the contractor were allowable, reasonable, and allocable to the  contract. The audit of direct costs is the responsibility of the  contracting officer; however, the contracting officer may request, for  a fee, that the CFA for the contractor perform the audit work. The  FAR does not provide time frames or other requirements for when the  audit of direct costs should be performed except that such an audit  may be necessary for closing out the contract at the end of contract  performance. Not annually auditing direct costs increases the risk  that CMS is paying for costs that are not allowable or allocable to the  contract.
section_title: CMS Did Not Follow Existing Policies on Invoice Certification and Purchase Card Oversight
paragraphs: CMS had policies for invoice certification and purchase card oversight;  however, these policies were not consistently followed. The failure to  follow established agency policy increases CMS’s risk of improperly  paying contractor invoices or purchase card transactions.
We estimate that for at least 59.0 percent of fiscal year 2008  contract actions, the project officer did not always certify the  invoices. CMS’s Acquisition Policy Notice 16-01 requires the project  officer to review each contractor invoice and recommend payment  approval or disapproval to the contracting officer. This review is to  determine, among other things, if the expenditure rate is  commensurate with technical progress and whether all direct cost  elements are appropriate, including subcontracts, travel, and  equipment. Based on his or her review, the project officer is then to  approve the invoice for payment by signing a Payments and Progress  Certification Form or disapprove by issuing a suspension notice. In  one case, although a contractor submitted over 100 invoices for fiscal  year 2008, only 8 were certified by the project officer. The total value  of the contract through January 2009 was about $64 million.
After the project officer’s review, the contracting officer or specialist  is also required to review invoices for critical elements such as  compliance with the terms of the contract—including indirect cost  rates—and mathematical accuracy. Based on a cursory review of the  fiscal year 2008 invoices submitted for payment, we found instances  in which the contracting officer or specialist did not identify items  that were inconsistent with the terms of the contract. For example,  facilities capital cost of money is generally disallowed by HHSAR.  However, we found two instances where the contractor billed, and  CMS paid, this cost. Another contractor submitted invoices under its  fixed price contract that were contrary to the payment schedule  stipulated in the contract terms. The contract required the contractor  to submit four invoices of equal amount every 3 months during the 1- year performance period. However, the contractor submitted one  invoice for the entire amount of the contract. Moreover, the invoice  was dated prior to the start date of the contract period of  performance. CMS increases its risk of making improper payments  when it does not properly review and approve invoices prior to  payment.
OAGM also did not perform required audits and reviews of  CMS purchase cards to identify fraud or waste. These audits  and reviews are particularly important because of the authorized  spending limits. As of July 15, 2009, OAGM’s purchase card program  had issued 123 cards with 20 percent having monthly spending limits  of at least $50,000. Eight card holders had monthly spending limits of  $100,000, the highest spending limit authorized by CMS. Without  sufficient oversight of the purchase card program, CMS does not have  assurance that only allowable transactions are procured through  purchase cards and that the purchase cards are not being used to  circumvent FAR competition requirements.
The HHS purchase card policy guidance provides that the purchase  card coordinator, which at CMS is within OAGM, is required to  conduct surveillance of the purchase card program by annually  auditing cardholder transactions using such methods as statistical and  nonstatistical sampling, data mining, and spot checks; monitoring  purchase card usage; and deactivitating purchase cards when  appropriate, among other things. The OAGM purchase card  coordinator’s supervisor told us that OAGM did not perform the  oversight activities because the supervisor viewed those activities as  the responsibility of the Office of Financial Management (OFM). We  spoke with an OFM official who stated that OFM does not review  purchase card transactions for fraud or inappropriate use, but instead  pays the purchase card invoice based on the authorizing official’s  approval.
section_title: CMS Did Not Maintain Adequate Documentation in Its Contract Files
paragraphs: During the tests of control procedures, we observed that the contract files  did not always contain all required documentation to support the contract  actions we reviewed. Standards for internal control call for transactions  and other significant events to be clearly documented, and the  documentation should be readily available for examination. In addition,  the FAR provides that the documentation in the contract files shall be  sufficient to constitute a complete history of the contract action for the  purpose of providing a basis for informed decisions at each step in the  acquisition process, and providing information for reviews and  investigations, among other things. Clearly documenting the history of a  contract action is an important tool that provides management with  assurance that the agency has complied with applicable regulations and  has made well-informed decisions for efficient contract management.  Incomplete or inadequate contract files and documentation hinder the  ability of the contracting officers to perform their oversight duties,  especially those who assume responsibility for contracts that have  changed hands during the life of the contract.
CMS contract files did not always contain documentation necessary to  support the action and that would provide contracting officers with the  tools they needed to adequately perform their oversight functions.  Specifically, we found a contract file was missing a statement of work and  another file was missing a copy of the actual contract. In addition, two  contract files did not maintain any information regarding the General  Services Administration schedule contract that was valid at the time of the  award of the task order. In numerous instances, we determined that the  letter delegating duties to the project officer and the training certificate for  the project officer—both of which are required by OAGM policies—were  not in the file. Also, a chronological list of contracting officers and their  dates of responsibility, which provides an important tool for establishing  accountability for contract files over time, was consistently absent.
Additionally, we found that CMS’s use of negotiation memorandums was  inconsistent. The HHSAR provides that the negotiation memorandum is a  complete record of all actions leading to the award of a contract and  should be in sufficient detail to explain and support the rationale,  judgments, and authorities upon which all actions were predicated and  should be signed by the contract negotiator. However, we found that  negotiation memorandums were not always prepared for actions in which  they were clearly required, and were prepared for actions in which they  may not be required, according to HHSAR. Moreover, while many  negotiation memorandums we reviewed had signature blocks for both the  contract specialist and the contracting officer (generally the preparer and  reviewer, respectively) the memorandums were not always signed by the  contracting officer.
section_title: Contract Review Board Not Effective in Ensuring Proper Contract Award Actions
paragraphs: CMS’s OAGM established the Contract Review Board (CRB) reviews as a  key control procedure to help ensure contract award actions are in  conformance with law, established policies and procedures, and sound  business practices. However, our review of the CRB process found that  the process had not been properly or fully implemented. For example, of  the 22 contracts selected to be reviewed by the CRB in 2008, only 7 were  actually reviewed. Similarly, for fiscal year 2009, 22 contracts were  selected for the CRB but only 2 have been reviewed as of the end of the  third quarter. Also, the contracting officer for the contract action being  reviewed is neither required to reach consensus with the CRB on the  resolution of issues identified nor to document the justification for not  resolving CRB issues. Moreover, CMS is not following its policies for  selecting the contracts to be reviewed by the CRB. While OAGM’s policies  require that all contracts above $10 million be subjected to the CRB, CMS  confirmed that only contracts nominated by division directors are  reviewed. If used correctly, the CRB can be an effective tool for risk-based  quality assurance and for reviewing the internal controls throughout the  contract award and administration process. However, because CMS  policies do not require issues to be resolved and documented and because  CMS is not fully implementing the CRB, opportunities to identify and fix  deficiencies in the contract administration process and to improve internal  controls may be missed.
section_title: Weak Control Environment Hinders CMS’s Ability to Manage its FAR-based Acquisition Process
paragraphs: In addition to the deficiencies in contract-level control procedures as  discussed previously, CMS’s FAR-based contract management was  impaired by a weak control environment. CMS’s control environment is  characterized by the lack of strategic planning to identify necessary  staffing and funding, a lack of reliable data for effectively carrying out  contract management responsibilities, very limited actions taken on the  recommendations we made in 2007 related to contracting and payments to  contractors, and a lack of procedures for managing contract audits which  are essential to managing and overseeing the growing value of contracting  activities. A positive control environment sets the tone for the overall  quality of an entity’s internal control, and provides the foundation for an  entity to effectively manage contracts and payments to contractors.  Without a strong control environment, the control deficiencies we  identified during this review will likely persist.
subsections: section_title: OAGM Management Has Not Determined CMS Contract Management Staffing and Funding Resource Requirements
paragraphs: OAGM management has not analyzed its contract management workforce  and related funding needs through a comprehensive, strategic acquisition  workforce plan. Such a plan is critical to help manage the increasing  acquisition workload and meet its contracting oversight needs. We  reported in November 2007 that staff resources allocated to contract  oversight had not kept pace with the increase in CMS contract awards. A  similar trend continued into 2008. While the obligated amount of contract  awards has increased 71 percent since 1998, OAGM staffing resources—its  number of full time equivalents (FTE)—has increased 26 percent. This  trend presents a major challenge to contract award and administration  personnel who must deal with a significantly increased workload without  additional support and resources.
While CMS has data on its workforce changes since January 2007  (attritions and additions), documentation requesting additional FTEs for a  specific project, and, in its fiscal year 2010 budget, a request to hire  contract support staff to help meet contract and grant administration  needs, CMS has not yet determined the amount of total FTEs needed for  the fiscal year and beyond. For example, the documentation did not  contain an analysis of the workload anticipated for the year, such as the  total number of new awards, the number of active contracts by contract  type, the number of CMS contracts under HHS’s cognizance, or the  number and type of audits needed. The documents did not contain  information on CMS’s current FTE level, skill mix, or analysis of any skill  gaps. Without this information, OAGM has limited insight into appropriate  solutions, such as the use of contractor support staff. While the use of  contractor support staff has in recent years become commonplace in the  federal government, we have previously reported that using contractors  for contract administrative functions may increase the risk of establishing  unauthorized personal services contracts or the risk of contractors  performing inherently governmental functions, both of which are  prohibited by FAR.
According to its staff and management, OAGM is challenged to meet the  various audit requirements necessary to ensure adequate oversight of  contracts that pose more risk to the government, specifically cost  reimbursement contracts, as well as perform the activities required of a  CFA. While officials told us they could use more audit funding, we found  that OAGM management had yet to determine what an appropriate funding  level should be. Without knowing for which contractors additional CFA  oversight is needed, CMS does not know with certainty the number of  audits and reviews that must be performed annually or the depth and  complexity of those audits. Without this key information, CMS can not  estimate an adequate level of audit funding that it needs.
During interviews and our on-site review of contract files, we were told by  OAGM senior management and contracting officers and specialists that  the first set of activities that the contracting officers and specialists tend to  neglect under resource constraints was post-award administration and  contract closeout. Moreover, while OAGM management told us that staff  worked hard to comply with its instructions to follow all applicable FAR  requirements, CMS staff told us they take shortcuts due to resource  constraints. For example, one contract specialist told us she prepared the  Independent Government Cost Estimate based on the winning contractor’s  proposed costs instead of conducting her own independent research to  determine the government’s benchmark for the reasonableness of the  costs of the scope of work. Additionally, as previously discussed, CMS  officials told us that incurred cost audits are not performed annually  primarily due to insufficient resources. A shortage of financial and human  resources creates an environment that introduces vulnerabilities to the  contracting process, hinders management’s ability to sustain an effective  overall control environment, and ultimately increases risk in the  contracting process.
section_title: CMS Lacks Reliable Data Needed to Effectively Carry Out Contract Management Responsibilities
paragraphs: Although CMS has generally reliable information on basic attributes of  each contract action, such as vendor name and obligation amount, CMS  lacks reliable management information on other key aspects of its FAR- based contracting operations, including the number of certain contract  types awarded, the extent of competition achieved, and total contract  value. Standards for internal control provide that for an agency to manage  its operations, it must have relevant, reliable, and timely information  relating to the extent and nature of its operations, including both  operational and financial data, that should be recorded and communicated  to management and others within the agency who need it and in a form  and within a time frame that enables them to carry out their internal  control and operational responsibilities. The acquisition data errors are  due in part to a lack of sufficient quality assurance activities over the data  entered into the acquisition databases. Without accurate data, CMS  program managers do not have adequate information to identify and  monitor areas that pose a high risk of improper payments or waste.  Moreover, inaccurate or incomplete data hinder CMS’s ability to mitigate  through additional policies or enhanced oversight any high-risk areas,  such as the frequent use of cost reimbursement contracts, that would be  identified based on reports or analysis of the databases. The errors in  DCIS, including the unrecorded actions, also impact governmentwide  reporting. The Office of Management and Budget (OMB) requires agencies  to submit their acquisition data to the Federal Procurement Database  System-Next Generation (FDPS-NG). Since HHS submits DCIS data to the  FDPS-NG, which in turn feeds into OMB’s publicly available database at  www.usaspending.gov, the DCIS errors noted above are provided to the  public and limit the usefulness and transparency of this important tool.
We estimate that for at least 34.9 percent of fiscal year 2008  contract actions, PRISM contained at least one error in the  selected critical fields we reviewed. In particular, we found that  PRISM contained 16 errors in a field we reviewed that designated the  extent to which the contract was competed, for example, full and  open competition or not competed as a result of being a logical  follow-on to a previous contract. Additionally, we determined that the  award type field in PRISM did not capture consistent information. For  example, the field had prepopulated options associated with both  award type (basic ordering agreement, delivery order, letter contract,  etc.) and contract type (cost reimbursement, fixed price, and T&M).  Combining these options into one data field prevents CMS from  determining the total number of each award type and each contract  type, making it difficult to accurately determine CMS’s contracting  trends. OAGM officials told us that the data entered into PRISM are  not subjected to a secondary review in which the data entered are  compared to the information in the contract file.
We estimate that for at least 54.2 percent of fiscal year 2008  contract actions, DCIS contained at least one error in the  selected critical fields we reviewed. DCIS contained errors in  current contract value and ultimate contract value fields, as well as  the extent of competition, contract type, and award type fields.  Further, 11 sample items, or approximately 10 percent of the sample,  were not in DCIS. Our high-level data analysis on the population of  fiscal year 2008 contract actions identified that certain required fields,  such as contract type and competition, contained blank responses and  “nulls”. We also noted obvious errors. For example, CMS entered  codes for “potato farming” and “tortilla manufacturing” in the industry  code field for two contract actions.
Prior to calendar year 2008, CMS did not have quality assurance  activities, such as formal data entry reviews or database training, over  the data contained in the DCIS database. In December 2007, OAGM  established a Verification and Validation Plan for DCIS Accuracy  Improvements (V&V). The V&V plan contained several actions,  including a secondary review of data entered into DCIS for every 50th  contract action. The V&V plan lacks key elements and controls to  ensure that the resolution of potential errors is properly documented  and errors are corrected in a timely manner. For example, OAGM  officials could not determine if all errors identified during the file  reviews were properly resolved and the appropriate adjustments to  DCIS were made. Additionally, while staff training was provided in  January 2008, the DCIS data entry instructions were later modified  with new information. In one instance, we noted that the DCIS  preparer and the reviewer were using different versions of the  instructions resulting in confusion over what would be the  appropriate DCIS entry. OAGM officials provided us with the results  for the V&V plan for 2008, which showed that 23 of the total 2,031  contract actions entered into DCIS in 2008 were reviewed for  accuracy, which is approximately every 88th action.
section_title: Seven of Nine GAO 2007 Recommendations Remain Substantially Unresolved
paragraphs: As of July 22, 2009, CMS management had not taken substantial actions to  address our prior recommendations to improve internal control in the  contracting process. Only two of GAO’s nine 2007 recommendations had  been fully addressed. Table 1 summarizes, and appendix II provides  additional detail on, our assessment of the status of CMS’s actions to  address our recommendations. The seven substantially unresolved  recommendations represent a lack of action on the part of CMS  management to resolve key control deficiencies.
Policies and criteria for pre-award contract activities have not  been developed. In our 2007 report, we recommended that CMS  develop policies for certain pre-award contract activities, such as  analysis to justify the contract type selected and verification of the  adequacy of the contractor’s accounting system prior to the award of  a cost reimbursement contract. However, no new policies or guidance  were developed, because in CMS’s view, policies and criteria are  already established in the FAR and HHSAR. While the FAR provides  requirements for federal acquisitions, it is up to the agencies to  develop and provide their contracting workforce with specific policies  and day-to-day procedures that guide them in implementing those  requirements and to tailor the policies to address the specific  operational environment. Agency-specific policy may include  guidance on applicable approval levels, time frames, agency forms,  and routing processes. Also, while the HHSAR provides additional  guidance and policies specific to HHS, the HHSAR does not  specifically address all of the pre-award contract activities that we  identified as needing improvement, nor does it delineate the roles and  responsibilities of the different staff involved in the contracting  process or establish time frames for when certain pre-award contract  activities should be performed. The deficiencies identified in this  report, especially those associated with FAR requirements unique to  specific contract types, further highlight the need for additional  guidance for contracting officers.
Roles and responsibilities for implementation of CFA  responsibilities not clearly defined. The FAR requires that CFAs  perform certain oversight and monitoring activities. The CFA concept  provides an efficient way for contractors to receive a streamlined set  of audits and reviews, thereby enabling them to receive and perform  government contracts. In our 2007 report, we found that CFA  responsibilities were inadequately fulfilled and recommended that  CMS develop policies and procedures to ensure that CFA  responsibilities were performed. In a recommendation resolution  report, HHS stated that policies and procedures were needed at both  the department level and at CMS. As of July 2009, neither HHS nor  CMS had developed such policies and procedures or a mechanism to  track the CMS contractors for which additional oversight is needed.  Moreover, roles and responsibilities for the performance of CFA  duties were not clear among HHS and its components, including CMS.
During an interview with CMS, HHS, NIH, and HHS Office of  Inspector General (OIG) officials, HHS officials stated that CFA  responsibilities lie at the HHS department level. However, HHS  officials also said that certain CFA responsibilities are delegated to  HHS components and to contracting officers. Specifically, NIH was  assigned responsibility to establish indirect rates for the contractors  under HHS’s cognizance, but contracting officers within HHS  components are responsible for other CFA duties. However, during  the meeting, the officials could not clearly explain how the  performance of these duties was monitored to ensure that CFA  oversight takes place. HHS officials said that they did not have a  process to identify the contractors, including CMS contractors, for  which HHS would be the CFA. Without a list that is periodically  updated for the contractors’ portfolio of federal government  contracting activity, HHS and its components do not know the  contractors for which CFA oversight is needed.
NIH officials acknowledged their centralized role in determining  indirect rates, but noted that NIH did not have the resources  necessary to determine the indirect rates for the contractors under  HHS’s cognizance. CMS officials told us that when NIH can not  perform the reviews within the needed time frames to make timely  contract awards, CMS’s cost/price team establishes the rates. The  confusion over roles and responsibilities increases the risk that CFA  responsibilities are not being timely performed, if at all. Without  effective coordination, contractors may not receive the necessary  oversight and the government may not be positioned to protect itself  from the risk of improper payments or waste. The risks of not  performing CFA duties are exacerbated by the fact that other federal  agencies that use the same contractors rely on the oversight and  monitoring work of the CFA.
CMS policies did not provide guidance on what constitutes  sufficient detail to support amounts billed on contractor  invoices to facilitate the review process. Despite our prior  recommendation, CMS had not prepared guidelines or revised its  invoice review policy to specify or provide examples of sufficient  detail that would be needed to support contractor invoices to  facilitate an adequate review. In fact, most of the invoices we  reviewed were not sufficiently supported. We identified invoices  missing payroll detail, travel receipts, and subcontractor invoices, all  of which are necessary to provide the reviewers adequate information  to confirm if the amounts billed were compliant with the terms of the  contract or otherwise allowable and allocable to that contract. In one  instance, invoices reported labor costs based on labor categories, but  did not show hours worked by employees or their respective labor  rates. In another example, a contractor submitted an invoice in 2008  for services that were provided in 2003. The contractor did not  provide supporting documentation for the $36,944 billed. Neither the  invoice paid in 2008, nor the related file included evidence that the  charge was investigated or further evaluated by either the project  officer or contracting specialist. While different levels of review may  be required based on the complexity of individual invoices and  associated contract type, inadequately reviewing invoices increases  the risk of improper payments.
CMS has not set criteria for the use of negative certification.
We recommended in our 2007 report that CMS establish criteria for  the use of negative certification in the payment of contractor invoices  which would consider potential risk factors. CMS uses negative  certification—a process whereby it pays contractor invoices without  knowing whether they were reviewed and approved—in order to  ensure invoices are paid in a timely fashion. This approach, however,  significantly reduces the incentive for contracting officers, specialists,  and project officers to review the invoice prior to payment. Reviewing  invoices prior to payment is a preventive control which may result in  the identification of unallowable billings, especially on cost  reimbursement and T&M invoices, before the invoices are paid. In  light of the importance of this preventive control, we recommended  that CMS establish criteria for when to use negative certification; such  criteria may be based on considerations of potential risk factors such  as contract type, the adequacy of the contractor’s accounting system,  and prior history with the contractor. We found, however, that  OAGM’s invoice review policy was not revised to address this  recommendation and OAGM officials confirmed that negative  certification is still the primary method for paying invoices regardless  of risks.
Training on invoice review procedures still needed. As discussed  earlier, project officers did not always certify invoices for approval  and contracting officers or specialists did not always identify  instances where invoices did not comply with contract terms and  conditions. We also found that invoices were not always maintained in  the file, as required by CMS’s invoice review policy. In light of these  continuing deficiencies, and the need for further revisions to its  invoice review policy described above, further training on invoice  review procedures will be necessary.
Continuing backlog of contracts overdue for closeout. In 2007,  we reported that CMS did not timely perform contract closeout  procedures resulting in a backlog of 1,300 contracts, of which 407  were overdue for closeout as of September 30, 2007. We  recommended that CMS develop a plan to reduce the number of  contracts in the backlog. CMS did not provide us a closeout plan for  fiscal year 2008 and the fiscal year 2009 plan was insufficient.  Specifically, the plan did not include a comprehensive strategy to  reduce the backlog of contracts that are eligible and overdue for  closeout nor did it contain a workload analysis, such as a list of  contracts eligible for closeout by contracting officer or specialist or  an estimate of the number of hours or audit funds it would need to  close the contracts.
The FAR establishes time standards for closing out a contract after  the work is physically completed (i.e., goods or services are  provided). The contract closeout process is an important internal  control, in part, because it is generally the last opportunity for the  government to detect and recover any improper payments. The  complexity and length of the closeout process can vary with the  extent of oversight performed by the agency during the period of  performance and the contract type.
CMS officials told us that during fiscal year 2008, OAGM closed 581  contracts and reduced the overdue backlog to 400 contracts (from the  407 reported at the end of fiscal year 2007). Yet OAGM officials could  not provide support for these closures or a list of the contracts  overdue for closeout. Additionally, CMS officials stated that as of July  29, 2009, the total backlog of contracts eligible for closeout was 1,611,  with 594 overdue based on FAR timing standards. This is a substantial  increase over the balances at the end of fiscal year 2007. Moreover,  the total contract value of contracts eligible for closeout has  increased from $3 billion to at least $3.8 billion.
Insufficient progress has been made to reduce the backlog of  contracts eligible for closeout. The closeout process is particularly  important for cost reimbursement contracts because a contractor is  allowed to bill costs it incurred to provide the good or service. During  the closeout process, the government audits these billed costs to  determine if they were allowable and allocable to the contract, and  processes the final invoice with an adjustment for any over- or  underpayments. The failure to perform contract closeouts in a timely  manner puts CMS at increased risk of improper payments or waste,  and may make identification and recovery of any such improper  payments more difficult due to the passage of time.
CMS has not taken sufficient actions to investigate and  recover questionable payments. CMS described several actions it  has taken to investigate payments made to 3 of the 12 contractors for  which we identified questionable payments. The actions CMS has  taken to date are insufficient to fully resolve the issues identified and  more remains to be done to recover funds that may have been  inappropriately paid to contractors.
For example, CMS highlighted $67 million in questionable payments  that were related to one specific contractor and stated that these  questionable payments are being investigated via a fiscal year 2008  incurred cost audit. However, the $67 million related to costs incurred  in fiscal years 2004, 2005, and 2006 and therefore would not be  covered or investigated in an audit of fiscal year 2008 incurred costs.  Additionally, CMS said it had resolved the questionable payments  made to another contractor; however, CMS’s actions did not relate to  the $1.4 million in payments CMS made in fiscal year 2006 that we  questioned. Regarding a third contractor, CMS issued a demand letter  in April 2007 to recover funds the contractor billed and CMS paid in  excess of contract ceiling limits; however, no resolution has yet been  reached. CMS could not tell us whether it had recovered any of the  questioned amounts.
CMS’s resolution of questionable payments of the magnitude we  identified ($88.8 million) in the prior report should be performed  expeditiously. As a steward of taxpayer dollars, CMS is accountable  for how it spends and safeguards funds as well as having mechanisms  in place to recoup those funds when improper payments are  identified. CMS relies on incurred cost audits that are conducted at  the end of contract performance when the contract is closed to  validate the overall propriety of payments. As discussed earlier,  incurred cost audits are best conducted annually, rather than at the  end of contract performance. CMS’s backlog of contracts eligible for  closeout delays investigations and makes recovery more difficult.
section_title: CMS Does Not Track, Investigate, and Resolve Contract Audit and Evaluation Findings to Aid Decision Making
paragraphs: CMS does not track, investigate, and resolve contract audit and evaluation  findings for purposes of cost recovery and future award decisions.  Tracking audit and evaluation findings strengthens the control  environment in part because it can help assure management that the  agency’s objectives are being met through the efficient and effective use of  the agency’s resources. It can also help management determine whether  the entity is complying with applicable acquisition laws and regulations.  Contract audits and evaluations can add significant value to an  organization’s oversight and accountability structure, but only if  management ensures that the results of these audits and evaluations are  promptly investigated and resolved.
During our review of the contract files, we noted that audits and  evaluations CMS requested of organizations such as DCAA or performed  by the CMS cost/price team identified questionable payments, accounting  system deficiencies, and other significant weaknesses or deficiencies  associated with certain CMS contractors. However, we could not  consistently determine how the contracting officer or other OAGM staff  followed up on the results of these audits and noted that CMS was not  always taking the results of these audits and evaluations into  consideration when making decisions relating to future contract awards.
For example, in an audit report dated September 30, 2008, DCAA  questioned approximately $2.1 million of costs that CMS paid to a  contractor in fiscal year 2006. OAGM management confirmed that no  action has been taken to investigate and recover the challenged costs. In  another instance, the contracting officer—based on the results of a  cost/price team evaluation of a contractor’s technical capability and  negative results of DCAA audits—deemed the contractor “risky” during  the pre-award contract proposal evaluation process. Nevertheless, the  contracting officer awarded the cost reimbursement contract to this  “risky” contractor. We found no evidence of any plans or procedures that  would mitigate the identified risks.
CMS has not established a formal procedure or system for tracking and  pursuing the results of contract or contractor audits and had not provided  its contracting officers guidance or procedures for when to request the  assistance of internal and external audit and evaluation services. For  example, OAGM did not provide direction on when (what stage(s) in the  contract life cycle and under what circumstances) the contracting officer  should utilize the service of the cost/price team or other contract auditors.  By not timely acting on audit results or fully incorporating knowledge  identified by cost/price evaluations or other audits into award decisions,  CMS is forgoing the potential benefits from those audits and evaluations. A  well-established tenet for recovery of improper payments is that it  becomes increasingly more difficult with the passage of time. Careful and  prompt consideration of audit results, including tracking and pursuing  findings, helps to reduce the risk of improper payments or waste, and  making other-than-the-best award decisions.
section_title: Conclusion
paragraphs: The contract-level and overall control environment weaknesses we found  significantly increase CMS’s vulnerability to improper or wasteful contract  payments. To address these deficiencies, CMS will need to develop and  implement CMS-specific policies and procedures to ensure that contract  actions are properly administered and comply with applicable  requirements. CMS also needs to strengthen its overall contract  management control environment, including developing strategic  workforce plans, establishing appropriate contract management oversight  procedures, and maintaining reliable management information.
In addition, CMS management has made limited progress in substantively  addressing most of the broad-based recommendations from our 2007  report. We found that many of our findings in this review could be, at least  in part, attributed to CMS management’s lack of attention given to  resolving the control deficiencies. Consequently, we are reiterating our  previous recommendations to (1) develop policies for pre-award  contracting activities, (2) develop policies to help ensure CFA  responsibilities are performed, (3) prepare guidelines on what constitutes  sufficient detail to support contractor invoices, (4) establish criteria for  the use of negative certification, (5) provide training on revised invoice  review policies, (6) develop a plan to reduce the backlog of contracts  eligible for closeout, and (7) review the questionable payments identified  in the prior report to determine if payments are recoverable.
The continuing weaknesses in contracting activities and limited progress  in addressing known deficiencies raise questions concerning whether CMS  management has established an appropriate “tone at the top” regarding  contracting activities. Until CMS management addresses our previous  recommendations in this area, along with taking action to address the  additional deficiencies identified in this report, its contracting activities  will continue to pose significant risk of improper payments, waste, and  mismanagement. Further, the deficiencies we identified are likely to be  exacerbated by the rise in obligations for non-claims processing contract  awards as well as CMS’s extensive reliance on contractors to help achieve  its mission objectives. It is imperative that CMS take immediate action to  address its serious contract-level control deficiencies and take action on  our previous recommendations to improve contract-level and overall  environment controls or CMS will continue to place billions of taxpayer  dollars at risk of fraud, or otherwise improper contract payments.
section_title: Recommendations for Executive Action
paragraphs: We make the following nine recommendations to the Administrator of  CMS to develop and implement policies and procedures to ensure that  FAR requirements and other control objectives are met. Policies and  procedures should:    Document compliance with FAR requirements for different contract  types. At a minimum, enhance current documentation, such as the  contract checklist, to ensure the contract file documents  authorizations for letter contracts, adequacy of the contractors  accounting systems, and determination and findings for time and  materials contracts, when applicable.
Document in the contract file provisional indirect cost rates used as a  basis for reviewing the reasonableness of the indirect costs billed on  the contractor invoices.
Specify what constitutes timely performance of (or request for) audits  of contractors’ statements of incurred cost for cost reimbursement  and T&M contracts, including circumstances when OAGM should  perform the audit itself or request another organization to perform the  service.
Specify circumstances under which negotiation memorandums should  be used and the content of such, and any required secondary reviews,  in light of HHSAR requirements and current OAGM practice.
Specify Contract Review Board review documentation to include, at a  minimum, documentation of the number of contracts reviewed each  year, the issues identified by the CRB reviewer(s), and resolution of  issues identified during the CRB reviews.
Require Division Directors to periodically assess, document, and  report to senior management on the results of their review of whether  the contract files contain documentation that invoices were properly  reviewed by both the project officer and contracting officer or  specialist.
To strengthen the control environment, we recommend that OAGM  management:    Develop and implement a comprehensive strategic acquisition  workforce plan. The plan should include, at a minimum, elements  such as performance goals, time frames, implementation actions, and  resource requirements, and address issues such as OAGM workload,  full time equivalents needed, and a workforce skills analysis, as well  as an estimate of the amount of resources OAGM needs to fulfill the  audit and other FAR requirements for comprehensive oversight,  including those required of a CFA.
Revise the Verification and Validation Plan for DCIS Accuracy and  Improvements policy to require all relevant errors be corrected and  their resolution documented.
Develop and implement policies and procedures for tracking contract  audit requests, monitoring the results of contract audits and  evaluations, and resolving the audit findings, to include roles and  responsibilities of the contracting officer, specialist, and members of  the cost/price team.
We make the following recommendation to the Secretary of HHS to  improve the department’s fulfillment of CFA duties as described in FAR.
Develop policies and procedures that clearly assign roles and  responsibilities for the timely fulfillment of CFA duties, and that  include the preparation of and periodic update of a list of contractors  for which the department is the CFA.
section_title: Agency Comments and Our Evaluation
paragraphs: In written comments on a draft of this report (reprinted in their entirety in  appendix III), CMS and HHS agreed with each of our 10 new  recommendations and described steps planned to address them. CMS also  stated that the recommendations will serve as a catalyst for improvements  to the internal controls for its contracting function. In its comments, CMS  also expressed concerns about the scope and timing of our work with  respect to our November 2007 recommendations and disagreed with our  assessment of the status of 5 of the 7 recommendations we made in that  report. We address the concerns CMS raised in its comment letter below  and include additional information at the end of appendix III.
In its comments, CMS stated its belief that the 11 internal controls we  reviewed did not provide a complete picture of its internal controls over  contract management activities. We acknowledge that there are many  internal controls that are and can be instituted by agencies to help  safeguard assets, prevent and detect fraud and errors, and help  government program managers achieve desired results through effective  stewardship of public resources. As described in appendix I, we selected  11 controls that we determined to be “key” based on GAO’s standards for  internal control, the FAR and HHSAR, CMS’s policies and procedures, and  other factors including our prior audit findings regarding CMS’s  acquisition controls and the nature of CMS’s acquisition function.
CMS stated its belief that “virtually all” of the errors we identified related  to “perceived documentation deficiencies.” CMS stated it was encouraged  that the errors we found did not involve more substantive departures from  the FAR or HHSAR. We disagree with CMS’s overall assessment of our  findings and message of the report. The internal controls we tested are key  to ensuring that contracting activities, both pre-award and post-award,  mitigate risks to the federal government. A number of the findings we  identified during the testing of a statistically valid sample of contract files  involved the lack of documentation that the controls were performed.  Lack of documentation reduces management’s ability to ascertain whether  these important controls were appropriately implemented and therefore is  a serious internal control deficiency. OAGM management’s downplaying of  the overall message of the report—that control deficiencies are  pervasive—further illustrates the weak internal control environment.  Setting an appropriate control environment, especially “tone at the top,” is  key to ensuring that staff take all appropriate steps to mitigate risk and  protect tax dollars from fraud, waste, and abuse.
CMS also stated that a reasonable amount of time had not yet elapsed  since the issuance of our November 2007 report to allow for corrective  actions to have taken place. A significant number of our current report  findings, including weaknesses in the control environment, were based on  observations and interviews with OAGM officials and reviews of related  documentation such as policies and strategic plans. Our current review  was completed in September 2009, nearly 2 years after the issuance of our  November 2007 report. While CMS also stated that the contract actions we  reviewed took place in fiscal year 2008, it is important to note that we  considered the timing of CMS’s corrective actions when evaluating the  controls we tested. For example, CMS’s Acquisition Policy 02-03, which  identifies level of approvals required by agency officials based on the  estimated dollar value for acquisitions awarded through other than full  and open competition, was implemented in April 2008. We applied these  approval levels only to the awards and modifications in our sample that  were made after the policy was implemented. Furthermore, our  observations and recommendations related to CMS’s control environment  are based on conditions that continued to exist in September 2009.
CMS disagreed with our determination that their actions to address five of  the seven prior recommendations were not sufficient. These prior  recommendations were aimed at improving preventive controls.  Preventive controls, such as policies and criteria for pre-award activities  and a sound invoice review process prior to payment, are the first line of  defense in reducing the risk of improper payments or waste. We continue  to believe that the limited actions OAGM management has taken, and in  some cases, management’s inaction, fall short of expectations and miss the  intent of improving CMS’s overall system of control over its acquisition  activities.
For example, CMS asserted that its Acquisition Policy 16-01 entitled  “Invoicing Payment Procedures” satisfies two of the prior  recommendations. The intent of these two recommendations was to  ensure that contractors provided adequate support to facilitate an  appropriate detailed review of the invoiced costs prior to payment and  that CMS develop clear risk-based criteria for the use of negative  certification. CMS uses negative certification—a process whereby it pays  contractor invoices without knowing whether they were reviewed and  approved—in order to ensure invoices are paid in a timely fashion. We  examined this policy during our review and found it to be unresponsive to  the recommendations because it did not provide the recommended  additional guidelines on what the contractor should provide that would  constitute sufficient detail to support amounts billed on contractor  invoices. It also did not describe under what circumstances or in what  situations it was acceptable for CMS to use negative certification.
With regard to a third prior recommendation that CMS review the  questionable payments we identified, CMS described in its comment letter  specific actions taken to investigate some of the questionable payments  and subsequently provided documentation of actions it had taken to  investigate the questionable payments we identified for three contractors.  After reviewing this information, we revised our assessment of the status  of efforts taken by CMS from “No Actions Taken” to “Actions Insufficient.”  While CMS had taken some action, the steps have not resolved the  questionable payments we identified. For example, CMS highlighted $67  million that we previously questioned that was related to one specific  contractor and stated that these questionable payments are being  investigated via a fiscal year 2008 incurred cost audit. The $67 million we  questioned related to costs incurred in fiscal years 2004, 2005, and 2006  and therefore would not be covered or investigated in an audit of fiscal  year 2008 incurred costs. Moreover, as of the date of the report, CMS could  not tell us whether it had recovered any of the questioned amounts. We  continue to believe that CMS’s actions to date are insufficient and more  actions are needed to investigate and recover the questionable payments  we identified.
No other changes were made to the report as a result of agency comments.  See appendix III for a discussion of the remaining two prior  recommendations (points 2, 3, and 4) for which CMS disagreed with our  assessment of its progress and our analysis of comments CMS made on  our new recommendations.
As agreed with your offices, unless you publicly announce its contents  earlier, we plan no further distribution of this report until 30 days from its  date. At that time, we will send copies to the Secretary of Health and  Human Services, Administrator of the Centers for Medicare and Medicaid  Services, and interested congressional committees. Copies will also be  available to others on request. In addition, the report will be available at  no charge on the GAO Web site at http://www.gao.gov.
If you or your staff have any questions about this report, please contact me  at (202) 512-9095 or dalykl@gao.gov. Contact points for our Offices of  Congressional Relations and Public Affairs may be found on the last page  of this report. Major contributors to this report are acknowledged in  appendix IV.
section_title: Appendix I: Scope and Methodology
paragraphs: To determine the extent to which the Centers for Medicare and Medicaid  Services (CMS) implemented effective internal control procedures over  contract actions, we focused on contracts that were generally subjected to  the Federal Acquisition Regulation. We also interviewed senior  management of CMS’s Office of Acquisition and Grants Management  (OAGM), contracting officers and specialists, and cost/price team  members as well as officials in the Office of Acquisition Management and  Policy at the Department of Health and Human Services (HHS). We  selected 11 internal controls over contracting and payments to contractors  to test for this report, ranging from ensuring contractors had adequate  accounting systems prior to the use of a cost reimbursement contract to  certifying invoices for payment. We selected controls to test based on our  review of GAO’s standards for internal control, the Federal Acquisition  Regulation requirements, and agency policies and procedures, taking into  consideration prior audit findings and the contract types most frequently  awarded. The controls we tested are key to effective administration of the  contract in that the lack of implementation would significantly increase  the risk of improper payments or waste.
To test internal control procedures over contract actions, we selected a  stratified random sample of 102 contract actions totaling $140.7 million in  fiscal year 2008 obligations from a population of 2,441 contract actions  totaling $2.5 billion in fiscal year 2008 obligations. We stratified the  contract actions by type of action, namely contract awards and contract  modifications, recorded in CMS’s PRISM database from October 1, 2007,  through September 30, 2008. Each contract action was either a new  contract award or modification to an existing contract. With this  probability sample, each contract action in the sample frame had a non- zero probability of being included and that probability could be computed  from any contract action. Each stratum was subsequently weighted in the  analysis to account statistically for all the contract actions in the sample  frame, including those that were not selected. Results from this statistical  sample were projected to the population of contract actions made from  October 1, 2007, through September 30, 2008. See table 2 for specific  details related to contract actions selected in the sample.  sample item. Table 3 provides further details on the control procedures we  tested, the criteria or source for the procedure, and detailed results.
We also obtained information from  agency officials regarding contract closeout, cognizant federal agency  responsibilities, audit funding, and staff resources. We used the internal  control standards as a basis for our evaluation of CMS’s contract  management control environment.
We assessed the reliability of CMS’s two acquisition databases,  Departmental Contracts Information System (DCIS) and PRISM by (1)  performing electronic testing of required data elements, and (2)  interviewing both CMS and HHS officials on quality assurance activities  performed on the databases. In addition, we used a statistically random  sample selected to test the application of controls to also test the accuracy  of the data in the systems. We determined that only basic contract  information maintained in the PRISM database, such as vendor name and  obligation amount, was reliable for purposes of this report. The historical  obligation amounts presented in the background section of the report  come primarily from CMS’s PRISM database.
We requested comments on a draft of this report from HHS and CMS. We  received written comments on October 2, 2009, and have summarized  those comments in the Agency Comments and Our Evaluation section of  this report. Our response to certain specific CMS comments appears in the  GAO Comments section of appendix III. We conducted this performance  audit in accordance with generally accepted government auditing  standards. Those standards require that we plan and perform the audit to  obtain sufficient, appropriate evidence to provide a reasonable basis for  our findings and conclusions based on our audit objectives. We believe  that the evidence obtained provides a reasonable basis for our findings  and conclusions based on our audit objectives. We conducted our audit  work in Washington, D.C. and Baltimore, Maryland from July 2008 through  September 2009.
section_title: Appendix II: Status of Prior Recommendations
paragraphs: No action taken.
The Department of Health and Human Services (HHS) reported that  (a) the policy and criteria for pre-award contracting activities are  already established in the Federal Acquisition Regulation (FAR) and  the Health and Human Services Acquisition Regulation (HHSAR),  (b) that existing policies would be reviewed and changes would be  made as appropriate, and (c) certain pre-award activities, such as  the need for adequate accounting systems for cost reimbursement  contracts, would be reviewed with staff at internal training sessions.
While the Office of Acquisition and Grants Management (OAGM) did  conduct internal training on various pre-award activity topics, such  as the proper circumstances to use sole source contracts, the  Centers for Medicare and Medicaid Service’s (CMS) actions are  unresponsive to the recommendation. OAGM still has not developed  policies and criteria that provide clear procedures for staff to follow  during the pre-award stage, such as applicable approval levels, time  frames, agency forms, and routing processes. Furthermore, while  FAR and HHSAR provide regulations agencies must follow, it is up  to agency management to develop agency-specific policies and  other guidance that implement those regulations.
HHS reported that while HHS is the CFA for CMS’s contractors,  policies and procedures need to be developed both at the  department level and at CMS. Further it stated that to the extent  CMS is designated to perform functions supporting HHS as the  CFA, CMS will develop appropriate procedures for monitoring Cost  Accounting Standards compliance and for coordinating efforts with  other agencies.
Actions insufficient. No  policies and procedures  developed.
Neither HHS nor CMS has developed policies that clearly define key  areas of authority and duties for the CFA responsibilities. Moreover,  neither HHS nor CMS has developed a list of contractors for which  HHS is the CFA.
Completed.
HHS reported that CMS revised its invoice review policy to better  define roles and responsibilities.
We reviewed the CMS revised invoice review policy and determined  that new invoice payment procedures contain clear roles and  responsibilities.
No action taken.
HHS reported that CMS revised its invoice review policy.
CMS’s actions are unresponsive to the recommendation. The  revised policy does not specify the documentation the contractors  would be required to submit to support the invoices or what would  be needed for the project officer, contracting specialist, or  contracting officer to validate information in the invoices.
No action taken.
HHS reported that CMS revised its invoice review policy.
CMS’s actions are unresponsive to the recommendation. The  revised policy still contains the use of negative certification as a  default. This policy does not provide criteria to consider potential risk  factors for the use of negative certification in the review of  contractor’s invoices and discuss circumstances that warrant the  use of this method.
HHS reported that CMS provided invoice review training to the  OAGM staff and project officers on May 7 and May 15, 2008.
Actions insufficient.  Actions taken do not  achieve intent of  recommendation.
According to the OAGM Internal Training schedule, they provided  training on invoice review procedures. However, since CMS has not  addressed two of the three recommendations on invoice review— specifically, guidelines to contracting officers on what constitutes  sufficient detail to support amounts billed and establishing criteria for  the use of negative certification (see above)—actions taken do not  achieve the intent of the recommendation.
Completed.
HHS reported that they have implemented the Acquisition Career  Management Information System (ACMIS). ACMIS is a centralized  tracking mechanism that maintains training records for the personnel  assigned to contract activities.
HHS’s implementation of the centralized system to track training  addressed our recommendation.
Actions insufficient.
HHS reported that CMS developed a plan to reduce the backlog of  contracts overdue awaiting closeout and that CMS reduced this  backlog by the end of fiscal year 2007 from 581 to 407 contracts.
CMS provided its fiscal year 2009 contract closeout plan; however,  the plan did not include a comprehensive strategy to reduce the  backlog of contracts that are eligible and overdue for closeout. For  example, it did not contain a workload analysis, such as a list of  contracts eligible for closeout by contracting officer or specialist or  an estimate of the number of hours or audit funds it would need to  close the contracts.
The fiscal year 2009 plan only contained three bullets stating that  OAGM would provide quarterly reports to the division directors and  training to OAGM staff. It also stated that OAGM would establish “a  contract closeout day.” Furthermore, as discussed in the body of this  report, the backlog of contracts overdue for closeout persists.
Actions insufficient.
HHS reported that CMS will review the questionable payments  identified in GAO-08-54 to determine whether CMS should seek  reimbursement from the contractors. It further stated that the  questionable costs will be identified in the course of incurred cost  audits which CMS will obtain in the course of closing out the  contracts. Additionally, CMS described specific actions taken to  investigate some of the questionable payments.
The actions taken to investigate questionable payments were either  insufficient or incomplete. CMS’s approach to delay investigation  and recovery to the end of the contract performance period does not  result in timely resolution of questionable payments of this  magnitude. Audits and inquiries into the issues we identified in our  report should be made as soon as possible.
section_title: Appendix III: Comments from the Centers for Medicare and Medicaid Services
subsections: section_title: GAO Comments
paragraphs: 1. See “Agency Comments and Our Evaluation” section.  2. As we stated in our November 2007 report, we acknowledge that the  time frames for implementing the Medicare Prescription Drug,  Improvement, and Modernization Act of 2003 added schedule pressures for  the Centers for Medicare and Medicaid Services (CMS). At the same time,  the compressed time frames and resulting contracting practices added risk  to the contracting process. Many of the findings in the November 2007  report were a result of the increased risk together with inadequate  compensating controls to mitigate risk.  3. While the Virtual Acquisition Office, which is an off-the-shelf acquisition  software that provides Web links to acquisition regulation and templates to  aid in completion of common acquisition activities, can be a useful tool for  contracting officers, specialists, and the Office of Acquisition and Grants  Management (OAGM) management, it does not represent the agency- specific policies and criteria we recommended that CMS implement for  pre-award activities. As such, CMS’s actions are unresponsive to the  recommendation. Agency-specific policies provide guidance on how CMS  staff are expected to perform their day-to-day duties.  4. As discussed in the report, we continue to believe the contract closeout  plan does not sufficiently address our recommendation because it did not  include a comprehensive strategy to reduce the backlog of contracts that  are eligible and overdue for closeout, nor did it contain a workload  analysis. The plan was for fiscal year 2009; no other plans were developed.  Additionally, CMS stated that it achieved a 30 percent reduction in the  number of contracts eligible for closeout since 2007. However, CMS could  not fully support the analysis it provided and it related only to the time  period between April 2007 and September 30, 2007. According to data  provided to us by CMS during this current review, since September 30,  2007, the number of contracts eligible for closeout has increased by 24  percent, from 1,300 in 2007 to 1,611 in 2009. Additionally, the number of  contracts overdue for closeout has increased from 407 in 2007 to 594 in  2009, a 46 percent increase.  5. The contract file document checklist employed by CMS at the time of  our review identified key documents that may be included in a contract  file. This checklist is usually completed by either the contract specialist or  contracting officer. While such a checklist is useful for ensuring that  certain documents are contained in a contract file, it did not reflect certain  requirements in which we found CMS to be deficient, such as ensuring  contractors had adequate accounting systems prior to the use of a cost  reimbursement contract. We are encouraged that CMS is taking additional  actions to implement the checklists developed by the Department of  Health and Human Services to be used in fiscal year 2010.  6. During our review and as a result of multiple conversations with OAGM  staff including the team of contract auditors, we revised our testing  procedures to consider and accept provisional indirect cost rates that were  not maintained in the individual contract file but were maintained by the  cost/price team in its central files. Therefore, all provisional indirect cost  rate determinations that were maintained by OAGM, regardless of location,  were considered during our review. The steps CMS described that it plans  to take will be important for ensuring that contract office staff have the  information needed readily available to manage contracts throughout the  contract life cycle.  7. As stated in the report, CMS’s current procedures regarding the  accuracy of data entered into the Departmental Contracts Information  System (DCIS) do not include procedures that would ensure that the  resolution of potential errors are properly documented and errors are  corrected in a timely manner. We further found that OAGM was not fully  implementing its policy because it reviewed every 88th action, rather than  every 50th as provided for in the plan. However, we are encouraged by the  recent initiatives described in CMS’s comments, such as the scorecard, and  OAGM’s commitment to review current policies and procedures and to  make improvements where necessary.
section_title: Appendix IV: GAO Contact and Staff Acknowledgments
subsections: section_title: Acknowledgments
paragraphs: Staff members who made key contributions to this report include Marcia  Carlsen and Phil McIntyre (Assistant Directors), Sharon Byrd, Richard  Cambosos, Abe Dymond, Patrick Frey, Jason Kelly, John Lopez, Ron  Schwenn, Omar Torres, Ruth Walk, and Danietta Williams.