Medicaid Financial Management: Better Oversight of State Claims for Federal Reimbursement Needed
Published: 2002-02-28T00:00:00

Fast Facts:

Highlights:
section_title: Why GAO Did This Study
paragraphs: The Medicaid program spent more than $200 billion in fiscal year 2000 to meet the health care needs of nearly 34 million poor, elderly, blind, and disabled persons. States are responsible for making proper payments to Medicaid providers, recovering misspent funds, and accurately reporting costs for federal reimbursement. At the federal level, the Centers for Medicare and Medicaid Services (CMS) oversee state financial activities and ensure the propriety of expenditures reported for federal reimbursement.
section_title: What GAO Found
paragraphs: GAO found that weak financial oversight by CMS leaves the program vulnerable to improper payments. The Comptroller General's Standards for Internal Control in the Federal Government requires that agency managers perform risk assessment, take steps to mitigate identified risks, and monitor the effectiveness of those actions. The standards also require that authority and responsibility for internal controls be clearly defined. CMS oversight had weaknesses in each of these areas. As a result, CMS did not know if its control efforts were focused on areas of greatest risk. CMS also was not effectively implementing the controls it had in place. Furthermore, managers had not established performance standards for financial oversight activities, particularly their expenditure review activity. Limited data were collected to assess regional financial analyst performance in overseeing state internal controls and expenditures. In addition, the CMS audit resolution procedures did not collect enough information on the status of audit findings or ensure that audit findings were resolved promptly. CMS' current organizational structure lacks clear lines of authority and responsibility between the regions and headquarters.

section_title: Letter
paragraphs: The federal government and states share responsibility for the fiscal  integrity and financial management of the jointly funded Medicaid  program.  During fiscal year 2000, the Medicaid program served about  33.4 million low-income families as well as certain elderly, blind, and  disabled persons at a cost of $119 billion to the federal government and  $88 billion to the states for program payments and administrative  expenses. States are the first line of defense in safeguarding Medicaid  financial management, as they are responsible for making proper payments  to Medicaid providers, recovering misspent funds, and accurately reporting  costs for federal reimbursement.  At the federal level, the Centers for  Medicare and Medicaid Services (CMS) is responsible for overseeing state  financial activities and ensuring the propriety of expenditures reported by  states for federal reimbursement.
How well states manage Medicaid finances and how well CMS oversees  state financial management are important concerns because of the size and  nature of the program.  Audits of state Medicaid finances conducted in  accordance with the Single Audit Act of 1984, as amended, annually  identify millions of dollars in questionable or unallowable costs incurred by  state Medicaid agencies.  In addition, annual financial statement audits  required under the Chief Financial Officers Act have identified many  internal control weaknesses in regards to CMS’s oversight of state Medicaid  financial operations.
In light of these concerns, you requested that we review the adequacy of  CMS’s financial oversight process for Medicaid.  Our review assesses  whether (1) CMS has an adequate oversight process to help ensure the  propriety of Medicaid expenditures, (2) CMS adequately evaluates and  monitors the results of its oversight process and makes adjustments as  warranted, and (3) the current CMS organizational structure for financial  management is conducive to effectively directing its oversight process and  sustaining future improvements.  This report responds to your request.
subsections: section_title: Background
paragraphs: CMS, a component of the Department of Health and Human Services  (HHS), administers the Medicaid program. Medicaid is the third largest  social program in the federal budget and is one of the largest components  of state budgets.  Although it is one federal program, Medicaid consists of  56 distinct state-level programs–one for each state, territory, Puerto Rico,  and the District of Columbia.
Each of the states has a designated Medicaid agency that administers the  Medicaid program. The federal government matches state Medicaid  spending for medical assistance according to a formula based on each  state’s per capita income.  The federal share can range from 50 to 83 cents  of every state dollar spent.
In accordance with the Medicaid statute and within broad federal  guidelines, each state establishes its own eligibility standards; determines  the type, amount, duration, and scope of covered services; sets payment  rates; and develops its administrative structure. Each state Medicaid  agency is also responsible for establishing and maintaining an adequate  internal control structure to ensure that the Medicaid program is managed  with integrity and in compliance with applicable law. States are required to  describe the nature and scope of their programs in comprehensive written  plans submitted to CMS–with federal funding for state Medicaid services  contingent on CMS approval of the plans.  This approval hinges on whether  CMS determines that state Medicaid plans meet all applicable federal laws  and regulations.
At the federal level, the Center for Medicaid and State Operations (CMSO)  within CMS is responsible for approving state Medicaid plans, working  with the states on program integrity and other program administration  functions, and overseeing state financial management and internal control  processes.  CMSO shares Medicaid program administration and financial  management responsibilities with the 10 CMS regional offices (RO). The  Division of Financial Management (DFM), within CMSO’s Finance, Systems  and Quality Group, has primary responsibility for Medicaid financial  management.  DFM, in conjunction with the 10 regions, establishes and  maintains the internal control structure for Medicaid financial management  and state oversight.
As is the case for all major federal agency programs, the internal control  structure established by CMS for Medicaid should meet requirements of  Office of Management and Budget (OMB) Circular A-123, Management  Accountability and Control, and the Standards for Internal Control in the  Federal Government.  According to Circular A-123, management controls  are the organization policies and procedures used to reasonably ensure  that programs are protected from waste, fraud, and mismanagement and  achieve their intended results.  Establishing good management controls  requires, according to the circular, that agency managers take systematic  and proactive measures to implement appropriate management controls,  assess the adequacy of the controls, identify needed improvements, and  take corresponding corrective action. The Standards for Internal Control  in the Federal Government includes five standards that provide a roadmap  for agencies to establish control for all aspects of their operations and a  basis against which agencies’ control structures can be evaluated.  The  standards are defined as follows:
Control environment—creating a culture of accountability by  establishing a positive and supportive attitude toward improvement and  the achievement of established program outcomes.
Risk assessment—performing comprehensive reviews and analyses of  program operations to determine if risks exist and the nature and extent  of the risks identified.
Control activities—taking actions to address identified risk areas and  help ensure that management’s decisions and plans are carried out and  program objectives are met.
Information and communication—using and sharing relevant, reliable,  and timely financial and nonfinancial information in managing  operations.
Monitoring—tracking improvement initiatives over time, and identifying  additional actions needed to further improve program efficiency and  effectiveness.
The internal control structure and financial oversight process that CMS has  designed for Medicaid includes activities for  (1) approving and awarding  grants to make funds available to the states for the efficient operation of  the Medicaid program, (2) overseeing state financial management and  internal control processes, (3) ensuring the reasonableness of budgets  reported to estimate federal funding requirements, and (4) ensuring the  propriety of expenditures reported for federal matching funds.  DFM  shares these responsibilities with about 76 regional financial analysts and  branch chiefs, who report to their respective regional administrators.  Figure 1 outlines CMS’s organizational structure related to Medicaid.
Regional financial analysts are key to CMS financial management activities,  as they are responsible for performing frontline activities to oversee state  financial management and internal control processes.  Some of the key  oversight activities performed by regional analysts are (1) reviewing state  quarterly budget estimates and expenditure reports, (2) preparing decision  reports that document approvals for federal reimbursement and  reimbursement deferral actions, (3) providing technical assistance to states  on financial matters, and (4) serving as liaison to the states and audit  entities. DFM staff in headquarters rely on regional decision reports to help  determine and issue state grant awards.
States submit various federal reporting forms that provide regional  financial analysts with the budget and expenditure data to execute their  financial management and oversight responsibilities.  When the State  Children’s Health Insurance Program (SCHIP) was created through the  Balanced Budget Act of 1997 to provide health insurance to children of low- income families who would not qualify for Medicaid, states have been  required to submit expenditure and budget data on both Medicaid and  SCHIP.  The Medicaid and SCHIP forms are submitted quarterly through the  Medicaid and SCHIP Budget and Expenditure System (MBES).  See table 1  below for a brief description of the contents of the reporting forms.
Reviews of the Medicaid and SCHIP expenditure reports (CMS 64 and 21)  are the primary oversight control activities performed by regional financial  analysts.  These reviews are used to determine if Medicaid expenditures  are complete, properly supported by the state’s accounting records,  claimed at appropriate federal matching rates, and allowable in accordance  with existing federal laws and regulations.  Regional analysts are expected  to obtain knowledge about state financial management and internal control  processes to aid in assessing the expenditures reported for federal  reimbursement. Figure 2 shows an overview of the financial management  and oversight process.
Oversight of state expenditures and internal controls by CMS regional  financial analysts is not the only federal oversight mechanism for ensuring  the propriety of Medicaid finances.  Medicaid expenditures and requisite  internal controls are reviewed annually by auditors under requirements of  the Single Audit Act of 1984.  The Congress established the Single Audit Act  to gain reasonable assurance that federal financial assistance programs are  managed in accordance with applicable laws and regulations.  The Single  Audit Act requires audits of state and local government entities that expend  at least $300,000 in federal awards annually. The results of these audits are  provided to the state and responsible federal agency.  The federal agency is  responsible for following up with the state to ensure that the state takes  action to correct the deficiencies identified from the audit.
Other entities have responsibilities for routinely reviewing Medicaid  finances and Medicaid internal controls. Table 2 explains various oversight  activities by entities outside of CMS.
section_title: Objectives, Scope, and Methodology
paragraphs: Our objectives were to determine if (1) CMS has an adequate oversight  process to help ensure the propriety of Medicaid expenditures, (2) CMS  adequately evaluates and monitors the results of its oversight process and  makes adjustments as warranted, and (3) the current CMS organizational  structure for financial management is conducive to effectively directing its  oversight process and sustaining future improvements.
To evaluate CMS financial oversight, the control activities used to help  ensure the propriety of Medicaid expenditures, and CMS’s efforts to  monitor its financial oversight, we performed work at CMS regional and  headquarters offices, surveyed financial management staff, and reviewed  CMS manuals and other documentation, as well as audit reports.
As agreed with your offices, we visited 5 of the 10 CMS regional offices  (Atlanta, Boston, Chicago, New York, and San Francisco) to observe and  interview the financial management staff.  We selected the five regions  based on geographical dispersion across the country and based on the  total amount of Medicaid expenditures processed by each region.  The  five regions were collectively responsible for overseeing more than half  of the total Medicaid expenditures for fiscal year 2000. We discussed  recent program changes, which significantly increased financial  management oversight activities for regional analysts. We questioned  staff about the extent to which certain activities, such as focused  financial management reviews, were conducted and reviewed any  reports and corresponding workpapers that were available.  Key CMS  financial managers at headquarters in Baltimore were also interviewed  to gain a comprehensive understanding of overall financial management  objectives for the Medicaid program.  We also discussed performance  and budget reporting as well as efforts to coordinate with state auditors.
We administered a Web-based survey to regional financial management  members to gain a better understanding of the control activities being  performed by regional offices.  The survey was sent to all regional office  branch chiefs and staff classified as financial analysts who are  responsible for overseeing state financial management and internal  controls for Medicaid. All of the 11 branch chiefs responded and 59 of  the 65 analysts responded, for a 92 percent response rate—the 6  analysts who did not respond were from one regional office.  The  survey obtained information on how oversight for Medicaid financial  management is designed and implemented, as well as the frontline staff  perspective on effectiveness.  Survey respondents answered questions  relating to review procedures performed, use of state single audits,  follow-up of audit findings, and communications with state auditors and  offices of inspectors general. Many of the questions asked the analysts  to respond based on their performance of activities for the period from  October 1, 1999, through the date of the survey. The practical difficulties  in conducting any survey can introduce errors, commonly referred to as  nonsampling errors.  We included steps in both the data collection and  data analysis to minimize such nonsampling errors. Multiple versions of  the questionnaire were pretested with regional financial analysts before  the final survey was administered.  A 92 percent response rate was  achieved, and the respondents directly entered the responses into the  database via the Internet survey.  Data checks were performed and a  second independent analyst reviewed computer analyses.
We obtained and reviewed CMS documents and manuals that described  current financial oversight activities and performance reporting  previously used to monitor oversight.  We reviewed audit reports that  included findings related to Medicaid financial management, including  the CMS/HCFA financial reports for fiscal years 1998 through 2000 and  Single Audit Act reports for fiscal years 1999 and 2000.  To help judge  the adequacy of CMS’s Medicaid financial management oversight  process, we evaluated CMS oversight against the comptroller general’s  Standards for Internal Control in the Federal Government.  We also  consulted with state auditors during our regional site visits to obtain an  understanding of their oversight activities for the Medicaid program,  including the level of audit coverage given to Medicaid financial  operations and the control techniques used.
To determine whether CMS’s organizational structure for financial  management is conducive to effectively directing its oversight process and  sustaining future improvements, we interviewed the director and deputy  director of the CMSO Finance Systems and Quality Group as well as  managers within the Division of Financial Management.  We also  conducted interviews with managers at the five regional offices. In  addition, we compared information that we gathered about the current  organizational structure, regional and central office communications, and  improvement initiatives with the standards for control environment and  information and communication components of internal control as  described in the Standards for Internal Control in the Federal  Government.
We performed our fieldwork from October 2000 through September 2001,  at the CMS central office in Baltimore, Md., and the five regional offices  mentioned above.  We focused on the internal control processes in place  during fiscal years 2000 and 2001.  All work was performed in accordance  with generally accepted government auditing standards.  We requested  written comments on a draft of this report from the administrator of CMS.  These comments are reprinted in appendix I. We also received  supplementary oral comments from the Director of the CMS Division of  Audit Liaison.
section_title: CMS Had Not Implemented a Risk- Based Approach and Effective Control Activities for Financial Oversight
paragraphs: Although CMS is responsible for ensuring the propriety of over $100 billion  expended annually by the federal government for Medicaid, its financial  oversight process did not incorporate key standards for internal control  necessary to reduce the risk of inappropriate expenditures. The  comptroller general’s Standards for Internal Control in the Federal  Government requires that agency managers perform risk assessments and  then take actions to mitigate identified risks that could impede  achievement of agency objectives. However, until recently, the oversight  process that CMS used for Medicaid expenditures did not include  assessments that identified the areas of greatest risk of improper  payments.  Therefore, CMS did not have the requisite assurance that its  control activities were focused on areas of greatest risk.  In addition, the  controls that were in place were not effectively implemented. As a result,  CMS was not deploying its limited oversight resources efficiently and  effectively to detect improper expenditures.  CMS managers recognized the  deficiencies of its oversight and began efforts in April 2001 to develop a  risk-based approach and revise control activities.  However, these efforts  did not specifically consider information on state financial oversight and  program integrity activities such as pre- and postpayment detection  methods, and payment accuracy studies and initiatives to prevent fraud  and abuse, or consider advanced control techniques for detecting improper  Medicaid payments.
subsections: section_title: CMS Did Not Use a Risk- Based Approach in Reviewing Expenditures
paragraphs: Federal internal control standards require managers to perform risk  assessments to identify areas at greatest risk of fraud, waste, abuse, and  mismanagement. The standards require that once risks are identified, they  should be analyzed for their possible effect by estimating their significance  and assessing the likelihood of losses due to the risks identified.  Despite  repeated auditor recommendations, CMS had not developed and  implemented a systematic risk assessment method in its oversight process  to help ensure that states expend federal funds in accordance with laws  and to identify amounts inappropriately claimed for federal  reimbursement.  In April 2001, CMS took action to develop a risk  assessment; however, this analysis has not yet been used to deploy  resources to areas of greatest risk and requires several improvements to  enhance its usefulness in the oversight process.
Since 1998, financial auditors responsible for the annual financial  statement audit of Medicaid expenditures have recommended that CMS  implement a risk-based approach for overseeing state internal control  processes and reviewing expenditures.  In performing audits of CMS’s  financial statements for fiscal years 1998, 1999, and 2000, auditors have  noted that CMS failed to institute an oversight process that effectively  reduced the risk that inappropriate expenditures could be claimed and  paid. In addition, the auditors identified internal control weaknesses that  increased the risk of improper payments.  These weaknesses included (1) a  significant reduction in the level of detailed analysis performed by regional  financial analysts in reviewing state Medicaid expenses, (2) minimal review  of state Medicaid financial information systems, and (3) lack of a  methodology for estimating the range of Medicaid improper payments on a  national level.
CMS Medicaid officials attributed most of the weaknesses identified by the  auditors to reductions in staff resources and the multiple oversight  activities that its staff is responsible for carrying out.  According to  Medicaid financial managers, changes in the Medicaid program since fiscal  year 1998, specifically the addition of  SCHIP, created additional oversight  responsibilities for CMS financial management staff.  Particularly, financial  analysts are required to handle more state inquiries regarding technical  financial issues that must be addressed promptly.  At the same time,  however, financial analyst resources previously devoted to oversight  activities declined. Medicaid financial managers provided us with data to  show that from fiscal year 1992 to September 2000, full-time equivalent  (FTE) positions for regional financial staffs declined by 32 percent from 95  to approximately 65 FTEs.  At the same time, federal Medicaid  expenditures increased 74 percent from $69 billion to $120 billion. On  average, each of the 64 regional financial analysts is now responsible for  reviewing almost $1.9 billion in federal Medicaid expenditures each fiscal  year as compared to an average of about $0.7 billion a decade ago.  Figure 3  depicts the decrease in financial analysts (i.e., FTEs) and the increase in  Medicaid expenditures between the years 1992 and 2000.
Until recently, Medicaid financial managers had not taken action to  implement a risk-based approach for Medicaid financial oversight.  Managers stated that the Medicaid financial oversight process had been  based on the presumption that financial analysts adequately applied the  inherent knowledge of program risks acquired from years of experience in  reviewing state Medicaid expenditures and providing technical assistance  to states in operating their Medicaid programs.  However, as Medicaid  program expenditures have increased, CMS managers acknowledged that  they needed to revise their oversight approach.  As a result, during our  review, CMS began in April 2001 to develop a risk-based approach for  determining how best to deploy its resources in reviewing Medicaid  expenditures.
The Medicaid risk assessment effort required each regional office to  provide data on the states and territories in its jurisdiction based on  regional analyst experience and knowledge.  For each type of Medicaid  service and administrative expense, the Medicaid risk analysis estimates  the likelihood of risk based on the dollar amount expended annually and  measures the significance of risk based on factors such as unclear federal  payment policy, state payment involving county and local government, and  results of federal audits. The risk analysis provides a risk score for each  state that is intended to specify the Medicaid service and administrative  expense categories that are of greatest risk for improper payments in the  state.
Medicaid financial managers also tabulated a national risk score for each  type of Medicaid service and administrative expense using the state risk  scores. However, CMS had not taken steps to use the risk analysis in  deploying its regional financial oversight resources.  Medicaid financial  managers in headquarters and the regional offices plan to develop work  plans that will allocate resources based on the risks identified from its  analysis.  CMS expects to implement these work plans in reviewing the  state’s quarterly expenditure reports for fiscal year 2003.
In evaluating the Medicaid risk analysis, we considered strategies that  leading organizations used in successfully implementing risk management  processes.  Two such strategies, which are included in our executive guide,  Strategies to Manage Improper Payments are as follows.
Information developed from risk assessments should help form the  foundation or basis upon which management can determine the nature  and type of corrective actions needed, and should give management  baseline data for measuring progress in reducing payment inaccuracies  and other errors.
Management should reassess risks on a recurring basis to evaluate the  impact of changing conditions, both external and internal, on program  operations.
While the Medicaid risk analysis is a good start, we identified several  improvements that should be made to the assessment before it is used in  deploying resources.  The issues we identified could hinder the quality of  baseline information gathered and, accordingly, affect management’s  ability to thoroughly reassess risks and measure the impact of corrective  actions on a recurring basis. First, the analysis does not sufficiently take  into account state financial oversight activities in assessing the risks for  improper payments in each state. Regional financial analysts were  instructed to rate the adequacy of each state Medicaid agency’s financial  oversight as one of the risk factors in determining the likelihood and  significance of risk in each state.  The analysts were instructed to consider  whether a state regularly reviews claims submitted by local government  entities that provide Medicaid services and whether state audits were  conducted regularly. However, the analysts were not specifically instructed  to consider states’ use of (1) prepayment edits and reviews to help prevent  improper payments, (2) screening procedures to prevent dishonest  providers from entering the Medicaid program, (3) postpayment reviews to  detect inappropriate payments after the fact, and (4) payment accuracy  studies to measure the extent of improper payments.
Several states have implemented cost-effective prevention efforts to  protect Medicaid program dollars, such as prepayment computer “edits,”  manual reviews of claims before payment, and thoroughly checking the  credentials of individuals applying to be program providers.  Table 3 shows  examples of prepayment reviews currently being used by some states.
Many states have also developed postpayment detection systems and  payment accuracy studies to improve their ability to detect, investigate,  and measure potential improper payments. Kentucky and Washington, for  example, have hired private contractors to develop or use advanced  computer systems to analyze claims payment data that identified several  million dollars in overpayments.  Table 4 describes these and other state  postpayment efforts and related program savings.
While regional financial analysts may know about many activities like these  from performing their oversight responsibilities, analysts or staff in the  Division of Financial Management did not collect and document  information on the nature and results of each state’s financial oversight  activities.  Without such information being documented, CMS did not have  a complete picture or profile of the level of risk for improper payments in  each state and thus did not have comprehensive information to determine  the appropriate level of federal oversight that should be applied.
A second deficiency we found in the Medicaid risk analysis is that it did not  specifically integrate information about state fraud and abuse prevention  efforts in making risk assessments for each state.  Regional financial  analysts were instructed to report on the level of regional oversight of each  state’s Medicaid finances as one of the risk factors in determining the  likelihood and significance of risk in each state. Specifically, analysts were  instructed to consider the last time the regional office or HHS/OIG  conducted a review or audit.  However, the analysts were not specifically  instructed to consider results from reviews of state efforts to prevent fraud  and abuse recently conducted under the CMS Medicaid Alliance for  Program Safeguards.
In 1997, CMS established the Medicaid Alliance for Program Safeguards  staffed with program analysts from the 10 CMS regions and staff within the  Policy Coordination and Planning Group of the Center for Medicaid and  State Operations. The initiative was started to aid states in their program  integrity efforts. Since its inception, a fraud statute Web site has been  established and seminars on innovations and obstacles in safeguarding  Medicaid have been developed.  In fiscal year 2000, regional staff  conducted structured site reviews of program safeguards in eight states,  and in fiscal year 2001 reviews were conducted in another eight states.  Plans are to perform reviews in additional states until all states are  covered.  These reviews examined how state Medicaid agencies identify  and address potential fraud or abuse, whether state agencies are complying  with appropriate laws and regulations—such as how they check to ensure  that only qualified providers participate in the program—and potential  areas for improvement.  CMS would gain valuable information from these  reviews to more accurately assess the level of risk for improper payments  in these 16 states and the appropriate level of federal oversight required.
A third deficiency we found is that the Medicaid risk analysis did not  include mechanisms to ensure that such analysis would be conducted  continuously in directing financial oversight. Agency managers should have  methods in place to revisit risk analysis to determine where risks have  decreased and where new risks have emerged, as identified risks are  addressed and control activities are changed.  As such, risk analysis should  be iterative. Medicaid financial managers had not determined how they  would continuously revise and update their Medicaid risk analysis.
Finally, the Medicaid risk analysis would be strengthened if states were  systematically estimating the level of improper payments in their programs.  Identifying the dollar amount of improper payments is a critical step in  determining where the greatest problems exist and the most cost-beneficial  approach to addressing the problems.  CMS management has recognized  this and has begun efforts to develop an approach for estimating improper  Medicaid payments.  In September 2001, nine states responded to a CMS  solicitation to participate in pilot studies to develop payment accuracy  measurement methodologies. The objective is to assess whether it is  feasible to develop a single methodology that could be used by the diverse  state Medicaid programs and to explore the feasibility of estimating the  range of improper Medicaid payments on a national level. Each of the nine  states involved is developing a different measurement methodology.  CMS  has assigned a senior Medicaid manager with responsibility for directing  this effort.  According to this manager, CMS has hired a consultant  experienced in program integrity reviews to oversee the state pilots.  CMS  managers expect the states to complete the pilots during fiscal year 2003,  after which time the consultant and the Medicaid manager plan to select  several of the state methodologies as test cases for fiscal year 2004. It is  important that CMS continues to place emphasis on development of these  payment accuracy reviews on a state-by-state basis and ultimately on a  national level, since this is a key baseline measure for managing improper  payments in the Medicaid program.
section_title: Control Activities Were Not Effectively Implemented
paragraphs: The comptroller general’s Standards for Internal Control in the Federal  Government states that managers must establish adequate control  activities to address identified risks and ensure that program objectives are  met.  Internal control activities are the policies, procedures, techniques,  and mechanisms that help ensure that management’s directives to mitigate  risk are carried out.  Control activities are an integral part of an  organization’s efforts to address risks that lead to fraud and error.  For the  Medicaid program, both the states and federal government share  responsibility for ensuring that adequate control activities are in place. The  control activities that CMS had in place to oversee state internal controls  and help ensure the propriety of Medicaid expenditures were not  effectively implemented. Given the current level of resources and the size  and complexity of the program, a different approach is needed that  incorporates new oversight techniques and strategies, as well as the results  of the risk assessment discussed previously.
CMS regional financial analysts are tasked with performing multiple  control activities designed to (1) oversee state financial management and  internal control processes, (2) help ensure that states expend federal funds  in accordance with laws, and (3) identify amounts inappropriately claimed  for federal reimbursement.  These activities include providing technical  assistance to states on a variety of financial issues to help improve state  accountability and help prevent payment inaccuracies as well as examining  state expenditures to defer improperly supported payments and disallow  those payments that do not comply with Medicaid regulations.  Analysts  also are responsible for following up on and resolving findings from audits  related to improper or questionable payments and weaknesses in state  internal controls.  Table 5 summarizes the control activities that regional  analysts are responsible for carrying out.
As Medicaid expenditures have grown and resources devoted to Medicaid  financial oversight have decreased, regional financial analysts have faced  significant challenges in monitoring state internal controls, providing  technical assistance, scrutinizing expenditures, and following up on audit  findings for all state Medicaid programs.  In an attempt to address these  challenges, in 1994 regional offices began refocusing oversight activities  from emphasizing detailed review of Medicaid expenditure data to  increasing the level of technical assistance provided to states.  However,  auditors of CMS financial statements found that, as a result, regional  offices were not providing appropriate review and oversight of state  Medicaid programs.  As mentioned previously, auditors have reported since  1998 that regional offices significantly reduced or inconsistently performed  control activities to detect potential errors and irregularities in state  expenditures, thus increasing the risk that errors and misappropriation  could occur and go undetected.  In our review, we found that these  weaknesses were still present.
In August 2001, we conducted a survey of regional financial analysts to  obtain their perspectives on the design and implementation of the Medicaid  financial oversight process, covering the period from October 1, 1999,  through the date of the survey.  In comments to the survey, some regional  analysts indicated that they were inundated with responsibility for multiple  control activities and unable to perform them effectively.  Our survey asked  the analysts to rate each of the control activities that they perform in terms  of how important they believe the activity is in overseeing state Medicaid  programs. The activity rated most important was quarterly expenditure  reviews performed on-site at state Medicaid agencies; 89 percent rated the  activity as having the “highest” or “high” level of importance—83 percent  “highest” and 6 percent  “high.”  However, when asked about the adequacy  in which they performed on-site expenditure reviews, almost 36 percent  rated the adequacy of their performance “inadequate” or “marginal”—13  percent inadequate and 23 percent marginal.  In discussions with regional  financial analysts during our site visits and in comments to our survey,  many financial analysts attributed deficiencies in quarterly reviews to  inadequate staff resources, the low priority placed on financial  management oversight, lack of training, and conflicting priorities.
During our site visits we interviewed 11 regional financial analysts  responsible for overseeing the five states that accounted for over  $70 billion in Medicaid expenditures in fiscal year 2000. We reviewed these  analysts’ workpapers related to their review of quarterly expenditure  reports submitted for the quarter ended December 31, 2000. Workpapers  prepared for three of the states to document their reviews did not contain  sufficient evidence that expenditures had been traced to original  documents.  Instead, the analysts had checked information against  summary schedules prepared by the states. Without proper documentation,  there is little assurance that these reviews are being adequately performed.
Survey respondents also rated activities to (1) defer and disallow Medicaid  expenditures and (2) perform in-depth analysis of specific Medicaid costs  where problems have been found (i.e., focused financial management  reviews) as important in overseeing the propriety of Medicaid  expenditures.  Some 89 percent of analysts rated deferral and disallowance  determinations as having “highest” or “high” level of importance and  focused financial management reviews were rated by 77 percent as  “highest” or “high.” Data provided by CMS indicate, however, that the  amount of Medicaid expenditures disallowed by regional analysts has  declined in years after 1996, when oversight emphasis shifted from detailed  reviews, and so did the number of focused financial management reviews  conducted each year.  For example, from 1990 through 1993, analysts  disallowed on average $239 million annually in expenditures reported by  states for federal reimbursement.  However, from fiscal years 1997 through  2000, analysts disallowed on average about $43 million annually, which  represents an 82 percent decline from previous years.  Also, during these  periods, Medicaid expenditures went from an average of $58 billion  annually to $106 billion annually—an increase of 83 percent.
Similarly, focused financial management reviews have declined.  Focused  financial management reviews generally involve selecting a sample of paid  claims for review related to certain types of Medicaid services provided.  These reviews have been useful in identifying unallowable costs outside of  those detected through the review of quarterly expenditure reports as well  as deficiencies in states’ financial management policies. According to CMS  managers, in fiscal year 1992, analysts performed approximately 90 in- depth reviews of specific Medicaid issues that identified approximately  $216 million in unallowable Medicaid costs.  In fiscal year 2000, analysts  only performed eight focused financial management reviews, but these  reviews resulted in almost $45 million in disallowed costs—an average of  about $5.6 million per review.  As demonstrated, this control activity is  effective in detecting unallowable Medicaid costs; however, it must be  consistently performed for cost savings to be discovered.
According to the director of DFM, the division is taking actions to improve  oversight by beginning a comprehensive assessment of CMS’s Medicaid  oversight activities.  The division would like to increase several oversight  activities, such as focused financial management reviews, to address the  risks identified in CMS’s new risk-based approach.  However, Medicaid  financial managers are concerned that efforts to effectively address  identified risks may be hindered without additional oversight resources.  In  the interim, CMS plans to use the current oversight process (i.e., quarterly  expenditure reviews and technical assistance) for targeting those Medicaid  issues that the new risk analysis identifies.
In assessing what steps CMS could take to more efficiently and effectively  carry out its responsibility on the federal level for helping ensure the  propriety of Medicaid finances, we considered strategies that other entities  have used in successfully addressing risks that lead to fraud, error, or  improper payments.  As discussed in our executive guide on strategies to  manage improper payments, key strategies include taking action to select appropriate control activities based on an analysis of the specific  risks facing the organization, taking into consideration the nature of the  organization and the environment in which it operates; perform a cost-benefit analysis of potential control activities before  implementation to ensure that the cost of the activities is not greater  than the benefit; and contract out activities to firms that specialize in specific areas like  neural networking, where in-house expertise is not available.
Our executive guide points out that many organizations have implemented  control techniques, including data mining, data sharing, and neural  networking, to address identified risk areas and help ensure that program  objectives are met. These techniques could help CMS better utilize its  limited resources in applying effective oversight of Medicaid finances at the  federal level.
Some state Medicaid agencies have already implemented data mining, data  sharing, and neural networking techniques to carry out their  responsibilities on the state level for ensuring Medicaid program integrity.
State auditors and HHS/OIG staff have also had success using these  techniques in overseeing state Medicaid programs.  However, resources  devoted to protecting Medicaid program integrity and the use of these  techniques varies significantly by state.  From a federal standpoint, CMS  should take into consideration the control activities performed at the state  level in designing its Medicaid financial oversight control activities. CMS  should use the results from states that are already using data mining, data  sharing, and neural networking techniques in determining the extent and  type of control techniques that its regional financial analysts should use in  overseeing each state.  And, for states where these techniques are not being  used, CMS should consider using these tools in its oversight process.
As illustrated in the following examples, data mining, data sharing, and  neural networking techniques have been shown to achieve significant  savings by identifying and detecting improper payments that have been  made.
Data mining is a technique in which relationships among data are  analyzed to discover new patterns, associations, or sequences.  The  incidence of improper payments among Medicaid claims can, if  sufficiently analyzed and related to other Medicaid data, reveal a  correlation with a particular health care provider or providers.  Using  data mining software, the Illinois Department of Public Aid, in  partnership with HHS/OIG, identified 232 hospital transfers that may  have been miscoded as discharges, creating a potential overpayment of  $1.7 million.
Data sharing allows entities to compare information from different  sources to help ensure that Medicaid expenditures are appropriate.  Data sharing is particularly useful in confirming the initial or continuing  eligibility of participants and in identifying improper payments that have  already been made.  We recently reported on a data sharing project  called the Public Assistance Reporting Information System interstate  match (PARIS) that has identified millions of dollars in costs savings for  states. PARIS helps states share information on public assistance  programs, such as Food Stamps and eligibility data for Medicaid, to  identify individuals who may be receiving benefits in more than one  state simultaneously.  Using the PARIS data match for the first time in  1997, Maryland identified numerous individuals who no longer lived in  the state but on whose behalf the state was continuing to pay a Medicaid  managed care organization (MCO) as part of the MCO’s prospective  monthly payment.  The match identified $7.3 million in savings for the  Medicaid program.
Neural networking is a technique used to extract and analyze data.  A  neural network is intended to simulate the way a brain processes  information, learns, and remembers.  For example, this technique can  help identify perpetrators of both known and unknown fraud schemes  through the analysis of utilization trends, patterns, and complex  interrelationships in the data.  In 1997, the Texas legislature mandated  the use of neural networks in the Medicaid program.  Large volumes of  medical claims and patient and provider history data are examined  using neural network technology to identify fraudulent patterns.  The  Texas Medicaid Fraud and Abuse Detection System used neural  networking to recover $3.4 million in fiscal year 2000.
Based on consultations with state auditors, we noted that some auditors  are performing audits that incorporate the advanced oversight techniques  described above.  New York and Texas are instituting data sharing and  matching techniques at the state level to confirm initial eligibility of  Medicaid participants and to identify improper payments that have already  been made.  Texas is using private contractors to design, develop, install,  and train staff to use a system intended to integrate detection and  investigation capabilities.  This system includes a neural network that will  allow the state to uncover potentially problematic payment patterns.
Similarly, a large portion of the audit work that the HHS/OIG conducts to  oversee the Medicaid expenditures for Massachusetts, Ohio, and Maine is  conducted through electronic data matches of Medicaid claims data  contained in the Medicaid Statistical Information System (MSIS). MSIS is  the primary source of Medicaid program statistical information. As of the  date of our report, 47 states were submitting Medicaid data electronically  to MSIS.  Information that the HHS/OIG finds as a result of electronic data  matches is subsequently made available to regions and states for additional  detailed work.
CMS managers acknowledge that systems like MSIS could provide them  with the capabilities to implement more advanced control techniques.  While implementing control techniques such as data sharing, data mining,  and neural networking may require up-front investment of resources, use  of these techniques has the potential to result in significant savings to the  Medicaid program.
section_title: Monitoring Activities Were Limited in Scope and Effectiveness
paragraphs: Having mechanisms in place to monitor the quality of an agency’s  performance in carrying out program activities over time is critical to  program management. The federal internal control standard for monitoring  requires that agency managers implement monitoring activities to  continuously assess the effectiveness of control activities put in place to  address identified risks.  Monitoring activities should include procedures to  ensure that findings from all audits are reviewed and promptly resolved.  The standards also state that pertinent information should be recorded and  communicated to managers and staff promptly, to allow effective  monitoring of events and activities as well as to allow prompt reactions.  However, CMS had few mechanisms in place to continuously monitor the  effectiveness of its control activities in overseeing the Medicaid program  and collected limited information on the quality of Medicaid financial  oversight performance.  Specifically, CMS had not established performance  standards to measure the effectiveness of its control activities, in particular  its expenditure review activity. In addition, the CMS audit resolution  process did not ensure that audit findings were resolved promptly and did  not collect sufficient information on the status of audit findings. Without  effective monitoring, CMS did not have the information needed to help  assure the propriety of Medicaid expenditures.
subsections: section_title: Few Steps Were Taken to Monitor Performance
paragraphs: DFM financial managers responsible for monitoring the effectiveness of  Medicaid internal control processes had established few mechanisms to do  so. CMS did not establish performance standards and did not analyze or  compare trend information on the results of its control activities, including  the amount and type of Medicaid expenditures deferred and disallowed by  regional analysts across all 10 regions.
Medicaid financial managers told us that, before 1993, CMS collected  information to monitor the performance of its oversight process.  The  performance reporting process required each region to submit quarterly  data on the amount of expenditures disallowed; the number of focused financial management reviews conducted, and  the related expenditures identified and recovered as a result of the  reviews; the amount of inappropriate expenditures averted by providing  technical assistance to states before payment; the number of regional financial analysts and related salary costs  devoted to financial oversight; and the amount of travel dollars devoted to Medicaid financial oversight.
Medicaid financial managers in DFM used this information to prepare  national performance reports that calculated a return on investment for  each region and a national return on investment.  CMS managers said that  they discontinued efforts to collect, analyze, and maintain performance  data after 1993 because of staff reductions in the regions and headquarters.
DFM managers currently collect some performance information, but it is  not used to evaluate regional performance.  For example, staff in DFM  collect information on the amount of expenditures deferred and disallowed  each quarter by each region. These data are used to adjust total  expenditures for financial reporting purposes but not to assess regional  oversight activities. DFM also maintains a spreadsheet that includes  information on the types of expenditures disallowed.  This information is  not distributed to regional analysts.  In addition, information on the types  of expenditures deferred by each regional analyst is not consolidated and  disseminated across regions.  Regional analysts include the types of  expenditures deferred in their own regional decision reports, but do not  have the benefit of nationwide information because DFM does not prepare  summary reports.  Comprehensive information on the type of expenditures  deferred and disallowed would help identify the types of Medicaid  expenditures for which improper payments commonly occur and measure  whether corrective actions or control techniques applied to certain  Medicaid expenditures are effective in reducing improper payments.
The director of DFM told us that steps would be taken within the next year  to begin monitoring the effectiveness of the Medicaid financial oversight  process.  Medicaid financial managers plan to reinstitute the performance  reporting process that was in place prior to 1993.  While this is a good step,  the previous performance reporting process lacked several elements  necessary for effective internal control monitoring. For example, the  performance reporting process did not establish agency-specific goals and  measures for evaluating regional performance in reducing payment errors  and inaccuracies. In addition, there were no formal criteria or standard  estimation methodologies for regions to use in measuring the amount of  unallowable costs that the states avoided because of technical assistance  provided before payment.  As discussed in our executive guide, Strategies  to Manage Improper Payments, establishing such goals and measures is  key to tracking the success of improvement initiatives.
section_title: Audit Resolution Activities Are Not Effective
paragraphs: Standards for Internal Control in the Federal Government requires that  agencies’ internal control monitoring activities include policies and  procedures to ensure that audit and review findings are promptly resolved.  According to the standards, agency managers should implement policies  and procedures for reporting findings to the appropriate level of  management, evaluating the findings, and ensuring that corrective actions  are taken promptly in response to the findings. In our review, we found that  the audit resolution and monitoring activities performed by CMS and its  regional offices were limited.  In addition, we found that audit resolution  activities were inconsistently performed across regions. Further, pertinent  information was not identified, documented, and distributed among those  responsible for audit resolution.  These conditions hamper CMS’s ability to  resolve audit findings promptly and slow the recovery of millions of dollars  in federal funds due from the states.
Within CMS, three units share responsibility for audit resolution activities  related to the Medicaid program.  These are regional administrators and  regional financial analysts, the Division of Audit Liaison (DAL), and DFM.
Regional administrators and regional financial analysts have responsibility  to perform the following audit resolution activities required by the HHS  Grants Administration Manual: coordinate resolution of findings with the pertinent auditee (i.e., state  Medicaid agency or providers); ensure that the related questioned costs due the federal government are  recovered within established timeframes; verify that corrective actions have been developed and implemented for prepare quarterly reports documenting the status of audit resolution.
DAL is responsible for maintaining a tracking system for each audit report  and related findings, monitoring the timeliness and adequacy of audit  resolution activities, distributing all audit clearance documents, and  preparing monthly reports on the status of audit resolution and collection  activities. DFM has one headquarters staff person responsible for  coordinating and interacting with DAL and regional analysts to ensure that  Medicaid related findings are resolved.
An important part of regional analyst audit resolution activities involves  following up on state Single Audit Act reports.  Under the Single Audit Act,  state auditors issue reports that include assessments of the internal  controls related to major federal programs, including the Medicaid  program, and compliance with laws, regulations, and provisions of contract  or grant agreements. These reports generally include findings related to  weaknesses identified in the financial management of state Medicaid  programs as well as expenditures deemed erroneous or improper (e.g.,  questioned costs) for which states may owe money back to the federal  government.
Regional analysts are responsible for resolving audit findings, including  determining whether the questioned costs related to audit findings  reported by state auditors represent actual costs to be recovered from the  state, and ensuring that they are actually recovered.  In our discussions  with regional staff during our review of state single audit findings, analysts  admitted that they spend very little time on resolving state audit findings  due to competing oversight responsibilities.  Audit follow-up is one step of  many performed during their quarterly state Medicaid expenditure reviews.  As a result, state single audit findings are not always resolved, and related  questioned costs are not promptly recovered.
For example, we identified questioned costs totaling $24 million that had  not been recovered. The audit reports that included the $24 million in  questioned costs had been issued for years prior to fiscal year 1999.  However, as of September 30, 2001, regional analysts had not completed  actions to recover these costs.
In addition, we found that, as of September 30, 2001, regional analysts had  not determined whether corrective actions had been developed and/or  implemented to resolve 85 of a total of 288 Medicaid findings included in  state single audit reports for fiscal year 1999.  These findings related to  problems with state financial reporting, computer systems, and cash  management.  Lack of timely follow-up on financial management and  internal control issues increases the risk that corrective actions have not  been taken by the auditee and erroneous or improper payments are  continuing to be made.
In our review, we also found that the regional financial analysts  inconsistently followed procedures for monitoring, tracking, and reporting  on the resolution of Single Audit Act and HHS/OIG audit findings.  For  example, 3 of the 10 regions had not prepared quarterly status reports that  are intended to provide information on corrective actions that states have  taken to resolve audit findings.
Further, pertinent information was not identified, documented, and  distributed among those responsible for audit resolution. The internal  control standard related to information and communication provides that  pertinent information be identified, captured, and distributed to the  appropriate areas in sufficient detail and at the appropriate time to enable  the entity to carry out its duties and responsibilities efficiently and  effectively.
In our review, we found that the monthly report prepared by DAL that is  intended to provide a complete list of all audits with unresolved Medicaid  findings did not meet this standard. We analyzed a list provided by the  HHS/OIG, which included 23 Medicaid related reports issued by the  HHS/OIG and state auditors in fiscal year 2001.  We found four reports from  the HHS/OIG list that were not included in DAL monthly reports related to  the second, third, and fourth quarters of that year. This information is  critical and must be distributed to the regions to ensure that they are taking  action to resolve all Medicaid related findings.
We also found that the regions did not document information critical to  tracking unresolved audits in their regional quarterly status reports.  The  regions reported which audits had been resolved.  They did not report  information on audits that they were reviewing that had not yet been  resolved.  This makes it difficult to track audit status.
section_title: Organizational Structure Impedes Effective Oversight
paragraphs: A sound organizational structure is a key factor that contributes to whether  agency management can establish a positive control environment.  Standards for Internal Control in the Federal Government provides that  managers should ensure that an agency organizational structure is  appropriate for the nature of its operations and designed so that authority  and internal control responsibility is defined and well understood.  Although CMS’s 10 regional offices are the federal government’s frontline  for overseeing state Medicaid financial operations and expenditures, there  are no reporting lines to the headquarters unit responsible for Medicaid  financial management and few other mechanisms to ensure performance  accountability.  This structural relationship has created challenges in  (1) establishing and enforcing minimum standards for performing financial  oversight activities, (2) routinely evaluating the regional office oversight,  and (3) implementing efforts to improve financial oversight. As a result,  CMS lacks a consistent approach to monitor and improve performance  among the units that share responsibility for financial management and  ingrain a sound internal control environment for Medicaid finances  throughout CMS.
subsections: section_title: Many Oversight Weaknesses Are a Result of Current Structure
paragraphs: During the time of our review, there were no formal reporting relationships  between the regional financial analysts and CMSO’s DFM or any other  division or unit within CMSO.  Regional offices reported directly to the  CMS administrator through their respective regional administrators.  This  structural relationship does not lend itself to instituting standards for  oversight control activities that can be consistently and effectively  implemented.
To illustrate, the CMS financial management strategy workgroup, headed  by the director of DFM, updated guidance for expenditure reviews in  September 2000 to provide uniform review procedures and address  concerns raised by auditors about the inconsistency in expenditure reviews  across regions.  While the guide strongly encouraged regional analysts to  complete all of its procedures, it did not mandate that analysts do so.  Headquarters financial managers do not have direct authority to enforce  such a directive and regional managers have discretion in how resources  are utilized.  Similarly, the guide allowed regional branch managers wide  discretion in performing supervisory review of regional analysts’  expenditure review workpapers. The guide provides that a supervisor can  assure that the analysts’ work measures up to CMS requirements in the  review guide by either directly and selectively reviewing the work papers  or by obtaining written or verbal assurance from the reviewer that the  procedures have been completed.  Supervisory reviews are a key internal  control activity.  By allowing supervisors to satisfy this responsibility  merely with verbal assurance, CMS is minimizing the effectiveness of this  basic control. During our site visits, we found evidence that supervisory  reviews were not conducted.  We reviewed regional analysts’ workpapers  related to reviews of quarterly expenditure reports for five states submitted  for the quarter ended December 31, 2000.  These five states represent the  largest states within the regions visited.  Analysts’ workpapers for three of  the five state quarterly expenditure reviews had no evidence of supervisory  “sign off” and, when asked if the supervisors had reviewed the workpapers  or discussed the results of the review, the analysts said they had not.
The CMS organizational structure also hindered efforts to evaluate and  monitor regional office performance. Currently, there are few formal  requirements for regions to report to headquarters and CMS does not  collect, analyze, or evaluate consistent information on the quality of  regional financial oversight for Medicaid across the country.  As mentioned  previously, efforts to monitor performance were discontinued because  regional staff resources were not available to collect and submit the data to  headquarters managers. Headquarters managers did not have the authority  to require regions to collect such data.  As a result, Medicaid financial  managers in headquarters were not in a position to provide formal  feedback to region financial management staff to improve their  performance and therefore have not been in a position to assess the  effectiveness of Medicaid oversight activities.
The current organizational structure also poses challenges to implementing  corrective actions aimed at addressing oversight weaknesses and  improving accountability. Over the past 2 years, headquarters financial  managers have taken steps to develop and implement improvements to the  financial oversight process.  As previously mentioned, Medicaid staff are  currently developing risk analysis to identify expenditures of greatest risk, working with states to develop methodologies for estimating Medicaid developing work plans that guide efforts to allocate financial oversight  staff and travel resources based on the risk analysis, and developing performance-reporting mechanisms.
Medicaid staff have also recently formed a financial management strategy workgroup of headquarters and  regional financial management staff members to review the entire  Medicaid financial oversight process and determine the proper structure  for an adequate oversight process, updated its expenditure and budget review guides, and gathered information on how regional financial analyst staff time is  allocated between oversight responsibilities.
Headquarters DFM managers recognize that regional office commitment is  critical to successfully implementing and sustaining its improvement  initiatives.  The current structural relationship could diminish the chances  of such success. Headquarters managers expressed concern that despite  recent efforts to develop risk analysis and implement work plans that  allocate resources based on identified risks, regional managers will still  have the authority to decide how oversight resources are used.  Given the  multiple oversight activities that regional financial analysts are responsible  for, headquarters managers have no assurance that review areas included  in the work plans will be given priority in each region.  Headquarters  managers may experience similar difficulties in reestablishing performance  reporting.  According to one senior Medicaid manager, some regions have  already petitioned headquarters managers not to use data on the amount of  expenditures deferred and disallowed in gauging performance.
During our review, we asked regional financial analysts about several  recent improvement initiatives to gauge their knowledge of and  participation in such initiatives.  Several analysts we spoke with during site  visits did not think the risk assessment effort was useful because they felt  that they were already aware of the risks within the states that they were  responsible for and did not need a formal assessment to identify the risks.  In addition, some said that they resented the headquarters managers trying  to tell them where they needed to focus their efforts.  In our survey, we  asked regional financial analysts to rate the importance of the risk  assessment, staff time allocation effort, and review guide updates to overall  financial oversight.  Approximately 50 percent of survey respondents  thought the initiatives were of marginal or little importance. During  pretests of our survey, several analysts said they did not understand the  purpose of the initiatives, even though they had provided input.  According  to the analysts, no one had communicated to them how the information  was going to be used.
In discussions with headquarters managers, they acknowledged that a  written plan or strategy, which describes the initiatives and the  responsibility for implementing them, is currently being drafted.  Such a  plan or strategy could be very useful in soliciting regional analyst support.  More important, headquarters managers acknowledged that performance  accountability mechanisms for the regions are needed to implement  improvements successfully.  CMS is currently planning some changes that  may improve mechanisms to hold CMS financial managers, including  regional managers and administrators, accountable for critical tasks.  A  Restructuring and Management Plan recently developed by the CMS chief  operating officer seeks to add specific responsibilities that are tied to  specific agency goals into senior managers’ performance agreements. CMS  has not determined how Medicaid financial management oversight and the  various aspects of oversight responsibilities that can be evaluated will be  included in the plan.  Inclusion of such information is key to establishing a  sound internal control environment for Medicaid finances throughout CMS.
section_title: Conclusion
paragraphs: While CMS is taking steps to improve its financial oversight of the Medicaid  program, the increasing size and complexity of the program, coupled with  diminishing oversight resources, requires a new approach to address these  challenges.  Developing baseline information on Medicaid issues at greatest  risk for improper payments and measuring improvements in program  management against that baseline are key to achieving effective financial  oversight.  Determining the level of state activities to monitor and control  Medicaid finances is also critical to CMS determining the extent and type of  control techniques as well as the amount of resources it must apply at the  federal level to adequately oversee the program.  Establishing clear lines of  authority and performance standards for CMS oversight would also provide  for a more efficient, effective, and accountable Medicaid program. CMS’s  ability to make the kind of changes that are needed will require top-level  management commitment, a comprehensive financial oversight strategy  that is clearly communicated to all those responsible for program  oversight, and clear expectations for implementation of the changes.
Recommendations for 	 To strengthen Medicaid internal controls and the financial oversight  Executive Action  process that CMS has in place to ensure the propriety of Medicaid finances, we make the following recommendations to the CMS administrator.
subsections: section_title: Risk Assessment
paragraphs: We recommend that the CMS administrator revise current risk assessment  efforts in order to more effectively and efficiently target oversight  resources towards areas most vulnerable to improper payments by collecting, summarizing, and incorporating profiles of state financial  oversight activities, that include information on state prepayment edits,  provider screening procedures, postpayment detection efforts, and  payment accuracy studies;  incorporating information from reviews of state initiatives to prevent  Medicaid fraud and abuse; developing and instituting feedback mechanisms to make risk  assessment a continuous process and to measure whether risks have  changed as a result of corrective actions taken to address them; and completing efforts to develop an approach to payment accuracy reviews  at the state and national levels.
section_title: Financial Oversight Control Activities
paragraphs: In addition, we recommend that the CMS administrator restructure  oversight control activities by  increasing in-depth oversight of areas of higher risk as identified from  the risk assessment efforts and applying fewer resources to lower risk  areas;  incorporating advanced control techniques, such as data mining, data  sharing, and neural networking, where practical to detect potential  improper payments; and using comprehensive Medicaid payment data that states must provide in  the legislatively mandated national MSIS database.
section_title: Monitoring Performance
paragraphs: We also recommend that the CMS administrator develop mechanisms to  routinely monitor, measure, and evaluate the quality and effectiveness of  financial oversight, including audit resolution, by collecting, analyzing, and comparing trend information on the results of  oversight control activities particularly deferral and disallowance  determinations, focused financial reviews, and technical assistance; using the information collected above to assess overall quality of  financial management oversight;  identifying standard reporting formats that can be used consistently  across regions for tracking open audit findings and reporting on the  status of corrective actions; and revising DAL audit tracking reports to ensure that all audits with  Medicaid related findings are identified and promptly reported to the  regions for timely resolution.
section_title: Organizational Structure
paragraphs: Finally, we recommend that the CMS administrator establish mechanisms  to help ensure accountability and clarify authority and internal control  responsibility between regional office and headquarters financial managers  by  including specific Medicaid financial oversight performance standards  in senior managers’ performance agreements; and developing a written plan and strategy, which clearly defines and  communicates the goals of Medicaid financial oversight and  responsibilities for implementing and sustaining improvements.
section_title: Agency Comments and Our Evaluation
paragraphs: CMS provided written comments on a draft of this report (reprinted in app.  I), as well as supplementary oral comments.  In its written comments, CMS  outlined a series of actions it has begun to take to address its Medicaid  financial management challenges. In supplementary oral comments, CMS  disagreed with our recommendations related to its audit tracking and  resolution reports.
In outlining actions taken to address Medicaid financial management  challenges, CMS stated that its efforts substantially address, within current  resource constraints, the four areas of our recommendations.  CMS  improvement efforts include (1) a structured financial workplan process  that has been incorporated into its formal Restructuring and Management  Plan, (2) actions to strengthen exchange of information with state  oversight agencies, and (3) pilot projects aimed at clarifying authority and  internal control responsibility between regional and headquarters  managers.  As many of these efforts are in the planning or early  implementation stages, it is too soon to conclude whether they will  effectively address our recommendations and improve Medicaid financial  management.  Additionally, given CMS concerns about resource  constraints, prioritizing the planned actions and developing projected  implementation schedules is key to ensuring that progress is made toward  improving Medicaid financial management.
In oral comments, CMS disagreed with our recommendations for  strengthening its audit tracking and resolution functions.  Regarding our  recommendation to standardize the audit tracking reports among CMS  regions, CMS stated that although the current format of audit tracking  reports is not consistent across regions, the reports provide agency  management with sufficient information to ensure that audit findings are  resolved in a timely manner.  We disagree.  As stated in our report, the  current reporting formats did not provide CMS with sufficient information  to determine whether action had been taken to recover approximately  $24 million in questioned costs identified in audit reports more than 2 years  ago.
Regarding our recommendation to revise its audit tracking reports, CMS  stated that the reports are as complete as they can be given the information  that they receive from the HHS-OIG.  CMS offered a number of reasons for  lack of complete data.  CMS stated that the HHS-OIG does not consistently  provide timely copies of Medicaid audit reports or make audit reports  available on-line in a timely manner.  Further, CMS said that the reports do  not contain the information it needs to enter the report and related findings  into the CMS tracking system properly, such as audit findings categorized  by type (i.e., questioned cost or management related).
HHS/OIG officials acknowledged that they sometimes fail to send some  audit reports that CMS is responsible for tracking and resolving but said  that they attempt to provide reports promptly when CMS contacts them.  In  our view, CMS and the HHS-OIG share responsibility in audit resolution.  Accordingly, we continue to believe that CMS needs to be proactive in  ensuring its tracking mechanisms promptly identify Medicaid findings for  resolution and in following up to ensure that actions are taken to prevent  Medicaid financial management weaknesses from continuing.
As agreed with your office, unless you publicly announce the contents of  this report earlier, we plan no further distribution until 30 days from its  date.  At that time, we will send copies to the chairmen and ranking  minority members of the Senate Committee on Governmental Affairs and  House Committee on Government Reform.  We are also sending copies of  this report to the secretary of health and human services, administrator of  CMS, inspector general of HHS, and other interested parties. Copies will  also be made available to those who request them.
Please contact me or Kimberly Brooks at (202) 512-9508 if you or your staff  have any questions about this report or need additional information. W. Ed  Brown, Lisa Crye, Carolyn Frye, Chanetta Reed, Vera Seekins, Taya Tasse,  and Cynthia Teddleton made key contributions to this report.
section_title: Related GAO Products
paragraphs: Strategies to Manage Improper Payments:  Learning From Public and  Private Sector Organizations (GAO-02-69G, Oct. 2001).
Public Assistance:  PARIS Project Can Help States Reduce Improper  Benefit Payments (GAO-01-935, Sept. 2001).
Internal Control Management and Evaluation Tool (GAO-01-1008G, Aug.  2001).
Medicaid:  State Efforts to Control Improper Payments Vary (GAO-01-662,  June 2001).
Medicaid in Schools:  Improper Payments Demand Improvements in  HCFA Oversight (GAO/HEHS/OSI-00-69, Apr. 2000).
Standards for Internal Control in the Federal Government (GAO/AIMD- 00-21.3.1, Nov. 1999).
Medicaid Enrollment:  Amid Declines, State Efforts to Ensure Coverage  After Welfare Reform Vary (GAO/HEHS-99-163, Sept. 1999).
subsections: section_title: GAO’s Mission
paragraphs: The General Accounting Office, the investigative arm of Congress, exists to  support Congress in meeting its constitutional responsibilities and to help improve  the performance and accountability of the federal government for the American  people. GAO examines the use of public funds; evaluates federal programs and  policies; and provides analyses, recommendations, and other assistance to help  Congress make informed oversight, policy, and funding decisions. GAO’s  commitment to good government is reflected in its core values of accountability,  integrity, and reliability.
section_title: Obtaining Copies of GAO Reports and Testimony
paragraphs: The fastest and easiest way to obtain copies of GAO documents is through the  Internet. GAO’s Web site (www.gao.gov) contains abstracts and full-text files of  current reports and testimony and an expanding archive of older products. The  Web site features a search engine to help you locate documents using key words  and phrases. You can print these documents in their entirety, including charts and  other graphics.
Each day, GAO issues a list of newly released reports, testimony, and  correspondence. GAO posts this list, known as “Today’s Reports,” on its Web site  daily. The list contains links to the full-text document files. To have GAO E-mail  this list to you every afternoon, go to www.gao.gov and select “Subscribe to daily  e-mail alert for newly released products” under the GAO Reports heading.
subsections: section_title: Order by Mail or Phone
section_title: Visit GAO’s Document Distribution Center
section_title: To Report Fraud, Waste, and Abuse in Federal Programs
paragraphs: Web site: www.gao.gov/fraudnet/fraudnet.htm, E-mail: fraudnet@gao.gov, or 1-800-424-5454 or (202) 512-7470 (automated answering system).
section_title: Public Affairs