Patient Protection and Affordable Care Act: Procedures for Reporting Certain Financial Management Information Should Be Improved
Released: 2014-09-22T00:00:00

Letter

Background

HHS is one of several federal agencies collectively responsible for implementing the provisions of PPACA related to private health insurance and health insurance exchanges. Within HHS, CMS is the primary component responsible for PPACA implementation. In 2011, CMS created CCIIO, one of six centers under CMS, to oversee implementation of PPACA’s private health insurance and health insurance exchange provisions. PPACA provided much of the funding used by CMS to implement the CCIIO-related private health insurance and health insurance exchange provisions it contains. Most such funding provided by PPACA is dedicated to funding these CCIIO-related provisions and cannot be used for any other CMS activities. However, CMS also used funding provided by other legislation that was not specifically dedicated to the private health insurance and health insurance exchange provisions of PPACA and thus was also available to fund other CMS activities. This includes CMS’s annual Program Management appropriation, which provides funding for CMS’s administrative activities and the Health Insurance Reform Implementation Fund. Funding for CCIIO-related activities represents a relatively small portion of the total funding used by CMS and recorded in its core financial system, the Healthcare Integrated General Ledger Accounting System (HIGLAS). For example, for fiscal year 2013, CMS reported that it incurred obligations totaling $1.16 trillion of which $5.72 billion (0.49 percent) was for CCIIO-related transactions according to data provided by CMS.

CMS’s accounting for CCIIO-related transactions is significantly affected by the manner in which transactions are funded and recorded in HIGLAS, which is used by all of CMS’s 21 offices and centers, including CCIIO. Appropriated funds are recorded in HIGLAS using separate appropriation accounts established by the Department of the Treasury (Treasury). Each year, CMS uses funding from these appropriation accounts to support its activities, including the implementation of the CCIIO-related private health insurance provisions of PPACA. HIGLAS accounts for financial transactions by appropriation account to ensure that funds are obligated and expended in accordance with applicable appropriations law. Accordingly, the appropriation accounts in HIGLAS correspond to the related budgetary funding sources that gave rise to them, rather than to the CMS office responsible for implementing the specific activities for which the funding was provided. Consequently, appropriation accounts that were created based on legislation that funds only CCIIO-related activities will include only CCIIO-related transactions, and appropriation accounts that were created based on legislation that funds both CCIIO- related and non-CCIIO-related CMS activities will include both types of transactions.

Each fiscal year from 2010 through 2013, CMS’s financial statements, which were derived from its core financial system, were audited by an independent public accountant (IPA). In each of these years, the IPA concluded that CMS’s financial balance sheets—and statements of net costs, changes in net position, and budgetary resources—were free of material misstatement.HIGLAS constitute reliable evidence of the nature of the underlying transactions and their total dollar amount.

Limitations in CMS’s Policies and Procedures Impeded Efforts to Determine the Reliability of Most of the CCIIO-Related Resources That CMS Reported It Received and Used

CMS provided most of the CCIIO-related information we requested, but limitations in its policies and procedures made the process of obtaining it difficult and time consuming, and we could not determine the reliability of most of the amounts CMS provided. For several reasons, CMS’s core financial system—HIGLAS—did not produce CCIIO-specific totals for much of the financial information we requested, and CMS did not have an efficient alternate approach for identifying the information. Expenditure totals for certain activities—for example, advertising—could not be distinguished from other transactions because CMS had not assigned identifying codes to identify the CMS office or the nature of the activity in HIGLAS. Also, HIGLAS does not produce totals of CCIIO-related travel and salary transactions in total or by funding source. In addition, information regarding staff reassignments to CCIIO from other CMS and HHS units was not readily available, and the related information CMS provided was incomplete and not supported by documentary evidence. CMS did not have policies and procedures for responding to nonroutine information requests such as ours. Consequently, CMS employed an ad hoc manual process to identify the information requested, which was labor intensive and time consuming. In addition, CMS’s procedures for identifying and obtaining the information and its review and approval were not documented, so we also could not verify that these procedures had been properly performed.

Statement of Federal Financial Accounting Standards No. 4, Managerial Cost Accounting Standards and Concepts, and Statement of Federal Financial Accounting Concepts No.1, Objectives of Federal Financial Reporting, highlight the importance of reliable and timely information to key stakeholders, such as managers, executives, and Congress, to support informed resource allocation decisions and assessments of program performance and the need for it to be verifiable. In addition, Standards for Internal Control in the Federal Government requires that internal control be clearly documented and that the documentation be readily available for examination. Because CMS was not able to provide timely CCIIO-related information whose reliability could be independently determined, Congress and other decision makers may not have timely and reliable CCIIO-related financial management information, which could hamper efforts to make informed resource allocation decisions and assessment of program performance.

CMS Provided Most of the Requested Information

CMS provided most of the CCIIO-related financial management information we requested, which consisted of (1) total CCIIO-related obligations and expenditures from the enactment of PPACA through fiscal year 2013; (2) estimates of total CCIIO-related obligations for expenditures for fiscal year 2014; (3) the number of full-time CCIIO staff as of September 30, 2013; and (4) total CCIIO-related expenditures from the enactment of PPACA through fiscal year 2013 for salaries, travel, advertising and other public relations activities, polling and focus groups, and conferences. However, CMS did not provide complete information regarding the following:

Estimates of fiscal year 2014 CCIIO-related obligations (1) for staff salaries funded by legislation that also funds salaries related to other non-CCIIO related CMS activities or (2) related to the Prevention and Public Health Fund, travel, advertising and other public relations activities, polling and focus groups, and conferences. CMS did not provide estimates of fiscal year 2014 obligations for these specific categories because it did not prepare related estimates at this level of detail.

Reassignments of staff to CCIIO from Medicare, Medicaid, or other CMS or HHS divisions and offices. CMS did not provide complete staff reassignment information because according to CMS officials, obtaining it would require review of each staff member’s personnel file, which would be labor intensive and time consuming.

As discussed in the following section, although CMS was able to provide most of the information we requested, the reliability of most of it could not be determined.

Reliability of Most of the Information CMS Provided Could Not Be Determined

Because of limitations in CMS’s policies and procedures, we could not determine the reliability of most of the CCIIO-related financial management information that CMS provided. Specifically, CMS did not record and retain the information in a manner that facilitated its retrieval in a form that lent itself to independent verification of reliability. CMS extracted most of the requested data from HIGLAS based on transaction codes and provided it to us on manually prepared spreadsheets. However, CMS’s core financial system—HIGLAS, which is the basis of its audited financial statements—did not produce corresponding totals. As a result, there were no HIGLAS totals to which the CMS-provided spreadsheet amounts could be compared for purposes of determining whether they included all appropriate data that were contained in HIGLAS and could therefore be considered complete. Also, certain expenditures had not been assigned identifying transaction codes in HIGLAS, so the system was unable to produce related totals. In addition, the staff reassignment information provided by CMS was not supported by documentary evidence and therefore its reliability could also not be determined.

Some of the Information CMS Provided Was Determined to Be Reliable

We determined that CMS’s estimates of total obligations for expenditures for fiscal year 2014—both in total and by funding source—were reliable. Also, estimates of salary expenditures funded by appropriation accounts that fund only CCIIO-related activities were reliable. To make these determinations, we reconciled CMS’s estimates to the President’s Budget and reviewed the logic underlying subsequent updates to the estimates, which we determined to be reasonable. These data, which we determined to be reliable, are shown in table 1.

In addition, data provided by CMS on the total CCIIO salary expenditures from March 2010 through September 30, 2013, which was $79.8 million, as well as the related number of full-time CCIIO staff as of September 30, 2013, which was 347, were determined to be reliable. To make this determination, we estimated total CCIIO salary expenditures based on the number of full-time staff assigned to CCIIO over this period and their salary levels, compared our estimate to the total CCIIO salary expenditures provided by CMS, and found the difference to be reasonable.

Reliability Could Not Be Determined for CCIIO-Related Amounts Partially Funded by Appropriation Accounts That Also Fund Non-CCIIO Activities

Because CMS’s core financial system (HIGLAS) does not produce totals for a portion of the CCIIO-related obligations and expenditures in total or by their funding sources, we could not determine whether these amounts were complete, which is a major factor in determining reliability. A portion of CCIIO-related expenditures are funded from appropriation accounts that also fund non-CCIIO related CMS activities and therefore include both CCIIO-related and non-CCIIO-related CMS transactions. In such cases, HIGLAS does not produce CCIIO-related totals for these obligations and expenditures. Consequently, there were no CCIIO-related totals produced by HIGLAS to which we could compare the amounts provided by CMS for the purpose of determining their completeness. Information provided by CMS indicated that from PPACA’s enactment through September 30, 2013, a total of $2.1 billion in CCIIO-related obligations and $714 million of CCIIO-related expenditures were included in appropriation accounts that also funded CMS activities unrelated to CCIIO, as detailed in table 2. However, because we were unable to determine whether these amounts were complete, we do not have any assurance whether these amounts are reliable and whether the actual amounts are larger.

Because HIGLAS does not produce totals of CCIIO-related salary or travel expenditures, we also could not determine whether the amounts that CMS provided for CCIIO-related salary or travel expenditures by funding source, or travel expenditures in total, were reliable. CMS officials provided salary and travel expenditure amounts that they had extracted from HIGLAS and placed on manually prepared spreadsheets. However, there were no HIGLAS totals for salary or travel expenditures to which we could compare the related amounts provided by CMS to determine if they were complete, as detailed in table 3. As noted above, total salary expenditures of $79.8 million from March 2010 through fiscal year 2013 were determined to be reliable.

HIGLAS does not produce totals of CCIIO-related expenditures for advertising and other public relations activities, polling and focus groups, and conferences because CMS has not assigned these activities identifying transaction codes that identify the nature of the activity and the related CMS office so that they can be separately identified and tracked in HIGLAS. Consequently, HIGLAS cannot distinguish them from other transactions or produce related totals. Also, because there are no codes identifying these types of transactions, CMS staff could not identify them in HIGLAS as being CCIIO-related transactions and extract them as they had with the CCIIO-related portions of total obligations, total expenditures, salaries, and travel expenditures. Instead, CMS staff identified these expenditures by manually reviewing individual underlying contracts. Because HIGLAS does not produce totals for these CCIIO- related expenditures to which we could compare CMS-provided amounts for purposes of determining their completeness, we could not determine their reliability, as detailed in table 4.

The information CMS provided regarding reassignment of staff to CCIIO from other CMS or other HHS offices was not complete and was based on personal recollection unsupported by documentary evidence, as previously discussed. Consequently, we could not determine if it was reliable. CMS officials indicated that this information was not readily available and obtaining it would have required labor-intensive and time- consuming review of each staff member’s individual personnel file. Of the 347 full-time CCIIO staff as of September 30, 2013, CMS provided information based on personal recollection that indicated that 92 staff had been reassigned from other CMS or HHS offices, including 5 who had been reassigned from the Medicare or Medicaid programs. CMS also informed us that 24 staff were assigned to CCIIO on temporary detail from other CMS or HHS offices as of September 30, 2013. According to CMS officials, 4 of these staff were detailed from the Medicare program, and 8 were detailed from offices that support the Medicare and Medicaid programs. However, we could not determine if these data were reliable. CMS did not provide any information regarding the previous assignments of the 255 other full-time CCIIO staff as of September 30, 2013.

CMS Did Not Have Adequate Policies and Procedures for Identifying CCIIO-Related Financial Management Information

CMS officials informed us that although they have established policies and procedures governing CMS’s standard financial operations, they do not have established policies and procedures for responding to nonroutine information requests, such as those that might originate from Congress or other oversight bodies. Instead, CMS used ad hoc, largely manual procedures that consisted of either extracting CCIIO-related transactions from HIGLAS using transaction codes to identify them as CCIIO related or, for certain categories of expenditures that did not have such codes, manually reviewing underlying individual contracts. CMS used similar manual transaction identification and extraction procedures to produce its quarterly Status of Funds Report, which reflects CCIIO- related obligations and expenditure information that CMS management routinely uses to help support CCIIO-related budgetary and spending decisions. CMS officials informed us that HIGLAS possesses a “query” feature enabling users to produce custom reports to meet information needs not covered by existing standard reports. However, they also indicated that in part because of competing demands and resource constraints, they had been unable to develop and employ this functionality.

The largely manual, ad hoc process CMS employed was labor intensive and time consuming, and it often required an extended period of time to respond to our requests, in some cases several months. For example: In March 2013, we requested information regarding expenditures related to polling and focus groups, advertising and other public relations, and conferences. CMS did not provide us this information until about a year later, in March 2014.

In March 2013, we requested a listing of CCIIO employees who had been reassigned to CCIIO from other HHS or CMS offices when CCIIO was created in 2011 and the offices from which they had been reassigned. However, CMS did not provide this information until about 4 months later, in July 2013. As discussed above, this information was not complete.

Statement of Federal Financial Accounting Concepts No. 1, Objectives of Federal Financial Reporting, recognizes that if financial reports are to be useful, they must be issued soon enough to affect decisions, and that the passage of time usually diminishes the usefulness that the information otherwise would have had. Statement of Federal Financial Accounting Standards No. 4, Managerial Cost Accounting Standards and Concepts, observes that cost information that is timely as well as reliable helps government managers ensure that resources are spent to achieve expected results and outputs and alerts them to waste and inefficiency. This concept also applies to other forms of financial management information. Standards for Internal Control in the Federal Government also recognizes that information should be recorded and communicated to management and others in a form and within a time frame that enables them to carry out their internal control and other responsibilities.

We also found that CMS also did not have policies and procedures that required documented review and approval of the information provided in response to nonroutine requests to help ensure the reliability of financial management information. Although CMS officials informed us that the CCIIO-related financial management information we were provided was subject to multiple levels of review and approval before we received it, including review by subject matter experts, its review and approval of the CCIIO-related information provided to us were not documented. Consequently, we were unable to independently verify that these reviews and approvals had taken place. Our concern also applies to CMS’s Status of Funds Report, which is a standard quarterly report that CMS uses to assist in making budgetary and spending decisions. According to CMS, this report was also prepared using a similar largely manual process, and review and approval of this report were also not documented. Such reviews and approvals are important internal control activities that can help provide reasonable assurance that information is reliable.

Standards for Internal Control in the Federal Government requires that internal control be clearly documented and that the documentation be readily available for examination.approval of financial management information increases the risk that these procedures may not be performed effectively and that as a result significant errors may not be prevented or be detected and corrected in a timely manner, adversely affecting the reliability of the information provided to key stakeholders.

Conclusions

In order to make informed decisions regarding matters affecting the financial aspects of operations and the performance of programs, it is critical that decision makers have available timely and reliable information. This is particularly true as it relates to programs that have been subject to the significant degree of public and congressional scrutiny that has characterized the implementation of PPACA, including the CCIIO-related private health insurance and health insurance exchange provisions. However, CMS does not have documented policies and procedures governing responses to nonroutine information requests, such as those that may originate from oversight bodies. CMS’s reliance on manual procedures and personal recollection resulted in an inefficient and time-consuming process to provide the requested information. In addition, because of the manner in which CMS accounts for and retains CCIIO- related financial management information, we could not determine the reliability of most of it. Also, because its process for obtaining the information and its review and approval of the information provided were not documented, there is no assurance that such procedures have been properly performed. Collectively, these issues increase the risk that significant errors may not be prevented or detected and corrected before information is provided in response to requests from Congress and other decision makers. Consequently, such users of these data may not have timely and reliable CCIIIO-related financial management information, which could hamper their efforts to make informed resource allocation decisions and assessments of program performance.

Recommendations for Executive Action

We recommend that the Secretary of Health and Human Services direct the Administrator of the Centers for Medicare and Medicaid Services to take the following actions: identify and evaluate options to facilitate more timely and independently verifiable reporting of CCIIO-related financial management information, such as enhancing HIGLAS’s standard reporting or custom reporting capabilities, and develop and implement policies and procedures for responding to nonroutine CCIIO-related financial management information requests, including procedures for documenting the preparation process and the review and approval of the results.

Agency Comments and Our Evaluation

We provided a draft of this report to HHS for comment. In its written comments, reprinted in appendix II, HHS did not concur with our two recommendations. HHS also provided technical comments, which we incorporated as appropriate.

HHS did not concur with our recommendation that it identify and evaluate options to facilitate more timely and independently verifiable reporting of CCIIO-related financial management information, such as enhancing HIGLAS’s standard reporting or custom reporting capabilities. HHS indicated that in response to our requests, it gave us supporting data to permit validation and verification of the information it provided, including numerous summary tables and detailed transaction-level reports from HIGLAS. We disagree with HHS’s response. As discussed in our report, CMS was able to provide us with CCIIO-related obligation and expenditure amounts from appropriation accounts that exclusively funded CCIIO-related activities. For these accounts, we were able to assess completeness by comparing the amounts provided to summary totals in HIGLAS. However, for appropriation accounts that funded both CCIIO- related and non-CCIIO-related activities, CMS utilized a time-consuming manual process to extract the obligation and expenditure activity from HIGLAS, and the accounting code structure did not allow CMS to provide related HIGLAS summary totals. Without the ability to compare the information provided by CMS for all accounts with CCIIO-related activity to summary totals in HIGLAS, we were unable to determine that the total amounts of CCIIO-related obligations and expenditures CMS provided were complete, which is a major factor in determining reliability.

HHS also indicated that we could have determined the reliability of CCIIO-related obligations and expenditures by using the same procedures we used to determine that CMS's estimates of CCIIO-related total obligations for expenditures for fiscal year 2014 were reliable. However, we were able to verify the reliability of obligation estimates for fiscal year 2014 using budget data because estimates of future activity are not supported by past (actual) transaction activity. Therefore, our ability to verify these estimates was not affected by the lack of associated HIGLAS totals which affected our ability to verify the reliability of actual obligation and expenditure data for fiscal years 2010 through 2013. As discussed in our report, Statement of Federal Financial Accounting Standards No. 4, Managerial Cost Accounting Standards and Concepts, and Statement of Federal Financial Accounting Concepts No.1, Objectives of Federal Financial Reporting, highlight the importance of providing reliable and timely information to key stakeholders, including Congress, to support informed resource allocation decisions and assessments of program performance, and the need for such information to be verifiable. As discussed in our report, CMS sometimes took months to provide the information we requested and did not always provide CCIIO-related information whose reliability could be independently determined, thereby limiting the type and usefulness of information available to Congress and other decision makers for making informed decisions. HHS concluded its response with a statement that it will continue to evaluate options for enhancing HIGLAS’s “standard reporting and/or custom reporting capabilities.” We continue to believe that identifying and considering such options will help facilitate the timely response to stakeholder requests for reliable information on HHS programs, particularly for programs subject to a significant degree of public and congressional scrutiny.

HHS also did not agree with our recommendation that it develop and implement policies and procedures for responding to nonroutine CCIIO- related financial management information requests, including procedures for documenting the preparation process and the review and approval of the results. In its response, HHS stated that it has up-to-date and clearly documented standard operating procedures (SOP) for its normal day-to- day work processes and employs ad hoc teams and processes to address data requests for information that differs from HIGLAS standard reports. HHS also stated that the varying nature of data requests for nonroutine reports does not easily lend itself to utilizing one documented SOP. We agree that it would be difficult to develop an individual SOP for each specific CCIIO-related data request, but we continue to believe that regardless of the specifics of each request, common processes and controls that are necessary should be documented and required in written policies and procedures. For example, as discussed in the report, CMS did not have a policy or procedures that required documented review and approval of the information provided in response to nonroutine requests. Such documented review and approval would help ensure the reliability of the information CMS provided, regardless of the specific data request. Although HHS stated that subject matter experts were involved in all steps of identifying a methodology, extracting data from multiple systems, and manually producing reports in order to meet the requests for customized displays of information and that it conducted multiple levels of review prior to providing the information, none of these steps or reviews were documented, as noted in our report. As a result, we were not able to independently verify that these steps and reviews actually took place. Similarly, absent documented review and approval, management lacks assurance that these important controls are in place, increasing the risk that errors may not be prevented or detected and corrected in a timely manner.

We are sending copies of this report to appropriate congressional committees, the Secretary of Health and Human Services, the Administrator of the Centers for Medicare and Medicaid Services, the Director of the Office of Management and Budget, and other interested parties. In addition, the report is available at no charge on the GAO website at http://www.gao.gov.

If you or your staff have any questions about this report, please contact me at (202) 512-2623 or davisbh@gao.gov. Contact points for our Offices of Congressional Relations and Public Affairs may be found on the last page of this report. GAO staff who made key contributions to this report are listed in appendix III.

Appendix I: Objective, Scope, and Methodology

Our objective was to identify the resources related to the Center for Consumer Information and Insurance Oversight (CCIIO) that the Centers for Medicare and Medicaid Services (CMS) received, used, and expects to use from enactment of the Patient Protection and Affordable Care Act (PPACA) though fiscal year 2014, including certain categories of expenditures; the source of the funding; the number of CCIIO staff as of September 30, 2013; and the number of staff reassigned from other units. The scope of our review encompassed the financial and staff resources provided to and used by CMS to help implement the private health insurance and health insurance exchange provisions of PPACA from enactment in March 2010 through fiscal year 2013 and the amounts CMS estimates it will use for fiscal year 2014.

To achieve our audit objective, we contacted responsible officials at CMS to request the (1) data concerning total CCIIO-related obligations and expenditures from the enactment of PPACA in March 2010 through fiscal year 2013, including amounts related to salaries, travel, advertising and other public relations activities, polling and focus groups, and conferences; (2) CMS’s estimates of obligations in total and in each of these categories for fiscal year 2014; and (3) the number of full- and part- time CCIIO staff as of September 30, 2013, including the number reassigned from other CMS and Department of Health and Human Services (HHS) units. We also requested available supporting documentation for the information requested to assist in determining its reliability. We reviewed policies and procedures—including internal controls in place to ensure the reliability of the information CMS provided—in order to assess the information’s applicability to our audit objectives and its conformance with internal control standards. In order to determine whether the information CMS provided was reliable, we analyzed the information we received, conducted extensive follow-up inquiries with agency officials to ensure that we had received what we requested, and compared the information to available supporting documentation. Specifically, we compared the detailed financial information CMS extracted from the Healthcare Integrated General Ledger Accounting System (HIGLAS) to its related totals, where available, to determine whether all appropriate information had been extracted and the amounts provided by CMS were complete and estimated the amount of salaries based on detailed information on individual grade levels and pay rates that CMS obtained from its payroll system and compared the amount to the total salaries CMS obtained from HIGLAS to determine whether the total number of employees and related staff salary data were reliable as of September 30, 2013.

To determine the reasonableness of CCIIO’s estimated funding and spending amounts for fiscal year 2014, we compared CMS’s estimates to the President’s budget, with the exception of changes made subsequent to preparation of the President’s budget.estimates, we obtained an understanding of the basis upon which the changes were developed to determine if they were reasonable.

For such changes to the As described in our report, we could not determine the reliability of most of the data provided to us. We also met with officials from the Office of Inspector General of HHS and CMS’s independent financial statement auditor to determine whether they were aware of any internal control or substantive issues pertinent to CCIIO-related activities that could affect our ability to rely upon the financial management information CMS provided.

Appendix II: Comments from the Department of Health and Human Services

Appendix III: GAO Contact and Staff Acknowledgments

GAO Contact

Staff Acknowledgments

In addition to the contact named above, Charles Fox (Assistant Director), William Brown, Joshua Edelman, Wilfred Holloway, Robert Mabasa, Phillip McIntyre, and John Warner made key contributions to this report.