CMS, a component of the Department of Health and Human Services (HHS), administers the Medicaid program. Medicaid is the third largest social program in the federal budget and is one of the largest components of state budgets. Although it is one federal program, Medicaid consists of 56 distinct state-level programs–one for each state, territory, Puerto Rico, and the District of Columbia. Each of the states has a designated Medicaid agency that administers the Medicaid program. The federal government matches state Medicaid spending for medical assistance according to a formula based on each state’s per capita income. The federal share can range from 50 to 83 cents of every state dollar spent. In accordance with the Medicaid statute and within broad federal guidelines, each state establishes its own eligibility standards; determines the type, amount, duration, and scope of covered services; sets payment rates; and develops its administrative structure. Each state Medicaid agency is also responsible for establishing and maintaining an adequate internal control structure to ensure that the Medicaid program is managed with integrity and in compliance with applicable law. States are required to describe the nature and scope of their programs in comprehensive written plans submitted to CMS–with federal funding for state Medicaid services contingent on CMS approval of the plans. This approval hinges on whether CMS determines that state Medicaid plans meet all applicable federal laws and regulations. At the federal level, the Center for Medicaid and State Operations (CMSO) within CMS is responsible for approving state Medicaid plans, working with the states on program integrity and other program administration functions, and overseeing state financial management and internal control processes. CMSO shares Medicaid program administration and financial management responsibilities with the 10 CMS regional offices (RO). The Division of Financial Management (DFM), within CMSO’s Finance, Systems and Quality Group, has primary responsibility for Medicaid financial management. DFM, in conjunction with the 10 regions, establishes and maintains the internal control structure for Medicaid financial management and state oversight. As is the case for all major federal agency programs, the internal control structure established by CMS for Medicaid should meet requirements of Office of Management and Budget (OMB) Circular A-123, Management Accountability and Control, and the Standards for Internal Control in the Federal Government. According to Circular A-123, management controls are the organization policies and procedures used to reasonably ensure that programs are protected from waste, fraud, and mismanagement and achieve their intended results. Establishing good management controls requires, according to the circular, that agency managers take systematic and proactive measures to implement appropriate management controls, assess the adequacy of the controls, identify needed improvements, and take corresponding corrective action. The Standards for Internal Control in the Federal Government includes five standards that provide a roadmap for agencies to establish control for all aspects of their operations and a basis against which agencies’ control structures can be evaluated. The standards are defined as follows: Control environment—creating a culture of accountability by establishing a positive and supportive attitude toward improvement and the achievement of established program outcomes. Risk assessment—performing comprehensive reviews and analyses of program operations to determine if risks exist and the nature and extent of the risks identified. Control activities—taking actions to address identified risk areas and help ensure that management’s decisions and plans are carried out and program objectives are met. Information and communication—using and sharing relevant, reliable, and timely financial and nonfinancial information in managing operations. Monitoring—tracking improvement initiatives over time, and identifying additional actions needed to further improve program efficiency and effectiveness. The internal control structure and financial oversight process that CMS has designed for Medicaid includes activities for (1) approving and awarding grants to make funds available to the states for the efficient operation of the Medicaid program, (2) overseeing state financial management and internal control processes, (3) ensuring the reasonableness of budgets reported to estimate federal funding requirements, and (4) ensuring the propriety of expenditures reported for federal matching funds. DFM shares these responsibilities with about 76 regional financial analysts and branch chiefs, who report to their respective regional administrators. Figure 1 outlines CMS’s organizational structure related to Medicaid. Regional financial analysts are key to CMS financial management activities, as they are responsible for performing frontline activities to oversee state financial management and internal control processes. Some of the key oversight activities performed by regional analysts are (1) reviewing state quarterly budget estimates and expenditure reports, (2) preparing decision reports that document approvals for federal reimbursement and reimbursement deferral actions, (3) providing technical assistance to states on financial matters, and (4) serving as liaison to the states and audit entities. DFM staff in headquarters rely on regional decision reports to help determine and issue state grant awards. States submit various federal reporting forms that provide regional financial analysts with the budget and expenditure data to execute their financial management and oversight responsibilities. When the State Children’s Health Insurance Program (SCHIP) was created through the Balanced Budget Act of 1997 to provide health insurance to children of low- income families who would not qualify for Medicaid, states have been required to submit expenditure and budget data on both Medicaid and SCHIP. The Medicaid and SCHIP forms are submitted quarterly through the Medicaid and SCHIP Budget and Expenditure System (MBES). See table 1 below for a brief description of the contents of the reporting forms. Reviews of the Medicaid and SCHIP expenditure reports (CMS 64 and 21) are the primary oversight control activities performed by regional financial analysts. These reviews are used to determine if Medicaid expenditures are complete, properly supported by the state’s accounting records, claimed at appropriate federal matching rates, and allowable in accordance with existing federal laws and regulations. Regional analysts are expected to obtain knowledge about state financial management and internal control processes to aid in assessing the expenditures reported for federal reimbursement. Figure 2 shows an overview of the financial management and oversight process. Oversight of state expenditures and internal controls by CMS regional financial analysts is not the only federal oversight mechanism for ensuring the propriety of Medicaid finances. Medicaid expenditures and requisite internal controls are reviewed annually by auditors under requirements of the Single Audit Act of 1984. The Congress established the Single Audit Act to gain reasonable assurance that federal financial assistance programs are managed in accordance with applicable laws and regulations. The Single Audit Act requires audits of state and local government entities that expend at least $300,000 in federal awards annually. The results of these audits are provided to the state and responsible federal agency. The federal agency is responsible for following up with the state to ensure that the state takes action to correct the deficiencies identified from the audit. Other entities have responsibilities for routinely reviewing Medicaid finances and Medicaid internal controls. Table 2 explains various oversight activities by entities outside of CMS. Our objectives were to determine if (1) CMS has an adequate oversight process to help ensure the propriety of Medicaid expenditures, (2) CMS adequately evaluates and monitors the results of its oversight process and makes adjustments as warranted, and (3) the current CMS organizational structure for financial management is conducive to effectively directing its oversight process and sustaining future improvements. To evaluate CMS financial oversight, the control activities used to help ensure the propriety of Medicaid expenditures, and CMS’s efforts to monitor its financial oversight, we performed work at CMS regional and headquarters offices, surveyed financial management staff, and reviewed CMS manuals and other documentation, as well as audit reports. As agreed with your offices, we visited 5 of the 10 CMS regional offices (Atlanta, Boston, Chicago, New York, and San Francisco) to observe and interview the financial management staff. We selected the five regions based on geographical dispersion across the country and based on the total amount of Medicaid expenditures processed by each region. The five regions were collectively responsible for overseeing more than half of the total Medicaid expenditures for fiscal year 2000. We discussed recent program changes, which significantly increased financial management oversight activities for regional analysts. We questioned staff about the extent to which certain activities, such as focused financial management reviews, were conducted and reviewed any reports and corresponding workpapers that were available. Key CMS financial managers at headquarters in Baltimore were also interviewed to gain a comprehensive understanding of overall financial management objectives for the Medicaid program. We also discussed performance and budget reporting as well as efforts to coordinate with state auditors. We administered a Web-based survey to regional financial management members to gain a better understanding of the control activities being performed by regional offices. The survey was sent to all regional office branch chiefs and staff classified as financial analysts who are responsible for overseeing state financial management and internal controls for Medicaid. All of the 11 branch chiefs responded and 59 of the 65 analysts responded, for a 92 percent response rate—the 6 analysts who did not respond were from one regional office. The survey obtained information on how oversight for Medicaid financial management is designed and implemented, as well as the frontline staff perspective on effectiveness. Survey respondents answered questions relating to review procedures performed, use of state single audits, follow-up of audit findings, and communications with state auditors and offices of inspectors general. Many of the questions asked the analysts to respond based on their performance of activities for the period from October 1, 1999, through the date of the survey. The practical difficulties in conducting any survey can introduce errors, commonly referred to as nonsampling errors. We included steps in both the data collection and data analysis to minimize such nonsampling errors. Multiple versions of the questionnaire were pretested with regional financial analysts before the final survey was administered. A 92 percent response rate was achieved, and the respondents directly entered the responses into the database via the Internet survey. Data checks were performed and a second independent analyst reviewed computer analyses. We obtained and reviewed CMS documents and manuals that described current financial oversight activities and performance reporting previously used to monitor oversight. We reviewed audit reports that included findings related to Medicaid financial management, including the CMS/HCFA financial reports for fiscal years 1998 through 2000 and Single Audit Act reports for fiscal years 1999 and 2000. To help judge the adequacy of CMS’s Medicaid financial management oversight process, we evaluated CMS oversight against the comptroller general’s Standards for Internal Control in the Federal Government. We also consulted with state auditors during our regional site visits to obtain an understanding of their oversight activities for the Medicaid program, including the level of audit coverage given to Medicaid financial operations and the control techniques used. To determine whether CMS’s organizational structure for financial management is conducive to effectively directing its oversight process and sustaining future improvements, we interviewed the director and deputy director of the CMSO Finance Systems and Quality Group as well as managers within the Division of Financial Management. We also conducted interviews with managers at the five regional offices. In addition, we compared information that we gathered about the current organizational structure, regional and central office communications, and improvement initiatives with the standards for control environment and information and communication components of internal control as described in the Standards for Internal Control in the Federal Government. We performed our fieldwork from October 2000 through September 2001, at the CMS central office in Baltimore, Md., and the five regional offices mentioned above. We focused on the internal control processes in place during fiscal years 2000 and 2001. All work was performed in accordance with generally accepted government auditing standards. We requested written comments on a draft of this report from the administrator of CMS. These comments are reprinted in appendix I. We also received supplementary oral comments from the Director of the CMS Division of Audit Liaison. Although CMS is responsible for ensuring the propriety of over $100 billion expended annually by the federal government for Medicaid, its financial oversight process did not incorporate key standards for internal control necessary to reduce the risk of inappropriate expenditures. The comptroller general’s Standards for Internal Control in the Federal Government requires that agency managers perform risk assessments and then take actions to mitigate identified risks that could impede achievement of agency objectives. However, until recently, the oversight process that CMS used for Medicaid expenditures did not include assessments that identified the areas of greatest risk of improper payments. Therefore, CMS did not have the requisite assurance that its control activities were focused on areas of greatest risk. In addition, the controls that were in place were not effectively implemented. As a result, CMS was not deploying its limited oversight resources efficiently and effectively to detect improper expenditures. CMS managers recognized the deficiencies of its oversight and began efforts in April 2001 to develop a risk-based approach and revise control activities. However, these efforts did not specifically consider information on state financial oversight and program integrity activities such as pre- and postpayment detection methods, and payment accuracy studies and initiatives to prevent fraud and abuse, or consider advanced control techniques for detecting improper Medicaid payments. Federal internal control standards require managers to perform risk assessments to identify areas at greatest risk of fraud, waste, abuse, and mismanagement. The standards require that once risks are identified, they should be analyzed for their possible effect by estimating their significance and assessing the likelihood of losses due to the risks identified. Despite repeated auditor recommendations, CMS had not developed and implemented a systematic risk assessment method in its oversight process to help ensure that states expend federal funds in accordance with laws and to identify amounts inappropriately claimed for federal reimbursement. In April 2001, CMS took action to develop a risk assessment; however, this analysis has not yet been used to deploy resources to areas of greatest risk and requires several improvements to enhance its usefulness in the oversight process. Since 1998, financial auditors responsible for the annual financial statement audit of Medicaid expenditures have recommended that CMS implement a risk-based approach for overseeing state internal control processes and reviewing expenditures. In performing audits of CMS’s financial statements for fiscal years 1998, 1999, and 2000, auditors have noted that CMS failed to institute an oversight process that effectively reduced the risk that inappropriate expenditures could be claimed and paid. In addition, the auditors identified internal control weaknesses that increased the risk of improper payments. These weaknesses included (1) a significant reduction in the level of detailed analysis performed by regional financial analysts in reviewing state Medicaid expenses, (2) minimal review of state Medicaid financial information systems, and (3) lack of a methodology for estimating the range of Medicaid improper payments on a national level. CMS Medicaid officials attributed most of the weaknesses identified by the auditors to reductions in staff resources and the multiple oversight activities that its staff is responsible for carrying out. According to Medicaid financial managers, changes in the Medicaid program since fiscal year 1998, specifically the addition of SCHIP, created additional oversight responsibilities for CMS financial management staff. Particularly, financial analysts are required to handle more state inquiries regarding technical financial issues that must be addressed promptly. At the same time, however, financial analyst resources previously devoted to oversight activities declined. Medicaid financial managers provided us with data to show that from fiscal year 1992 to September 2000, full-time equivalent (FTE) positions for regional financial staffs declined by 32 percent from 95 to approximately 65 FTEs. At the same time, federal Medicaid expenditures increased 74 percent from $69 billion to $120 billion. On average, each of the 64 regional financial analysts is now responsible for reviewing almost $1.9 billion in federal Medicaid expenditures each fiscal year as compared to an average of about $0.7 billion a decade ago. Figure 3 depicts the decrease in financial analysts (i.e., FTEs) and the increase in Medicaid expenditures between the years 1992 and 2000. Until recently, Medicaid financial managers had not taken action to implement a risk-based approach for Medicaid financial oversight. Managers stated that the Medicaid financial oversight process had been based on the presumption that financial analysts adequately applied the inherent knowledge of program risks acquired from years of experience in reviewing state Medicaid expenditures and providing technical assistance to states in operating their Medicaid programs. However, as Medicaid program expenditures have increased, CMS managers acknowledged that they needed to revise their oversight approach. As a result, during our review, CMS began in April 2001 to develop a risk-based approach for determining how best to deploy its resources in reviewing Medicaid expenditures. The Medicaid risk assessment effort required each regional office to provide data on the states and territories in its jurisdiction based on regional analyst experience and knowledge. For each type of Medicaid service and administrative expense, the Medicaid risk analysis estimates the likelihood of risk based on the dollar amount expended annually and measures the significance of risk based on factors such as unclear federal payment policy, state payment involving county and local government, and results of federal audits. The risk analysis provides a risk score for each state that is intended to specify the Medicaid service and administrative expense categories that are of greatest risk for improper payments in the state. Medicaid financial managers also tabulated a national risk score for each type of Medicaid service and administrative expense using the state risk scores. However, CMS had not taken steps to use the risk analysis in deploying its regional financial oversight resources. Medicaid financial managers in headquarters and the regional offices plan to develop work plans that will allocate resources based on the risks identified from its analysis. CMS expects to implement these work plans in reviewing the state’s quarterly expenditure reports for fiscal year 2003. In evaluating the Medicaid risk analysis, we considered strategies that leading organizations used in successfully implementing risk management processes. Two such strategies, which are included in our executive guide, Strategies to Manage Improper Payments are as follows. Information developed from risk assessments should help form the foundation or basis upon which management can determine the nature and type of corrective actions needed, and should give management baseline data for measuring progress in reducing payment inaccuracies and other errors. Management should reassess risks on a recurring basis to evaluate the impact of changing conditions, both external and internal, on program operations. While the Medicaid risk analysis is a good start, we identified several improvements that should be made to the assessment before it is used in deploying resources. The issues we identified could hinder the quality of baseline information gathered and, accordingly, affect management’s ability to thoroughly reassess risks and measure the impact of corrective actions on a recurring basis. First, the analysis does not sufficiently take into account state financial oversight activities in assessing the risks for improper payments in each state. Regional financial analysts were instructed to rate the adequacy of each state Medicaid agency’s financial oversight as one of the risk factors in determining the likelihood and significance of risk in each state. The analysts were instructed to consider whether a state regularly reviews claims submitted by local government entities that provide Medicaid services and whether state audits were conducted regularly. However, the analysts were not specifically instructed to consider states’ use of (1) prepayment edits and reviews to help prevent improper payments, (2) screening procedures to prevent dishonest providers from entering the Medicaid program, (3) postpayment reviews to detect inappropriate payments after the fact, and (4) payment accuracy studies to measure the extent of improper payments. Several states have implemented cost-effective prevention efforts to protect Medicaid program dollars, such as prepayment computer “edits,” manual reviews of claims before payment, and thoroughly checking the credentials of individuals applying to be program providers. Table 3 shows examples of prepayment reviews currently being used by some states. Many states have also developed postpayment detection systems and payment accuracy studies to improve their ability to detect, investigate, and measure potential improper payments. Kentucky and Washington, for example, have hired private contractors to develop or use advanced computer systems to analyze claims payment data that identified several million dollars in overpayments. Table 4 describes these and other state postpayment efforts and related program savings. While regional financial analysts may know about many activities like these from performing their oversight responsibilities, analysts or staff in the Division of Financial Management did not collect and document information on the nature and results of each state’s financial oversight activities. Without such information being documented, CMS did not have a complete picture or profile of the level of risk for improper payments in each state and thus did not have comprehensive information to determine the appropriate level of federal oversight that should be applied. A second deficiency we found in the Medicaid risk analysis is that it did not specifically integrate information about state fraud and abuse prevention efforts in making risk assessments for each state. Regional financial analysts were instructed to report on the level of regional oversight of each state’s Medicaid finances as one of the risk factors in determining the likelihood and significance of risk in each state. Specifically, analysts were instructed to consider the last time the regional office or HHS/OIG conducted a review or audit. However, the analysts were not specifically instructed to consider results from reviews of state efforts to prevent fraud and abuse recently conducted under the CMS Medicaid Alliance for Program Safeguards. In 1997, CMS established the Medicaid Alliance for Program Safeguards staffed with program analysts from the 10 CMS regions and staff within the Policy Coordination and Planning Group of the Center for Medicaid and State Operations. The initiative was started to aid states in their program integrity efforts. Since its inception, a fraud statute Web site has been established and seminars on innovations and obstacles in safeguarding Medicaid have been developed. In fiscal year 2000, regional staff conducted structured site reviews of program safeguards in eight states, and in fiscal year 2001 reviews were conducted in another eight states. Plans are to perform reviews in additional states until all states are covered. These reviews examined how state Medicaid agencies identify and address potential fraud or abuse, whether state agencies are complying with appropriate laws and regulations—such as how they check to ensure that only qualified providers participate in the program—and potential areas for improvement. CMS would gain valuable information from these reviews to more accurately assess the level of risk for improper payments in these 16 states and the appropriate level of federal oversight required. A third deficiency we found is that the Medicaid risk analysis did not include mechanisms to ensure that such analysis would be conducted continuously in directing financial oversight. Agency managers should have methods in place to revisit risk analysis to determine where risks have decreased and where new risks have emerged, as identified risks are addressed and control activities are changed. As such, risk analysis should be iterative. Medicaid financial managers had not determined how they would continuously revise and update their Medicaid risk analysis. Finally, the Medicaid risk analysis would be strengthened if states were systematically estimating the level of improper payments in their programs. Identifying the dollar amount of improper payments is a critical step in determining where the greatest problems exist and the most cost-beneficial approach to addressing the problems. CMS management has recognized this and has begun efforts to develop an approach for estimating improper Medicaid payments. In September 2001, nine states responded to a CMS solicitation to participate in pilot studies to develop payment accuracy measurement methodologies. The objective is to assess whether it is feasible to develop a single methodology that could be used by the diverse state Medicaid programs and to explore the feasibility of estimating the range of improper Medicaid payments on a national level. Each of the nine states involved is developing a different measurement methodology. CMS has assigned a senior Medicaid manager with responsibility for directing this effort. According to this manager, CMS has hired a consultant experienced in program integrity reviews to oversee the state pilots. CMS managers expect the states to complete the pilots during fiscal year 2003, after which time the consultant and the Medicaid manager plan to select several of the state methodologies as test cases for fiscal year 2004. It is important that CMS continues to place emphasis on development of these payment accuracy reviews on a state-by-state basis and ultimately on a national level, since this is a key baseline measure for managing improper payments in the Medicaid program. The comptroller general’s Standards for Internal Control in the Federal Government states that managers must establish adequate control activities to address identified risks and ensure that program objectives are met. Internal control activities are the policies, procedures, techniques, and mechanisms that help ensure that management’s directives to mitigate risk are carried out. Control activities are an integral part of an organization’s efforts to address risks that lead to fraud and error. For the Medicaid program, both the states and federal government share responsibility for ensuring that adequate control activities are in place. The control activities that CMS had in place to oversee state internal controls and help ensure the propriety of Medicaid expenditures were not effectively implemented. Given the current level of resources and the size and complexity of the program, a different approach is needed that incorporates new oversight techniques and strategies, as well as the results of the risk assessment discussed previously. CMS regional financial analysts are tasked with performing multiple control activities designed to (1) oversee state financial management and internal control processes, (2) help ensure that states expend federal funds in accordance with laws, and (3) identify amounts inappropriately claimed for federal reimbursement. These activities include providing technical assistance to states on a variety of financial issues to help improve state accountability and help prevent payment inaccuracies as well as examining state expenditures to defer improperly supported payments and disallow those payments that do not comply with Medicaid regulations. Analysts also are responsible for following up on and resolving findings from audits related to improper or questionable payments and weaknesses in state internal controls. Table 5 summarizes the control activities that regional analysts are responsible for carrying out. As Medicaid expenditures have grown and resources devoted to Medicaid financial oversight have decreased, regional financial analysts have faced significant challenges in monitoring state internal controls, providing technical assistance, scrutinizing expenditures, and following up on audit findings for all state Medicaid programs. In an attempt to address these challenges, in 1994 regional offices began refocusing oversight activities from emphasizing detailed review of Medicaid expenditure data to increasing the level of technical assistance provided to states. However, auditors of CMS financial statements found that, as a result, regional offices were not providing appropriate review and oversight of state Medicaid programs. As mentioned previously, auditors have reported since 1998 that regional offices significantly reduced or inconsistently performed control activities to detect potential errors and irregularities in state expenditures, thus increasing the risk that errors and misappropriation could occur and go undetected. In our review, we found that these weaknesses were still present. In August 2001, we conducted a survey of regional financial analysts to obtain their perspectives on the design and implementation of the Medicaid financial oversight process, covering the period from October 1, 1999, through the date of the survey. In comments to the survey, some regional analysts indicated that they were inundated with responsibility for multiple control activities and unable to perform them effectively. Our survey asked the analysts to rate each of the control activities that they perform in terms of how important they believe the activity is in overseeing state Medicaid programs. The activity rated most important was quarterly expenditure reviews performed on-site at state Medicaid agencies; 89 percent rated the activity as having the “highest” or “high” level of importance—83 percent “highest” and 6 percent “high.” However, when asked about the adequacy in which they performed on-site expenditure reviews, almost 36 percent rated the adequacy of their performance “inadequate” or “marginal”—13 percent inadequate and 23 percent marginal. In discussions with regional financial analysts during our site visits and in comments to our survey, many financial analysts attributed deficiencies in quarterly reviews to inadequate staff resources, the low priority placed on financial management oversight, lack of training, and conflicting priorities. During our site visits we interviewed 11 regional financial analysts responsible for overseeing the five states that accounted for over $70 billion in Medicaid expenditures in fiscal year 2000. We reviewed these analysts’ workpapers related to their review of quarterly expenditure reports submitted for the quarter ended December 31, 2000. Workpapers prepared for three of the states to document their reviews did not contain sufficient evidence that expenditures had been traced to original documents. Instead, the analysts had checked information against summary schedules prepared by the states. Without proper documentation, there is little assurance that these reviews are being adequately performed. Survey respondents also rated activities to (1) defer and disallow Medicaid expenditures and (2) perform in-depth analysis of specific Medicaid costs where problems have been found (i.e., focused financial management reviews) as important in overseeing the propriety of Medicaid expenditures. Some 89 percent of analysts rated deferral and disallowance determinations as having “highest” or “high” level of importance and focused financial management reviews were rated by 77 percent as “highest” or “high.” Data provided by CMS indicate, however, that the amount of Medicaid expenditures disallowed by regional analysts has declined in years after 1996, when oversight emphasis shifted from detailed reviews, and so did the number of focused financial management reviews conducted each year. For example, from 1990 through 1993, analysts disallowed on average $239 million annually in expenditures reported by states for federal reimbursement. However, from fiscal years 1997 through 2000, analysts disallowed on average about $43 million annually, which represents an 82 percent decline from previous years. Also, during these periods, Medicaid expenditures went from an average of $58 billion annually to $106 billion annually—an increase of 83 percent. Similarly, focused financial management reviews have declined. Focused financial management reviews generally involve selecting a sample of paid claims for review related to certain types of Medicaid services provided. These reviews have been useful in identifying unallowable costs outside of those detected through the review of quarterly expenditure reports as well as deficiencies in states’ financial management policies. According to CMS managers, in fiscal year 1992, analysts performed approximately 90 in- depth reviews of specific Medicaid issues that identified approximately $216 million in unallowable Medicaid costs. In fiscal year 2000, analysts only performed eight focused financial management reviews, but these reviews resulted in almost $45 million in disallowed costs—an average of about $5.6 million per review. As demonstrated, this control activity is effective in detecting unallowable Medicaid costs; however, it must be consistently performed for cost savings to be discovered. According to the director of DFM, the division is taking actions to improve oversight by beginning a comprehensive assessment of CMS’s Medicaid oversight activities. The division would like to increase several oversight activities, such as focused financial management reviews, to address the risks identified in CMS’s new risk-based approach. However, Medicaid financial managers are concerned that efforts to effectively address identified risks may be hindered without additional oversight resources. In the interim, CMS plans to use the current oversight process (i.e., quarterly expenditure reviews and technical assistance) for targeting those Medicaid issues that the new risk analysis identifies. In assessing what steps CMS could take to more efficiently and effectively carry out its responsibility on the federal level for helping ensure the propriety of Medicaid finances, we considered strategies that other entities have used in successfully addressing risks that lead to fraud, error, or improper payments. As discussed in our executive guide on strategies to manage improper payments, key strategies include taking action to select appropriate control activities based on an analysis of the specific risks facing the organization, taking into consideration the nature of the organization and the environment in which it operates; perform a cost-benefit analysis of potential control activities before implementation to ensure that the cost of the activities is not greater than the benefit; and contract out activities to firms that specialize in specific areas like neural networking, where in-house expertise is not available. Our executive guide points out that many organizations have implemented control techniques, including data mining, data sharing, and neural networking, to address identified risk areas and help ensure that program objectives are met. These techniques could help CMS better utilize its limited resources in applying effective oversight of Medicaid finances at the federal level. Some state Medicaid agencies have already implemented data mining, data sharing, and neural networking techniques to carry out their responsibilities on the state level for ensuring Medicaid program integrity. State auditors and HHS/OIG staff have also had success using these techniques in overseeing state Medicaid programs. However, resources devoted to protecting Medicaid program integrity and the use of these techniques varies significantly by state. From a federal standpoint, CMS should take into consideration the control activities performed at the state level in designing its Medicaid financial oversight control activities. CMS should use the results from states that are already using data mining, data sharing, and neural networking techniques in determining the extent and type of control techniques that its regional financial analysts should use in overseeing each state. And, for states where these techniques are not being used, CMS should consider using these tools in its oversight process. As illustrated in the following examples, data mining, data sharing, and neural networking techniques have been shown to achieve significant savings by identifying and detecting improper payments that have been made. Data mining is a technique in which relationships among data are analyzed to discover new patterns, associations, or sequences. The incidence of improper payments among Medicaid claims can, if sufficiently analyzed and related to other Medicaid data, reveal a correlation with a particular health care provider or providers. Using data mining software, the Illinois Department of Public Aid, in partnership with HHS/OIG, identified 232 hospital transfers that may have been miscoded as discharges, creating a potential overpayment of $1.7 million. Data sharing allows entities to compare information from different sources to help ensure that Medicaid expenditures are appropriate. Data sharing is particularly useful in confirming the initial or continuing eligibility of participants and in identifying improper payments that have already been made. We recently reported on a data sharing project called the Public Assistance Reporting Information System interstate match (PARIS) that has identified millions of dollars in costs savings for states. PARIS helps states share information on public assistance programs, such as Food Stamps and eligibility data for Medicaid, to identify individuals who may be receiving benefits in more than one state simultaneously. Using the PARIS data match for the first time in 1997, Maryland identified numerous individuals who no longer lived in the state but on whose behalf the state was continuing to pay a Medicaid managed care organization (MCO) as part of the MCO’s prospective monthly payment. The match identified $7.3 million in savings for the Medicaid program. Neural networking is a technique used to extract and analyze data. A neural network is intended to simulate the way a brain processes information, learns, and remembers. For example, this technique can help identify perpetrators of both known and unknown fraud schemes through the analysis of utilization trends, patterns, and complex interrelationships in the data. In 1997, the Texas legislature mandated the use of neural networks in the Medicaid program. Large volumes of medical claims and patient and provider history data are examined using neural network technology to identify fraudulent patterns. The Texas Medicaid Fraud and Abuse Detection System used neural networking to recover $3.4 million in fiscal year 2000. Based on consultations with state auditors, we noted that some auditors are performing audits that incorporate the advanced oversight techniques described above. New York and Texas are instituting data sharing and matching techniques at the state level to confirm initial eligibility of Medicaid participants and to identify improper payments that have already been made. Texas is using private contractors to design, develop, install, and train staff to use a system intended to integrate detection and investigation capabilities. This system includes a neural network that will allow the state to uncover potentially problematic payment patterns. Similarly, a large portion of the audit work that the HHS/OIG conducts to oversee the Medicaid expenditures for Massachusetts, Ohio, and Maine is conducted through electronic data matches of Medicaid claims data contained in the Medicaid Statistical Information System (MSIS). MSIS is the primary source of Medicaid program statistical information. As of the date of our report, 47 states were submitting Medicaid data electronically to MSIS. Information that the HHS/OIG finds as a result of electronic data matches is subsequently made available to regions and states for additional detailed work. CMS managers acknowledge that systems like MSIS could provide them with the capabilities to implement more advanced control techniques. While implementing control techniques such as data sharing, data mining, and neural networking may require up-front investment of resources, use of these techniques has the potential to result in significant savings to the Medicaid program. Having mechanisms in place to monitor the quality of an agency’s performance in carrying out program activities over time is critical to program management. The federal internal control standard for monitoring requires that agency managers implement monitoring activities to continuously assess the effectiveness of control activities put in place to address identified risks. Monitoring activities should include procedures to ensure that findings from all audits are reviewed and promptly resolved. The standards also state that pertinent information should be recorded and communicated to managers and staff promptly, to allow effective monitoring of events and activities as well as to allow prompt reactions. However, CMS had few mechanisms in place to continuously monitor the effectiveness of its control activities in overseeing the Medicaid program and collected limited information on the quality of Medicaid financial oversight performance. Specifically, CMS had not established performance standards to measure the effectiveness of its control activities, in particular its expenditure review activity. In addition, the CMS audit resolution process did not ensure that audit findings were resolved promptly and did not collect sufficient information on the status of audit findings. Without effective monitoring, CMS did not have the information needed to help assure the propriety of Medicaid expenditures. DFM financial managers responsible for monitoring the effectiveness of Medicaid internal control processes had established few mechanisms to do so. CMS did not establish performance standards and did not analyze or compare trend information on the results of its control activities, including the amount and type of Medicaid expenditures deferred and disallowed by regional analysts across all 10 regions. Medicaid financial managers told us that, before 1993, CMS collected information to monitor the performance of its oversight process. The performance reporting process required each region to submit quarterly data on the amount of expenditures disallowed; the number of focused financial management reviews conducted, and the related expenditures identified and recovered as a result of the reviews; the amount of inappropriate expenditures averted by providing technical assistance to states before payment; the number of regional financial analysts and related salary costs devoted to financial oversight; and the amount of travel dollars devoted to Medicaid financial oversight. Medicaid financial managers in DFM used this information to prepare national performance reports that calculated a return on investment for each region and a national return on investment. CMS managers said that they discontinued efforts to collect, analyze, and maintain performance data after 1993 because of staff reductions in the regions and headquarters. DFM managers currently collect some performance information, but it is not used to evaluate regional performance. For example, staff in DFM collect information on the amount of expenditures deferred and disallowed each quarter by each region. These data are used to adjust total expenditures for financial reporting purposes but not to assess regional oversight activities. DFM also maintains a spreadsheet that includes information on the types of expenditures disallowed. This information is not distributed to regional analysts. In addition, information on the types of expenditures deferred by each regional analyst is not consolidated and disseminated across regions. Regional analysts include the types of expenditures deferred in their own regional decision reports, but do not have the benefit of nationwide information because DFM does not prepare summary reports. Comprehensive information on the type of expenditures deferred and disallowed would help identify the types of Medicaid expenditures for which improper payments commonly occur and measure whether corrective actions or control techniques applied to certain Medicaid expenditures are effective in reducing improper payments. The director of DFM told us that steps would be taken within the next year to begin monitoring the effectiveness of the Medicaid financial oversight process. Medicaid financial managers plan to reinstitute the performance reporting process that was in place prior to 1993. While this is a good step, the previous performance reporting process lacked several elements necessary for effective internal control monitoring. For example, the performance reporting process did not establish agency-specific goals and measures for evaluating regional performance in reducing payment errors and inaccuracies. In addition, there were no formal criteria or standard estimation methodologies for regions to use in measuring the amount of unallowable costs that the states avoided because of technical assistance provided before payment. As discussed in our executive guide, Strategies to Manage Improper Payments, establishing such goals and measures is key to tracking the success of improvement initiatives. Standards for Internal Control in the Federal Government requires that agencies’ internal control monitoring activities include policies and procedures to ensure that audit and review findings are promptly resolved. According to the standards, agency managers should implement policies and procedures for reporting findings to the appropriate level of management, evaluating the findings, and ensuring that corrective actions are taken promptly in response to the findings. In our review, we found that the audit resolution and monitoring activities performed by CMS and its regional offices were limited. In addition, we found that audit resolution activities were inconsistently performed across regions. Further, pertinent information was not identified, documented, and distributed among those responsible for audit resolution. These conditions hamper CMS’s ability to resolve audit findings promptly and slow the recovery of millions of dollars in federal funds due from the states. Within CMS, three units share responsibility for audit resolution activities related to the Medicaid program. These are regional administrators and regional financial analysts, the Division of Audit Liaison (DAL), and DFM. Regional administrators and regional financial analysts have responsibility to perform the following audit resolution activities required by the HHS Grants Administration Manual: coordinate resolution of findings with the pertinent auditee (i.e., state Medicaid agency or providers); ensure that the related questioned costs due the federal government are recovered within established timeframes; verify that corrective actions have been developed and implemented for prepare quarterly reports documenting the status of audit resolution. DAL is responsible for maintaining a tracking system for each audit report and related findings, monitoring the timeliness and adequacy of audit resolution activities, distributing all audit clearance documents, and preparing monthly reports on the status of audit resolution and collection activities. DFM has one headquarters staff person responsible for coordinating and interacting with DAL and regional analysts to ensure that Medicaid related findings are resolved. An important part of regional analyst audit resolution activities involves following up on state Single Audit Act reports. Under the Single Audit Act, state auditors issue reports that include assessments of the internal controls related to major federal programs, including the Medicaid program, and compliance with laws, regulations, and provisions of contract or grant agreements. These reports generally include findings related to weaknesses identified in the financial management of state Medicaid programs as well as expenditures deemed erroneous or improper (e.g., questioned costs) for which states may owe money back to the federal government. Regional analysts are responsible for resolving audit findings, including determining whether the questioned costs related to audit findings reported by state auditors represent actual costs to be recovered from the state, and ensuring that they are actually recovered. In our discussions with regional staff during our review of state single audit findings, analysts admitted that they spend very little time on resolving state audit findings due to competing oversight responsibilities. Audit follow-up is one step of many performed during their quarterly state Medicaid expenditure reviews. As a result, state single audit findings are not always resolved, and related questioned costs are not promptly recovered. For example, we identified questioned costs totaling $24 million that had not been recovered. The audit reports that included the $24 million in questioned costs had been issued for years prior to fiscal year 1999. However, as of September 30, 2001, regional analysts had not completed actions to recover these costs. In addition, we found that, as of September 30, 2001, regional analysts had not determined whether corrective actions had been developed and/or implemented to resolve 85 of a total of 288 Medicaid findings included in state single audit reports for fiscal year 1999. These findings related to problems with state financial reporting, computer systems, and cash management. Lack of timely follow-up on financial management and internal control issues increases the risk that corrective actions have not been taken by the auditee and erroneous or improper payments are continuing to be made. In our review, we also found that the regional financial analysts inconsistently followed procedures for monitoring, tracking, and reporting on the resolution of Single Audit Act and HHS/OIG audit findings. For example, 3 of the 10 regions had not prepared quarterly status reports that are intended to provide information on corrective actions that states have taken to resolve audit findings. Further, pertinent information was not identified, documented, and distributed among those responsible for audit resolution. The internal control standard related to information and communication provides that pertinent information be identified, captured, and distributed to the appropriate areas in sufficient detail and at the appropriate time to enable the entity to carry out its duties and responsibilities efficiently and effectively. In our review, we found that the monthly report prepared by DAL that is intended to provide a complete list of all audits with unresolved Medicaid findings did not meet this standard. We analyzed a list provided by the HHS/OIG, which included 23 Medicaid related reports issued by the HHS/OIG and state auditors in fiscal year 2001. We found four reports from the HHS/OIG list that were not included in DAL monthly reports related to the second, third, and fourth quarters of that year. This information is critical and must be distributed to the regions to ensure that they are taking action to resolve all Medicaid related findings. We also found that the regions did not document information critical to tracking unresolved audits in their regional quarterly status reports. The regions reported which audits had been resolved. They did not report information on audits that they were reviewing that had not yet been resolved. This makes it difficult to track audit status. A sound organizational structure is a key factor that contributes to whether agency management can establish a positive control environment. Standards for Internal Control in the Federal Government provides that managers should ensure that an agency organizational structure is appropriate for the nature of its operations and designed so that authority and internal control responsibility is defined and well understood. Although CMS’s 10 regional offices are the federal government’s frontline for overseeing state Medicaid financial operations and expenditures, there are no reporting lines to the headquarters unit responsible for Medicaid financial management and few other mechanisms to ensure performance accountability. This structural relationship has created challenges in (1) establishing and enforcing minimum standards for performing financial oversight activities, (2) routinely evaluating the regional office oversight, and (3) implementing efforts to improve financial oversight. As a result, CMS lacks a consistent approach to monitor and improve performance among the units that share responsibility for financial management and ingrain a sound internal control environment for Medicaid finances throughout CMS. During the time of our review, there were no formal reporting relationships between the regional financial analysts and CMSO’s DFM or any other division or unit within CMSO. Regional offices reported directly to the CMS administrator through their respective regional administrators. This structural relationship does not lend itself to instituting standards for oversight control activities that can be consistently and effectively implemented. To illustrate, the CMS financial management strategy workgroup, headed by the director of DFM, updated guidance for expenditure reviews in September 2000 to provide uniform review procedures and address concerns raised by auditors about the inconsistency in expenditure reviews across regions. While the guide strongly encouraged regional analysts to complete all of its procedures, it did not mandate that analysts do so. Headquarters financial managers do not have direct authority to enforce such a directive and regional managers have discretion in how resources are utilized. Similarly, the guide allowed regional branch managers wide discretion in performing supervisory review of regional analysts’ expenditure review workpapers. The guide provides that a supervisor can assure that the analysts’ work measures up to CMS requirements in the review guide by either directly and selectively reviewing the work papers or by obtaining written or verbal assurance from the reviewer that the procedures have been completed. Supervisory reviews are a key internal control activity. By allowing supervisors to satisfy this responsibility merely with verbal assurance, CMS is minimizing the effectiveness of this basic control. During our site visits, we found evidence that supervisory reviews were not conducted. We reviewed regional analysts’ workpapers related to reviews of quarterly expenditure reports for five states submitted for the quarter ended December 31, 2000. These five states represent the largest states within the regions visited. Analysts’ workpapers for three of the five state quarterly expenditure reviews had no evidence of supervisory “sign off” and, when asked if the supervisors had reviewed the workpapers or discussed the results of the review, the analysts said they had not. The CMS organizational structure also hindered efforts to evaluate and monitor regional office performance. Currently, there are few formal requirements for regions to report to headquarters and CMS does not collect, analyze, or evaluate consistent information on the quality of regional financial oversight for Medicaid across the country. As mentioned previously, efforts to monitor performance were discontinued because regional staff resources were not available to collect and submit the data to headquarters managers. Headquarters managers did not have the authority to require regions to collect such data. As a result, Medicaid financial managers in headquarters were not in a position to provide formal feedback to region financial management staff to improve their performance and therefore have not been in a position to assess the effectiveness of Medicaid oversight activities. The current organizational structure also poses challenges to implementing corrective actions aimed at addressing oversight weaknesses and improving accountability. Over the past 2 years, headquarters financial managers have taken steps to develop and implement improvements to the financial oversight process. As previously mentioned, Medicaid staff are currently developing risk analysis to identify expenditures of greatest risk, working with states to develop methodologies for estimating Medicaid developing work plans that guide efforts to allocate financial oversight staff and travel resources based on the risk analysis, and developing performance-reporting mechanisms. Medicaid staff have also recently formed a financial management strategy workgroup of headquarters and regional financial management staff members to review the entire Medicaid financial oversight process and determine the proper structure for an adequate oversight process, updated its expenditure and budget review guides, and gathered information on how regional financial analyst staff time is allocated between oversight responsibilities. Headquarters DFM managers recognize that regional office commitment is critical to successfully implementing and sustaining its improvement initiatives. The current structural relationship could diminish the chances of such success. Headquarters managers expressed concern that despite recent efforts to develop risk analysis and implement work plans that allocate resources based on identified risks, regional managers will still have the authority to decide how oversight resources are used. Given the multiple oversight activities that regional financial analysts are responsible for, headquarters managers have no assurance that review areas included in the work plans will be given priority in each region. Headquarters managers may experience similar difficulties in reestablishing performance reporting. According to one senior Medicaid manager, some regions have already petitioned headquarters managers not to use data on the amount of expenditures deferred and disallowed in gauging performance. During our review, we asked regional financial analysts about several recent improvement initiatives to gauge their knowledge of and participation in such initiatives. Several analysts we spoke with during site visits did not think the risk assessment effort was useful because they felt that they were already aware of the risks within the states that they were responsible for and did not need a formal assessment to identify the risks. In addition, some said that they resented the headquarters managers trying to tell them where they needed to focus their efforts. In our survey, we asked regional financial analysts to rate the importance of the risk assessment, staff time allocation effort, and review guide updates to overall financial oversight. Approximately 50 percent of survey respondents thought the initiatives were of marginal or little importance. During pretests of our survey, several analysts said they did not understand the purpose of the initiatives, even though they had provided input. According to the analysts, no one had communicated to them how the information was going to be used. In discussions with headquarters managers, they acknowledged that a written plan or strategy, which describes the initiatives and the responsibility for implementing them, is currently being drafted. Such a plan or strategy could be very useful in soliciting regional analyst support. More important, headquarters managers acknowledged that performance accountability mechanisms for the regions are needed to implement improvements successfully. CMS is currently planning some changes that may improve mechanisms to hold CMS financial managers, including regional managers and administrators, accountable for critical tasks. A Restructuring and Management Plan recently developed by the CMS chief operating officer seeks to add specific responsibilities that are tied to specific agency goals into senior managers’ performance agreements. CMS has not determined how Medicaid financial management oversight and the various aspects of oversight responsibilities that can be evaluated will be included in the plan. Inclusion of such information is key to establishing a sound internal control environment for Medicaid finances throughout CMS. While CMS is taking steps to improve its financial oversight of the Medicaid program, the increasing size and complexity of the program, coupled with diminishing oversight resources, requires a new approach to address these challenges. Developing baseline information on Medicaid issues at greatest risk for improper payments and measuring improvements in program management against that baseline are key to achieving effective financial oversight. Determining the level of state activities to monitor and control Medicaid finances is also critical to CMS determining the extent and type of control techniques as well as the amount of resources it must apply at the federal level to adequately oversee the program. Establishing clear lines of authority and performance standards for CMS oversight would also provide for a more efficient, effective, and accountable Medicaid program. CMS’s ability to make the kind of changes that are needed will require top-level management commitment, a comprehensive financial oversight strategy that is clearly communicated to all those responsible for program oversight, and clear expectations for implementation of the changes. Recommendations for 	 To strengthen Medicaid internal controls and the financial oversight Executive Action process that CMS has in place to ensure the propriety of Medicaid finances, we make the following recommendations to the CMS administrator. We recommend that the CMS administrator revise current risk assessment efforts in order to more effectively and efficiently target oversight resources towards areas most vulnerable to improper payments by collecting, summarizing, and incorporating profiles of state financial oversight activities, that include information on state prepayment edits, provider screening procedures, postpayment detection efforts, and payment accuracy studies; incorporating information from reviews of state initiatives to prevent Medicaid fraud and abuse; developing and instituting feedback mechanisms to make risk assessment a continuous process and to measure whether risks have changed as a result of corrective actions taken to address them; and completing efforts to develop an approach to payment accuracy reviews at the state and national levels. In addition, we recommend that the CMS administrator restructure oversight control activities by increasing in-depth oversight of areas of higher risk as identified from the risk assessment efforts and applying fewer resources to lower risk areas; incorporating advanced control techniques, such as data mining, data sharing, and neural networking, where practical to detect potential improper payments; and using comprehensive Medicaid payment data that states must provide in the legislatively mandated national MSIS database. We also recommend that the CMS administrator develop mechanisms to routinely monitor, measure, and evaluate the quality and effectiveness of financial oversight, including audit resolution, by collecting, analyzing, and comparing trend information on the results of oversight control activities particularly deferral and disallowance determinations, focused financial reviews, and technical assistance; using the information collected above to assess overall quality of financial management oversight; identifying standard reporting formats that can be used consistently across regions for tracking open audit findings and reporting on the status of corrective actions; and revising DAL audit tracking reports to ensure that all audits with Medicaid related findings are identified and promptly reported to the regions for timely resolution. Finally, we recommend that the CMS administrator establish mechanisms to help ensure accountability and clarify authority and internal control responsibility between regional office and headquarters financial managers by including specific Medicaid financial oversight performance standards in senior managers’ performance agreements; and developing a written plan and strategy, which clearly defines and communicates the goals of Medicaid financial oversight and responsibilities for implementing and sustaining improvements. CMS provided written comments on a draft of this report (reprinted in app. I), as well as supplementary oral comments. In its written comments, CMS outlined a series of actions it has begun to take to address its Medicaid financial management challenges. In supplementary oral comments, CMS disagreed with our recommendations related to its audit tracking and resolution reports. In outlining actions taken to address Medicaid financial management challenges, CMS stated that its efforts substantially address, within current resource constraints, the four areas of our recommendations. CMS improvement efforts include (1) a structured financial workplan process that has been incorporated into its formal Restructuring and Management Plan, (2) actions to strengthen exchange of information with state oversight agencies, and (3) pilot projects aimed at clarifying authority and internal control responsibility between regional and headquarters managers. As many of these efforts are in the planning or early implementation stages, it is too soon to conclude whether they will effectively address our recommendations and improve Medicaid financial management. Additionally, given CMS concerns about resource constraints, prioritizing the planned actions and developing projected implementation schedules is key to ensuring that progress is made toward improving Medicaid financial management. In oral comments, CMS disagreed with our recommendations for strengthening its audit tracking and resolution functions. Regarding our recommendation to standardize the audit tracking reports among CMS regions, CMS stated that although the current format of audit tracking reports is not consistent across regions, the reports provide agency management with sufficient information to ensure that audit findings are resolved in a timely manner. We disagree. As stated in our report, the current reporting formats did not provide CMS with sufficient information to determine whether action had been taken to recover approximately $24 million in questioned costs identified in audit reports more than 2 years ago. Regarding our recommendation to revise its audit tracking reports, CMS stated that the reports are as complete as they can be given the information that they receive from the HHS-OIG. CMS offered a number of reasons for lack of complete data. CMS stated that the HHS-OIG does not consistently provide timely copies of Medicaid audit reports or make audit reports available on-line in a timely manner. Further, CMS said that the reports do not contain the information it needs to enter the report and related findings into the CMS tracking system properly, such as audit findings categorized by type (i.e., questioned cost or management related). HHS/OIG officials acknowledged that they sometimes fail to send some audit reports that CMS is responsible for tracking and resolving but said that they attempt to provide reports promptly when CMS contacts them. In our view, CMS and the HHS-OIG share responsibility in audit resolution. Accordingly, we continue to believe that CMS needs to be proactive in ensuring its tracking mechanisms promptly identify Medicaid findings for resolution and in following up to ensure that actions are taken to prevent Medicaid financial management weaknesses from continuing. As agreed with your office, unless you publicly announce the contents of this report earlier, we plan no further distribution until 30 days from its date. At that time, we will send copies to the chairmen and ranking minority members of the Senate Committee on Governmental Affairs and House Committee on Government Reform. We are also sending copies of this report to the secretary of health and human services, administrator of CMS, inspector general of HHS, and other interested parties. Copies will also be made available to those who request them. Please contact me or Kimberly Brooks at (202) 512-9508 if you or your staff have any questions about this report or need additional information. W. Ed Brown, Lisa Crye, Carolyn Frye, Chanetta Reed, Vera Seekins, Taya Tasse, and Cynthia Teddleton made key contributions to this report. Strategies to Manage Improper Payments: Learning From Public and Private Sector Organizations (GAO-02-69G, Oct. 2001). Public Assistance: PARIS Project Can Help States Reduce Improper Benefit Payments (GAO-01-935, Sept. 2001). Internal Control Management and Evaluation Tool (GAO-01-1008G, Aug. 2001). Medicaid: State Efforts to Control Improper Payments Vary (GAO-01-662, June 2001). Medicaid in Schools: Improper Payments Demand Improvements in HCFA Oversight (GAO/HEHS/OSI-00-69, Apr. 2000). Standards for Internal Control in the Federal Government (GAO/AIMD- 00-21.3.1, Nov. 1999). Medicaid Enrollment: Amid Declines, State Efforts to Ensure Coverage After Welfare Reform Vary (GAO/HEHS-99-163, Sept. 1999). The General Accounting Office, the investigative arm of Congress, exists to support Congress in meeting its constitutional responsibilities and to help improve the performance and accountability of the federal government for the American people. GAO examines the use of public funds; evaluates federal programs and policies; and provides analyses, recommendations, and other assistance to help Congress make informed oversight, policy, and funding decisions. GAO’s commitment to good government is reflected in its core values of accountability, integrity, and reliability. The fastest and easiest way to obtain copies of GAO documents is through the Internet. GAO’s Web site (www.gao.gov) contains abstracts and full-text files of current reports and testimony and an expanding archive of older products. The Web site features a search engine to help you locate documents using key words and phrases. You can print these documents in their entirety, including charts and other graphics. Each day, GAO issues a list of newly released reports, testimony, and correspondence. GAO posts this list, known as “Today’s Reports,” on its Web site daily. The list contains links to the full-text document files. To have GAO E-mail this list to you every afternoon, go to www.gao.gov and select “Subscribe to daily e-mail alert for newly released products” under the GAO Reports heading. Web site: www.gao.gov/fraudnet/fraudnet.htm, E-mail: fraudnet@gao.gov, or 1-800-424-5454 or (202) 512-7470 (automated answering system).

Summary: The Medicaid program spent more than $200 billion in fiscal year 2000 to meet the health care needs of nearly 34 million poor, elderly, blind, and disabled persons. States are responsible for making proper payments to Medicaid providers, recovering misspent funds, and accurately reporting costs for federal reimbursement. At the federal level, the Centers for Medicare and Medicaid Services (CMS) oversee state financial activities and ensure the propriety of expenditures reported for federal reimbursement. GAO found that weak financial oversight by CMS leaves the program vulnerable to improper payments. The Comptroller General's Standards for Internal Control in the Federal Government requires that agency managers perform risk assessment, take steps to mitigate identified risks, and monitor the effectiveness of those actions. The standards also require that authority and responsibility for internal controls be clearly defined. CMS oversight had weaknesses in each of these areas. As a result, CMS did not know if its control efforts were focused on areas of greatest risk. CMS also was not effectively implementing the controls it had in place. Furthermore, managers had not established performance standards for financial oversight activities, particularly their expenditure review activity. Limited data were collected to assess regional financial analyst performance in overseeing state internal controls and expenditures. In addition, the CMS audit resolution procedures did not collect enough information on the status of audit findings or ensure that audit findings were resolved promptly. CMS' current organizational structure lacks clear lines of authority and responsibility between the regions and headquarters.