Before 2006, companies choosing to participate in the Medicare Advantage program were required to annually submit an ACRP to CMS for review and approval for each plan they intended to offer. The ACRP consisted of two parts—a plan benefit package and the adjusted community rate (ACR). The plan benefit package contained a detailed description of the benefits offered, and the ACR contained a detailed description of the estimated costs to provide the package of benefits to an enrolled Medicare beneficiary. These costs were to be calculated based on how much a plan would charge a commercial customer to provide the same benefit package if its members had the same expected use of services as Medicare beneficiaries. CMS made payments to the companies monthly in advance of rendering services. In 2003, Congress enacted the Medicare Prescription Drug, Improvement and Modernization Act of 2003 (MMA). MMA included provisions that established a bid submission process to replace the ACRP submission process, as well as a new prescription drug benefit, both effective for 2006. Under the bid process, an organization choosing to participate in Medicare Advantage is required to annually submit a bid for review and approval for each plan they intend to offer. The bid submission includes the organization’s estimate of the cost of delivering services (submitted on a bid form) to an enrolled Medicare beneficiary and a plan benefit package that provides a detailed description of the benefits offered. In addition, each MA organization and prescription drug plan that offers prescription drug benefits under Part D is required to submit a separate prescription drug bid form, a formulary, and a plan benefit package to CMS for its review and approval. On the bid forms, MA organizations include an estimate of the per-person cost of providing Medicare-covered services. BBA requires CMS to annually audit the submissions of one-third of MA organizations. In defining what constituted an organization for the purpose of selecting one-third for audit, CMS officials explained that they determined the number of participating organizations based on the number of contracts they awarded. Under each contract, an organization can offer multiple plans. Further, an organization like Humana Inc. can have multiple contracts. CMS contracts with accounting and actuarial firms to perform these audits. For audits of the contract year 2006 bid forms, CMS contracted in September 2005 with six firms. CMS gave the auditors guidance. It is important to note that the audit guidance includes procedures to verify information used in the projection or estimation of costs submitted in the bids, not actual results or costs each year, as the bids do not report actual costs. According to our analysis of available CMS data, CMS did not meet the statutory requirement to audit the financial records of at least one-third of the participating MA organizations for contract years 2001 through 2005, nor has it done so yet for the 2006 bid submissions. We performed an analysis to determine whether CMS had met the requirement because CMS could not provide documentation to support the method it used to select the ACRs and bids for audit, nor did CMS document whether or how it met the one-third requirement for contract years 2001 through 2006. Our analysis shows that between 18.6 and 23.6 percent, or fewer than one- third, of the MA organizations (as defined by the number of contracts each year) for contract years 2001 through 2005 were audited each year. Similarly, we determined that only 13.9 percent of the MA organizations and prescription drug plans with approved bids for 2006 were audited, as of the end of our review. Table 1 summarizes our results. As stated earlier, CMS selects organizations to meet the one-third audit requirement based on the number of contracts awarded and not the total number of plans offered under each contract. However, to present additional perspective, we also analyzed the percentage of plans audited of the total number of plans offered by each audited organization. Our analysis shows that with the exception of contract year 2002, the level of audit coverage achieved by CMS audits has progressively decreased in terms of the percentage of plans audited for those organizations that were audited. Audit coverage has also decreased in terms of the percentage of plans audited of all plans offered by participating organizations each contract year. In contract year 2006, a large increase in the number of bid submissions meant that the 159 plans audited reflected only 3.2 percent of all the plans offered. Table 2 summarizes our analysis. Regarding contract years 2001 through 2004, CMS officials told us that they did not know how the MA organizations were selected for audit, and the documentation supporting the selections was either not created or not retained. For contract year 2005 audits, CMS officials told us that the selection criteria included several factors. They said that the criteria considered included whether the MA organization had been audited previously and whether it had significant issues. With respect to contract year 2006, CMS officials acknowledged the one- third requirement, but they stated that they did not intend for the audits of the 2006 bid submissions to meet the one-third audit requirement. They explained that they plan to conduct other reviews of the financial records of MA organizations and prescription drug plans to meet the requirement for 2006. In September 2006, CMS hired a contractor to develop the agency’s overall approach to conducting reviews to meet the one-third requirement. Draft audit procedures prepared by the contractor in May 2007, indicate that CMS plans to review solvency, risk scores, related parties, direct medical and administrative costs, and, where relevant, regional preferred provider organizations’ (RPPO) cost reconciliation reports for MA bids. For Part D bids, CMS indicated it also plans to review other areas, including beneficiaries’ true out-of-pocket costs. However, when our review ended, CMS had not yet clearly laid out how these reviews will be conducted to meet the one-third requirement. Further, CMS is not likely to complete these other financial reviews until almost 3 years after the bid submission date (see figure 1) for each contract year, in part because it must first reconcile payment data that prescription drug plans are not required to submit to CMS until 6 months after the contract year is over. Such an extended cycle for conducting these reviews greatly limits their usefulness to CMS and hinders CMS’ ability to recommend and implement timely actions to address identified deficiencies in the MA organizations’ and prescription drug plans’ bid processes. In its audits for contract years 2001-2005, CMS did not consistently ensure that the audit process provided information needed for assessing the potential impact of errors on beneficiaries’ benefits or payments to the MA organizations. The auditors reported findings ranging from lack of supporting documentation to overstating or understating certain costs, but did not identify how the errors affected beneficiary benefits, copayments, or premiums. In addition, although the auditors categorized their results as findings and observations, with findings being more significant, depending on their materiality to the average payment rate reported in the ACR, the distinction between findings and observations, was based on judgment, and therefore varied among the different auditors. In our 2001 report, we reported that CMS planned to require auditors, where applicable, to quantify in their audit reports the overall impact of errors. Further, during the work for the 2001 report, CMS officials stated that they were in the process of determining the impact on beneficiaries and crafting a strategy for audit follow-up and resolution. CMS did not initiate any actions to attempt to determine such impact until after the contract year 2003 audits were completed. CMS took steps to determine such impact and identified a net of about $35 million from the contract year 2003 audits that beneficiaries could have received in additional benefits. The only audit follow-up action that CMS has taken regarding the ACR audits was to provide copies of the audit reports to the MA organizations and instruct them to take action in subsequent ACR filings. In CMS’ audits of the 2006 bid submissions, 18 (or about 23 percent) of the 80 organizations audited had material findings that have an impact on beneficiaries or plan payments approved in bids. CMS defined material findings as those that would result in changes in the total bid amount of 1 percent or more or in the estimate for the costs per member per month of 10 percent or more for any bid element. CMS officials told us that they will use the results of the bid audits to help organizations improve their methods in preparing bids in subsequent years and to help improve the overall bid process. Specifically, they told us they could improve the bid forms, bid instructions, training, and bid review process. CMS’ audit follow-up process has not involved pursuing financial recoveries from Medicare Advantage organizations based on audit results even when information was available on deficiencies or errors that could impact beneficiaries. CMS officials told us they do not plan to pursue financial recoveries from MA organizations based on the results of ACR or bid audits because the agency does not have the legal authority to do so. According to our assessment of the statutes, CMS has the authority to pursue financial recoveries, but its rights under contracts for 2001 through 2005 are limited because its implementing regulations did not require that each contract include provisions to inform organizations about the audits and about the steps that CMS would take to address identified deficiencies, including pursuit of financial recoveries. Regarding the bid process that began in 2006, our assessment of the statutes is that CMS has the authority to include terms in bid contracts that would allow it to pursue financial recoveries based on bid audit results. CMS also has the authority to sanction organizations, but it has not. CMS officials believe the bid audits provide a “sentinel or deterrent effect” for organizations to properly prepare their bids because they do not know when the bids may be selected for a detailed audit. Given the current audit coverage, CMS is unlikely to achieve significant deterrent effect, however, because only 13.9 percent of participating organizations for contract 2006 have been audited. Appropriate oversight and accountability mechanisms are key to protecting the federal government’s interests in using taxpayer resources prudently. When CMS falls short in meeting the statutory audit requirements and in a timely manner resolving the findings arising from those audits, the intended oversight is not achieved and opportunities are lost to determine whether organizations have reasonably estimated the costs to provide benefits to Medicare enrollees. Inaction or untimely audit resolution also undermines the presumed deterrent effect of audit efforts. While the statutory audit requirement does not expressly state the objective of the audits or how CMS should address the results of the audits, the statute does not preclude CMS from including terms in its contracts that allow it to pursue financial recoveries based on audit results. If CMS maintains the view that statute does not allow it to take certain actions, the utility of CMS’ efforts is of limited value. In our recent report, we made several recommendations to the CMS Administrator to improve processes and procedures related to its meeting the one-third audit requirement and audit follow-up. We also recommended that CMS amend its implementing regulations for the Medicare Advantage Program and Prescription Drug Program to provide that all contracts CMS enters into with MA organizations and prescription drug plan sponsors include terms that inform these organizations of the audits and give CMS authority to address identified deficiencies, including pursuit of financial recoveries. We further recommended that if CMS does not believe it has the authority to amend its implementing regulations for these purposes, it should ask Congress for express authority to do so. In response to our report, CMS concurred with our recommendations and stated it is in the process of implementing some of our recommendations. For information about this statement, please contact Jeanette Franzel, Director, Financial Management and Assurance, at (202) 512-9471 or franzelj@gao.gov or James Cosgrove, Acting Director, Health Care, at (202) 512-7029 or cosgrovej@gao.gov. Individuals who made key contributions to this testimony include Kimberly Brooks (Assistant Director), Christine Brudevold, Paul Caban, Abe Dymond, Jason Kirwan, and Diane Morris. This is a work of the U.S. government and is not subject to copyright protection in the United States. It may be reproduced and distributed in its entirety without further permission from GAO. However, because this work may contain copyrighted images or other material, permission from the copyright holder may be necessary if you wish to reproduce this material separately.

Summary: In fiscal year 2006, the Centers for Medicare & Medicaid Services (CMS) estimated it spent over $51 billion on the Medicare Advantage program, which serves as an alternative to the traditional feefor- service program. Under the Medicare Advantage program, CMS approves private companies to offer health plan options to Medicare enrollees that include all Medicare-covered services. Many plans also provide supplemental benefits. The Balanced Budget Act (BBA) of 1997 requires CMS to annually audit the financial records supporting the submissions (i.e., adjusted community rate proposals (ACRP) or bids) of at least onethird of participating organizations. BBA also requires that GAO monitor the audits. This testimony provides information on (1) the ACRP and bid process and related audit requirement, (2) CMS' efforts related to complying with the audit requirement, and (3) factors that cause CMS' audit process to be of limited value. Before 2006, companies choosing to participate in the Medicare Advantage program were annually required to submit an ACRP to CMS for review and approval. In 2006, a bid submission process replaced the ACRP process. The ACRPs and bids identify the health services the company will provide to Medicare members and the estimated cost for providing those services. CMS contracted with accounting and actuarial firms to perform the required audits. According to our analysis, CMS did not meet the requirement for auditing the financial records of at least one-third of the participating Medicare Advantage organizations for contract years 2001-2005. CMS is planning to conduct other financial reviews of organizations to meet the audit requirement for contract year 2006. However, CMS does not plan to complete the financial reviews until almost 3 years after the bid submission date each contract year, which will affect its ability to address any identified deficiencies in a timely manner. CMS did not consistently ensure that the audit process for contract years 2001-2005 provided information to assess the impact on beneficiaries. After contract year 2003 audits were completed, CMS took steps to determine such impact and identified an impact on beneficiaries of about $35 million. CMS audited contract year 2006 bids for 80 organizations, and 18 had a material finding that affected amounts in approved bids. CMS officials took limited action to follow up on contract year 2006 findings. CMS officials told us they do not plan to sanction or pursue financial recoveries based on these audits because the agency does not have the legal authority to do so. According to our assessment of the statutes, CMS had the authority to pursue financial recoveries, but its rights under contracts for 2001-2005 were limited because its implementing regulations did not require that each contract include provisions to inform organizations about the audits and about the steps that CMS would take to address identified deficiencies. Further, our assessment of the statute is that CMS has the authority to include terms in bid contracts that would allow it to pursue financial recoveries. Without changes in its procedures, CMS will continue to invest resources in audits that will likely provide limited value.