To address the extent to which CMS implemented control procedures over contract actions, we focused on contracts that were generally subject to the FAR (i.e., FAR-based), which represented about $2.5 billion, or about 70 percent, of total obligations awarded in fiscal year 2008. The FAR is the governmentwide regulation containing the rules, standards, and requirements for the award, administration, and termination of government contracts. Based on the standards for internal control, FAR requirements, and agency policies, we identified and evaluated 11 key internal control procedures over contract actions, ranging from ensuring contractors had adequate accounting systems prior to the use of a cost reimbursement contract to certifying invoices for payment. Contract actions include new contract awards and modifications to existing contracts. We conducted our tests on a statistically random sample of 102 FAR-based contract actions CMS made in fiscal year 2008 and projected the results of our statistical sample conservatively by reporting the lower bound of our two-sided, 95 percent confidence interval. We tested a variety of contract actions including a range of dollars obligated, different contract types (fixed price, cost reimbursement, etc.), and the types of goods and services procured. The actions in the sample ranged from a $1,000 firm-fixed price contract for newspapers to a $17.5 million modification of an information technology contract valued at over $500 million. For each contract action in the sample, we determined if the 11 key internal control procedures were implemented by reviewing the contract file supporting the action and, where applicable, by obtaining additional information from the contracting officer or specialist or senior acquisition management. We also tested the reliability of the data contained in CMS’s two acquisition databases. To address the extent to which CMS established a strong control environment for contract management, we obtained and reviewed documentation regarding contract closeout, acquisition planning, and other management information and interviewed officials in the Office of Acquisition and Grants Management (OAGM) about its contract management processes. We also evaluated the extent to which CMS had addressed recommendations we made in our 2007 report. We used the internal control standards as a basis for our evaluation of CMS’s contract management control environment. Appendix I of our October 2009 report provides additional details of our scope and methodology. This testimony is based on our October 2009 performance audit, which was conducted from July 2008 to September 2009 in accordance with generally accepted government auditing standards. Those standards require that we plan and perform the audit to obtain sufficient, appropriate evidence to provide a reasonable basis for our findings and conclusions based on our audit objectives. We believe that the evidence obtained provides a reasonable basis for our findings and conclusions based on our audit objectives. Except for certain Medicare claims processing contracts, CMS contracts are generally required to be awarded and administered in accordance with general government procurement laws and regulations such as the FAR; the Health and Human Services Acquisition Regulations (HHSAR); the Cost Accounting Standards (CAS); and the terms of the contract. Since 1998, CMS’s obligations to fiscal intermediaries, carriers, and Medicare Administrative Contractors (contractors that primarily process Medicare claims) have decreased approximately 16 percent. In contrast, obligations for other-than-claims processing contract activities, such as the 1-800 help line, information technology and financial management initiatives, and program management and consulting services, have increased 466 percent. These trends may be explained in part by recent changes to the Medicare program, including the movement of functions, such as the help line, data centers, and certain financial management activities, from the fiscal intermediaries and carriers to specialized contractors. MMA required CMS to transition its Medicare claims processing contracts, which generally did not follow the FAR, to the FAR environment through the award of contracts to Medicare Administrative Contractors. CMS projected that the transition, referred to as Medicare contracting reform, would produce administrative cost savings due to the effects of competition and contract consolidation as well as produce Medicare trust fund savings due to a reduction in the amount of improper benefit payments. Additionally, the transition would subject millions of dollars of CMS acquisitions to the rules, standards, and requirements for the award, administration, and termination of government contracts in the FAR. Obligations to the new Medicare Administrative Contractors were first made in fiscal year 2007. CMS is required to complete Medicare contracting reform by 2011. As of September 1, 2009, 19 contracts had been awarded to Medicare Administrative Contractors, totaling about $1 billion in obligations. The Standards for Internal Control in the Federal Government provide the overall framework for establishing and maintaining internal control and for identifying and addressing areas at greatest risk of fraud, waste, abuse, and mismanagement. These standards provide that—to be effective—an entity’s management should establish both a supportive overall control environment and specific control activities directed at carrying out its objectives. As such, an entity’s management should establish and maintain an environment that sets a positive and supportive attitude towards control and conscientious management. A positive control environment provides discipline and structure as well as the climate supportive of quality internal control, and includes an assessment of the risks the agency faces from both external and internal sources. Control activities are the policies, procedures, techniques, and mechanisms that enforce management’s directives and help ensure that actions are taken to address risks. The standards further provide that information should be recorded and communicated to management and oversight officials in a form and within a time frame that enables them to carry out their responsibilities. Finally, an entity should have internal control monitoring activities in place to assess the quality of performance over time and ensure that the findings of audits and other reviews are promptly resolved. Control activities include both preventive and detective controls. Preventive controls—such as invoice review prior to payment—are controls designed to prevent errors, improper payments, or waste, while detective controls—such as incurred cost audits—are designed to identify errors or improper payments after the payment is made. A sound system of internal control contains a balance of both preventive and detective controls that is appropriate for the agency’s operations. While detective controls are beneficial in that they identify funds that may have been inappropriately paid and should be returned to the government, preventive controls such as accounting system reviews and invoice reviews help to reduce the risk of improper payments or waste before they occur. A key concept in the standards is that control activities selected for implementation be cost beneficial. Generally it is more effective and efficient to prevent improper payments. A control activity can be preventive, detective, or both based on when the control occurs in the contract life cycle. Additional, detailed background information is available in our related report, GAO-10-60. Our October 2009 report identified pervasive deficiencies in internal control over contracting and payments to contractors. Specifically, as a result of our work, we estimated that at least 84.3 percent of FAR-based contract actions made by CMS in fiscal year 2008 contained at least one instance in which 1 of 11 key controls was not adequately implemented. Not only was the number of internal control deficiencies widespread, but also many contract actions had more than one deficiency. We estimated that at least 37.2 percent of FAR-based contract actions made in fiscal year 2008 had three or more instances in which a key control was not adequately implemented. The internal control deficiencies occurred throughout the contracting process and increased the risk of improper payments or waste. These deficiencies were due in part to a lack of agency-specific policies and procedures to ensure that FAR requirements and other control objectives were met. CMS also did not take appropriate steps to ensure that existing policies were properly implemented or maintain adequate documentation in its contract files. Further, CMS’s Contract Review Board process had not been properly or effectively implemented to help ensure proper contract award actions. These internal control deficiencies are a manifestation of CMS’s weak overall control environment, which is discussed later. Additional, detailed information on our testing of key internal controls is available in our October 2009 report. The high percentage of deficiencies indicates a serious failure of control procedures over FAR-based acquisitions, thereby creating a heightened risk of improper payments or waste. Highlights of the control deficiencies we noted included the following. We estimated that at least 46.0 percent of fiscal year 2008 CMS contract actions did not meet the FAR requirements applicable to the specific contract type awarded. For example, we found that CMS used cost reimbursement contracts without first ensuring that the contractor had an adequate accounting system. According to the FAR, a cost reimbursement contract may be used only when the contractor’s accounting system is adequate for determining costs applicable to the contract. To illustrate, of the contract awards in our sample, we found nine cases in which cost reimbursement contracts were used without first ensuring that the contractor had an adequate accounting system. In addition to these nine cases, during our review of contract modifications we observed another six cases in which cost reimbursement contracts were used even though CMS was aware that the contractor’s accounting system was inadequate at the time of award. In one instance, the contracting officer was aware that a contractor had an inadequate accounting system resulting from numerous instances of noncompliance with applicable Cost Accounting Standards. Using a cost reimbursement contract when a contractor does not have an adequate accounting system hinders the government’s ability to fulfill its oversight duties throughout the contract life cycle and increases risk of improper payments and the risk that costs billed cannot be substantiated during an audit. We estimated that for at least 40.4 percent of fiscal year 2008 contract actions, CMS did not have sufficient support for provisional indirect cost rates nor did it identify instances when a contractor billed rates higher than the rates that were approved for use. Provisional indirect cost rates provide agencies with a mechanism by which to determine if the indirect costs billed on invoices are reasonable for the services provided until such time that final indirect cost rates can be established, generally at the end of the contractor’s fiscal year. When the agency does not maintain adequate support for provisional indirect rates, it increases its risk of making improper payments. We estimated that for at least 52.6 percent of fiscal year 2008 contract actions, CMS did not have support for final indirect cost rates or support for the prompt request of an audit of indirect costs. The FAR states that final indirect cost rates, which are based on a contactor’s actual indirect costs incurred during a given fiscal year, shall be used in reimbursing indirect costs under cost reimbursement contracts. The amounts a contractor billed using provisional indirect cost rates are adjusted annually for final indirect cost rates, thereby providing a mechanism for the government to timely ensure that indirect costs are allowable and allocable to the contract. CMS officials told us that they generally adjust for final indirect cost rates during contract closeout at the end of the contract performance rather than annually mainly due to the cost and effort the adjustment takes. However, CMS did not promptly close out its contracts and had not made progress in reducing the backlog of contracts eligible for closeout. Specifically, in 2007, we reported that CMS’s backlog was 1,300 contracts, of which 407 were overdue for closeout as of September 30, 2007. This backlog continued to increase, and CMS officials stated that as of July 29, 2009, the total backlog of contracts eligible for closeout was 1,611, with 594 overdue based on FAR timing standards. Not annually adjusting for final indirect cost rates increases the risk that CMS is paying for costs that are not allowable or allocable to the contract. Furthermore, putting off the control activity until the end of contract performance increases the risk of overpaying for indirect costs during contract performance and may make identification or recovery of any unallowable costs during contract closeout more difficult due to the passage of time. We estimated that for at least 54.9 percent of fiscal year 2008 contract actions, CMS did not promptly perform or request an audit of direct costs. Similar to the audit of indirect costs, audits of direct costs allow the government to verify that the costs billed by the contractor were allowable, reasonable, and allocable to the contract. Not annually auditing direct costs increases the risk that CMS is paying for costs that are not allowable or allocable to the contract. We estimated that for at least 59.0 percent of fiscal year 2008 contract actions, the project officer did not always certify the invoices. CMS’s Acquisition Policy Notice 16-01 requires the project officer to review each contractor invoice and recommend payment approval or disapproval to the contracting officer. This review is to determine, among other things, if the expenditure rate is commensurate with technical progress and whether all direct cost elements are appropriate, including subcontracts, travel, and equipment. We noted in our 2007 report that CMS used negative certification—a process whereby it paid contractor invoices without knowing whether they were reviewed and approved—in order to ensure invoices were paid in a timely fashion. In October 2009 we reported that negative certification continued to be CMS’s policy to process contractor invoices for payment. This approach, however, significantly reduces the incentive for contracting officers, specialists, and project officers to review the invoice prior to payment. For example, in one case, although a contractor submitted over 100 invoices for fiscal year 2008, only 8 were certified by the project officer. The total value of the contract through January 2009 was about $64 million. In addition, based on a cursory review of the fiscal year 2008 invoices submitted for payment, we found instances in which the contracting officer or specialist did not identify items that were inconsistent with the terms of the contract or acquisition regulations. For example, we found two instances where the contractor billed, and CMS paid, for items generally disallowed by HHSAR. Reviewing invoices prior to payment is a preventive control that may result in the identification of unallowable billings, especially on cost reimbursement and time and materials invoices, before the invoices are paid. CMS increases its risk of improper payments when it does not properly review and approve invoices prior to payment. The control deficiencies we identified in the statistical sample discussed in our October 2009 report stemmed from a weak overall control environment. CMS’s control environment was characterized by the lack of (1) strategic planning to identify necessary staffing and funding; (2) reliable data for effectively carrying out contract management responsibilities; and (3) follow-up to track, investigate, and resolve contract audit and evaluation findings for purposes of cost recovery and future award decisions. A positive control environment sets the tone for the overall quality of an entity’s internal control, and provides the foundation for an entity to effectively manage contracts and payments to contractors. Without a strong control environment, the control deficiencies we identified will likely persist. Following is a summary of the weaknesses we found in CMS’s overall control environment: Limited analysis of contract management workforce and related funding needs. OAGM management had not analyzed its contract management workforce and related funding needs through a comprehensive, strategic acquisition workforce plan. Such a plan is critical to help manage the increasing acquisition workload and meet its contracting oversight needs. We reported in November 2007 that staff resources allocated to contract oversight had not kept pace with the increase in CMS contract awards. In our 2009 report, we found a similar trend continued into 2008. While the obligated amount of contract awards had increased 71 percent since 1998, OAGM staffing resources—its number of full time equivalents (FTE)—had increased 26 percent. This trend presents a major challenge to contract award and administration personnel who must deal with a significantly increased workload without additional support and resources. In addition, according to its staff and management, OAGM faced challenges in meeting the various audit requirements necessary to ensure adequate oversight of contracts that pose more risk to the government, specifically cost reimbursement contracts, as well as in performing the activities required of a cognizant federal agency (CFA). Although officials told us they could use more audit funding, we found that OAGM management had yet to determine what an appropriate funding level should be. Without knowing for which contractors additional CFA oversight was needed, CMS did not have reliable information on the number of audits and reviews that must be performed annually or the depth and complexity of those audits. Without this key information, CMS could not estimate an adequate level of needed audit funding. The risks of not performing CFA duties are increased by the fact that other federal agencies that use the same contractors rely on the oversight and monitoring work of the CFA. A shortage of financial and human resources creates an environment that introduces vulnerabilities to the contracting process, hinders management’s ability to sustain an effective overall control environment, and ultimately increases risk in the contracting process. Lack of reliable contract management data. Although CMS had generally reliable information on the basic attributes of each contract action, such as vendor name and obligation amount, CMS lacked reliable management information on other key aspects of its FAR-based contracting operations. For example, in our October 2009 report we identified acquisition data errors related to the number of certain contract types awarded, the extent of competition achieved, and total contract value. Standards for internal control provide that for an agency to manage its operations, it must have relevant, reliable, and timely information relating to the extent and nature of its operations, including both operational and financial data, and such information should be recorded and communicated to management and others within the agency who need it and in a form and within a time frame that enables them to carry out their internal control and operational responsibilities. The acquisition data errors were due in part to a lack of sufficient quality assurance activities over the data entered into the acquisition databases. Without accurate data, CMS program managers did not have adequate information to identify, monitor, and correct or mitigate areas that posed a high risk of improper payments or waste. Lack of follow-up to resolve contract audit and evaluation findings. CMS did not track, investigate, and resolve contract audit and evaluation findings for purposes of cost recovery and future award decisions. Tracking audit and evaluation findings strengthens the control environment in part because it can help assure management that the agency’s objectives are being met through the efficient and effective use of the agency’s resources. It can also help management determine whether the entity is complying with applicable acquisition laws and regulations. Contract audits and evaluations can add significant value to an organization’s oversight and accountability structure, but only if management ensures that the results of these audits and evaluations are promptly investigated and resolved. For example, in an audit report dated September 30, 2008, the Defense Contract Audit Agency questioned approximately $2.1 million of costs that CMS paid to a contractor in fiscal year 2006. As discussed in our October 2009 report, OAGM management confirmed that no action had been taken at that time to investigate and recover the challenged costs. As we reported in October 2009, CMS management had not taken substantial actions to address our 2007 recommendations to improve internal control in the contracting process. Only two of GAO’s nine 2007 recommendations had been fully addressed. Table 1 summarizes our assessment of the status of CMS’s actions to address our recommendations. In addition to reaffirming the 7 substantially unresolved 2007 recommendations, our October 2009 report included 10 recommendations to further improve oversight and strengthen CMS’s control environment. Specifically, we made recommendations for additional procedures or plans to address the following 10 areas: document compliance with FAR requirements for different contract types; document provisional indirect cost rates in the contract file; specify what constitutes timely performance of (or request for) audits of contractors’ billed costs; specify circumstances for the use and content of negotiation memorandums, including any required secondary reviews; specify Contract Review Board documentation, including resolution of issues identified during the CRB reviews; conduct periodic reviews of contract files to ensure invoices were properly reviewed by both the project officer and contracting officer or specialist; develop a comprehensive strategic acquisition workforce plan, with resource needs to fulfill FAR requirements for comprehensive oversight, including CFA duties; revise the verification and validation plan to require all relevant acquisition data errors be corrected and their resolution documented; develop procedures for tracking contract audit requests and the resolution of audit findings; and develop procedures that clearly assign roles and responsibilities for the timely fulfillment of CFA duties. In commenting on a draft of our October 2009 report, CMS and HHS agreed with each of our 10 new recommendations and described steps planned to address them. CMS also stated that the recommendations will serve as a catalyst for improvements to the internal controls for its contracting function. CMS also expressed concerns about our assessment of key internal controls and disagreed with our conclusions on the status of CMS’s actions to address our November 2007 recommendations. CMS stated its belief that “virtually all” of the errors we identified in our statistical sample related to “perceived documentation deficiencies.” CMS also expressed concern that a reasonable amount of time had not yet elapsed since the issuance of our November 2007 report to allow for corrective actions to have taken place. However, as discussed in greater detail in our October 2009 report response to agency comments, nearly 2 years had elapsed between our November 2007 and October 2009 reports and CMS had made little progress in addressing the recommendations from our November 2007 report. Further, a significant number of our October 2009 report findings, including weaknesses in the control environment, were based on observations and interviews with OAGM officials and reviews of related documentation such as policies and strategic plans. Finally, the deficiencies we identified negatively impact the key controls intended to help ensure compliance with agency acquisition regulations and the FAR. In conclusion, Madam Chairman, while we have not updated the status of any CMS actions to address our October 2009 findings and recommendations, the extent to which control weaknesses in CMS’s contracting activities continue, raises questions concerning whether CMS management has established an appropriate “tone at the top” to effectively manage these key activities. Until CMS management addresses our previous recommendations in this area, along with taking action to address the additional deficiencies identified in our October 2009 report, its contracting activities will continue to pose significant risk of improper payments, waste, and mismanagement. Further, the deficiencies we identified are likely to be exacerbated by the rise in obligations for non- claims processing contract awards as well as CMS’s extensive reliance on contractors to help achieve its mission objectives. It is imperative that CMS address its serious contract-level control deficiencies and take action on our recommendations to improve overall environment controls or CMS will continue to place billions of taxpayer dollars at risk of fraud, or otherwise improper contract payments. We commend the Subcommittee for its continuing oversight and leadership in this important area and believe that hearings such as the one being held today will be critical to ensuring that CMS’s continuing contract management weaknesses are resolved without further delay and that overall risks to the government are substantially reduced. Madam Chairman and Members of the Subcommittee, this concludes my prepared statement. I would be happy to answer any questions that you may have at this time. For further information regarding this testimony, please contact Kay L. Daly at (202) 512-9095 or dalykl@gao.gov. In addition, contact points for our Offices of Congressional Relations and Public Affairs may be found on the last page of this statement. Individuals who made key contributions to this testimony are Marcia Carlsen and Phil McIntyre (Assistant Directors), Sharon Byrd, Richard Cambosos, Francine DelVecchio, Abe Dymond, John Lopez, Ron Schwenn, Omar Torres, Ruth Walk, and Danietta Williams. This is a work of the U.S. government and is not subject to copyright protection in the United States. The published product may be reproduced and distributed in its entirety without further permission from GAO. However, because this work may contain copyrighted images or other material, permission from the copyright holder may be necessary if you wish to reproduce this material separately.

Summary: In November 2007, GAO reported significant deficiencies in internal control over certain contracts the Centers for Medicare and Medicaid Services (CMS) awarded under the Federal Acquisition Regulation (FAR). This Subcommittee and others in Congress asked GAO to perform an in-depth review of CMS's contract management practices. This testimony is based on GAO's October 2009 report on these issues and summarizes GAO's findings on the extent to which CMS (1) implemented effective control procedures over contract actions, (2) established a strong contract management control environment, and (3) implemented GAO's 2007 recommendations. GAO used a statistical random sample of 2008 CMS contract actions to assess CMS internal control procedures. The results were projected to the population of 2008 CMS contract actions. GAO reviewed contract file documentation and interviewed senior acquisition management officials. GAO reported in October 2009 that pervasive deficiencies in CMS contract management internal control increased the risk of improper payments or waste. Specifically, based on a statistical random sample of 2008 CMS contract actions, GAO estimated that at least 84.3 percent of fiscal year 2008 contract actions contained at least one instance where a key control was not adequately implemented. For example, CMS used cost reimbursement contracts without first ensuring that the contractor had an adequate accounting system, as required by the FAR. These deficiencies were due in part to a lack of agency-specific policies and procedures to help ensure proper contracting expenditures. These control deficiencies stemmed from a weak overall control environment characterized primarily by inadequate strategic planning for staffing and funding resources. CMS also did not accurately capture data on the nature and extent of its contracting, hindering CMS's ability to manage its acquisition function by identifying areas of risk. Finally, CMS did not track, investigate, and resolve contract audit and evaluation findings for purposes of cost recovery and future award decisions. A positive control environment sets the tone for the overall quality of internal control and provides the foundation for effective contract management. Without a strong control environment, the specific control deficiencies GAO identified will likely persist. As of the date of GAO's October 2009 report, CMS had not substantially addressed seven of the nine recommendations made by GAO in 2007 to improve internal control over contracting and payments to contractors. To the extent that CMS has continuing weaknesses in contracting activities, it will continue to put billions of taxpayer dollars at risk of improper payments or waste.