CMS, a component of the Department of Health and Human Services (HHS), administers the Medicaid program. Medicaid is the third largest social program in the federal budget and is one of the largest components of state budgets. Although it is one federal program, Medicaid consists of 56 distinct state-level programs–one for each state, territory, Puerto Rico, and the District of Columbia. Each of the states has a designated Medicaid agency that administers the Medicaid program. The federal government matches state Medicaid spending for medical assistance according to a formula based on each state’s per capita income. The federal share can range from 50 to 83 cents of every state dollar spent. In accordance with the Medicaid statute and within broad federal guidelines, each state establishes its own eligibility standards; determines the type, amount, duration, and scope of covered services; sets payment rates; and develops its administrative structure. Each state Medicaid agency is also responsible for establishing and maintaining an adequate internal control structure to ensure that the Medicaid program is managed with integrity and in compliance with applicable law. States are required to describe the nature and scope of their programs in comprehensive written plans submitted to CMS–with federal funding for state Medicaid services contingent on CMS approval of the plans. This approval hinges on whether CMS determines that state Medicaid plans meet all applicable federal laws and regulations. At the federal level, the Center for Medicaid and State Operations (CMSO) within CMS is responsible for approving state Medicaid plans, working with the states on program integrity and other program administration functions, and overseeing state financial management and internal control processes. CMSO shares Medicaid program administration and financial management responsibilities with the 10 CMS regional offices (RO). The Division of Financial Management (DFM), within CMSO’s Finance, Systems and Quality Group, has primary responsibility for Medicaid financial management. DFM, in conjunction with the 10 regions, establishes and maintains the internal control structure for Medicaid financial management and state oversight. As is the case for all major federal agency programs, the internal control structure established by CMS for Medicaid should meet requirements of Office of Management and Budget (OMB) Circular A-123, Management Accountability and Control, and the Standards for Internal Control in the Federal Government. According to Circular A-123, management controls are the organization policies and procedures used to reasonably ensure that programs are protected from waste, fraud, and mismanagement and achieve their intended results. Establishing good management controls requires, according to the circular, that agency managers take systematic and proactive measures to implement appropriate management controls, assess the adequacy of the controls, identify needed improvements, and take corresponding corrective action. The Standards for Internal Control in the Federal Government includes five standards that provide a roadmap for agencies to establish control for all aspects of their operations and a basis against which agencies’ control structures can be evaluated. The standards are defined as follows: Control environment—creating a culture of accountability by establishing a positive and supportive attitude toward improvement and the achievement of established program outcomes. Risk assessment—performing comprehensive reviews and analyses of program operations to determine if risks exist and the nature and extent of the risks identified. Control activities—taking actions to address identified risk areas and help ensure that management’s decisions and plans are carried out and program objectives are met. Information and communication—using and sharing relevant, reliable, and timely financial and nonfinancial information in managing operations. Monitoring—tracking improvement initiatives over time, and identifying additional actions needed to further improve program efficiency and effectiveness. The internal control structure and financial oversight process that CMS has designed for Medicaid includes activities for (1) approving and awarding grants to make funds available to the states for the efficient operation of the Medicaid program, (2) overseeing state financial management and internal control processes, (3) ensuring the reasonableness of budgets reported to estimate federal funding requirements, and (4) ensuring the propriety of expenditures reported for federal matching funds. DFM shares these responsibilities with about 76 regional financial analysts and branch chiefs, who report to their respective regional administrators. Figure 1 outlines CMS’s organizational structure related to Medicaid. Regional financial analysts are key to CMS financial management activities, as they are responsible for performing frontline activities to oversee state financial management and internal control processes. Some of the key oversight activities performed by regional analysts are (1) reviewing state quarterly budget estimates and expenditure reports, (2) preparing decision reports that document approvals for federal reimbursement and reimbursement deferral actions, (3) providing technical assistance to states on financial matters, and (4) serving as liaison to the states and audit entities. DFM staff in headquarters rely on regional decision reports to help determine and issue state grant awards. States submit various federal reporting forms that provide regional financial analysts with the budget and expenditure data to execute their financial management and oversight responsibilities. When the State Children’s Health Insurance Program (SCHIP) was created through the Balanced Budget Act of 1997 to provide health insurance to children of low- income families who would not qualify for Medicaid, states have been required to submit expenditure and budget data on both Medicaid and SCHIP. The Medicaid and SCHIP forms are submitted quarterly through the Medicaid and SCHIP Budget and Expenditure System (MBES). See table 1 below for a brief description of the contents of the reporting forms. Reviews of the Medicaid and SCHIP expenditure reports (CMS 64 and 21) are the primary oversight control activities performed by regional financial analysts. These reviews are used to determine if Medicaid expenditures are complete, properly supported by the state’s accounting records, claimed at appropriate federal matching rates, and allowable in accordance with existing federal laws and regulations. Regional analysts are expected to obtain knowledge about state financial management and internal control processes to aid in assessing the expenditures reported for federal reimbursement. Figure 2 shows an overview of the financial management and oversight process. Oversight of state expenditures and internal controls by CMS regional financial analysts is not the only federal oversight mechanism for ensuring the propriety of Medicaid finances. Medicaid expenditures and requisite internal controls are reviewed annually by auditors under requirements of the Single Audit Act of 1984. The Congress established the Single Audit Act to gain reasonable assurance that federal financial assistance programs are managed in accordance with applicable laws and regulations. The Single Audit Act requires audits of state and local government entities that expend at least $300,000 in federal awards annually. The results of these audits are provided to the state and responsible federal agency. The federal agency is responsible for following up with the state to ensure that the state takes action to correct the deficiencies identified from the audit. Other entities have responsibilities for routinely reviewing Medicaid finances and Medicaid internal controls. Table 2 explains various oversight activities by entities outside of CMS. Our objectives were to determine if (1) CMS has an adequate oversight process to help ensure the propriety of Medicaid expenditures, (2) CMS adequately evaluates and monitors the results of its oversight process and makes adjustments as warranted, and (3) the current CMS organizational structure for financial management is conducive to effectively directing its oversight process and sustaining future improvements. To evaluate CMS financial oversight, the control activities used to help ensure the propriety of Medicaid expenditures, and CMS’s efforts to monitor its financial oversight, we performed work at CMS regional and headquarters offices, surveyed financial management staff, and reviewed CMS manuals and other documentation, as well as audit reports. As agreed with your offices, we visited 5 of the 10 CMS regional offices (Atlanta, Boston, Chicago, New York, and San Francisco) to observe and interview the financial management staff. We selected the five regions based on geographical dispersion across the country and based on the total amount of Medicaid expenditures processed by each region. The five regions were collectively responsible for overseeing more than half of the total Medicaid expenditures for fiscal year 2000. We discussed recent program changes, which significantly increased financial management oversight activities for regional analysts. We questioned staff about the extent to which certain activities, such as focused financial management reviews, were conducted and reviewed any reports and corresponding workpapers that were available. Key CMS financial managers at headquarters in Baltimore were also interviewed to gain a comprehensive understanding of overall financial management objectives for the Medicaid program. We also discussed performance and budget reporting as well as efforts to coordinate with state auditors. We administered a Web-based survey to regional financial management members to gain a better understanding of the control activities being performed by regional offices. The survey was sent to all regional office branch chiefs and staff classified as financial analysts who are responsible for overseeing state financial management and internal controls for Medicaid. All of the 11 branch chiefs responded and 59 of the 65 analysts responded, for a 92 percent response rate—the 6 analysts who did not respond were from one regional office. The survey obtained information on how oversight for Medicaid financial management is designed and implemented, as well as the frontline staff perspective on effectiveness. Survey respondents answered questions relating to review procedures performed, use of state single audits, follow-up of audit findings, and communications with state auditors and offices of inspectors general. Many of the questions asked the analysts to respond based on their performance of activities for the period from October 1, 1999, through the date of the survey. The practical difficulties in conducting any survey can introduce errors, commonly referred to as nonsampling errors. We included steps in both the data collection and data analysis to minimize such nonsampling errors. Multiple versions of the questionnaire were pretested with regional financial analysts before the final survey was administered. A 92 percent response rate was achieved, and the respondents directly entered the responses into the database via the Internet survey. Data checks were performed and a second independent analyst reviewed computer analyses. We obtained and reviewed CMS documents and manuals that described current financial oversight activities and performance reporting previously used to monitor oversight. We reviewed audit reports that included findings related to Medicaid financial management, including the CMS/HCFA financial reports for fiscal years 1998 through 2000 and Single Audit Act reports for fiscal years 1999 and 2000.