Before 2006, companies choosing to participate in the Medicare Advantage program were required to annually submit an ACRP to CMS for review and approval for each plan they intended to offer. The ACRP consisted of two parts—a plan benefit package and the adjusted community rate (ACR). The plan benefit package contained a detailed description of the benefits offered, and the ACR contained a detailed description of the estimated costs to provide the package of benefits to an enrolled Medicare beneficiary. These costs were to be calculated based on how much a plan would charge a commercial customer to provide the same benefit package if its members had the same expected use of services as Medicare beneficiaries. CMS made payments to the companies monthly in advance of rendering services. In 2003, Congress enacted the Medicare Prescription Drug, Improvement and Modernization Act of 2003 (MMA). MMA included provisions that established a bid submission process to replace the ACRP submission process, as well as a new prescription drug benefit, both effective for 2006. Under the bid process, an organization choosing to participate in Medicare Advantage is required to annually submit a bid for review and approval for each plan they intend to offer. The bid submission includes the organization’s estimate of the cost of delivering services (submitted on a bid form) to an enrolled Medicare beneficiary and a plan benefit package that provides a detailed description of the benefits offered. In addition, each MA organization and prescription drug plan that offers prescription drug benefits under Part D is required to submit a separate prescription drug bid form, a formulary, and a plan benefit package to CMS for its review and approval. On the bid forms, MA organizations include an estimate of the per-person cost of providing Medicare-covered services. BBA requires CMS to annually audit the submissions of one-third of MA organizations. In defining what constituted an organization for the purpose of selecting one-third for audit, CMS officials explained that they determined the number of participating organizations based on the number of contracts they awarded. Under each contract, an organization can offer multiple plans. Further, an organization like Humana Inc. can have multiple contracts. CMS contracts with accounting and actuarial firms to perform these audits. For audits of the contract year 2006 bid forms, CMS contracted in September 2005 with six firms. CMS gave the auditors guidance. It is important to note that the audit guidance includes procedures to verify information used in the projection or estimation of costs submitted in the bids, not actual results or costs each year, as the bids do not report actual costs. According to our analysis of available CMS data, CMS did not meet the statutory requirement to audit the financial records of at least one-third of the participating MA organizations for contract years 2001 through 2005, nor has it done so yet for the 2006 bid submissions. We performed an analysis to determine whether CMS had met the requirement because CMS could not provide documentation to support the method it used to select the ACRs and bids for audit, nor did CMS document whether or how it met the one-third requirement for contract years 2001 through 2006. Our analysis shows that between 18.6 and 23.6 percent, or fewer than one- third, of the MA organizations (as defined by the number of contracts each year) for contract years 2001 through 2005 were audited each year. Similarly, we determined that only 13.9 percent of the MA organizations and prescription drug plans with approved bids for 2006 were audited, as of the end of our review. Table 1 summarizes our results. As stated earlier, CMS selects organizations to meet the one-third audit requirement based on the number of contracts awarded and not the total number of plans offered under each contract. However, to present additional perspective, we also analyzed the percentage of plans audited of the total number of plans offered by each audited organization. Our analysis shows that with the exception of contract year 2002, the level of audit coverage achieved by CMS audits has progressively decreased in terms of the percentage of plans audited for those organizations that were audited. Audit coverage has also decreased in terms of the percentage of plans audited of all plans offered by participating organizations each contract year. In contract year 2006, a large increase in the number of bid submissions meant that the 159 plans audited reflected only 3.2 percent of all the plans offered. Table 2 summarizes our analysis. Regarding contract years 2001 through 2004, CMS officials told us that they did not know how the MA organizations were selected for audit, and the documentation supporting the selections was either not created or not retained. For contract year 2005 audits, CMS officials told us that the selection criteria included several factors. They said that the criteria considered included whether the MA organization had been audited previously and whether it had significant issues. With respect to contract year 2006, CMS officials acknowledged the one- third requirement, but they stated that they did not intend for the audits of the 2006 bid submissions to meet the one-third audit requirement. They explained that they plan to conduct other reviews of the financial records of MA organizations and prescription drug plans to meet the requirement for 2006. In September 2006, CMS hired a contractor to develop the agency’s overall approach to conducting reviews to meet the one-third requirement. Draft audit procedures prepared by the contractor in May 2007, indicate that CMS plans to review solvency, risk scores, related parties, direct medical and administrative costs, and, where relevant, regional preferred provider organizations’ (RPPO) cost reconciliation reports for MA bids. For Part D bids, CMS indicated it also plans to review other areas, including beneficiaries’ true out-of-pocket costs. However, when our review ended, CMS had not yet clearly laid out how these reviews will be conducted to meet the one-third requirement. Further, CMS is not likely to complete these other financial reviews until almost 3 years after the bid submission date (see figure 1) for each contract year, in part because it must first reconcile payment data that prescription drug plans are not required to submit to CMS until 6 months after the contract year is over. Such an extended cycle for conducting these reviews greatly limits their usefulness to CMS and hinders CMS’ ability to recommend and implement timely actions to address identified deficiencies in the MA organizations’ and prescription drug plans’ bid processes. In its audits for contract years 2001-2005, CMS did not consistently ensure that the audit process provided information needed for assessing the potential impact of errors on beneficiaries’ benefits or payments to the MA organizations. The auditors reported findings ranging from lack of supporting documentation to overstating or understating certain costs, but did not identify how the errors affected beneficiary benefits, copayments, or premiums. In addition, although the auditors categorized their results as findings and observations, with findings being more significant, depending on their materiality to the average payment rate reported in the ACR, the distinction between findings and observations, was based on judgment, and therefore varied among the different auditors. In our 2001 report, we reported that CMS planned to require auditors, where applicable, to quantify in their audit reports the overall impact of errors. Further, during the work for the 2001 report, CMS officials stated that they were in the process of determining the impact on beneficiaries and crafting a strategy for audit follow-up and resolution. CMS did not initiate any actions to attempt to determine such impact until after the contract year 2003 audits were completed. CMS took steps to determine such impact and identified a net of about $35 million from the contract year 2003 audits that beneficiaries could have received in additional benefits. The only audit follow-up action that CMS has taken regarding the ACR audits was to provide copies of the audit reports to the MA organizations and instruct them to take action in subsequent ACR filings. In CMS’ audits of the 2006 bid submissions, 18 (or about 23 percent) of the 80 organizations audited had material findings that have an impact on beneficiaries or plan payments approved in bids. CMS defined material findings as those that would result in changes in the total bid amount of 1 percent or more or in the estimate for the costs per member per month of 10 percent or more for any bid element. CMS officials told us that they will use the results of the bid audits to help organizations improve their methods in preparing bids in subsequent years and to help improve the overall bid process. Specifically, they told us they could improve the bid forms, bid instructions, training, and bid review process. CMS’ audit follow-up process has not involved pursuing financial recoveries from Medicare Advantage organizations based on audit results even when information was available on deficiencies or errors that could impact beneficiaries. CMS officials told us they do not plan to pursue financial recoveries from MA organizations based on the results of ACR or bid audits because the agency does not have the legal authority to do so. According to our assessment of the statutes, CMS has the authority to pursue financial recoveries, but its rights under contracts for 2001 through 2005 are limited because its implementing regulations did not require that each contract include provisions to inform organizations about the audits and about the steps that CMS would take to address identified deficiencies, including pursuit of financial recoveries. Regarding the bid process that began in 2006, our assessment of the statutes is that CMS has the authority to include terms in bid contracts that would allow it to pursue financial recoveries based on bid audit results. CMS also has the authority to sanction organizations, but it has not. CMS officials believe the bid audits provide a “sentinel or deterrent effect” for organizations to properly prepare their bids because they do not know when the bids may be selected for a detailed audit. Given the current audit coverage, CMS is unlikely to achieve significant deterrent effect, however, because only 13.9 percent of participating organizations for contract 2006 have been audited. Appropriate oversight and accountability mechanisms are key to protecting the federal government’s interests in using taxpayer resources prudently.