This is the accessible text file for GAO report number GAO-10-637T 
entitled 'Centers For Medicare And Medicaid Services: Pervasive 
Internal Control Weaknesses Hindered Effective Contract Management' 
which was released on April 28, 2010. 

This text file was formatted by the U.S. Government Accountability 
Office (GAO) to be accessible to users with visual impairments, as 
part of a longer term project to improve GAO products' accessibility. 
Every attempt has been made to maintain the structural and data 
integrity of the original printed product. Accessibility features, 
such as text descriptions of tables, consecutively numbered footnotes 
placed at the end of the file, and the text of agency comment letters, 
are provided but may not exactly duplicate the presentation or format 
of the printed version. The portable document format (PDF) file is an 
exact electronic replica of the printed version. We welcome your 
feedback. Please E-mail your comments regarding the contents or 
accessibility features of this document to Webmaster@gao.gov. 

This is a work of the U.S. government and is not subject to copyright 
protection in the United States. It may be reproduced and distributed 
in its entirety without further permission from GAO. Because this work 
may contain copyrighted images or other material, permission from the 
copyright holder may be necessary if you wish to reproduce this 
material separately. 

Testimony: 

Before the Ad Hoc Subcommittee on Contracting Oversight, Committee on 
Homeland Security and Governmental Affairs, U.S. Senate: 

United States Government Accountability Office: 
GAO: 

For Release on Delivery: 
Expected at 2:30 p.m. EDT:
Wednesday, April 28, 2010: 

Centers For Medicare And Medicaid Services: 

Pervasive Internal Control Weaknesses Hindered Effective Contract 
Management: 

Statement of Kay L. Daly:
Director:
Financial Management and Assurance: 

GAO-10-637T: 

GAO Highlights: 

Highlights of GAO-10-637T, a testimony before the Ad Hoc Subcommittee 
on Contracting Oversight, Committee on Homeland Security and 
Governmental Affairs, U.S. Senate. 

Why GAO Did This Study: 

In November 2007, GAO reported significant deficiencies in internal 
control over certain contracts the Centers for Medicare and Medicaid 
Services (CMS) awarded under the Federal Acquisition Regulation (FAR). 
This Subcommittee and others in Congress asked GAO to perform an in-
depth review of CMS’s contract management practices. This testimony is 
based on GAO’s October 2009 report on these issues and summarizes 
GAO’s findings on the extent to which CMS (1) implemented effective 
control procedures over contract actions, (2) established a strong 
contract management control environment, and (3) implemented GAO’s 
2007 recommendations. 

GAO used a statistical random sample of 2008 CMS contract actions to 
assess CMS internal control procedures. The results were projected to 
the population of 2008 CMS contract actions. GAO reviewed contract 
file documentation and interviewed senior acquisition management 
officials. 

What GAO Found: 

GAO reported in October 2009 that pervasive deficiencies in CMS 
contract management internal control increased the risk of improper 
payments or waste. Specifically, based on a statistical random sample 
of 2008 CMS contract actions, GAO estimated that at least 84.3 percent 
of fiscal year 2008 contract actions contained at least one instance 
where a key control was not adequately implemented. For example, CMS 
used cost reimbursement contracts without first ensuring that the 
contractor had an adequate accounting system, as required by the FAR. 
These deficiencies were due in part to a lack of agency-specific 
policies and procedures to help ensure proper contracting expenditures. 

These control deficiencies stemmed from a weak overall control 
environment characterized primarily by inadequate strategic planning 
for staffing and funding resources. CMS also did not accurately 
capture data on the nature and extent of its contracting, hindering 
CMS’s ability to manage its acquisition function by identifying areas 
of risk. Finally, CMS did not track, investigate, and resolve contract 
audit and evaluation findings for purposes of cost recovery and future 
award decisions. A positive control environment sets the tone for the 
overall quality of internal control and provides the foundation for 
effective contract management. Without a strong control environment, 
the specific control deficiencies GAO identified will likely persist. 

As of the date of GAO’s October 2009 report, CMS had not substantially 
addressed seven of the nine recommendations made by GAO in 2007 to 
improve internal control over contracting and payments to contractors. 

Table: GAO’s 2009 Assessment of CMS Actions to Address Prior 
Recommendations: 

GAO recommendation: 1. Develop policies for pre-award contract 
activities; 
GAO assessment: No action taken. 

GAO recommendation: 2. Develop policies regarding cognizant federal 
agency responsibilities; 
GAO assessment: Actions insufficient. 

GAO recommendation: 3. Develop policies that clarify roles and 
responsibilities during the invoice review process; 
GAO assessment: Completed. 

GAO recommendation: 4. Develop guidelines regarding sufficient detail 
to support contractor invoices; 
GAO assessment: No action taken. 

GAO recommendation: 5. Establish criteria for negative certification 
for payment of invoices; 
GAO assessment: No action taken. 

GAO recommendation: 6. Provide training on the invoice review policies; 
GAO assessment: Actions insufficient. 

GAO recommendation: 7. Develop a centralized tracking mechanism for 
employee training; 
GAO assessment: Completed. 

GAO recommendation: 8. Develop a plan to reduce the backlog of 
contracts eligible for closeout; 
GAO assessment: Actions insufficient. 

GAO recommendation: 9. Review the questionable payments identified in 
GAO’s 2007 report; 
GAO assessment: Actions insufficient. 

Source: GAO. See GAO-10-60 for further details. 

[End of table] 

To the extent that CMS has continuing weaknesses in contracting 
activities, it will continue to put billions of taxpayer dollars at 
risk of improper payments or waste. 

What GAO Recommends: 

GAO’s October 2009 report included 10 recommendations to improve 
oversight and strengthen CMS’s control environment and reaffirmed 7 
recommendations from our November 2007 report. CMS concurred with the 
new recommendations, but generally disagreed with GAO’s assessment of 
progress on the 2007 recommendations. GAO’s analysis confirmed only 
limited progress at that time. 

View [hyperlink, http://www.gao.gov/products/GAO-10-637T] or key 
components. For more information, contact Kay L. Daly at (202) 512-
9095 or dalykl@gao.gov. 

[End of section] 

Madam Chairman and Members of the Subcommittee: 

I am pleased to be here today to discuss contract management at the 
Centers for Medicare and Medicaid Services (CMS), a component of the 
Department of Health and Human Services (HHS). CMS administers 
Medicare and Medicaid, two programs included on our high-risk list, 
[Footnote 1] and other programs such as the State Children's Health 
Insurance Program. CMS relies extensively on contractors to assist in 
carrying out its basic mission, including program administration, 
management, and oversight of its health programs. In fiscal year 2008, 
the most recent fiscal year for which data were available at the time 
we completed our work, CMS reported that it obligated $3.6 billion 
under contracts for a variety of goods and services. CMS's 
acquisitions include contracts to administer, oversee, and audit 
claims made under the Medicare program; provide information technology 
systems; provide program management and consulting services; and 
operate the 1-800 Medicare help line. 

In November 2007, we reported[Footnote 2] pervasive deficiencies in 
internal control over certain contracts used by CMS for start-up 
administrative services to implement programs enacted under the 
Medicare Prescription Drug, Improvement, and Modernization Act of 2003 
(MMA).[Footnote 3] We reported that CMS's internal control 
deficiencies resulted in millions of dollars of questionable payments 
to certain contractors, primarily because CMS did not obtain adequate 
support for billed costs. Internal control--the plans, methods, and 
procedures used to meet missions, goals, and objectives--is the first 
line of defense in safeguarding assets and preventing and detecting 
fraud and errors and helps government program managers achieve desired 
results through effective stewardship of public resources. 

Because of concerns about the implications that these weaknesses may 
have on all CMS contracts generally subject to the requirements of the 
Federal Acquisition Regulation (FAR),[Footnote 4] we were asked to 
perform a comprehensive, in-depth review of internal controls over 
CMS's contract management practices. My remarks today are based on the 
findings and recommendations included in our subsequent report issued 
in October 2009.[Footnote 5] That report addressed the extent to which 
(1) CMS implemented effective internal control procedures over 
contract actions to help ensure proper contracting expenditures and 
(2) CMS established a strong control environment for contract 
management. Our report also discussed the extent to which CMS 
implemented the recommendations we made in 2007 to improve internal 
control over contracting and payments to contractors. For this 
testimony, because of the relatively short time between the request to 
testify and the hearing date, we did not have sufficient time to 
update the status of CMS's actions to implement our prior 
recommendations. 

Scope and Methodology: 

To address the extent to which CMS implemented control procedures over 
contract actions, we focused on contracts that were generally subject 
to the FAR (i.e., FAR-based),[Footnote 6] which represented about $2.5 
billion, or about 70 percent, of total obligations awarded in fiscal 
year 2008. The FAR is the governmentwide regulation containing the 
rules, standards, and requirements for the award, administration, and 
termination of government contracts. Based on the standards for 
internal control,[Footnote 7] FAR requirements, and agency policies, 
we identified and evaluated 11 key internal control procedures 
[Footnote 8] over contract actions, ranging from ensuring contractors 
had adequate accounting systems prior to the use of a cost 
reimbursement contract to certifying invoices for payment. Contract 
actions include new contract awards and modifications to existing 
contracts. We conducted our tests on a statistically random sample 
[Footnote 9] of 102 FAR-based contract actions CMS made in fiscal year 
2008 and projected the results of our statistical sample 
conservatively by reporting the lower bound of our two-sided, 95 
percent confidence interval. We tested a variety of contract actions 
including a range of dollars obligated, different contract types 
(fixed price, cost reimbursement, etc.), and the types of goods and 
services procured. The actions in the sample ranged from a $1,000 firm-
fixed price contract for newspapers to a $17.5 million modification of 
an information technology contract valued at over $500 million. For 
each contract action in the sample, we determined if the 11 key 
internal control procedures were implemented by reviewing the contract 
file supporting the action and, where applicable, by obtaining 
additional information from the contracting officer or specialist or 
senior acquisition management. We also tested the reliability of the 
data contained in CMS's two acquisition databases. 

To address the extent to which CMS established a strong control 
environment for contract management, we obtained and reviewed 
documentation regarding contract closeout, acquisition planning, and 
other management information and interviewed officials in the Office 
of Acquisition and Grants Management (OAGM) about its contract 
management processes. We also evaluated the extent to which CMS had 
addressed recommendations we made in our 2007 report.[Footnote 10] We 
used the internal control standards as a basis for our evaluation of 
CMS's contract management control environment. Appendix I of our 
October 2009 report provides additional details of our scope and 
methodology. 

This testimony is based on our October 2009 performance audit, which 
was conducted from July 2008 to September 2009 in accordance with 
generally accepted government auditing standards. Those standards 
require that we plan and perform the audit to obtain sufficient, 
appropriate evidence to provide a reasonable basis for our findings 
and conclusions based on our audit objectives. We believe that the 
evidence obtained provides a reasonable basis for our findings and 
conclusions based on our audit objectives. 

Background: 

Except for certain Medicare claims processing contracts, CMS contracts 
are generally required to be awarded and administered in accordance 
with general government procurement laws[Footnote 11] and regulations 
such as the FAR; the Health and Human Services Acquisition Regulations 
(HHSAR);[Footnote 12] the Cost Accounting Standards (CAS);[Footnote 
13] and the terms of the contract. 

Since 1998, CMS's obligations to fiscal intermediaries, carriers, and 
Medicare Administrative Contractors (contractors that primarily 
process Medicare claims) have decreased approximately 16 percent. In 
contrast, obligations for other-than-claims processing contract 
activities, such as the 1-800 help line, information technology and 
financial management initiatives, and program management and 
consulting services, have increased 466 percent. These trends may be 
explained in part by recent changes to the Medicare program, including 
the movement of functions, such as the help line, data centers, and 
certain financial management activities, from the fiscal 
intermediaries and carriers to specialized contractors. 

MMA required CMS to transition its Medicare claims processing 
contracts, which generally did not follow the FAR, to the FAR 
environment through the award of contracts to Medicare Administrative 
Contractors. CMS projected that the transition, referred to as 
Medicare contracting reform, would produce administrative cost savings 
due to the effects of competition and contract consolidation as well 
as produce Medicare trust fund savings due to a reduction in the 
amount of improper benefit payments. Additionally, the transition 
would subject millions of dollars of CMS acquisitions to the rules, 
standards, and requirements for the award, administration, and 
termination of government contracts in the FAR. Obligations to the new 
Medicare Administrative Contractors were first made in fiscal year 
2007. CMS is required to complete Medicare contracting reform by 2011. 
As of September 1, 2009, 19 contracts had been awarded[Footnote 14] to 
Medicare Administrative Contractors, totaling about $1 billion in 
obligations. 

The Standards for Internal Control in the Federal Government[Footnote 
15] provide the overall framework for establishing and maintaining 
internal control and for identifying and addressing areas at greatest 
risk of fraud, waste, abuse, and mismanagement. These standards 
provide that--to be effective--an entity's management should establish 
both a supportive overall control environment and specific control 
activities directed at carrying out its objectives. As such, an 
entity's management should establish and maintain an environment that 
sets a positive and supportive attitude towards control and 
conscientious management. A positive control environment provides 
discipline and structure as well as the climate supportive of quality 
internal control, and includes an assessment of the risks the agency 
faces from both external and internal sources. Control activities are 
the policies, procedures, techniques, and mechanisms that enforce 
management's directives and help ensure that actions are taken to 
address risks. The standards further provide that information should 
be recorded and communicated to management and oversight officials in 
a form and within a time frame that enables them to carry out their 
responsibilities. Finally, an entity should have internal control 
monitoring activities in place to assess the quality of performance 
over time and ensure that the findings of audits and other reviews are 
promptly resolved. 

Control activities include both preventive and detective controls. 
Preventive controls--such as invoice review prior to payment--are 
controls designed to prevent errors, improper payments, or waste, 
while detective controls--such as incurred cost audits--are designed 
to identify errors or improper payments after the payment is made. A 
sound system of internal control contains a balance of both preventive 
and detective controls that is appropriate for the agency's 
operations. While detective controls are beneficial in that they 
identify funds that may have been inappropriately paid and should be 
returned to the government, preventive controls such as accounting 
system reviews[Footnote 16] and invoice reviews help to reduce the 
risk of improper payments or waste before they occur. A key concept in 
the standards is that control activities selected for implementation 
be cost beneficial. Generally it is more effective and efficient to 
prevent improper payments. A control activity can be preventive, 
detective, or both based on when the control occurs in the contract 
life cycle. 

Additional, detailed background information is available in our 
related report, GAO-10-60. 

Pervasive Deficiencies in Control Procedures at the Contract Level 
Increase the Risk of Improper Payments or Waste: 

Our October 2009 report identified pervasive deficiencies in internal 
control over contracting and payments to contractors. Specifically, as 
a result of our work, we estimated that at least 84.3 percent[Footnote 
17] of FAR-based contract actions made by CMS in fiscal year 2008 
contained at least one instance in which 1 of 11 key controls was not 
adequately implemented. Not only was the number of internal control 
deficiencies widespread, but also many contract actions had more than 
one deficiency. We estimated that at least 37.2 percent[Footnote 18] 
of FAR-based contract actions made in fiscal year 2008 had three or 
more instances in which a key control was not adequately implemented. 
The internal control deficiencies occurred throughout the contracting 
process and increased the risk of improper payments or waste. These 
deficiencies were due in part to a lack of agency-specific policies 
and procedures to ensure that FAR requirements and other control 
objectives were met. CMS also did not take appropriate steps to ensure 
that existing policies were properly implemented or maintain adequate 
documentation in its contract files. Further, CMS's Contract Review 
Board process had not been properly or effectively implemented to help 
ensure proper contract award actions.[Footnote 19] These internal 
control deficiencies are a manifestation of CMS's weak overall control 
environment, which is discussed later. Additional, detailed 
information on our testing of key internal controls is available in 
our October 2009 report. 

The high percentage of deficiencies indicates a serious failure of 
control procedures over FAR-based acquisitions, thereby creating a 
heightened risk of improper payments or waste. Highlights of the 
control deficiencies we noted included the following. 

* We estimated that at least 46.0 percent of fiscal year 2008 CMS 
contract actions did not meet the FAR requirements applicable to the 
specific contract type awarded.[Footnote 20] For example, we found 
that CMS used cost reimbursement contracts without first ensuring that 
the contractor had an adequate accounting system. According to the 
FAR, a cost reimbursement contract may be used only when the 
contractor's accounting system is adequate for determining costs 
applicable to the contract.[Footnote 21] To illustrate, of the 
contract awards in our sample, we found nine cases in which cost 
reimbursement contracts were used without first ensuring that the 
contractor had an adequate accounting system. In addition to these 
nine cases, during our review of contract modifications we observed 
another six cases in which cost reimbursement contracts were used even 
though CMS was aware that the contractor's accounting system was 
inadequate at the time of award. In one instance, the contracting 
officer was aware that a contractor had an inadequate accounting 
system resulting from numerous instances of noncompliance with 
applicable Cost Accounting Standards. Using a cost reimbursement 
contract when a contractor does not have an adequate accounting system 
hinders the government's ability to fulfill its oversight duties 
throughout the contract life cycle and increases risk of improper 
payments and the risk that costs billed cannot be substantiated during 
an audit. 

* We estimated that for at least 40.4 percent of fiscal year 2008 
contract actions, CMS did not have sufficient support for provisional 
indirect cost rates[Footnote 22] nor did it identify instances when a 
contractor billed rates higher than the rates that were approved for 
use.[Footnote 23] Provisional indirect cost rates provide agencies 
with a mechanism by which to determine if the indirect costs billed on 
invoices are reasonable for the services provided until such time that 
final indirect cost rates can be established, generally at the end of 
the contractor's fiscal year. When the agency does not maintain 
adequate support for provisional indirect rates, it increases its risk 
of making improper payments. 

* We estimated that for at least 52.6 percent of fiscal year 2008 
contract actions, CMS did not have support for final indirect cost 
rates or support for the prompt request of an audit of indirect costs. 
[Footnote 24] The FAR states that final indirect cost rates, which are 
based on a contactor's actual indirect costs incurred during a given 
fiscal year, shall be used in reimbursing indirect costs under cost 
reimbursement contracts.[Footnote 25] The amounts a contractor billed 
using provisional indirect cost rates are adjusted annually for final 
indirect cost rates, thereby providing a mechanism for the government 
to timely ensure that indirect costs are allowable and allocable to 
the contract. CMS officials told us that they generally adjust for 
final indirect cost rates during contract closeout at the end of the 
contract performance rather than annually mainly due to the cost and 
effort the adjustment takes. However, CMS did not promptly close out 
its contracts and had not made progress in reducing the backlog of 
contracts eligible for closeout. Specifically, in 2007, we reported 
that CMS's backlog was 1,300 contracts, of which 407 were overdue for 
closeout as of September 30, 2007. This backlog continued to increase, 
and CMS officials stated that as of July 29, 2009, the total backlog 
of contracts eligible for closeout was 1,611, with 594 overdue based 
on FAR timing standards.[Footnote 26] Not annually adjusting for final 
indirect cost rates increases the risk that CMS is paying for costs 
that are not allowable or allocable to the contract. Furthermore, 
putting off the control activity until the end of contract performance 
increases the risk of overpaying for indirect costs during contract 
performance and may make identification or recovery of any unallowable 
costs during contract closeout more difficult due to the passage of 
time. 

* We estimated that for at least 54.9 percent of fiscal year 2008 
contract actions, CMS did not promptly perform or request an audit of 
direct costs.[Footnote 27] Similar to the audit of indirect costs, 
audits of direct costs allow the government to verify that the costs 
billed by the contractor were allowable, reasonable, and allocable to 
the contract. Not annually auditing direct costs increases the risk 
that CMS is paying for costs that are not allowable or allocable to 
the contract. 

* We estimated that for at least 59.0 percent of fiscal year 2008 
contract actions, the project officer did not always certify the 
invoices.[Footnote 28] CMS's Acquisition Policy Notice 16-01 requires 
the project officer to review each contractor invoice and recommend 
payment approval or disapproval to the contracting officer. This 
review is to determine, among other things, if the expenditure rate is 
commensurate with technical progress and whether all direct cost 
elements are appropriate, including subcontracts, travel, and 
equipment. We noted in our 2007 report[Footnote 29] that CMS used 
negative certification--a process whereby it paid contractor invoices 
without knowing whether they were reviewed and approved--in order to 
ensure invoices were paid in a timely fashion. In October 2009 we 
reported that negative certification continued to be CMS's policy to 
process contractor invoices for payment. This approach, however, 
significantly reduces the incentive for contracting officers, 
specialists, and project officers to review the invoice prior to 
payment. For example, in one case, although a contractor submitted 
over 100 invoices for fiscal year 2008,[Footnote 30] only 8 were 
certified by the project officer. The total value of the contract 
through January 2009 was about $64 million. In addition, based on a 
cursory review of the fiscal year 2008 invoices submitted for payment, 
we found instances in which the contracting officer or specialist did 
not identify items that were inconsistent with the terms of the 
contract or acquisition regulations. For example, we found two 
instances where the contractor billed, and CMS paid, for items 
generally disallowed by HHSAR.[Footnote 31] Reviewing invoices prior 
to payment is a preventive control that may result in the 
identification of unallowable billings, especially on cost 
reimbursement and time and materials invoices, before the invoices are 
paid. CMS increases its risk of improper payments when it does not 
properly review and approve invoices prior to payment. 

Weak Control Environment Hindered CMS's Ability to Manage Its FAR-
based Acquisition Process: 

The control deficiencies we identified in the statistical sample 
discussed in our October 2009 report stemmed from a weak overall 
control environment. CMS's control environment was characterized by 
the lack of (1) strategic planning to identify necessary staffing and 
funding; (2) reliable data for effectively carrying out contract 
management responsibilities; and (3) follow-up to track, investigate, 
and resolve contract audit and evaluation findings for purposes of 
cost recovery and future award decisions. A positive control 
environment sets the tone for the overall quality of an entity's 
internal control, and provides the foundation for an entity to 
effectively manage contracts and payments to contractors. Without a 
strong control environment, the control deficiencies we identified 
will likely persist. Following is a summary of the weaknesses we found 
in CMS's overall control environment: 

* Limited analysis of contract management workforce and related 
funding needs. OAGM management had not analyzed its contract 
management workforce and related funding needs through a 
comprehensive, strategic acquisition workforce plan. Such a plan is 
critical to help manage the increasing acquisition workload and meet 
its contracting oversight needs. We reported in November 2007[Footnote 
32] that staff resources allocated to contract oversight had not kept 
pace with the increase in CMS contract awards. In our 2009 report, we 
found a similar trend continued into 2008. While the obligated amount 
of contract awards had increased 71 percent since 1998, OAGM staffing 
resources--its number of full time equivalents (FTE)--had increased 26 
percent. This trend presents a major challenge to contract award and 
administration personnel who must deal with a significantly increased 
workload without additional support and resources. In addition, 
according to its staff and management, OAGM faced challenges in 
meeting the various audit requirements necessary to ensure adequate 
oversight of contracts that pose more risk to the government, 
specifically cost reimbursement contracts, as well as in performing 
the activities required of a cognizant federal agency (CFA).[Footnote 
33] 

Although officials told us they could use more audit funding, we found 
that OAGM management had yet to determine what an appropriate funding 
level should be. Without knowing for which contractors additional CFA 
oversight was needed, CMS did not have reliable information on the 
number of audits and reviews that must be performed annually or the 
depth and complexity of those audits. Without this key information, 
CMS could not estimate an adequate level of needed audit funding. The 
risks of not performing CFA duties are increased by the fact that 
other federal agencies that use the same contractors rely on the 
oversight and monitoring work of the CFA. A shortage of financial and 
human resources creates an environment that introduces vulnerabilities 
to the contracting process, hinders management's ability to sustain an 
effective overall control environment, and ultimately increases risk 
in the contracting process. 

* Lack of reliable contract management data. Although CMS had 
generally reliable information on the basic attributes of each 
contract action, such as vendor name and obligation amount, CMS lacked 
reliable management information on other key aspects of its FAR-based 
contracting operations. For example, in our October 2009 report we 
identified acquisition data errors related to the number of certain 
contract types awarded, the extent of competition achieved, and total 
contract value. Standards for internal control provide that for an 
agency to manage its operations, it must have relevant, reliable, and 
timely information relating to the extent and nature of its 
operations, including both operational and financial data, and such 
information should be recorded and communicated to management and 
others within the agency who need it and in a form and within a time 
frame that enables them to carry out their internal control and 
operational responsibilities. The acquisition data errors were due in 
part to a lack of sufficient quality assurance activities over the 
data entered into the acquisition databases. Without accurate data, 
CMS program managers did not have adequate information to identify, 
monitor, and correct or mitigate areas that posed a high risk of 
improper payments or waste. 

* Lack of follow-up to resolve contract audit and evaluation findings. 
CMS did not track, investigate, and resolve contract audit and 
evaluation findings for purposes of cost recovery and future award 
decisions. Tracking audit and evaluation findings strengthens the 
control environment in part because it can help assure management that 
the agency's objectives are being met through the efficient and 
effective use of the agency's resources. It can also help management 
determine whether the entity is complying with applicable acquisition 
laws and regulations. Contract audits and evaluations can add 
significant value to an organization's oversight and accountability 
structure, but only if management ensures that the results of these 
audits and evaluations are promptly investigated and resolved. For 
example, in an audit report dated September 30, 2008, the Defense 
Contract Audit Agency[Footnote 34] questioned approximately $2.1 
million of costs that CMS paid to a contractor in fiscal year 2006. As 
discussed in our October 2009 report, OAGM management confirmed that 
no action had been taken at that time to investigate and recover the 
challenged costs. 

GAO Has Made Numerous Recommendations to Improve CMS's Contract 
Management Controls: 

Seven of Nine GAO 2007 Recommendations Were Substantially Unresolved: 

As we reported in October 2009, CMS management had not taken 
substantial actions to address our 2007 recommendations to improve 
internal control in the contracting process. Only two of GAO's nine 
2007 recommendations had been fully addressed. Table 1 summarizes our 
assessment of the status of CMS's actions to address our 
recommendations. 

Table 1: GAO's October 2009 Assessment of Status of CMS Actions Taken 
to Address 2007 Recommendations: 

GAO recommendation: 1. Develop policies for pre-award contract 
activities; 
GAO assessment: No action taken. 

GAO recommendation: 2. Develop policies regarding cognizant federal 
agency responsibilities; 
GAO assessment: Actions insufficient. 

GAO recommendation: 3. Develop policies that clarify roles and 
responsibilities during the invoice review process; 
GAO assessment: Completed. 

GAO recommendation: 4. Develop guidelines regarding sufficient detail 
to support contractor invoices; 
GAO assessment: No action taken. 

GAO recommendation: 5. Establish criteria for negative certification 
for payment of invoices; 
GAO assessment: No action taken. 

GAO recommendation: 6. Provide training on the invoice review policies; 
GAO assessment: Actions insufficient. 

GAO recommendation: 7. Develop a centralized tracking mechanism for 
employee training; 
GAO assessment: Completed. 

GAO recommendation: 8. Develop a plan to reduce the backlog of 
contracts eligible for closeout; 
GAO assessment: Actions insufficient. 

GAO recommendation: 9. Review the questionable payments identified in 
GAO’s 2007 report; 
GAO assessment: Actions insufficient. 

Source: GAO. See GAO-10-60 for further details. 

[End of table] 

GAO Made 10 Additional Recommendations in October 2009 to Further 
Improve CMS Contract Management: 

In addition to reaffirming the 7 substantially unresolved 2007 
recommendations, our October 2009 report included 10 recommendations 
to further improve oversight and strengthen CMS's control environment. 
Specifically, we made recommendations for additional procedures or 
plans to address the following 10 areas: 

* document compliance with FAR requirements for different contract 
types; 

* document provisional indirect cost rates in the contract file; 

* specify what constitutes timely performance of (or request for) 
audits of contractors' billed costs; 

* specify circumstances for the use and content of negotiation 
memorandums, including any required secondary reviews; 

* specify Contract Review Board documentation, including resolution of 
issues identified during the CRB reviews; 

* conduct periodic reviews of contract files to ensure invoices were 
properly reviewed by both the project officer and contracting officer 
or specialist; 

* develop a comprehensive strategic acquisition workforce plan, with 
resource needs to fulfill FAR requirements for comprehensive 
oversight, including CFA duties; 

* revise the verification and validation plan to require all relevant 
acquisition data errors be corrected and their resolution documented; 

* develop procedures for tracking contract audit requests and the 
resolution of audit findings; and: 

* develop procedures that clearly assign roles and responsibilities 
for the timely fulfillment of CFA duties. 

In commenting on a draft of our October 2009 report, CMS and HHS 
agreed with each of our 10 new recommendations and described steps 
planned to address them. CMS also stated that the recommendations will 
serve as a catalyst for improvements to the internal controls for its 
contracting function. CMS also expressed concerns about our assessment 
of key internal controls and disagreed with our conclusions on the 
status of CMS's actions to address our November 2007 recommendations. 
CMS stated its belief that "virtually all" of the errors we identified 
in our statistical sample related to "perceived documentation 
deficiencies." CMS also expressed concern that a reasonable amount of 
time had not yet elapsed since the issuance of our November 2007 
report to allow for corrective actions to have taken place. 

However, as discussed in greater detail in our October 2009 report 
response to agency comments, nearly 2 years had elapsed between our 
November 2007 and October 2009 reports and CMS had made little 
progress in addressing the recommendations from our November 2007 
report. Further, a significant number of our October 2009 report 
findings, including weaknesses in the control environment, were based 
on observations and interviews with OAGM officials and reviews of 
related documentation such as policies and strategic plans. Finally, 
the deficiencies we identified negatively impact the key controls 
intended to help ensure compliance with agency acquisition regulations 
and the FAR. 

In conclusion, Madam Chairman, while we have not updated the status of 
any CMS actions to address our October 2009 findings and 
recommendations, the extent to which control weaknesses in CMS's 
contracting activities continue, raises questions concerning whether 
CMS management has established an appropriate "tone at the top" to 
effectively manage these key activities. Until CMS management 
addresses our previous recommendations in this area, along with taking 
action to address the additional deficiencies identified in our 
October 2009 report, its contracting activities will continue to pose 
significant risk of improper payments, waste, and mismanagement. 
Further, the deficiencies we identified are likely to be exacerbated 
by the rise in obligations for non-claims processing contract awards 
as well as CMS's extensive reliance on contractors to help achieve its 
mission objectives. It is imperative that CMS address its serious 
contract-level control deficiencies and take action on our 
recommendations to improve overall environment controls or CMS will 
continue to place billions of taxpayer dollars at risk of fraud, or 
otherwise improper contract payments. We commend the Subcommittee for 
its continuing oversight and leadership in this important area and 
believe that hearings such as the one being held today will be 
critical to ensuring that CMS's continuing contract management 
weaknesses are resolved without further delay and that overall risks 
to the government are substantially reduced. 

Madam Chairman and Members of the Subcommittee, this concludes my 
prepared statement. I would be happy to answer any questions that you 
may have at this time. 

GAO Contacts and Acknowledgments: 

For further information regarding this testimony, please contact Kay 
L. Daly at (202) 512-9095 or dalykl@gao.gov. In addition, contact 
points for our Offices of Congressional Relations and Public Affairs 
may be found on the last page of this statement. Individuals who made 
key contributions to this testimony are Marcia Carlsen and Phil 
McIntyre (Assistant Directors), Sharon Byrd, Richard Cambosos, 
Francine DelVecchio, Abe Dymond, John Lopez, Ron Schwenn, Omar Torres, 
Ruth Walk, and Danietta Williams. 

[End of section] 

Footnotes: 

[1] GAO, High Risk Series: An Update, [hyperlink, 
http://www.gao.gov/products/GAO-09-271] (Washington, D.C.: Jan. 22, 
2009). 

[2] GAO, Centers for Medicare and Medicaid Services: Internal Control 
Deficiencies Resulted in Millions of Dollars of Questionable Contract 
Payments, [hyperlink, http://www.gao.gov/products/GAO-08-54] 
(Washington, D.C.: Nov. 15, 2007). 

[3] Pub. L. No. 108-173, 117 Stat. 2066 (Dec. 8, 2003). 

[4] 48 C.F.R. ch. 1. 

[5] GAO, Centers for Medicare and Medicaid Services: Deficiencies in 
Contract Management Internal Control Are Pervasive, [hyperlink, 
http://www.gao.gov/products/GAO-10-60] (Washington, D.C.: Oct. 23, 
2009). 

[6] Certain CMS contracts, such as the claims administration contracts 
referred to as fiscal intermediaries and carriers, generally are not 
subject to FAR requirements. 

[7] GAO, Standards for Internal Control in the Federal Government, 
[hyperlink, http://www.gao.gov/products/GAO/AIMD-00-21.3.1] 
(Washington, D.C.: November 1999). 

[8] We determined a control to be "key" based on our review of the 
standards for internal control as well as the FAR, Health and Human 
Services Acquisition Regulations, and agency policies and whether 
inadequate implementation would significantly increase the risk of 
improper payments or waste. 

[9] We selected a stratified random sample of 102 contract actions 
from a population of 2,441 total contract actions recorded in CMS's 
procurement system, PRISM, during fiscal year 2008. 

[10] [hyperlink, http://www.gao.gov/products/GAO-08-54]. 

[11] Title 41, United States Code. 

[12] 48 C.F.R. ch. 3. 

[13] 48 C.F.R. ch. 99. These standards are mandatory for use by all 
executive agencies and by contractors and subcontractors in 
estimating, accumulating, and reporting costs in connection with 
pricing and administration of, and settlement of disputes concerning, 
all negotiated prime contract and subcontract procurements with the 
U.S. government in excess of $500,000. Certain contracts or 
subcontracts are exempt from CAS, such as those that are fixed price 
or those with a small business. Additionally, contractors that 
received less than $50 million in net awards in the prior accounting 
period are subject to only certain CAS standards, known as modified 
coverage. The FAR incorporates the CAS, see 48 C.F.R. §30.101(b). 

[14] Of the 19 contracts awarded, 6 were under protest and were not 
yet operational as of September 1, 2009. 

[15] [hyperlink, http://www.gao.gov/products/GAO/AIMD-00-21.3.1]. 

[16] An accounting system review is used to determine whether a 
contractor's accounting system is adequate for determining costs 
applicable to a contract. 

[17] Based on the results of our work, we are 95 percent confident 
that the percentage of contract actions that did not meet at least one 
control test is at least 84.3 percent. 

[18] Based on the results of our work, we are 95 percent confident 
that the percentage of contract actions that did not meet three or 
more control tests is at least 37.2 percent. 

[19] CMS's OAGM established the Contract Review Board as a key control 
procedure to help ensure contract award actions are in conformance 
with law, established policies and procedures, and sound business 
practices. 

[20] We identified 25 contract actions to which FAR requirements 
specific to the contract type awarded applied, of which 16 contract 
actions did not meet the control test. Based on the results of our 
work, we are 95 percent confident that the total percentage of 
contract actions that did not meet the control test is at least 46.0 
percent. 

[21] 48 C.F.R. §§ 16.104(h), 16.301-3. 

[22] The FAR states that provisional indirect cost rates shall be used 
in reimbursing indirect costs such as fringe benefits or overhead 
costs under cost reimbursement contracts and are used to prevent 
substantial overpayment or underpayment of indirect costs. 48 C.F.R. § 
42.703-1(b). Provisional indirect cost rates, sometimes called a 
materials handling rate, may also be used on some time and materials 
(T&M) contracts. 48 C.F.R. §§ 16.307(a)(1), 52.216-7. 

[23] We identified 62 contract actions to which provisional indirect 
cost rates applied, of which 36 contract actions did not meet the 
control test. Based on the results of our work, we are 95 percent 
confident that the total percentage of contract actions that did not 
meet the control test is at least 40.4 percent. 

[24] We identified 34 contract actions to which final indirect cost 
rates applied, of which 23 contract actions did not meet the control 
test. Based on the results of our work, we are 95 percent confident 
that the total percentage of contract actions that did not meet the 
control test is at least 52.6 percent. 

[25] 48 C.F.R. § 42.703-1(b). 

[26] 48 C.F.R. § 4.804 states that firm fixed price contracts should 
be closed within 6 months; contracts requiring the settlement of 
indirect costs rates, such as cost reimbursement contracts, should be 
closed within 36 months; and all other contracts should be closed 
within 20 months. These time frames begin in the month in which the 
contracting official receives evidence of physical completion of the 
contract. Generally, files for contracts using simplified acquisition 
procedures should be considered closed when the contracting officer 
receives evidence of receipt of property and final payment. 

[27] We identified 36 contract actions to which an audit of direct 
costs applied, of which 25 contract actions did not meet the control 
test. Based on the results of our work, we are 95 percent confident 
that the total percentage of contract actions that did not meet the 
control test is at least 54.9 percent. 

[28] We identified 90 contract actions to which certification of 
invoices applied, of which 61 contract actions did not meet the 
control test. Based on the results of our work, we are 95 percent 
confident that the total percentage of contract actions that did not 
meet the control test is at least 59.0 percent. 

[29] [hyperlink, http://www.gao.gov/products/GAO-08-54]. 

[30] The contractor submitted separate invoices for different contract 
line items, which resulted in the high number of invoices in 1 fiscal 
year. 

[31] 48 C.F.R. § 315.404-4(d)(4). The HHSAR generally disallows 
facilities capital cost of money. In cases when the contractor 
includes the cost in its proposal, the agency is required to reduce 
the amount of the profit objective by an equivalent amount. In the two 
instances where CMS paid facilities capital cost of money, the cost 
was either expressly disallowed by 48 C.F.R. § 52.215-17 or the profit 
objective was not reduced. 

[32] [hyperlink, http://www.gao.gov/products/GAO-08-54], p. 18. 

[33] A CFA is a contracting role established in the FAR. The FAR 
defines the CFA as the agency responsible for establishing forward 
pricing rates, final indirect cost rates (when not accomplished by a 
designated contract auditor), and administering cost accounting 
standards for all contracts in a business unit. 48 C.F.R. §§ 2.101. 
See 48 C.F.R. §§ 42.302(a), 42.703-1, 30.601. Generally, the CFA is 
the agency with the largest dollar amount of negotiated contracts, 
including options, with the contractor. The CFA concept provides an 
efficient way for contractors to receive a streamlined set of audits 
and reviews, thereby enabling them to receive and perform government 
contracts. 

[34] Within the Department of Defense (DOD), the Defense Contract 
Audit Agency (DCAA) performs contract audits, including those required 
to fulfill DOD's responsibilities as a cognizant federal agency. When 
requested and for a fee, DCAA will perform contract audits for other 
agencies. 

[End of section] 

GAO's Mission: 

The Government Accountability Office, the audit, evaluation and 
investigative arm of Congress, exists to support Congress in meeting 
its constitutional responsibilities and to help improve the performance 
and accountability of the federal government for the American people. 
GAO examines the use of public funds; evaluates federal programs and 
policies; and provides analyses, recommendations, and other assistance 
to help Congress make informed oversight, policy, and funding 
decisions. GAO's commitment to good government is reflected in its core 
values of accountability, integrity, and reliability. 

Obtaining Copies of GAO Reports and Testimony: 

The fastest and easiest way to obtain copies of GAO documents at no 
cost is through GAO's Web site [hyperlink, http://www.gao.gov]. Each 
weekday, GAO posts newly released reports, testimony, and 
correspondence on its Web site. To have GAO e-mail you a list of newly 
posted products every afternoon, go to [hyperlink, http://www.gao.gov] 
and select "E-mail Updates." 

Order by Phone: 

The price of each GAO publication reflects GAO’s actual cost of
production and distribution and depends on the number of pages in the
publication and whether the publication is printed in color or black and
white. Pricing and ordering information is posted on GAO’s Web site, 
[hyperlink, http://www.gao.gov/ordering.htm]. 

Place orders by calling (202) 512-6000, toll free (866) 801-7077, or
TDD (202) 512-2537. 

Orders may be paid for using American Express, Discover Card,
MasterCard, Visa, check, or money order. Call for additional 
information. 

To Report Fraud, Waste, and Abuse in Federal Programs: 

Contact: 

Web site: [hyperlink, http://www.gao.gov/fraudnet/fraudnet.htm]: 
E-mail: fraudnet@gao.gov: 
Automated answering system: (800) 424-5454 or (202) 512-7470: 

Congressional Relations: 

Ralph Dawn, Managing Director, dawnr@gao.gov: 
(202) 512-4400: 
U.S. Government Accountability Office: 
441 G Street NW, Room 7125: 
Washington, D.C. 20548: 

Public Affairs: 

Chuck Young, Managing Director, youngc1@gao.gov: 
(202) 512-4800: 
U.S. Government Accountability Office: 
441 G Street NW, Room 7149: 
Washington, D.C. 20548: