Required Audits of Limited Value
GAO-08-154T, Oct 16, 2007
In fiscal year 2006, the Centers for Medicare & Medicaid Services (CMS) estimated it spent over $51 billion on the Medicare Advantage program, which serves as an alternative to the traditional feefor- service program. Under the Medicare Advantage program, CMS approves private companies to offer health plan options to Medicare enrollees that include all Medicare-covered services. Many plans also provide supplemental benefits. The Balanced Budget Act (BBA) of 1997 requires CMS to annually audit the financial records supporting the submissions (i.e., adjusted community rate proposals (ACRP) or bids) of at least onethird of participating organizations. BBA also requires that GAO monitor the audits. This testimony provides information on (1) the ACRP and bid process and related audit requirement, (2) CMS' efforts related to complying with the audit requirement, and (3) factors that cause CMS' audit process to be of limited value.
Before 2006, companies choosing to participate in the Medicare Advantage program were annually required to submit an ACRP to CMS for review and approval. In 2006, a bid submission process replaced the ACRP process. The ACRPs and bids identify the health services the company will provide to Medicare members and the estimated cost for providing those services. CMS contracted with accounting and actuarial firms to perform the required audits. According to our analysis, CMS did not meet the requirement for auditing the financial records of at least one-third of the participating Medicare Advantage organizations for contract years 2001-2005. CMS is planning to conduct other financial reviews of organizations to meet the audit requirement for contract year 2006. However, CMS does not plan to complete the financial reviews until almost 3 years after the bid submission date each contract year, which will affect its ability to address any identified deficiencies in a timely manner. CMS did not consistently ensure that the audit process for contract years 2001-2005 provided information to assess the impact on beneficiaries. After contract year 2003 audits were completed, CMS took steps to determine such impact and identified an impact on beneficiaries of about $35 million. CMS audited contract year 2006 bids for 80 organizations, and 18 had a material finding that affected amounts in approved bids. CMS officials took limited action to follow up on contract year 2006 findings. CMS officials told us they do not plan to sanction or pursue financial recoveries based on these audits because the agency does not have the legal authority to do so. According to our assessment of the statutes, CMS had the authority to pursue financial recoveries, but its rights under contracts for 2001-2005 were limited because its implementing regulations did not require that each contract include provisions to inform organizations about the audits and about the steps that CMS would take to address identified deficiencies. Further, our assessment of the statute is that CMS has the authority to include terms in bid contracts that would allow it to pursue financial recoveries. Without changes in its procedures, CMS will continue to invest resources in audits that will likely provide limited value.