Centers for Medicare and Medicaid Services:

Deficiencies in Contract Management Internal Control Are Pervasive

GAO-10-60: Published: Oct 23, 2009. Publicly Released: Nov 24, 2009.

Additional Materials:

Contact:

Kay L. Daly
(202) 512-9312
contact@gao.gov

 

Office of Public Affairs
(202) 512-4800
youngc1@gao.gov

As a result of internal control deficiencies discussed in GAO's 2007 report on certain contracts at the Centers for Medicare and Medicaid Services (CMS), GAO was asked to identify the extent to which CMS (1) implemented effective control procedures over contract actions, and (2) established a strong control environment for contract management. GAO used a statistical random sample of 2008 CMS contract actions (including contract awards and modifications) to assess CMS internal control procedures. The results were projected to the population of 2008 CMS contract actions. GAO also determined the extent to which CMS implemented recommendations GAO made in 2007 to improve internal control over contracting and payments to contractors. GAO reviewed contract file documentation and interviewed senior acquisition management officials.

Pervasive deficiencies in CMS contract management internal controlincrease the risk of improper payments or waste. Specifically, based on our statistical random sample of 2008 CMS contract actions, GAO estimates that at least 84.3 percent of fiscal year 2008 contract actions contained at least one instance where a key control was not adequately implemented. GAO also estimates that at least 37.2 percent of fiscal year 2008 contract actions had three or more instances in which a key control was not adequately implemented. The contract actions GAO evaluated were generally subject to the Federal Acquisition Regulation. For example, CMS used cost reimbursement contracts without first ensuring that the contractor had an adequate accounting system. Also, project officers did not always certify invoices for payment. These deficiencies were due in part to a lack of agency-specific policies and procedures to help ensure proper contracting expenditures. These control deficiencies also stem from a weak overall control environment as characterized primarily by inadequate strategic planning for staffing and funding resources. CMS also did not accurately capture data on the nature and extent of its contracting, which hinders CMS's ability to manage its acquisition function by identifying areas of risk, due to a lack of quality assurance procedures over data entry. CMS also has not substantially addressed seven of the nine recommendations made by GAO in 2007 to improve internal control over contracting and payments to contractors. For example, CMS has not made progress in clarifying the roles and responsibilities for implementing certain contractor oversight responsibilities and, as of July 2009, CMS still had a backlog of contacts that were overdue for closeout, putting CMS at increased risk of not identifying or recovering improper payments or waste. The continuing weaknesses in contracting activities and limited progress in addressing known deficiencies will continue to put billions of taxpayer dollars at risk of improper payments or waste.

Recommendations for Executive Action

  1. Status: Closed - Implemented

    Comments: In fiscal year 2012, CMS responded by developing a Quality Assurance Plan that includes a contract review checklist to test compliance with the FAR throughout the contract lifecycle. On April 13, 2012, CMS implemented the "Contract File Documentation of Award Decisions" that are in accordance with the FAR and the Health and Human Services Acquisition Regulation.

    Recommendation: The Administrator of CMS should develop and implement policies and procedures to ensure that federal acquisition requirements (FAR) requirements and other control objectives are met. Policies and procedures should document compliance with FAR requirements for different contract types. At a minimum, enhance current documentation, such as the contract checklist, to ensure the contract file documents authorizations for letter contracts, adequacy of the contractors accounting systems, and determination and findings for time and materials contracts, when applicable.

    Agency Affected: Department of Health and Human Services: Centers for Medicare and Medicaid Services

  2. Status: Closed - Implemented

    Comments: in March 2012, CMS implemented a Cost/Price Analysis and Contract Audit Desk Guide, which defines the policy and procedures for cost/price analysis, rate checks, and cost audits within the Office of Acquisition Grants Management and clarifies the roles and responsibilities for operational contracting personnel, cost/price analysis staff, and audit staff.

    Recommendation: The Administrator of CMS should develop and implement policies and procedures to ensure that FAR requirements and other control objectives are met. Policies and procedures should document in the contract file provisional indirect cost rates used as a basis for reviewing the reasonableness of the indirect costs billed on the contractor invoices.

    Agency Affected: Department of Health and Human Services: Centers for Medicare and Medicaid Services

  3. Status: Closed - Implemented

    Comments: CMS addressed this recommendation by developing the "Cost Audit Team" Tracker database, which identifies CMS' complete audit workload and allows CMS to review the last 10 years of audit workload. Also, in March 2012, to help ensure the timely performance of audits of contractors' statements of incurred cost CMS implemented a Cost/Price Analysis and Contract Audit Desk Guide, which defines the policy and procedures for cost/price analysis, rate checks, and cost audits within the OAGM and clarifies the roles and responsibilities for operational contracting personnel, cost/price analysis staff, and audit staff.

    Recommendation: The Administrator of CMS should develop and implement policies and procedures to ensure that FAR requirements and other control objectives are met. Policies and procedures should specify what constitutes timely performance of (or request for) audits of contractors' statements of incurred cost for cost reimbursement and time and materials (T&M) contracts, including circumstances when Office of Acqusition and Grants Management (OAGM) should perform the audit itself or request another organization to perform the service.

    Agency Affected: Department of Health and Human Services: Centers for Medicare and Medicaid Services

  4. Status: Closed - Implemented

    Comments: In April 2012, CMS implemented a policy for Contract File Documentation for Award Decisions and Negotiation Memorandums, as specified by the FAR and HHSAR. This policy includes specific guidance required for preparing and documenting pre- and post-negotiation memorandums.

    Recommendation: The Administrator of CMS should develop and implement policies and procedures to ensure that FAR requirements and other control objectives are met. Policies and procedures should specify circumstances under which negotiation memorandums should be used and the content of such, and any required secondary reviews, in light of Health and Human Services Acquisition Regulations (HHSAR) requirements and current OAGM practice.

    Agency Affected: Department of Health and Human Services: Centers for Medicare and Medicaid Services

  5. Status: Closed - Implemented

    Comments: CMS developed and implemented policies and procedures to ensure that FAR requirements and other control objectives are met. CMS issued revised Contract Review Board policies that included documentation of the contracts reviewed annually, issues identified, and resolutions.

    Recommendation: The Administrator of CMS should develop and implement policies and procedures to ensure that FAR requirements and other control objectives are met. Policies and procedures should specify Contract Review Board review documentation to include, at a minimum, documentation of the number of contracts reviewed each year, the issues identified by the Contract Review Board (CRB) reviewer(s), and resolution of issues identified during the CRB reviews.

    Agency Affected: Department of Health and Human Services: Centers for Medicare and Medicaid Services

  6. Status: Closed - Implemented

    Comments: in fiscal year 2012, CMS developed a Quality Assurance Plan (QAP) that includes a contract review checklist to test the effectiveness of internal controls throughout the acquisition lifecycle by The Office of Acquisition and Grants Management (OAGM).

    Recommendation: The Administrator of CMS should develop and implement policies and procedures to ensure that FAR requirements and other control objectives are met. Policies and procedures should require Division Directors to periodically assess, document, and report to senior management on the results of their review of whether the contract files contain documentation that invoices were properly reviewed by both the project officer and contracting officer or specialist.

    Agency Affected: Department of Health and Human Services: Centers for Medicare and Medicaid Services

  7. Status: Closed - Implemented

    Comments: In response to our recommendation, CMS contracted with a third party to prepare a workforce plan, which was completed in October 2010. The plan included recommendations, implementation actions, and timelines to resolve staffing deficiencies and recruit, develop, and retain staff; development of policies and procedures for contract awards; and development and tracking of agency performance goals.

    Recommendation: To strengthen the control environment, the Office of Acquisition Grants Management (OAGM) management should develop and implement a comprehensive strategic acquisition workforce plan. The plan should include, at a minimum, elements such as performance goals, time frames, implementation actions, and resource requirements, and address issues such as OAGM workload, full time equivalents needed, and a workforce skills analysis, as well as an estimate of the amount of resources OAGM needs to fulfill the audit and other FAR requirements for comprehensive oversight, including those required of a cognizant federal agency (CFA).

    Agency Affected: Department of Health and Human Services: Centers for Medicare and Medicaid Services: Office of Acquisition and Grants Management

  8. Status: Closed - Implemented

    Comments: During November of each year, Health and Human Services (HHS) requires DCIS anomalies to be resolved by the end of November and documented. Additionally, in April, 2012, CMS implemented the CMS Comprehensive Acquisition Management System (CAMS) application, which is now CMS's complete end-to-end acquisition lifecycle application that includes acquisition planning, requisitioning, contract writing, invoicing, and contract closeout modules.

    Recommendation: To strengthen the control environment, the Office of Acquisition Grants Management (OAGM) management should revise the Verification and Validation Plan for Departmental Contracts Information System (DCIS) Accuracy and Improvements policy to require all relevant errors be corrected and their resolution documented.

    Agency Affected: Department of Health and Human Services: Centers for Medicare and Medicaid Services: Office of Acquisition and Grants Management

  9. Status: Closed - Implemented

    Comments: February 2011 CMS developed the Cost Audit Team Tracker database which identifies their complete audit workload and allows CMS to review the last ten years of audits. In March 2012, CMS implemented a Cost/Price Analysis and Contract Audit Desk Guide which defines the policy and procedures for cost/price analysis, rate checks, and cost audits within the Office of Acquisition & Grants Management and clarifies the roles and responsibilities for operational contracting personnel and cost/price analysis staff and audit staff.

    Recommendation: To strengthen the control environment, the Office of Acquisition Grants Management (OAGM) management should develop and implement policies and procedures for tracking contract audit requests, monitoring the results of contract audits and evaluations, and resolving the audit findings, to include roles and responsibilities of the contracting officer, specialist, and members of the cost/price team.

    Agency Affected: Department of Health and Human Services: Centers for Medicare and Medicaid Services: Office of Acquisition and Grants Management

  10. Status: Closed - Implemented

    Comments: CMS agreed with our recommendation. In March 2012, CMS implemented a Cost/Price Analysis and Contract Audit Desk Guide, in accordance with the Federal Acquisition Regulation (FAR), and Health and Human Services Acquisition Regulation (HHSAR), which clarifies the roles and responsibilities for operational contracting personnel and cost/price analysis staff and audit staff.

    Recommendation: To improve the department's fulfillment of CFA duties as described in FAR, the Secretary of HHS should develop policies and procedures that clearly assign roles and responsibilities for the timely fulfillment of CFA duties, and that include the preparation of and periodic update of a list of contractors for which the department is the CFA.

    Agency Affected: Department of Health and Human Services

 

Explore the full database of GAO's Open Recommendations »

Nov 21, 2014

Nov 14, 2014

Nov 13, 2014

Nov 12, 2014

Oct 31, 2014

Oct 30, 2014

Oct 27, 2014

Oct 24, 2014

Oct 20, 2014

Oct 9, 2014

Looking for more? Browse all our products here