Centers for Medicare and Medicaid Services: Deficiencies in Contract Management Internal Control Are Pervasive
GAO-10-60
Published: Oct 23, 2009. Publicly Released: Nov 24, 2009.
Skip to Highlights
Highlights
As a result of internal control deficiencies discussed in GAO's 2007 report on certain contracts at the Centers for Medicare and Medicaid Services (CMS), GAO was asked to identify the extent to which CMS (1) implemented effective control procedures over contract actions, and (2) established a strong control environment for contract management. GAO used a statistical random sample of 2008 CMS contract actions (including contract awards and modifications) to assess CMS internal control procedures. The results were projected to the population of 2008 CMS contract actions. GAO also determined the extent to which CMS implemented recommendations GAO made in 2007 to improve internal control over contracting and payments to contractors. GAO reviewed contract file documentation and interviewed senior acquisition management officials.
Recommendations
Recommendations for Executive Action
| Agency Affected | Recommendation | Status |
|---|---|---|
| Centers for Medicare & Medicaid Services | The Administrator of CMS should develop and implement policies and procedures to ensure that federal acquisition requirements (FAR) requirements and other control objectives are met. Policies and procedures should document compliance with FAR requirements for different contract types. At a minimum, enhance current documentation, such as the contract checklist, to ensure the contract file documents authorizations for letter contracts, adequacy of the contractors accounting systems, and determination and findings for time and materials contracts, when applicable. |
In fiscal year 2012, CMS responded by developing a Quality Assurance Plan that includes a contract review checklist to test compliance with the FAR throughout the contract lifecycle. On April 13, 2012, CMS implemented the "Contract File Documentation of Award Decisions" that are in accordance with the FAR and the Health and Human Services Acquisition Regulation.
|
| Centers for Medicare & Medicaid Services | The Administrator of CMS should develop and implement policies and procedures to ensure that FAR requirements and other control objectives are met. Policies and procedures should document in the contract file provisional indirect cost rates used as a basis for reviewing the reasonableness of the indirect costs billed on the contractor invoices. |
in March 2012, CMS implemented a Cost/Price Analysis and Contract Audit Desk Guide, which defines the policy and procedures for cost/price analysis, rate checks, and cost audits within the Office of Acquisition Grants Management and clarifies the roles and responsibilities for operational contracting personnel, cost/price analysis staff, and audit staff.
|
| Centers for Medicare & Medicaid Services | The Administrator of CMS should develop and implement policies and procedures to ensure that FAR requirements and other control objectives are met. Policies and procedures should specify what constitutes timely performance of (or request for) audits of contractors' statements of incurred cost for cost reimbursement and time and materials (T&M) contracts, including circumstances when Office of Acqusition and Grants Management (OAGM) should perform the audit itself or request another organization to perform the service. |
CMS addressed this recommendation by developing the "Cost Audit Team" Tracker database, which identifies CMS' complete audit workload and allows CMS to review the last 10 years of audit workload. Also, in March 2012, to help ensure the timely performance of audits of contractors' statements of incurred cost CMS implemented a Cost/Price Analysis and Contract Audit Desk Guide, which defines the policy and procedures for cost/price analysis, rate checks, and cost audits within the OAGM and clarifies the roles and responsibilities for operational contracting personnel, cost/price analysis staff, and audit staff.
|
| Centers for Medicare & Medicaid Services | The Administrator of CMS should develop and implement policies and procedures to ensure that FAR requirements and other control objectives are met. Policies and procedures should specify circumstances under which negotiation memorandums should be used and the content of such, and any required secondary reviews, in light of Health and Human Services Acquisition Regulations (HHSAR) requirements and current OAGM practice. |
In April 2012, CMS implemented a policy for Contract File Documentation for Award Decisions and Negotiation Memorandums, as specified by the FAR and HHSAR. This policy includes specific guidance required for preparing and documenting pre- and post-negotiation memorandums.
|
| Centers for Medicare & Medicaid Services | The Administrator of CMS should develop and implement policies and procedures to ensure that FAR requirements and other control objectives are met. Policies and procedures should specify Contract Review Board review documentation to include, at a minimum, documentation of the number of contracts reviewed each year, the issues identified by the Contract Review Board (CRB) reviewer(s), and resolution of issues identified during the CRB reviews. |
CMS developed and implemented policies and procedures to ensure that FAR requirements and other control objectives are met. CMS issued revised Contract Review Board policies that included documentation of the contracts reviewed annually, issues identified, and resolutions.
|
| Centers for Medicare & Medicaid Services | The Administrator of CMS should develop and implement policies and procedures to ensure that FAR requirements and other control objectives are met. Policies and procedures should require Division Directors to periodically assess, document, and report to senior management on the results of their review of whether the contract files contain documentation that invoices were properly reviewed by both the project officer and contracting officer or specialist. |
in fiscal year 2012, CMS developed a Quality Assurance Plan (QAP) that includes a contract review checklist to test the effectiveness of internal controls throughout the acquisition lifecycle by The Office of Acquisition and Grants Management (OAGM).
|
| CMS Office of Acquisition and Grants Management | To strengthen the control environment, the Office of Acquisition Grants Management (OAGM) management should develop and implement a comprehensive strategic acquisition workforce plan. The plan should include, at a minimum, elements such as performance goals, time frames, implementation actions, and resource requirements, and address issues such as OAGM workload, full time equivalents needed, and a workforce skills analysis, as well as an estimate of the amount of resources OAGM needs to fulfill the audit and other FAR requirements for comprehensive oversight, including those required of a cognizant federal agency (CFA). |
In response to our recommendation, CMS contracted with a third party to prepare a workforce plan, which was completed in October 2010. The plan included recommendations, implementation actions, and timelines to resolve staffing deficiencies and recruit, develop, and retain staff; development of policies and procedures for contract awards; and development and tracking of agency performance goals.
|
| CMS Office of Acquisition and Grants Management | To strengthen the control environment, the Office of Acquisition Grants Management (OAGM) management should revise the Verification and Validation Plan for Departmental Contracts Information System (DCIS) Accuracy and Improvements policy to require all relevant errors be corrected and their resolution documented. |
During November of each year, Health and Human Services (HHS) requires DCIS anomalies to be resolved by the end of November and documented. Additionally, in April, 2012, CMS implemented the CMS Comprehensive Acquisition Management System (CAMS) application, which is now CMS's complete end-to-end acquisition lifecycle application that includes acquisition planning, requisitioning, contract writing, invoicing, and contract closeout modules.
|
| CMS Office of Acquisition and Grants Management | To strengthen the control environment, the Office of Acquisition Grants Management (OAGM) management should develop and implement policies and procedures for tracking contract audit requests, monitoring the results of contract audits and evaluations, and resolving the audit findings, to include roles and responsibilities of the contracting officer, specialist, and members of the cost/price team. |
February 2011 CMS developed the Cost Audit Team Tracker database which identifies their complete audit workload and allows CMS to review the last ten years of audits. In March 2012, CMS implemented a Cost/Price Analysis and Contract Audit Desk Guide which defines the policy and procedures for cost/price analysis, rate checks, and cost audits within the Office of Acquisition & Grants Management and clarifies the roles and responsibilities for operational contracting personnel and cost/price analysis staff and audit staff.
|
| Department of Health and Human Services | To improve the department's fulfillment of CFA duties as described in FAR, the Secretary of HHS should develop policies and procedures that clearly assign roles and responsibilities for the timely fulfillment of CFA duties, and that include the preparation of and periodic update of a list of contractors for which the department is the CFA. |
CMS agreed with our recommendation. In March 2012, CMS implemented a Cost/Price Analysis and Contract Audit Desk Guide, in accordance with the Federal Acquisition Regulation (FAR), and Health and Human Services Acquisition Regulation (HHSAR), which clarifies the roles and responsibilities for operational contracting personnel and cost/price analysis staff and audit staff.
|
Full Report
Topics
Accounting proceduresAllowable costsBudget obligationsContract administrationContract oversightContracting officersContractor paymentsContractorsContractsDocumentationFederal procurementInformation managementInternal controlsOverhead costsRequirements definitionSchedule slippagesCompliancePolicies and procedures