This is the accessible text file for GAO report number GAO-02-300 
entitled 'Medicaid Financial Management: Better Oversight of State 
Claims for Federal Reimbursement Needed' which was released on 
February 28, 2002. 

This text file was formatted by the U.S. General Accounting Office 
(GAO) to be accessible to users with visual impairments, as part of a 
longer term project to improve GAO products' accessibility. Every 
attempt has been made to maintain the structural and data integrity of 
the original printed product. Accessibility features, such as text 
descriptions of tables, consecutively numbered footnotes placed at the 
end of the file, and the text of agency comment letters, are provided 
but may not exactly duplicate the presentation or format of the 
printed version. The portable document format (PDF) file is an exact 
electronic replica of the printed version. We welcome your feedback. 
Please E-mail your comments regarding the contents or accessibility 
features of this document to Webmaster@gao.gov. 

This is a work of the U.S. government and is not subject to copyright 
protection in the United States. It may be reproduced and distributed 
in its entirety without further permission from GAO. Because this work 
may contain copyrighted images or other material, permission from the 
copyright holder may be necessary if you wish to reproduce this 
material separately. 

United States General Accounting Office: 
GAO: 

Report to the Subcommittee on Government Efficiency, Financial 
Management and Intergovernmental Relations, Committee on Government 
Reform, House of Representatives: 

February 2002: 

Medicaid Financial Management: 

Better Oversight of State Claims for Federal Reimbursement Needed: 

GAO-02-300: 

Contents: 

Letter: 

Results in Brief: 

Background: 

Objectives, Scope, and Methodology: 

CMS Had Not Implemented a Risk-Based Approach and Effective Control 
Activities for Financial Oversight: 

Monitoring Activities Were Limited in Scope and Effectiveness: 

Organizational Structure Impedes Effective Oversight: 

Conclusion: 

Recommendations for Executive Action: 

Agency Comments and Our Evaluation: 

Appendix: 

Appendix I: Comments from the U.S. Department of Health and Human 
Services' Centers for Medicare and Medicaid Services: 

Related GAO Products: 

Tables: 

Table 1: Expenditure and Budget Forms Submitted by States: 

Table 2: External Oversight Activities by Entity: 

Table 3: Examples of State Medicaid Prepayment Reviews and Other 
Prevention Efforts: 

Table 4: Examples of State Postpayment Detection Activities and 
Payment Accuracy Studies: 

Table 5: Regional Office Oversight Activities : 

Figures: 

Figure 1: CMS Organization Chart: 

Figure 2: Medicaid Financial Management and Oversight Process: 

Figure 3: Change in Financial Analysts (FrEs) versus Change in Federal 
Medicaid Expenditures 1992 and 2000: 

Abbreviations: 

CMS: Centers for Medicare and Medicaid Services: 

CMSO: Center for Medicaid and State Operations: 

DAL: Division of Audit Liaison: 

DFM: Division of Financial Management: 

DSH: Disproportionate Share Hospital: 

FTE: full time equivalent: 

HCFA: Health Care Financing Administration: 

HHS: Department of Health and Human Services: 

MCO: Managed Care Organization: 

MSIS: Medicaid Statistical Information System: 

OIG: Office of Inspector General: 

OMB: Office of Management and Budget: 

PARIS: Public Assistance Reporting Information System: 

RO: Regional Office: 

SCRIP: State Children's Health Insurance Program: 

SSA: Social Security Administration: 

[End of section] 

United States General Accounting Office: 
Washington, D.C. 20548: 

February 28, 2002: 

The Honorable Stephen Horn: 
Chairman: 
The Honorable Janet D. Schakowsky: 
Ranking Member: 
Subcommittee on Government Efficiency, Financial Management and 
Intergovernmental Relations: 
Committee on Government Reform: 
House of Representatives: 

The federal government and states share responsibility for the fiscal 
integrity and financial management of the jointly funded Medicaid 
program. During fiscal year 2000, the Medicaid program served about 
33.4 million low-income families as well as certain elderly, blind, 
and disabled persons at a cost of $119 billion to the federal 
government and $88 billion to the states for program payments and 
administrative expenses. States are the first line of defense in 
safeguarding Medicaid financial management, as they are responsible 
for making proper payments to Medicaid providers, recovering misspent 
funds, and accurately reporting costs for federal reimbursement. At 
the federal level, the Centers for Medicare and Medicaid Services 
(CMS) is responsible for overseeing state financial activities and 
ensuring the propriety of expenditures reported by states for federal 
reimbursement.[Footnote 1] 

How well states manage Medicaid finances and how well CMS oversees 
state financial management are important concerns because of the size 
and nature of the program. Audits of state Medicaid finances conducted 
in accordance with the Single Audit Act of 1984, as amended, annually 
identify millions of dollars in questionable or unallowable costs 
incurred by state Medicaid agencies. In addition, annual financial 
statement audits required under the Chief Financial Officers Act have 
identified many internal control weaknesses in regards to CMS's 
oversight of state Medicaid financial operations. In light of these 
concerns, you requested that we review the adequacy of CMS's financial 
oversight process for Medicaid. Our review assesses whether (1) CMS 
has an adequate oversight process to help ensure the propriety of 
Medicaid expenditures, (2) CMS adequately evaluates and monitors the 
results of its oversight process and makes adjustments as warranted, 
and (3) the current CMS organizational structure for financial 
management is conducive to effectively directing its oversight process 
and sustaining future improvements. This report responds to your 
request. 

Results in Brief: 

Although CMS is responsible for overseeing the more than $100 billion 
that the federal government expends annually for Medicaid, its 
financial oversight has weaknesses that leave the program vulnerable 
to improper payments. The comptroller general's Standards for Internal 
Control in the Federal Government[Footnote 2] requires that agency 
managers perform risk assessments, take actions to mitigate identified 
risks, and then monitor the effectiveness of those actions. In 
addition, the standards provide that agencies should ensure that the 
organizational structure is designed so that authority and 
responsibility for internal controls are clear. CMS oversight had 
weaknesses in each of these areas. 

Our review found that CMS had only recently begun to assess areas of 
greatest risk for improper payments, and thus did not have controls in 
place that focused on the highest risk areas. As a result, CMS did not 
have the requisite assurance that its control activities were focused 
on areas of greatest risk. CMS also was not effectively implementing 
the controls it had in place. For example, analysts across the 10 
regions did not consistently conduct focused financial reviews that 
are beneficial in identifying unallowable costs in specific Medicaid 
service areas; only 8 such reviews were conducted in fiscal year 2000 
as compared to 90 reviews in fiscal year 1992, which CMS attributes to 
lack of resources. Recognizing its oversight deficiencies and resource 
constraints, CMS began efforts in April 2001 to develop a risk-based 
approach and revise its control activities. These efforts did not, 
however, integrate information available from state financial 
oversight program activities or consider other control techniques that 
could enable CMS to more efficiently and effectively carry out its 
oversight responsibilities. 

Our review also found that CMS had few mechanisms in place to 
continuously monitor the effectiveness of its oversight. Managers had 
not established performance standards for financial oversight 
activities, particularly their expenditure review activity. Limited 
data were collected to assess regional financial analyst performance 
in overseeing state internal controls and expenditures. In addition, 
the CMS audit resolution procedures did not collect sufficient 
information on the status of audit findings or ensure that audit 
findings were resolved promptly. 

The current organizational structure of CMS has created challenges to 
effective oversight because of unclear lines of authority and 
responsibility between the regions and headquarters. Although the 10 
regional offices are the CMS frontline defense in overseeing state 
financial management and Medicaid expenditures, there are no reporting 
relationships to the headquarters unit responsible for Medicaid 
financial management. As a result, CMS lacks consistency in its 
approach to establish and enforce standards, evaluate regional office 
oversight, and implement changes to improve financial oversight. 

Improving the oversight of Medicaid finances will require commitment 
from top-level managers to formulate a workable financial management 
strategy, ensure accountability for its implementation, and allocate 
sufficient resources. This report makes recommendations on ways CMS 
can revise its risk assessment efforts, restructure its financial 
control activities, improve monitoring, and address accountability and 
authority issues posed by its organizational structure. 

In written comments on a draft of this report, CMS outlined a series 
of actions it has planned or recently begun to address its Medicaid 
financial management challenges. CMS stated that these efforts 
substantially address, within current resource constraints, the four 
areas of our recommendations. In supplementary oral comments, however, 
CMS did not agree with our recommendations related to audit tracking 
and resolution reports, stating that the current reports are adequate. 
We disagree that the reports are adequate given the omission of 
information from the reports on the status of numerous audit findings 
and believe that CMS needs to work cooperatively with the HHS-OIG to 
ensure that its audit tracking information is current and complete. 
Accordingly, we continue to believe that CMS should take steps to 
ensure that tracking reports provide agency management with the 
necessary information to determine that actions are taken promptly to 
prevent Medicaid financial management weaknesses from continuing. 
Additional details on CMS comments and our assessment of its position 
appear in the Agency Comments and Our Evaluation section at the end of 
this report. 

Background: 

CMS, a component of the Department of Health and Human Services (HHS), 
administers the Medicaid program. Medicaid is the third largest social 
program in the federal budget and is one of the largest components of 
state budgets. Although it is one federal program, Medicaid consists 
of 56 distinct state-level programs-one for each state, territory, 
Puerto Rico, and the District of Columbia.[Footnote 3] 

Each of the states has a designated Medicaid agency that administers 
the Medicaid program. The federal government matches state Medicaid 
spending for medical assistance according to a formula based on each 
state's per capita income. The federal share can range from 50 to 83 
cents of every state dollar spent. 

In accordance with the Medicaid statute and within broad federal 
guidelines, each state establishes its own eligibility standards; 
determines the type, amount, duration, and scope of covered services; 
sets payment rates; and develops its administrative structure. Each 
state Medicaid agency is also responsible for establishing and 
maintaining an adequate internal control structure to ensure that the 
Medicaid program is managed with integrity and in compliance with 
applicable law. States are required to describe the nature and scope 
of their programs in comprehensive written plans submitted to CMS-with 
federal funding for state Medicaid services contingent on CMS approval 
of the plans. This approval hinges on whether CMS determines that 
state Medicaid plans meet all applicable federal laws and regulations. 

At the federal level, the Center for Medicaid and State Operations 
(CMSO) within CMS is responsible for approving state Medicaid plans, 
working with the states on program integrity and other program 
administration functions, and overseeing state financial management 
and internal control processes. CMSO shares Medicaid program 
administration and financial management responsibilities with the 10 
CMS regional offices (RO). The Division of Financial Management (DFM), 
within CMSO's Finance, Systems and Quality Group, has primary 
responsibility for Medicaid financial management. DFM, in conjunction 
with the 10 regions, establishes and maintains the internal control 
structure for Medicaid financial management and state oversight. 

As is the case for all major federal agency programs, the internal 
control structure established by CMS for Medicaid should meet 
requirements of Office of Management and Budget (OMB) Circular A-123, 
Management Accountability and Control, and the Standards for Internal 
Control in the Federal Government. According to Circular A-123, 
management controls are the organization policies and procedures used 
to reasonably ensure that programs are protected from waste, fraud, 
and mismanagement and achieve their intended results. Establishing 
good management controls requires, according to the circular, that 
agency managers take systematic and proactive measures to implement 
appropriate management controls, assess the adequacy of the controls, 
identify needed improvements, and take corresponding corrective 
action. The Standards for Internal Control in the Federal Government 
includes five standards that provide a roadmap for agencies to 
establish control for all aspects of their operations and a basis 
against which agencies' control structures can be evaluated. The 
standards are defined as follows: 

* Control environment—creating a culture of accountability by 
establishing a positive and supportive attitude toward improvement and 
the achievement of established program outcomes. 

* Risk assessment—performing comprehensive reviews and analyses of 
program operations to determine if risks exist and the nature and 
extent of the risks identified. 

* Control activities—taking actions to address identified risk areas 
and help ensure that management's decisions and plans are carried out 
and program objectives are met. 

* Information and communication—using and sharing relevant, reliable, 
and timely financial and nonfinancial information in managing 
operations. 

* Monitoring—tracking improvement initiatives over time, and 
identifying additional actions needed to further improve program 
efficiency and effectiveness. 

The internal control structure and financial oversight process that 
CMS has designed for Medicaid includes activities for (1) approving 
and awarding grants to make funds available to the states for the 
efficient operation of the Medicaid program, (2) overseeing state 
financial management and internal control processes, (3) ensuring the 
reasonableness of budgets reported to estimate federal funding 
requirements, and (4) ensuring the propriety of expenditures reported 
for federal matching funds. DFM shares these responsibilities with 
about 76 regional financial analysts and branch chiefs, who report to 
their respective regional administrators. Figure 1 outlines CMS's 
organizational structure related to Medicaid. 

Figure 1: CMS Organization Chart: 

[Refer to PDF for image] 

Top level: 
Department of Health and Human Services: Tommy Thompson, Secretary. 

Second level, reporting to Department of Health and Human Services: 
* Centers for Medicare and Medicaid Services: Thomas A. Scully, 
Administrator; 
* Center for Medicaid and State Operations: Dennis G. Smith, Director; 
- Policy Coordination and Planning Group; 
- Intergovernment and Tribal Affairs Group; 
- Private Health Insurance Group. 

Third level, reporting to Center for Medicaid and State Operations: 
* Family and Childrens Health Program Group; 
* Disabled and Elderly Health Program Group; 
* Survey and Certification Group; 
* Financial Systems and Quality Group; 
- Division of Financial Management. 

Fourth level, reporting to Centers for Medicare and Medicaid Services: 
* Northeastern Consortium: 
- New York Region; 
- Philadelphia Region; 
- Boston Region; 
* Southern Consortium: 
- Atlanta Region; 
- Dallas Region; 
* Western Consortium: 
- Seattle Region; 
- Denver Region; 
- San Francisco Region; 
* Midwestern Consortium
- Chicago Region; 
- Kansas City Region. 

[End of figure] 

Regional financial analysts are key to CMS financial management 
activities, as they are responsible for performing frontline 
activities to oversee state financial management and internal control 
processes. Some of the key oversight activities performed by regional 
analysts are (1) reviewing state quarterly budget estimates and 
expenditure reports, (2) preparing decision reports that document 
approvals for federal reimbursement and reimbursement deferral 
actions, (3) providing technical assistance to states on financial 
matters, and (4) serving as liaison to the states and audit entities. 
DFM staff in headquarters rely on regional decision reports to help 
determine and issue state grant awards. 

States submit various federal reporting forms that provide regional 
financial analysts with the budget and expenditure data to execute 
their financial management and oversight responsibilities. When the 
State Children's Health Insurance Program (SCHIP) was created through 
the Balanced Budget Act of 1997 to provide health insurance to 
children of low-income families who would not qualify for Medicaid, 
states have been required to submit expenditure and budget data on 
both Medicaid and SCRIP. The Medicaid and SCRIP forms are submitted 
quarterly through the Medicaid and SCRIP Budget and Expenditure System 
(MBES). See table 1 below for a brief description of the contents of 
the reporting forms. 

Table 1: Expenditure and Budget Forms Submitted by States: 

Form: CMS 64 — Quarterly Medicaid State Expenditures Report; 
Description: The accounting statements that the state agency, in 
accordance with 42 CFR 430.30(c), submits each quarter under Title XIX 
of the Social Security Act. The expenditure report shows how the state 
expended its federal Medicaid grant funds for the quarter being 
reported as well as any adjustments to expenditures, which relate to 
previous quarters. It is a summary of actual expenditures derived from 
source documents including invoices, cost reports, and eligibility 
records. 

Form: CMS 37 — Quarterly Medicaid Program Budget Report; 
Description: A financial report submitted by the state in accordance 
with 42 CFR 430.30(b). The report provides the state's Medicaid 
funding requirements for a certified quarter and estimates the 
underlying assumptions for 2 fiscal years, current and budget. In 
order to receive the federal share of state Medicaid expenditures, 
referred to as the Federal Financial Participation (FFP), the state 
must verify that the requisite matching state and local funds are, or 
will be, available for the certified quarter. 

Form: CMS 21 — State Children's Health Insurance Program (SCHIP) 
Statement of Expenditures for Title XXI; 
Description: The accounting statement that the state submits each 
quarter in accordance with Sections 2105 (e) and 2107 (b)(1) of the 
Social Security Act. The statement is a summary of actual expenditures 
derived from source documents including invoices, cost reports, and 
eligibility reports. 

Form: CMS 21 B — State Children's Health Insurance Program (SCHIP) 
Budget Report for Title XXI; 
Description: A financial report submitted by the state in accordance 
with Sections 2105 (e) and 2107 (b) of the Social Security Act. The 
report provides a statement of the state's expenditure plan and 
funding requirements for a certified quarter and estimates for 2 
fiscal years, current and budget. States must verify that the 
requisite matching state and local funds are, or will be, available 
for the certified quarter. 

[End of table] 

Reviews of the Medicaid and SCRIP expenditure reports (CMS 64 and 21) 
are the primary oversight control activities performed by regional 
financial analysts. These reviews are used to determine if Medicaid 
expenditures are complete, properly supported by the state's 
accounting records, claimed at appropriate federal matching rates, and 
allowable in accordance with existing federal laws and regulations. 
Regional analysts are expected to obtain knowledge about state 
financial management and internal control processes to aid in 
assessing the expenditures reported for federal reimbursement. Figure 
2 shows an overview of the financial management and oversight process. 

Figure 2: Medicaid Financial Management and Oversight Process: 

[Refer to PDF for image: illustration] 

State Medicaid Agency: 
* Administers the program; 
* Pays providers for Medicaid services. 
* CMS 64 and CMS 21 expenditure reports to CMS; 
* CMS 37 and CMS 21G budget reports to CMS. 

CMS: 
* Administers the program
* Awards matching payment grants to states for federal portion of 
program funding — initial, supplemental and final grant awards[A]. 

CMS Regional Offices (10): 
* Review state budget reports; 
* Review state expenditure reports for accuracy; 
* Identify unallowable costs; 
* Issue disallowance letters. 

CMS Central Office CMSO-DFM: 
* Approve and award grants after RO review of budget; 
* Reconcile grant awards to expenditures after RO review of 
expenditures; 
* Award supplemental and final grants; 
* Report financial data to CMS chief financial officer. 

Health Care Providers: 
* Health care providers[B] submit claims to state Medicaid agencies 
for services provided to Medicaid beneficiaries. 

[A] CMS transmits award amounts to HHS's Program Support Center. 
States withdraw funds to pay the expenses of the Medicaid program. 

[B] Health care providers include physicians, dentists, nurses, home 
health care providers, rural health clinics, and nursing facilities. 

[End of figure] 

Oversight of state expenditures and internal controls by CMS regional 
financial analysts is not the only federal oversight mechanism for 
ensuring the propriety of Medicaid finances. Medicaid expenditures and 
requisite internal controls are reviewed annually by auditors under 
requirements of the Single Audit Act of 1984. The Congress established 
the Single Audit Act to gain reasonable assurance that federal 
financial assistance programs are managed in accordance with 
applicable laws and regulations. The Single Audit Act requires audits 
of state and local government entities that expend at least $300,000 
in federal awards annually.[Footnote 4] The results of these audits 
are provided to the state and responsible federal agency. The federal 
agency is responsible for following up with the state to ensure that 
the state takes action to correct the deficiencies identified from the 
audit. 

Other entities have responsibilities for routinely reviewing Medicaid 
finances and Medicaid internal controls. Table 2 explains various 
oversight activities by entities outside of CMS. 

Table 2: External Oversight Activities by Entity: 

Entity: HHS Office of Inspector General (HHS/0IG); 
Oversight activity: 
* HHS/OIG oversees the annual CFO financial statement audit of CMS, 
which includes an audit of the Medicaid program's financial statements; 
* HHS/OIG performs program and financial audits; 
* HHS/OIG tracks open recommendations and performs follow-up inquiries. 

Entity: State auditors; 
Oversight activity: 
* State auditors perform the state single audit in accordance with the 
Single Audit Act; 
* The auditors perform state audits and reviews. 

Entity: State Medicaid agencies; 
Oversight activity: 
* State Medicaid agencies administer the Medicaid program to local 
beneficiaries; 
* The agencies pay the providers for Medicaid services; 
* The agencies ensure proper payment and recovery of funds paid for 
unallowable claims. 

Entity: State Medicaid Fraud Control Units; 
Oversight activity: 
State Medicaid Fraud Control Units are responsible for investigating 
and ensuring prosecution of Medicaid fraud. 

Objectives, Scope, and Methodology: 

Our objectives were to determine if (1) CMS has an adequate oversight 
process to help ensure the propriety of Medicaid expenditures, (2) CMS 
adequately evaluates and monitors the results of its oversight process 
and makes adjustments as warranted, and (3) the current CMS 
organizational structure for financial management is conducive to 
effectively directing its oversight process and sustaining future 
improvements. 

To evaluate CMS financial oversight, the control activities used to 
help ensure the propriety of Medicaid expenditures, and CMS's efforts 
to monitor its financial oversight, we performed work at CMS regional 
and headquarters offices, surveyed financial management staff, and 
reviewed CMS manuals and other documentation, as well as audit reports. 

* As agreed with your offices, we visited 5 of the 10 CMS regional 
offices (Atlanta, Boston, Chicago, New York, and San Francisco) to 
observe and interview the financial management staff. We selected the 
five regions based on geographical dispersion across the country and 
based on the total amount of Medicaid expenditures processed by each 
region. The five regions were collectively responsible for overseeing 
more than half of the total Medicaid expenditures for fiscal year 
2000. We discussed recent program changes, which significantly 
increased financial management oversight activities for regional 
analysts. We questioned staff about the extent to which certain 
activities, such as focused financial management reviews, were 
conducted and reviewed any reports and corresponding workpapers that 
were available. Key CMS financial managers at headquarters in 
Baltimore were also interviewed to gain a comprehensive understanding 
of overall financial management objectives for the Medicaid program. 
We also discussed performance and budget reporting as well as efforts 
to coordinate with state auditors. 

* We administered a Web-based survey to regional financial management 
members to gain a better understanding of the control activities being 
performed by regional offices. The survey was sent to all regional 
office branch chiefs and staff classified as financial analysts who 
are responsible for overseeing state financial management and internal 
controls for Medicaid. All of the 11 branch chiefs responded and 59 of 
the 65 analysts responded, for a 92 percent response rate—the 6 
analysts who did not respond were from one regional office. The survey 
obtained information on how oversight for Medicaid financial 
management is designed and implemented, as well as the frontline staff 
perspective on effectiveness. Survey respondents answered questions 
relating to review procedures performed, use of state single audits, 
follow-up of audit findings, and communications with state auditors 
and offices of inspectors general. Many of the questions asked the 
analysts to respond based on their performance of activities for the 
period from October 1, 1999, through the date of the survey. The 
practical difficulties in conducting any survey can introduce errors, 
commonly referred to as nonsampling errors. We included steps in both 
the data collection and data analysis to minimize such nonsampling 
errors. Multiple versions of the questionnaire were pretested with 
regional financial analysts before the final survey was administered. 
A 92 percent response rate was achieved, and the respondents directly 
entered the responses into the database via the Internet survey. Data 
checks were performed and a second independent analyst reviewed 
computer analyses. 

* We obtained and reviewed CMS documents and manuals that described 
current financial oversight activities and performance reporting 
previously used to monitor oversight. We reviewed audit reports that 
included findings related to Medicaid financial management, including 
the CMS/HCFA financial reports for fiscal years 1998 through 2000 and 
Single Audit Act reports for fiscal years 1999 and 2000. To help judge 
the adequacy of CMS's Medicaid financial management oversight process, 
we evaluated CMS oversight against the comptroller general's Standards 
for Internal Control in the Federal Government. We also consulted with 
state auditors during our regional site visits to obtain an 
understanding of their oversight activities for the Medicaid program, 
including the level of audit coverage given to Medicaid financial 
operations and the control techniques used. 

To determine whether CMS's organizational structure for financial 
management is conducive to effectively directing its oversight process 
and sustaining future improvements, we interviewed the director and 
deputy director of the CMSO Finance Systems and Quality Group as well 
as managers within the Division of Financial Management. We also 
conducted interviews with managers at the five regional offices. In 
addition, we compared information that we gathered about the current 
organizational structure, regional and central office communications, 
and improvement initiatives with the standards for control environment 
and information and communication components of internal control as 
described in the Standards for Internal Control in the Federal 
Government. 

We performed our fieldwork from October 2000 through September 2001, 
at the CMS central office in Baltimore, Md., and the five regional 
offices mentioned above. We focused on the internal control processes 
in place during fiscal years 2000 and 2001. All work was performed in 
accordance with generally accepted government auditing standards. We 
requested written comments on a draft of this report from the 
administrator of CMS. These comments are reprinted in appendix I. We 
also received supplementary oral comments from the Director of the CMS 
Division of Audit Liaison. 

CMS Had Not Implemented a Risk-Based Approach and Effective Control 
Activities for Financial Oversight: 

Although CMS is responsible for ensuring the propriety of over $100 
billion expended annually by the federal government for Medicaid, its 
financial oversight process did not incorporate key standards for 
internal control necessary to reduce the risk of inappropriate 
expenditures. The comptroller general's Standards for Internal Control 
in the Federal Government requires that agency managers perform risk 
assessments and then take actions to mitigate identified risks that 
could impede achievement of agency objectives. However, until 
recently, the oversight process that CMS used for Medicaid 
expenditures did not include assessments that identified the areas of 
greatest risk of improper payments. Therefore, CMS did not have the 
requisite assurance that its control activities were focused on areas 
of greatest risk. In addition, the controls that were in place were 
not effectively implemented. As a result, CMS was not deploying its 
limited oversight resources efficiently and effectively to detect 
improper expenditures. CMS managers recognized the deficiencies of its 
oversight and began efforts in April 2001 to develop a risk-based 
approach and revise control activities. However, these efforts did not 
specifically consider information on state financial oversight and 
program integrity activities such as pre- and postpayment detection 
methods, and payment accuracy studies and initiatives to prevent fraud 
and abuse, or consider advanced control techniques for detecting 
improper Medicaid payments. 

CMS Did Not Use a Risk-Based Approach in Reviewing Expenditures: 

Federal internal control standards require managers to perform risk 
assessments to identify areas at greatest risk of fraud, waste, abuse, 
and mismanagement. The standards require that once risks are 
identified, they should be analyzed for their possible effect by 
estimating their significance and assessing the likelihood of losses 
due to the risks identified. Despite repeated auditor recommendations, 
CMS had not developed and implemented a systematic risk assessment 
method in its oversight process to help ensure that states expend 
federal funds in accordance with laws and to identify amounts 
inappropriately claimed for federal reimbursement. In April 2001, CMS 
took action to develop a risk assessment; however, this analysis has 
not yet been used to deploy resources to areas of greatest risk and 
requires several improvements to enhance its usefulness in the 
oversight process. 

Since 1998, financial auditors responsible for the annual financial 
statement audit of Medicaid expenditures have recommended that CMS 
implement a risk-based approach for overseeing state internal control 
processes and reviewing expenditures. In performing audits of CMS's 
financial statements for fiscal years 1998, 1999, and 2000, auditors 
have noted that CMS failed to institute an oversight process that 
effectively reduced the risk that inappropriate expenditures could be 
claimed and paid.[Footnote 5] In addition, the auditors identified 
internal control weaknesses that increased the risk of improper 
payments. These weaknesses included (1) a significant reduction in the 
level of detailed analysis performed by regional financial analysts in 
reviewing state Medicaid expenses, (2) minimal review of state 
Medicaid financial information systems, and (3) lack of a methodology 
for estimating the range of Medicaid improper payments on a national 
level. 

CMS Medicaid officials attributed most of the weaknesses identified by 
the auditors to reductions in staff resources and the multiple 
oversight activities that its staff is responsible for carrying out. 
According to Medicaid financial managers, changes in the Medicaid 
program since fiscal year 1998, specifically the addition of SCRIP, 
created additional oversight responsibilities for CMS financial 
management staff. Particularly, financial analysts are required to 
handle more state inquiries regarding technical financial issues that 
must be addressed promptly. At the same time, however, financial 
analyst resources previously devoted to oversight activities declined. 
Medicaid financial managers provided us with data to show that from 
fiscal year 1992 to September 2000, full-time equivalent (FIT) 
positions for regional financial staffs declined by 32 percent from 95 
to approximately 65 FTEs. At the same time, federal Medicaid 
expenditures increased 74 percent from $69 billion to $120 billion. On 
average, each of the 64 regional financial analysts is now responsible 
for reviewing almost $1.9 billion in federal Medicaid expenditures 
each fiscal year as compared to an average of about $0.7 billion a 
decade ago. Figure 3 depicts the decrease in financial analysts (i.e., 
FrEs) and the increase in Medicaid expenditures between the years 1992 
and 2000. 

Figure 3: Change in Financial Analysts (FTEs) versus Change in Federal 
Medicaid Expenditures 1992 and 2000[A]: 

[Refer to PDF for image: vertical bar graph] 

Federal expenditures: 
1992: $69 billion; 
2000: $120 billion. 

Number of analysts: 
1992: 95 FTEs; 
2000: 65 FTEs. 

[A] The $120 billion in expenditures in 2000 is equal to $97.8 billion 
in 1992 dollars when adjusted for inflation. 

Source: CMS. 

[End of figure] 

Until recently, Medicaid financial managers had not taken action to 
implement a risk-based approach for Medicaid financial oversight. 
Managers stated that the Medicaid financial oversight process had been 
based on the presumption that financial analysts adequately applied 
the inherent knowledge of program risks acquired from years of 
experience in reviewing state Medicaid expenditures and providing 
technical assistance to states in operating their Medicaid programs. 
However, as Medicaid program expenditures have increased, CMS managers 
acknowledged that they needed to revise their oversight approach. As a 
result, during our review, CMS began in April 2001 to develop a risk-
based approach for determining how best to deploy its resources in 
reviewing Medicaid expenditures. 

The Medicaid risk assessment effort required each regional office to 
provide data on the states and territories in its jurisdiction based 
on regional analyst experience and knowledge. For each type of 
Medicaid service and administrative expense, the Medicaid risk 
analysis estimates the likelihood of risk based on the dollar amount 
expended annually and measures the significance of risk based on 
factors such as unclear federal payment policy, state payment 
involving county and local government, and results of federal audits. 
The risk analysis provides a risk score for each state that is 
intended to specify the Medicaid service and administrative expense 
categories that are of greatest risk for improper payments in the 
state. 

Medicaid financial managers also tabulated a national risk score for 
each type of Medicaid service and administrative expense using the 
state risk scores. However, CMS had not taken steps to use the risk 
analysis in deploying its regional financial oversight resources. 
Medicaid financial managers in headquarters and the regional offices 
plan to develop work plans that will allocate resources based on the 
risks identified from its analysis. CMS expects to implement these 
work plans in reviewing the state's quarterly expenditure reports for 
fiscal year 2003. 

In evaluating the Medicaid risk analysis, we considered strategies 
that leading organizations used in successfully implementing risk 
management processes. Two such strategies, which are included in our 
executive guide, Strategies to Manage Improper Payments[Footnote 6] 
are as follows. 

* Information developed from risk assessments should help form the 
foundation or basis upon which management can determine the nature and 
type of corrective actions needed, and should give management baseline 
data for measuring progress in reducing payment inaccuracies and other 
errors. 

* Management should reassess risks on a recurring basis to evaluate 
the impact of changing conditions, both external and internal, on 
program operations. 

While the Medicaid risk analysis is a good start, we identified 
several improvements that should be made to the assessment before it 
is used in deploying resources. The issues we identified could hinder 
the quality of baseline information gathered and, accordingly, affect 
management's ability to thoroughly reassess risks and measure the 
impact of corrective actions on a recurring basis. First, the analysis 
does not sufficiently take into account state financial oversight 
activities in assessing the risks for improper payments in each state. 
Regional financial analysts were instructed to rate the adequacy of 
each state Medicaid agency's financial oversight as one of the risk 
factors in determining the likelihood and significance of risk in each 
state. The analysts were instructed to consider whether a state 
regularly reviews claims submitted by local government entities that 
provide Medicaid services and whether state audits were conducted 
regularly. However, the analysts were not specifically instructed to 
consider states' use of (1) prepayment edits and reviews to help 
prevent improper payments, (2) screening procedures to prevent 
dishonest providers from entering the Medicaid program, (3) 
postpayment reviews to detect inappropriate payments after the fact, 
and (4) payment accuracy studies to measure the extent of improper 
payments. 

Several states have implemented cost-effective prevention efforts to 
protect Medicaid program dollars, such as prepayment computer "edits," 
manual reviews of claims before payment, and thoroughly checking the 
credentials of individuals applying to be program providers. Table 3 
shows examples of prepayment reviews currently being used by some 
states. 

Table 3: Examples of State Medicaid Prepayment Reviews and Other 
Prevention Efforts: 

State: California; 
State effort: Bars providers with previously questionable billing 
patterns from submitting claims electronically and performs a manual 
review before making payment. This saved more than $17 million in 
fiscal years 1998 and 1999. 

State: New Jersey; 
State effort: Uses off-the-shelf software to analyze claims for 
aberrant patterns before payments are made. 

State: Washington; 
State effort: Uses an on-line drug claims management system to 
finalize pharmaceutical claims when the pharmacist fills the 
beneficiary's prescription. The system screens for duplicate claims 
and drugs requiring prior authorization, and provides alerts to such 
factors as insufficient or excessive dosages and interactions with 
other drugs. If appropriate, it approves payment. 

State: Florida; 
State effort: Requires providers such as physicians, pharmacists, 
dentists, and others who are not employees of institutions like 
hospitals to undergo fingerprinting and criminal background screening. 
All officers, directors, managers, and owners of 5 percent or more of 
a provider business must be screened. Fingerprints are checked with 
both state and federal law enforcement agencies. 

State: Connecticut, Florida, Georgia, and Texas; 
State effort: Structure provider agreements so that they can terminate 
providers from their program without cause, allowing for more 
expeditious removal of providers who are billing inappropriately. 

State: Florida and Texas; 
Implement tighter enrollment standards—through enhanced background 
checks. Recently required existing providers to reenroll under 
stricter new standards. 

State: New Jersey; 
State effort: Institutes more stringent enrollment procedures for 
provider categories with higher risk of payment problems, such as 
pharmacies, independent laboratories, and transportation companies. 

State: Florida, Georgia, and New Jersey; 
State effort: Conduct preenrollment site visits, usually to higher-
risk provider types, such as pharmacies and durable medical equipment 
suppliers. 

Source: U.S. General Accounting Office, Medicaid: State Efforts to 
Control Improper Payments Vary, GA0-01-662 (Washington D.C.: 2001). 

[End of table] 

Many states have also developed postpayment detection systems and 
payment accuracy studies to improve their ability to detect, 
investigate, and measure potential improper payments. Kentucky and 
Washington, for example, have hired private contractors to develop or 
use advanced computer systems to analyze claims payment data that 
identified several million dollars in overpayments. Table 4 describes 
these and other state postpayment efforts and related program savings. 

Table 4: Examples of State Postpayment Detection Activities and 
Payment Accuracy Studies: 

Action: Automated claims processing systems; 
State: Texas; 
State effort: Uses a state-of-the-art system intended to integrate 
detection and investigation capabilities, including "neural 
networking," which helped identify potentially fraudulent patterns 
from large volumes of medical claims and patient and provider history 
data. In the first year of operation,Texas collected $2.2 million in 
overpayments. 

Action: Automated claims processing systems; 
State: Kentucky; 
State effort: Uses an advanced computer system to analyze claims 
payment data. Using claims data from January 1995 through June 1998, 
the contractor identified $137 million in overpayments. 

Action: Automated claims processing systems; 
State: Washington; 
State effort: Uses an advanced computer system to analyze data. Since 
the program started, the state has identified overpayments totaling 
more than $2.95 million. 

Action: Advanced technology and special investigative protocols; 
State: New Jersey; 
State effort: Conducted special audits of transportation services, 
cross-matching data on transportation claims to beneficiary medical 
appointments. Also audited pharmacies with abnormally large numbers of 
claims for a newly covered, high-priced drug; audited the pharmacies' 
purchases from wholesalers; and discovered pharmacies were billing for 
larger amounts of this drug than had been shipped to them. 

Action: Beneficiary alerts; 
State: Multiple states; 
State effort: Established hotlines that beneficiaries can use to 
report suspected improprieties. Mail explanation-of-benefit statements 
to beneficiaries to increase awareness of the services being billed. 

Action: Payment accuracy studies; 
State: Illinois; 
State effort: Implemented payment accuracy studies that involved 
reviewing medical records and interviewing patients to verify that 
services were rendered and medically necessary. As a result, the state 
identified key areas of weakness and targeted several areas needing 
improvement. For example, because the Illinois payment accuracy review 
indicated that nearly one-third of payments to nonemergency 
transportation providers were in error, the Illinois Medicaid program 
has taken a number of steps to improve the accuracy of payments to 
this provider type. 

Action: Payment accuracy studies; 
State: Texas; 
State effort: Developed a methodology for estimating payment accuracy 
for acute medical care. In doing so, the state identified ways to 
reduce improper payments through expanded use of computerized fraud 
detection tools, such as matching Medicaid eligibility records with 
vital statistics databases to avoid payments for deceased 
beneficiaries. 

Action: Payment accuracy studies; 
State: Kansas; 
State effort: Implemented payment accuracy studies that involved 
reviewing medical records and interviewing patients to verify that 
services were rendered and medically necessary. The payment accuracy 
study recommended increased provider and consumer education, as well 
as improvements to computerized payment systems. In addition, Kansas 
officials undertook focused reviews of certain types of claims that 
were identified as vulnerable to abuse. 

Source: U.S. General Accounting Office, Medicaid: State Efforts to 
Control Improper Payments Vary, GA0-01-662 (Washington D.C.: 2001). 

[End of table] 

While regional financial analysts may know about many activities like 
these from performing their oversight responsibilities, analysts or 
staff in the Division of Financial Management did not collect and 
document information on the nature and results of each state's 
financial oversight activities. Without such information being 
documented, CMS did not have a complete picture or profile of the 
level of risk for improper payments in each state and thus did not 
have comprehensive information to determine the appropriate level of 
federal oversight that should be applied. 

A second deficiency we found in the Medicaid risk analysis is that it 
did not specifically integrate information about state fraud and abuse 
prevention efforts in making risk assessments for each state. Regional 
financial analysts were instructed to report on the level of regional 
oversight of each state's Medicaid finances as one of the risk factors 
in determining the likelihood and significance of risk in each state. 
Specifically, analysts were instructed to consider the last time the 
regional office or HHS/OIG conducted a review or audit. However, the 
analysts were not specifically instructed to consider results from 
reviews of state efforts to prevent fraud and abuse recently conducted 
under the CMS Medicaid Alliance for Program Safeguards.[Footnote 7] 

In 1997, CMS established the Medicaid Alliance for Program Safeguards 
staffed with program analysts from the 10 CMS regions and staff within 
the Policy Coordination and Planning Group of the Center for Medicaid 
and State Operations. The initiative was started to aid states in 
their program integrity efforts. Since its inception, a fraud statute 
Web site has been established and seminars on innovations and 
obstacles in safeguarding Medicaid have been developed. In fiscal year 
2000, regional staff conducted structured site reviews of program 
safeguards in eight states, and in fiscal year 2001 reviews were 
conducted in another eight states. Plans are to perform reviews in 
additional states until all states are covered. These reviews examined 
how state Medicaid agencies identify and address potential fraud or 
abuse, whether state agencies are complying with appropriate laws and 
regulations—such as how they check to ensure that only qualified 
providers participate in the program—and potential areas for 
improvement. CMS would gain valuable information from these reviews to 
more accurately assess the level of risk for improper payments in 
these 16 states and the appropriate level of federal oversight 
required. 

A third deficiency we found is that the Medicaid risk analysis did not 
include mechanisms to ensure that such analysis would be conducted 
continuously in directing financial oversight. Agency managers should 
have methods in place to revisit risk analysis to determine where 
risks have decreased and where new risks have emerged, as identified 
risks are addressed and control activities are changed. As such, risk 
analysis should be iterative. Medicaid financial managers had not 
determined how they would continuously revise and update their 
Medicaid risk analysis. 

Finally, the Medicaid risk analysis would be strengthened if states 
were systematically estimating the level of improper payments in their 
programs. Identifying the dollar amount of improper payments is a 
critical step in determining where the greatest problems exist and the 
most cost-beneficial approach to addressing the problems. CMS 
management has recognized this and has begun efforts to develop an 
approach for estimating improper Medicaid payments. In September 2001, 
nine states responded to a CMS solicitation to participate in pilot 
studies to develop payment accuracy measurement methodologies. The 
objective is to assess whether it is feasible to develop a single 
methodology that could be used by the diverse state Medicaid programs 
and to explore the feasibility of estimating the range of improper 
Medicaid payments on a national level. Each of the nine states 
involved is developing a different measurement methodology. CMS has 
assigned a senior Medicaid manager with responsibility for directing 
this effort. According to this manager, CMS has hired a consultant 
experienced in program integrity reviews to oversee the state pilots. 
CMS managers expect the states to complete the pilots during fiscal 
year 2003, after which time the consultant and the Medicaid manager 
plan to select several of the state methodologies as test cases for 
fiscal year 2004. It is important that CMS continues to place emphasis 
on development of these payment accuracy reviews on a state-by-state 
basis and ultimately on a national level, since this is a key baseline 
measure for managing improper payments in the Medicaid program. 

Control Activities Were Not Effectively Implemented: 

The comptroller general's Standards for Internal Control in the 
Federal Government states that managers must establish adequate 
control activities to address identified risks and ensure that program 
objectives are met. Internal control activities are the policies, 
procedures, techniques, and mechanisms that help ensure that 
management's directives to mitigate risk are carried out. Control 
activities are an integral part of an organization's efforts to 
address risks that lead to fraud and error. For the Medicaid program, 
both the states and federal government share responsibility for 
ensuring that adequate control activities are in place. The control 
activities that CMS had in place to oversee state internal controls 
and help ensure the propriety of Medicaid expenditures were not 
effectively implemented. Given the current level of resources and the 
size and complexity of the program, a different approach is needed 
that incorporates new oversight techniques and strategies, as well as 
the results of the risk assessment discussed previously. 

CMS regional financial analysts are tasked with performing multiple 
control activities designed to (1) oversee state financial management 
and internal control processes, (2) help ensure that states expend 
federal funds in accordance with laws, and (3) identify amounts 
inappropriately claimed for federal reimbursement. These activities 
include providing technical assistance to states on a variety of 
financial issues to help improve state accountability and help prevent 
payment inaccuracies as well as examining state expenditures to defer 
improperly supported payments and disallow those payments[Footnote 8] 
that do not comply with Medicaid regulations. Analysts also are 
responsible for following up on and resolving findings from audits 
related to improper or questionable payments and weaknesses in state 
internal controls. Table 5 summarizes the control activities that 
regional analysts are responsible for carrying out. 

Table 5: Regional Office Oversight Activities: 

Financial analysis and review activities: 
* Review state expenditure and budget reports. 
* Prepare and submit regional decision reports summarizing the results 
of expenditure and budget reviews. 
* Identify, defer, and disallow unsupported and unallowable 
expenditures. 
* Perform focused financial management reviews of specific Medicaid 
service and administrative expenditures. 
* Perform audit resolution tasks and coordinate with state auditors 
and HHS/OIG. 

Technical assistance activities: 
* Meet and interact with state Medicaid agency officials to provide 
technical assistance on a variety of financial and administrative 
policy issues. 
* Review and assist CMS program analysts with analyzing the financial 
aspects of plans submitted by states to amend their Medicaid program 
or to obtain waivers of certain Medicaid provisions. 
* Review plans submitted by states indicating how overhead and other 
administrative costs are allocated (cost allocation plans) and plans 
explaining state methodologies for claiming certain administrative 
costs. 

Note: Activities are performed for both Medicaid and SCHIP programs. 

[End of table] 

As Medicaid expenditures have grown and resources devoted to Medicaid 
financial oversight have decreased, regional financial analysts have 
faced significant challenges in monitoring state internal controls, 
providing technical assistance, scrutinizing expenditures, and 
following up on audit findings for all state Medicaid programs. In an 
attempt to address these challenges, in 1994 regional offices began 
refocusing oversight activities from emphasizing detailed review of 
Medicaid expenditure data to increasing the level of technical 
assistance provided to states. However, auditors of CMS financial 
statements found that, as a result, regional offices were not 
providing appropriate review and oversight of state Medicaid programs. 
As mentioned previously, auditors have reported since 1998 that 
regional offices significantly reduced or inconsistently performed 
control activities to detect potential errors and irregularities in 
state expenditures, thus increasing the risk that errors and 
misappropriation could occur and go undetected. In our review, we 
found that these weaknesses were still present. 

In August 2001, we conducted a survey of regional financial analysts 
to obtain their perspectives on the design and implementation of the 
Medicaid financial oversight process, covering the period from October 
1, 1999, through the date of the survey. In comments to the survey, 
some regional analysts indicated that they were inundated with 
responsibility for multiple control activities and unable to perform 
them effectively. Our survey asked the analysts to rate each of the 
control activities that they perform in terms of how important they 
believe the activity is in overseeing state Medicaid programs. The 
activity rated most important was quarterly expenditure reviews 
performed on-site at state Medicaid agencies; 89 percent rated the 
activity as having the "highest" or "high" level of importance-83 
percent "highest" and 6 percent "high." However, when asked about the 
adequacy in which they performed on-site expenditure reviews, almost 
36 percent rated the adequacy of their performance "inadequate" or 
"marginal"-13 percent inadequate and 23 percent marginal. In 
discussions with regional financial analysts during our site visits 
and in comments to our survey, many financial analysts attributed 
deficiencies in quarterly reviews to inadequate staff resources, the 
low priority placed on financial management oversight, lack of 
training, and conflicting priorities. 

During our site visits we interviewed 11 regional financial analysts 
responsible for overseeing the five states that accounted for over $70 
billion in Medicaid expenditures in fiscal year 2000. We reviewed 
these analysts' workpapers related to their review of quarterly 
expenditure reports submitted for the quarter ended December 31, 2000. 
Workpapers prepared for three of the states to document their reviews 
did not contain sufficient evidence that expenditures had been traced 
to original documents. Instead, the analysts had checked information 
against summary schedules prepared by the states. Without proper 
documentation, there is little assurance that these reviews are being 
adequately performed. 

Survey respondents also rated activities to (1) defer and disallow 
Medicaid expenditures and (2) perform in-depth analysis of specific 
Medicaid costs where problems have been found (i.e., focused financial 
management reviews) as important in overseeing the propriety of 
Medicaid expenditures. Some 89 percent of analysts rated deferral and 
disallowance determinations as having "highest" or "high" level of 
importance and focused financial management reviews were rated by 77 
percent as "highest" or "high." Data provided by CMS indicate, 
however, that the amount of Medicaid expenditures disallowed by 
regional analysts has declined in years after 1996, when oversight 
emphasis shifted from detailed reviews, and so did the number of 
focused financial management reviews conducted each year. For example, 
from 1990 through 1993, analysts disallowed on average $239 million 
[Footnote 9] annually in expenditures reported by states for federal 
reimbursement. However, from fiscal years 1997 through 2000, analysts 
disallowed on average about $43 million annually, which represents an 
82 percent decline from previous years. Also, during these periods, 
Medicaid expenditures went from an average of $58 billion annually to 
$106 billion annually—an increase of 83 percent.[Footnote 10] 

Similarly, focused financial management reviews have declined. Focused 
financial management reviews generally involve selecting a sample of 
paid claims for review related to certain types of Medicaid services 
provided. These reviews have been useful in identifying unallowable 
costs outside of those detected through the review of quarterly 
expenditure reports as well as deficiencies in states' financial 
management policies. According to CMS managers, in fiscal year 1992, 
analysts performed approximately 90 in-depth reviews of specific 
Medicaid issues that identified approximately $216 million in 
unallowable Medicaid costs. In fiscal year 2000, analysts only 
performed eight focused financial management reviews, but these 
reviews resulted in almost $45 million in disallowed costs—an average 
of about $5.6 million per review. As demonstrated, this control 
activity is effective in detecting unallowable Medicaid costs; 
however, it must be consistently performed for cost savings to be 
discovered. 

According to the director of DFM, the division is taking actions to 
improve oversight by beginning a comprehensive assessment of CMS's 
Medicaid oversight activities. The division would like to increase 
several oversight activities, such as focused financial management 
reviews, to address the risks identified in CMS's new risk-based 
approach. However, Medicaid financial managers are concerned that 
efforts to effectively address identified risks may be hindered 
without additional oversight resources. In the interim, CMS plans to 
use the current oversight process (i.e., quarterly expenditure reviews 
and technical assistance) for targeting those Medicaid issues that the 
new risk analysis identifies. 

In assessing what steps CMS could take to more efficiently and 
effectively carry out its responsibility on the federal level for 
helping ensure the propriety of Medicaid finances, we considered 
strategies that other entities have used in successfully addressing 
risks that lead to fraud, error, or improper payments. As discussed in 
our executive guide on strategies to manage improper payments, key 
strategies include taking action to: 

* select appropriate control activities based on an analysis of the 
specific risks facing the organization, taking into consideration the 
nature of the organization and the environment in which it operates; 

* perform a cost-benefit analysis of potential control activities 
before implementation to ensure that the cost of the activities is not 
greater than the benefit; and; 

* contract out activities to firms that specialize in specific areas 
like neural networking, where in-house expertise is not available. 

Our executive guide points out that many organizations have 
implemented control techniques, including data mining, data sharing, 
and neural networking, to address identified risk areas and help 
ensure that program objectives are met. These techniques could help 
CMS better utilize its limited resources in applying effective 
oversight of Medicaid finances at the federal level. 

Some state Medicaid agencies have already implemented data mining, 
data sharing, and neural networking techniques to carry out their 
responsibilities on the state level for ensuring Medicaid program 
integrity. 

State auditors and HHS/OIG staff have also had success using these 
techniques in overseeing state Medicaid programs. However, resources 
devoted to protecting Medicaid program integrity and the use of these 
techniques varies significantly by state. From a federal standpoint, 
CMS should take into consideration the control activities performed at 
the state level in designing its Medicaid financial oversight control 
activities. CMS should use the results from states that are already 
using data mining, data sharing, and neural networking techniques in 
determining the extent and type of control techniques that its 
regional financial analysts should use in overseeing each state. And, 
for states where these techniques are not being used, CMS should 
consider using these tools in its oversight process. 

As illustrated in the following examples, data mining, data sharing, 
and neural networking techniques have been shown to achieve 
significant savings by identifying and detecting improper payments 
that have been made. 

* Data mining is a technique in which relationships among data are 
analyzed to discover new patterns, associations, or sequences. The 
incidence of improper payments among Medicaid claims can, if 
sufficiently analyzed and related to other Medicaid data, reveal a 
correlation with a particular health care provider or providers. Using 
data mining software, the Illinois Department of Public Aid, in 
partnership with HHS/OIG, identified 232 hospital transfers that may 
have been miscoded as discharges, creating a potential overpayment of 
$1.7 million. 

* Data sharing allows entities to compare information from different 
sources to help ensure that Medicaid expenditures are appropriate. 
Data sharing is particularly useful in confirming the initial or 
continuing eligibility of participants and in identifying improper 
payments that have already been made. We recently reported on a data 
sharing project called the Public Assistance Reporting Information 
System interstate match (PARIS) that has identified millions of 
dollars in costs savings for states.[Footnote 11] PARIS helps states 
share information on public assistance programs, such as Food Stamps 
and eligibility data for Medicaid, to identify individuals who may be 
receiving benefits in more than one state simultaneously. Using the 
PARIS data match for the first time in 1997, Maryland identified 
numerous individuals who no longer lived in the state but on whose 
behalf the state was continuing to pay a Medicaid managed care 
organization (MCO) as part of the MCO's prospective monthly payment. 
The match identified $7.3 million in savings for the Medicaid program. 

* Neural networking is a technique used to extract and analyze data. A 
neural network is intended to simulate the way a brain processes 
information, learns, and remembers. For example, this technique can 
help identify perpetrators of both known and unknown fraud schemes 
through the analysis of utilization trends, patterns, and complex 
interrelationships in the data. In 1997, the Texas legislature 
mandated the use of neural networks in the Medicaid program. Large 
volumes of medical claims and patient and provider history data are 
examined using neural network technology to identify fraudulent 
patterns. The Texas Medicaid Fraud and Abuse Detection System used 
neural networking to recover $3.4 million in fiscal year 2000. 

Based on consultations with state auditors, we noted that some 
auditors are performing audits that incorporate the advanced oversight 
techniques described above. New York and Texas are instituting data 
sharing and matching techniques at the state level to confirm initial 
eligibility of Medicaid participants and to identify improper payments 
that have already been made. Texas is using private contractors to 
design, develop, install, and train staff to use a system intended to 
integrate detection and investigation capabilities. This system 
includes a neural network that will allow the state to uncover 
potentially problematic payment patterns. 

Similarly, a large portion of the audit work that the HHS/OIG conducts 
to oversee the Medicaid expenditures for Massachusetts, Ohio, and 
Maine is conducted through electronic data matches of Medicaid claims 
data contained in the Medicaid Statistical Information System (MSIS). 
MSIS is the primary source of Medicaid program statistical 
information. As of the date of our report, 47 states were submitting 
Medicaid data electronically to MSIS. Information that the HHS/OIG 
finds as a result of electronic data matches is subsequently made 
available to regions and states for additional detailed work. 

CMS managers acknowledge that systems like MSIS could provide them 
with the capabilities to implement more advanced control techniques. 
While implementing control techniques such as data sharing, data 
mining, and neural networking may require up-front investment of 
resources, use of these techniques has the potential to result in 
significant savings to the Medicaid program. 

Monitoring Activities Were Limited in Scope and Effectiveness: 

Having mechanisms in place to monitor the quality of an agency's 
performance in carrying out program activities over time is critical 
to program management. The federal internal control standard for 
monitoring requires that agency managers implement monitoring 
activities to continuously assess the effectiveness of control 
activities put in place to address identified risks. Monitoring 
activities should include procedures to ensure that findings from all 
audits are reviewed and promptly resolved. The standards also state 
that pertinent information should be recorded and communicated to 
managers and staff promptly, to allow effective monitoring of events 
and activities as well as to allow prompt reactions. However, CMS had 
few mechanisms in place to continuously monitor the effectiveness of 
its control activities in overseeing the Medicaid program and 
collected limited information on the quality of Medicaid financial 
oversight performance. Specifically, CMS had not established 
performance standards to measure the effectiveness of its control 
activities, in particular its expenditure review activity. In 
addition, the CMS audit resolution process did not ensure that audit 
findings were resolved promptly and did not collect sufficient 
information on the status of audit findings. Without effective 
monitoring, CMS did not have the information needed to help assure the 
propriety of Medicaid expenditures. 

Few Steps Were Taken to Monitor Performance: 

DFM financial managers responsible for monitoring the effectiveness of 
Medicaid internal control processes had established few mechanisms to 
do so. CMS did not establish performance standards and did not analyze 
or compare trend information on the results of its control activities, 
including the amount and type of Medicaid expenditures deferred and 
disallowed by regional analysts across all 10 regions. 

Medicaid financial managers told us that, before 1993, CMS collected 
information to monitor the performance of its oversight process. The 
performance reporting process required each region to submit quarterly 
data on: 

* the amount of expenditures disallowed; 

* the number of focused financial management reviews conducted, and 
the related expenditures identified and recovered as a result of the 
reviews; 

* the amount of inappropriate expenditures averted by providing 
technical assistance to states before payment; 

* the number of regional financial analysts and related salary costs 
devoted to financial oversight; and; 

* the amount of travel dollars devoted to Medicaid financial oversight. 

Medicaid financial managers in DFM used this information to prepare 
national performance reports that calculated a return on investment 
for each region and a national return on investment. CMS managers said 
that they discontinued efforts to collect, analyze, and maintain 
performance data after 1993 because of staff reductions in the regions 
and headquarters. 

DFM managers currently collect some performance information, but it is 
not used to evaluate regional performance. For example, staff in DFM 
collect information on the amount of expenditures deferred and 
disallowed each quarter by each region. These data are used to adjust 
total expenditures for financial reporting purposes but not to assess 
regional oversight activities. DFM also maintains a spreadsheet that 
includes information on the types of expenditures disallowed. This 
information is not distributed to regional analysts. In addition, 
information on the types of expenditures deferred by each regional 
analyst is not consolidated and disseminated across regions. Regional 
analysts include the types of expenditures deferred in their own 
regional decision reports, but do not have the benefit of nationwide 
information because DFM does not prepare summary reports. 
Comprehensive information on the type of expenditures deferred and 
disallowed would help identify the types of Medicaid expenditures for 
which improper payments commonly occur and measure whether corrective 
actions or control techniques applied to certain Medicaid expenditures 
are effective in reducing improper payments. 

The director of DFM told us that steps would be taken within the next 
year to begin monitoring the effectiveness of the Medicaid financial 
oversight process. Medicaid financial managers plan to reinstitute the 
performance reporting process that was in place prior to 1993. While 
this is a good step, the previous performance reporting process lacked 
several elements necessary for effective internal control monitoring. 
For example, the performance reporting process did not establish 
agency-specific goals and measures for evaluating regional performance 
in reducing payment errors and inaccuracies. In addition, there were 
no formal criteria or standard estimation methodologies for regions to 
use in measuring the amount of unallowable costs that the states 
avoided because of technical assistance provided before payment. As 
discussed in our executive guide, Strategies to Manage Improper 
Payments, establishing such goals and measures is key to tracking the 
success of improvement initiatives. 

Audit Resolution Activities Are Not Effective: 

Standards for Internal Control in the Federal Government requires that 
agencies' internal control monitoring activities include policies and 
procedures to ensure that audit and review findings are promptly 
resolved. According to the standards, agency managers should implement 
policies and procedures for reporting findings to the appropriate 
level of management, evaluating the findings, and ensuring that 
corrective actions are taken promptly in response to the findings. In 
our review, we found that the audit resolution and monitoring 
activities performed by CMS and its regional offices were limited. In 
addition, we found that audit resolution activities were 
inconsistently performed across regions. Further, pertinent 
information was not identified, documented, and distributed among 
those responsible for audit resolution. These conditions hamper CMS's 
ability to resolve audit findings promptly and slow the recovery of 
millions of dollars in federal funds due from the states. 

Within CMS, three units share responsibility for audit resolution 
activities related to the Medicaid program. These are regional 
administrators and regional financial analysts, the Division of Audit 
Liaison (DAL), and DFM. 

Regional administrators and regional financial analysts have 
responsibility to perform the following audit resolution activities 
required by the HHS Grants Administration Manual:[Footnote 12] 

* coordinate resolution of findings with the pertinent auditee (i.e., 
state Medicaid agency or providers); 

* ensure that the related questioned costs due the federal government 
are recovered within established timeframes; 

* verify that corrective actions have been developed and implemented 
for each finding; and; 

* prepare quarterly reports documenting the status of audit resolution. 

DAL is responsible for maintaining a tracking system for each audit 
report and related findings, monitoring the timeliness and adequacy of 
audit resolution activities, distributing all audit clearance 
documents, and preparing monthly reports on the status of audit 
resolution and collection activities. DFM has one headquarters staff 
person responsible for coordinating and interacting with DAL and 
regional analysts to ensure that Medicaid related findings are 
resolved. 

An important part of regional analyst audit resolution activities 
involves following up on state Single Audit Act reports. Under the 
Single Audit Act, state auditors issue reports that include 
assessments of the internal controls related to major federal 
programs, including the Medicaid program, and compliance with laws, 
regulations, and provisions of contract or grant agreements. These 
reports generally include findings related to weaknesses identified in 
the financial management of state Medicaid programs as well as 
expenditures deemed erroneous or improper (e.g., questioned costs) for 
which states may owe money back to the federal government. 

Regional analysts are responsible for resolving audit findings, 
including determining whether the questioned costs related to audit 
findings reported by state auditors represent actual costs to be 
recovered from the state, and ensuring that they are actually 
recovered. In our discussions with regional staff during our review of 
state single audit findings, analysts admitted that they spend very 
little time on resolving state audit findings due to competing 
oversight responsibilities. Audit follow-up is one step of many 
performed during their quarterly state Medicaid expenditure reviews. 
As a result, state single audit findings are not always resolved, and 
related questioned costs are not promptly recovered. 

For example, we identified questioned costs totaling $24 million that 
had not been recovered. The audit reports that included the $24 
million in questioned costs had been issued for years prior to fiscal 
year 1999. However, as of September 30, 2001, regional analysts had 
not completed actions to recover these costs. 

In addition, we found that, as of September 30, 2001, regional 
analysts had not determined whether corrective actions had been 
developed and/or implemented to resolve 85 of a total of 288 Medicaid 
findings included in state single audit reports for fiscal year 1999. 
These findings related to problems with state financial reporting, 
computer systems, and cash management. Lack of timely follow-up on 
financial management and internal control issues increases the risk 
that corrective actions have not been taken by the auditee and 
erroneous or improper payments are continuing to be made. 

In our review, we also found that the regional financial analysts 
inconsistently followed procedures for monitoring, tracking, and 
reporting on the resolution of Single Audit Act and HHS/OIG audit 
findings. For example, 3 of the 10 regions had not prepared quarterly 
status reports that are intended to provide information on corrective 
actions that states have taken to resolve audit findings. 

Further, pertinent information was not identified, documented, and 
distributed among those responsible for audit resolution. The internal 
control standard related to information and communication provides 
that pertinent information be identified, captured, and distributed to 
the appropriate areas in sufficient detail and at the appropriate time 
to enable the entity to carry out its duties and responsibilities 
efficiently and effectively. 

In our review, we found that the monthly report prepared by DAL that 
is intended to provide a complete list of all audits with unresolved 
Medicaid findings did not meet this standard. We analyzed a list 
provided by the HHS/OIG, which included 23 Medicaid related reports 
issued by the HHS/OIG and state auditors in fiscal year 2001. We found 
four reports from the HHS/OIG list that were not included in DAL 
monthly reports related to the second, third, and fourth quarters of 
that year. This information is critical and must be distributed to the 
regions to ensure that they are taking action to resolve all Medicaid 
related findings. 

We also found that the regions did not document information critical 
to tracking unresolved audits in their regional quarterly status 
reports. The regions reported which audits had been resolved. They did 
not report information on audits that they were reviewing that had not 
yet been resolved. This makes it difficult to track audit status. 

Organizational Structure Impedes Effective Oversight: 

A sound organizational structure is a key factor that contributes to 
whether agency management can establish a positive control 
environment. Standards for Internal Control in the Federal Government 
provides that managers should ensure that an agency organizational 
structure is appropriate for the nature of its operations and designed 
so that authority and internal control responsibility is defined and 
well understood. Although CMS's 10 regional offices are the federal 
government's frontline for overseeing state Medicaid financial 
operations and expenditures, there are no reporting lines to the 
headquarters unit responsible for Medicaid financial management and 
few other mechanisms to ensure performance accountability. This 
structural relationship has created challenges in (1) establishing and 
enforcing minimum standards for performing financial oversight 
activities, (2) routinely evaluating the regional office oversight, 
and (3) implementing efforts to improve financial oversight. As a 
result, CMS lacks a consistent approach to monitor and improve 
performance among the units that share responsibility for financial 
management and ingrain a sound internal control environment for 
Medicaid finances throughout CMS. 

Many Oversight Weaknesses Are a Result of Current Structure: 

During the time of our review, there were no formal reporting 
relationships between the regional financial analysts and CMSO's DFM 
or any other division or unit within CMSO. Regional offices reported 
directly to the CMS administrator through their respective regional 
administrators. This structural relationship does not lend itself to 
instituting standards for oversight control activities that can be 
consistently and effectively implemented. 

To illustrate, the CMS financial management strategy workgroup, headed 
by the director of DFM, updated guidance for expenditure reviews in 
September 2000 to provide uniform review procedures and address 
concerns raised by auditors about the inconsistency in expenditure 
reviews across regions. While the guide strongly encouraged regional 
analysts to complete all of its procedures, it did not mandate that 
analysts do so. Headquarters financial managers do not have direct 
authority to enforce such a directive and regional managers have 
discretion in how resources are utilized. Similarly, the guide allowed 
regional branch managers wide discretion in performing supervisory 
review of regional analysts' expenditure review workpapers. The guide 
provides that a supervisor can assure that the analysts' work measures 
up to CMS requirements in the review guide by either directly and 
selectively reviewing the work papers or by obtaining written or 
verbal assurance from the reviewer that the procedures have been 
completed. Supervisory reviews are a key internal control activity. By 
allowing supervisors to satisfy this responsibility merely with verbal 
assurance, CMS is minimizing the effectiveness of this basic control. 
During our site visits, we found evidence that supervisory reviews 
were not conducted. We reviewed regional analysts' workpapers related 
to reviews of quarterly expenditure reports for five states submitted 
for the quarter ended December 31, 2000. These five states represent 
the largest states within the regions visited. Analysts' workpapers 
for three of the five state quarterly expenditure reviews had no 
evidence of supervisory "sign off' and, when asked if the supervisors 
had reviewed the workpapers or discussed the results of the review, 
the analysts said they had not. 

The CMS organizational structure also hindered efforts to evaluate and 
monitor regional office performance. Currently, there are few formal 
requirements for regions to report to headquarters and CMS does not 
collect, analyze, or evaluate consistent information on the quality of 
regional financial oversight for Medicaid across the country. As 
mentioned previously, efforts to monitor performance were discontinued 
because regional staff resources were not available to collect and 
submit the data to headquarters managers. Headquarters managers did 
not have the authority to require regions to collect such data. As a 
result, Medicaid financial managers in headquarters were not in a 
position to provide formal feedback to region financial management 
staff to improve their performance and therefore have not been in a 
position to assess the effectiveness of Medicaid oversight activities. 

The current organizational structure also poses challenges to 
implementing corrective actions aimed at addressing oversight 
weaknesses and improving accountability. Over the past 2 years, 
headquarters financial managers have taken steps to develop and 
implement improvements to the financial oversight process. As 
previously mentioned, Medicaid staff are currently: 

* developing risk analysis to identify expenditures of greatest risk, 

* working with states to develop methodologies for estimating Medicaid 
improper payments, 

* developing work plans that guide efforts to allocate financial 
oversight staff and travel resources based on the risk analysis, and; 

* developing performance-reporting mechanisms. 

Medicaid staff have also recently: 

* formed a financial management strategy workgroup of headquarters and 
regional financial management staff members to review the entire 
Medicaid financial oversight process and determine the proper 
structure for an adequate oversight process, 

* updated its expenditure and budget review guides, and, 

* gathered information on how regional financial analyst staff time is 
allocated between oversight responsibilities. 

Headquarters DFM managers recognize that regional office commitment is 
critical to successfully implementing and sustaining its improvement 
initiatives. The current structural relationship could diminish the 
chances of such success. Headquarters managers expressed concern that 
despite recent efforts to develop risk analysis and implement work 
plans that allocate resources based on identified risks, regional 
managers will still have the authority to decide how oversight 
resources are used. Given the multiple oversight activities that 
regional financial analysts are responsible for, headquarters managers 
have no assurance that review areas included in the work plans will be 
given priority in each region. Headquarters managers may experience 
similar difficulties in reestablishing performance reporting. 
According to one senior Medicaid manager, some regions have already 
petitioned headquarters managers not to use data on the amount of 
expenditures deferred and disallowed in gauging performance. 

During our review, we asked regional financial analysts about several 
recent improvement initiatives to gauge their knowledge of and 
participation in such initiatives. Several analysts we spoke with 
during site visits did not think the risk assessment effort was useful 
because they felt that they were already aware of the risks within the 
states that they were responsible for and did not need a formal 
assessment to identify the risks. In addition, some said that they 
resented the headquarters managers trying to tell them where they 
needed to focus their efforts. In our survey, we asked regional 
financial analysts to rate the importance of the risk assessment, 
staff time allocation effort, and review guide updates to overall 
financial oversight. Approximately 50 percent of survey respondents 
thought the initiatives were of marginal or little importance. During 
pretests of our survey, several analysts said they did not understand 
the purpose of the initiatives, even though they had provided input. 
According to the analysts, no one had communicated to them how the 
information was going to be used. 

In discussions with headquarters managers, they acknowledged that a 
written plan or strategy, which describes the initiatives and the 
responsibility for implementing them, is currently being drafted. Such 
a plan or strategy could be very useful in soliciting regional analyst 
support. More important, headquarters managers acknowledged that 
performance accountability mechanisms for the regions are needed to 
implement improvements successfully. CMS is currently planning some 
changes that may improve mechanisms to hold CMS financial managers, 
including regional managers and administrators, accountable for 
critical tasks. A Restructuring and Management Plan recently developed 
by the CMS chief operating officer seeks to add specific 
responsibilities that are tied to specific agency goals into senior 
managers' performance agreements. CMS has not determined how Medicaid 
financial management oversight and the various aspects of oversight 
responsibilities that can be evaluated will be included in the plan. 
Inclusion of such information is key to establishing a sound internal 
control environment for Medicaid finances throughout CMS. 

Conclusion: 

While CMS is taking steps to improve its financial oversight of the 
Medicaid program, the increasing size and complexity of the program, 
coupled with diminishing oversight resources, requires a new approach 
to address these challenges. Developing baseline information on 
Medicaid issues at greatest risk for improper payments and measuring 
improvements in program management against that baseline are key to 
achieving effective financial oversight. Determining the level of 
state activities to monitor and control Medicaid finances is also 
critical to CMS determining the extent and type of control techniques 
as well as the amount of resources it must apply at the federal level 
to adequately oversee the program. Establishing clear lines of 
authority and performance standards for CMS oversight would also 
provide for a more efficient, effective, and accountable Medicaid 
program. CMS's ability to make the kind of changes that are needed 
will require top-level management commitment, a comprehensive 
financial oversight strategy that is clearly communicated to all those 
responsible for program oversight, and clear expectations for 
implementation of the changes. 

Recommendations for Executive Action: 

To strengthen Medicaid internal controls and the financial oversight 
process that CMS has in place to ensure the propriety of Medicaid 
finances, we make the following recommendations to the CMS 
administrator. 

Risk Assessment: 

We recommend that the CMS administrator revise current risk assessment 
efforts in order to more effectively and efficiently target oversight 
resources towards areas most vulnerable to improper payments by: 

* collecting, summarizing, and incorporating profiles of state 
financial oversight activities, that include information on state 
prepayment edits, provider screening procedures, postpayment detection 
efforts, and payment accuracy studies; 

* incorporating information from reviews of state initiatives to 
prevent Medicaid fraud and abuse; 

* developing and instituting feedback mechanisms to make risk 
assessment a continuous process and to measure whether risks have 
changed as a result of corrective actions taken to address them; and; 

* completing efforts to develop an approach to payment accuracy 
reviews at the state and national levels. 

Financial Oversight Control Activities: 

In addition, we recommend that the CMS administrator restructure 
oversight control activities by: 

* increasing in-depth oversight of areas of higher risk as identified 
from the risk assessment efforts and applying fewer resources to lower 
risk areas; 

* incorporating advanced control techniques, such as data mining, data 
sharing, and neural networking, where practical to detect potential 
improper payments; and; 

* using comprehensive Medicaid payment data that states must provide 
in the legislatively mandated national MSIS database. 

Monitoring Performance: 

We also recommend that the CMS administrator develop mechanisms to 
routinely monitor, measure, and evaluate the quality and effectiveness 
of financial oversight, including audit resolution, by: 

* collecting, analyzing, and comparing trend information on the 
results of oversight control activities particularly deferral and 
disallowance determinations, focused financial reviews, and technical 
assistance; 

* using the information collected above to assess overall quality of 
financial management oversight; 

* identifying standard reporting formats that can be used consistently 
across regions for tracking open audit findings and reporting on the 
status of corrective actions; and; 

* revising DAL audit tracking reports to ensure that all audits with 
Medicaid related findings are identified and promptly reported to the 
regions for timely resolution. 

Organizational Structure: 

Finally, we recommend that the CMS administrator establish mechanisms 
to help ensure accountability and clarify authority and internal 
control responsibility between regional office and headquarters 
financial managers by: 

* including specific Medicaid financial oversight performance 
standards in senior managers' performance agreements; and; 

* developing a written plan and strategy, which clearly defines and 
communicates the goals of Medicaid financial oversight and 
responsibilities for implementing and sustaining improvements. 

Agency Comments and Our Evaluation: 

CMS provided written comments on a draft of this report (reprinted in 
appendix I), as well as supplementary oral comments. In its written 
comments, CMS outlined a series of actions it has begun to take to 
address its Medicaid financial management challenges. In supplementary 
oral comments, CMS disagreed with our recommendations related to its 
audit tracking and resolution reports. 

In outlining actions taken to address Medicaid financial management 
challenges, CMS stated that its efforts substantially address, within 
current resource constraints, the four areas of our recommendations. 
CMS improvement efforts include (1) a structured financial workplan 
process that has been incorporated into its formal Restructuring and 
Management Plan, (2) actions to strengthen exchange of information 
with state oversight agencies, and (3) pilot projects aimed at 
clarifying authority and internal control responsibility between 
regional and headquarters managers. As many of these efforts are in 
the planning or early implementation stages, it is too soon to 
conclude whether they will effectively address our recommendations and 
improve Medicaid financial management. Additionally, given CMS 
concerns about resource constraints, prioritizing the planned actions 
and developing projected implementation schedules is key to ensuring 
that progress is made toward improving Medicaid financial management. 

In oral comments, CMS disagreed with our recommendations for 
strengthening its audit tracking and resolution functions. Regarding 
our recommendation to standardize the audit tracking reports among CMS 
regions, CMS stated that although the current format of audit tracking 
reports is not consistent across regions, the reports provide agency 
management with sufficient information to ensure that audit findings 
are resolved in a timely manner. We disagree. As stated in our report, 
the current reporting formats did not provide CMS with sufficient 
information to determine whether action had been taken to recover 
approximately $24 million in questioned costs identified in audit 
reports more than 2 years ago. 

Regarding our recommendation to revise its audit tracking reports, CMS 
stated that the reports are as complete as they can be given the 
information that they receive from the HHS-OIG. CMS offered a number 
of reasons for lack of complete data. CMS stated that the HHS-OIG does 
not consistently provide timely copies of Medicaid audit reports or 
make audit reports available on-line in a timely manner. Further, CMS 
said that the reports do not contain the information it needs to enter 
the report and related findings into the CMS tracking system properly, 
such as audit findings categorized by type (i.e., questioned cost or 
management related). 

HHS/OIG officials acknowledged that they sometimes fail to send some 
audit reports that CMS is responsible for tracking and resolving but 
said that they attempt to provide reports promptly when CMS contacts 
them. In our view, CMS and the HHS-OIG share responsibility in audit 
resolution. Accordingly, we continue to believe that CMS needs to be 
proactive in ensuring its tracking mechanisms promptly identify 
Medicaid findings for resolution and in following up to ensure that 
actions are taken to prevent Medicaid financial management weaknesses 
from continuing. 

As agreed with your office, unless you publicly announce the contents 
of this report earlier, we plan no further distribution until 30 days 
from its date. At that time, we will send copies to the chairmen and 
ranking minority members of the Senate Committee on Governmental 
Affairs and House Committee on Government Reform. We are also sending 
copies of this report to the secretary of health and human services, 
administrator of CMS, inspector general of HHS, and other interested 
parties. Copies will also be made available to those who request them. 

Please contact me or Kimberly Brooks at (202) 512-9508 if you or your 
staff have any questions about this report or need additional 
information. W. Ed Brown, Lisa Crye, Carolyn Frye, Chanetta Reed, Vera 
Seekins, Taya Tasse, and Cynthia Teddleton made key contributions to 
this report. 

Sincerely yours, 

Signed by: 

Linda M. Calbom: 
Director, Financial Management and Assurance: 

[End of section] 

Appendix I: Comments from the U.S. Department of Health and Human 
Services' Centers for Medicare and Medicaid Services: 

Department of Health and Human Services: 
Centers for Medicare and Medicaid Services: 
Administrator: 
Washington, DC 20201: 

February 4, 2002: 

T0: Linda M. Calbom: 
Director, Financial Management and Assurance: 
General Accounting Office: 

From: [Signed by] Thomas A. Scully: 
Administrator: 

Subject: General Accounting Office (GAO) Draft Report, Medicaid 
Financial Management: Better Oversight Needed of State Claims for 
Federal Reimbursement (GAO-02-300). 

Thank you for the opportunity to review and comment on the above-
referenced report. We appreciate the work the GAO has done over a 
period of a year in examining the financial oversight function in the 
Medicaid program. 

This report for the most part accurately reflects the information and 
concerns that the Centers for Medicare & Medicaid Services (CMS): 
conveyed to the GAO reviewers. It also appropriately highlights and 
supports the actions in this area that CMS has initiated over the past 
year. Over the past decade, the emphasis of CMS financial oversight 
has shifted from reviews and disallowances to technical assistance on 
collaborative program development efforts. Several years ago, CMS 
recognized the need to strengthen our Medicaid financial management 
program. We believe that CMS's efforts described below substantially 
address, within current CMS resource constraints, the four areas of 
GAO's recommendation. 

Recommendation: 

To strengthen Medicaid internal controls and the financial oversight 
process that CMS has in place to ensure the propriety of Medicaid 
finances, we recommend that the CMS Administrator: 

1) Revise current risk assessment efforts in order to more effectively 
and efficiently target oversight resources towards areas most 
vulnerable to improper payments, 

2) Restructure oversight control activities, 

3) Develop mechanisms to routinely monitor, measure, and evaluate the 
quality and effectiveness of financial oversight, including audit 
resolution; and, 

4) Establish mechanisms to help ensure accountability and clarify 
authority and internal control responsibility between regional office 
and headquarters financial managers. 

CMS Response: 

CMS has taken the following steps towards addressing this 
recommendation. 

Structured Financial Management (FM) Workplan Process. Beginning with 
fiscal year (FY) 2002, CMS has instituted a structured FM work 
planning process. Under the process, each regional office (RO) will 
propose an annual FM Workplan describing the specific activities which 
it will perform and be held accountable for throughout the fiscal 
year. Each RO's workplan will be reviewed and approved through the 
Regional Administrator, Consortium Administrators, and the Director of 
the Center for Medicaid and State Operations (CMSO). The process 
incorporates a comprehensive resource assessment effort and risk 
assessment and analysis. Once the FM Workplan is established for each 
year, each RO will submit a quarterly report to central office (CO) 
that tracks FM activities and accomplishments. These reports will help 
us evaluate how well the ROs are succeeding in meeting the workplan 
objectives. The explicit goal in establishing the FM fiscal year 
workplan is to strengthen CMS's Medicaid financial oversight by 
establishing specific RO performance expectations, tracking related 
actions and their results, and improving RO-CO communications and 
consistency among ROs in financial oversight. This process will 
facilitate the alignment of CO and RO management priorities in this 
area, which in turn will strengthen accountability. 

Focused financial reviews of identified high risk areas are a key 
element of the new FM strategy. In the spring of 2001, CMS formally 
assessed the risk of improper claiming of Federal Medicaid funds on a 
state-specific, service-by-service basis. This formal risk assessment 
provides a useful baseline and documents in a structured manner what 
CMS already knew to be areas of risk. The FM strategy now being 
implemented will emphasize focused FM reviews of high-risk areas; 
onsite reviews of state quarterly expenditure reports where justified 
by the magnitude of state spending or a history of claiming issues; 
partnering with state and Federal audit agencies; and taking 
additional steps to ensure that Federal reimbursement policies are 
clearly articulated and understood. The CMS is updating FM review 
guides on selected topics that will be shared with states as well as 
used by our own RO staff. In this and other ways, CMS will emphasize 
the states' own responsibility for ensuring the financial integrity of 
their Medicaid programs and claims for Federal reimbursement. 

As part of the continuing FM workplan process, risk assessment, and 
analysis, we also intend to explore the use of data analysis 
techniques and opportunities to maximize and incorporate the use of 
the different data sources available. This would include the FM budget 
and expenditure information as well as information obtained through 
the Medicaid Statistical Information System (MSIS). Our goal would be 
twofold: 1) to use such techniques and analysis as a tool to better 
understand the FM environment and provide an improved oversight 
mechanism; and 2) to better educate the staff both at the RO and 
national levels regarding the FM activities, so that they may maximize 
the use of scarce resources. 

The structured FM workplan process described above has been 
incorporated into CMS's formal Restructuring and Management Plan. 
Relevant elements that are explicitly identified in the Plan include: 

* improving coordination, consistency, and accountability between CO 
and the ROs, 

* implementing a CMSO pilot to improve CO/RO goal and resource 
coordination, 

* implementing a CMSO pilot to improve national reimbursement policy 
consistency; and, 

* improving the Medicaid and State Children's Health Insurance Program 
(SCHIP) FM review process, including establishing specific RO workload 
objectives and developing updated review protocols. 

The Organizational Structure concerns expressed in the GAO report will 
be addressed through these activities. We expect to continuously 
evaluate the FM oversight function as we proceed in implementing these 
initiatives. 

FM Technical Advisory Group. In partnership with the National 
Association of State Medicaid Directors, CMS is establishing a joint 
state-Federal FM technical advisory group (TAG). Key TAG functions 
will be working with CMS to improve current Medicaid FM strategies and 
practices; identifying and following-up on cross-cutting issues which 
require coordination with the Fraud and Abuse, Third Party Liability, 
and other TAGs; and working with CMS to identify significant trends in 
Medicaid financing and expenditures. To the extent feasible within 
existing resource constraints, we also expect the FM TAG to explore 
the use of data analysis techniques and opportunities in order to 
maximize use of MSIS data. 

Payment Accuracy Measurement. The CMS is committed to developing 
methodologies for measuring Medicaid program improper payments on a 
state-specific and national basis. The Medicare program has 
systematically measured payment accuracy for several years, and the 
GAO among others, has recommended systematic measurement of payment 
accuracy in all major Federally assisted programs. The CMSO is 
currently working with a technical consultant and 9 pilot states - to 
be expanded to 15 in FY 2003 - to develop and test methodologies that 
might be used by all states despite the wide variations in the program 
from state to state. 

Fraud and Abuse Activities. Under our National Medicaid Fraud and 
Abuse Initiative (recently re-named the Medicaid Alliance for Program 
Safeguards, or "Alliance"), the CMS ROs conduct program integrity 
reviews of state fraud and abuse activities. These reviews focus on 
state compliance with applicable program integrity statutes and 
regulations and may also include a detailed assessment of the states' 
strengths and vulnerabilities in this area. The information obtained 
from these reviews may be relevant to the FM work planning process 
described above, particularly with respect to risk assessment and 
analysis. Therefore, we will ensure that the information and findings 
obtained through these program integrity reviews are considered as 
annual RO and national FM workplans are developed. 

Partnership with State and Federal Financial Oversight Agencies. Every 
state has one or more audit entities responsible for ensuring that 
state expenditures, including those in the Medicaid and State Children 
Health Insurance Program programs, are properly made and documented. 
Furthermore, every Medicaid agency has a surveillance and utilization 
review staff to pinpoint and pursue questionable provider claims and 
agency payments. Finally, virtually all states operate a Medicaid 
Fraud Control Unit, typically housed in the Attorney General's office, 
to pursue instances of suspected Medicaid fraud. A key element of our 
new FM strategy is to strengthen our working relationship and exchange 
of information with these state entities. 

In addition, over the last several years, we have developed a close 
collaboration with the Department of Health and Human Services Office 
of Inspector General. We intend to continue this relationship. 
Finally, in cooperation with the American Public Human Services 
Association, we plan to survey state Medicaid agencies this year in 
order to identify specific ways to improve the usefulness of the 
annual Single Audits performed by every state pursuant to the Single 
Audit Act of 1984. 

The new CMS FM strategy is comprehensive and explicitly addresses the 
basic concerns described by the GAO in this report, notably risk 
assessment and analysis, RO consistency and accountability, focused 
financial reviews, and consideration of state audit, fraud and abuse, 
and other pertinent activities. We intend to carefully consider the 
GAO recommendations and will address them to the extent we can subject 
to resource limitations. 

We look forward to working with GAO on this and other issues. 

[End of section] 

Related GAO Products: 

Strategies to Manage Improper Payments: Learning From Public and 
Private Sector Organizations [hyperlink, 
http://www.gao.gov/products/GAO-02-69G], Oct. 2001. 

Public Assistance: PARIS Project Can Help States Reduce Improper 
Benefit Payments [hyperlink, http://www.gao.gov/products/GAO-01-935], 
Sept. 2001. 

Internal Control Management and Evaluation Tool [hyperlink, 
http://www.gao.gov/products/GAO-01-1008G], Aug. 2001. 

Medicaid: State Efforts to Control Improper Payments Vary [hyperlink, 
http://www.gao.gov/products/GAO-01-662], June 2001. 

Medicaid in Schools: Improper Payments Demand Improvements in HCFA 
Oversight [hyperlink, http://www.gao.gov/products/GAO/HEHS/OSI-00-69], 
Apr. 2000. 

Standards for Internal Control in the Federal Government [hyperlink, 
http://www.gao.gov/products/GAO/AIMD00-21.3.1], Nov. 1999. 

Medicaid Enrollment: Amid Declines, State Efforts to Ensure Coverage 
After Welfare Reform Vary [hyperlink, 
http://www.gao.gov/products/GAO/HEHS-99-163], Sept. 1999. 

[End of section] 

Footnotes: 

[1] Until June 2001, CMS was known as the Health Care Financing 
Administration (HCFA). 

[2] U.S. General Accounting Office, Standards for Internal Control in 
the Federal Government, [hyperlink, 
http://www.gao.gov/products/GAO/AIMD-00-21.3.1] (Washington D.C.: 
1999). 

[3] Hereafter, all will be referred to as states. 

[4] In some instances, states hire independent public accounting firms 
to perform the state single audit. 

[5] In some instances, these findings were included in the management 
letters that accompanied the audited financial statements in fiscal 
years 2000, 1999, and 1998. 

[6] U.S. General Accounting Office, Strategies to Manage Improper 
Payments: Learning From Public and Private Sector Organizations, 
[hyperlink, http://www.gao.gov/products/GAO-02-69G] (Washington D.C.: 
2001). 

[7] Formally known as the National Medicaid Fraud and Abuse Initiative. 

[8] A deferral is an action taken to withhold funds from the states 
until additional clarification or documentation is received from the 
states regarding Medicaid costs claimed. A disallowance is a 
determination by CMS that a claim or portion of a claim by a state for 
federal funds is unallowable. 

[9] The calculation of this amount does not include $1.15 billion in 
disallowances of Medicaid amounts for Disproportionate Share Hospital 
(DSH) claims in fiscal year 1992 that resulted from a change in the 
legislation related to DSH. Including this amount would increase the 
average disallowance to $527 million for fiscal years 1990 through 
1993. 

[10] Expenditure and disallowance data provided by CMS. 

[11] U.S. General Accounting Office, Public Assistance: PARIS Project 
Can Help States Reduce Improper Benefit Payments (Washington D.C.: 
2001). 

[12] The Grants Administration Manual, issued by HHS, provides 
guidance on implementing HHS policies on the administration of HHS 
grants. Chapter 1-105 of the manual addresses the resolution of audit 
findings. 

[End of section] 

GAO’s Mission: 

The General Accounting Office, the investigative arm of Congress, 
exists to support Congress in meeting its constitutional 
responsibilities and to help improve the performance and accountability 
of the federal government for the American people. GAO examines the use 
of public funds; evaluates federal programs and policies; and provides 
analyses, recommendations, and other assistance to help Congress make 
informed oversight, policy, and funding decisions. GAO’s commitment to 
good government is reflected in its core values of accountability, 
integrity, and reliability. 

Obtaining Copies of GAO Reports and Testimony: 

The fastest and easiest way to obtain copies of GAO documents at no 
cost is through the Internet. GAO’s Web site [hyperlink, 
http://www.gao.gov] contains abstracts and full text files of current 
reports and testimony and an expanding archive of older products. The 
Web site features a search engine to help you locate documents using 
key words and phrases. You can print these documents in their entirety, 
including charts and other graphics. 

Each day, GAO issues a list of newly released reports, testimony, and 
correspondence. GAO posts this list, known as “Today’s Reports,” on its 
Web site daily. The list contains links to the full-text document 
files. To have GAO e-mail this list to you every afternoon, go to 
[hyperlink, http://www.gao.gov] and select “Subscribe to daily E-mail 
alert for newly released products” under the GAO Reports heading. 

Order by Mail or Phone: 

The first copy of each printed report is free. Additional copies are $2 
each. A check or money order should be made out to the Superintendent 
of Documents. GAO also accepts VISA and Mastercard. Orders for 100 or 
more copies mailed to a single address are discounted 25 percent. 
Orders should be sent to: 

U.S. General Accounting Office: 
441 G Street NW, Room LM: 
Washington, D.C. 20548: 

To order by Phone: 
Voice: (202) 512-6000: 
TDD: (202) 512-2537: 
Fax: (202) 512-6061: 

To Report Fraud, Waste, and Abuse in Federal Programs Contact:
Web site: [hyperlink, http://www.gao.gov/fraudnet/fraudnet.htm]: 
E-mail: fraudnet@gao.gov: 
Automated answering system: (800) 424-5454 or (202) 512-7470: 

Public Affairs: 

Jeff Nelligan, managing director, NelliganJ@gao.gov: 
(202) 512-4800: 
U.S. General Accounting Office: 
441 G Street NW, Room 7149:
Washington, D.C. 20548: