This is the accessible text file for GAO report number GAO-07-945 
entitled 'Medicare Advantage: Required Audits of Limited Value' which 
was released on July 31, 2007. 

This text file was formatted by the U.S. Government Accountability 
Office (GAO) to be accessible to users with visual impairments, as part 
of a longer term project to improve GAO products' accessibility. Every 
attempt has been made to maintain the structural and data integrity of 
the original printed product. Accessibility features, such as text 
descriptions of tables, consecutively numbered footnotes placed at the 
end of the file, and the text of agency comment letters, are provided 
but may not exactly duplicate the presentation or format of the printed 
version. The portable document format (PDF) file is an exact electronic 
replica of the printed version. We welcome your feedback. Please E-mail 
your comments regarding the contents or accessibility features of this 
document to Webmaster@gao.gov. 

This is a work of the U.S. government and is not subject to copyright 
protection in the United States. It may be reproduced and distributed 
in its entirety without further permission from GAO. Because this work 
may contain copyrighted images or other material, permission from the 
copyright holder may be necessary if you wish to reproduce this 
material separately. 

Report to Congressional Committees: 

United States Government Accountability Office: 

GAO: 

July 2007: 

Medicare Advantage: 

Required Audits of Limited Value: 

Medicare Advantage Audits: 

GAO-07-945: 

GAO Highlights: 

Highlights of GAO-07-945, a report to congressional committees 

Why GAO Did This Study: 

In fiscal year 2006, the Centers for Medicare & Medicaid Services (CMS) 
spent over $51 billion on the Medicare Advantage program, which serves 
as an alternative to the traditional fee-for-service program. Under the 
Medicare Advantage program, companies wishing to participate must 
annually submit bids (effective with contract year 2006) that identify 
the health services the company will provide to Medicare members and 
the estimated cost and revenue requirements for providing those 
services. For 2001 through 2005, the submissions were called Adjusted 
Community Rate (ACR) Proposals. The Balanced Budget Act (BBA) of 1997 
requires CMS to annually audit the financial records supporting the 
submissions of at least one-third of participating organizations. BBA 
also requires that GAO monitor the audits. In this report, GAO examined 
(1) whether CMS met the one-third requirement for 2001 through 2006, 
(2) what information the ACR audits provided and how CMS used it, and 
(3) what information the bid audits provided and how CMS used it. 

What GAO Found: 

CMS did not document its process to determine whether it met the 
requirement for auditing ACRs for one-third of the participating 
Medicare Advantage organizations for contract years 2001-2005. CMS is 
planning to conduct other financial reviews of organizations to meet 
the audit requirement for contract year 2006, but by the end of our 
fieldwork in June 2007, CMS had not finalized its plans. Further, CMS 
does not plan to complete the financial reviews until almost 3 years 
after the bid submission date each contract year. This will affect its 
ability to address deficiencies in a timely manner. 

Figure: Number of organizations audited (percent) 

[See PDF for image] 

Source: GAO analysis of CMS data. 

[End of figure] 

CMS did not document its process to determine whether it met the 
requirement for auditing ACRs for one-third of the participating 
Medicare Advantage organizations for contract years 2001-2005. CMS is 
planning to conduct other financial reviews of organizations to meet 
the audit requirement for contract year 2006, but by the end of our 
fieldwork in June 2007, CMS had not finalized its plans. Further, CMS 
does not plan to complete the financial reviews until almost 3 years 
after the bid submission date each contract year. This will affect its 
ability to address deficiencies in a timely manner. 

CMS audited contract year 2006 bids for 80 organizations, and 18 had a 
material finding that affected amounts in approved bids. CMS officials 
said that they will use the audit results to help improve bids in 
subsequent years but took limited action to follow-up on contract year 
2006 findings. CMS will not pursue financial recoveries based on audit 
results because it maintains that it does not have the legal authority 
to do so. However, according to our assessment of the statutes, CMS has 
the authority to include terms in bid contracts that would allow it to 
pursue financial recoveries. CMS also has the authority to sanction 
organizations but has not identified instances where sanctions are 
warranted. We also noted that CMS did not document steps taken to 
mitigate conflicts of interest for the firms performing audits. 

What GAO Recommends: 

GAO makes five recommendations to CMS for meeting the one-third audit 
requirement, enhancing its audit follow-up, and improving the bid audit 
process. CMS concurred with our recommendations. 

[hyperlink, http://www.gao.gov/cgi-bin/getrpt?GAO-07-945]. 

To view the full product, including the scope and methodology, click on 
the link above. For more information, contact Jeffrey Steinhoff at 202-
512-2600 or steinhoffj@gao.gov. 

[End of section] 

Contents: 

Letter: 

Results in Brief: 

Background: 

GAO Analysis Shows CMS Has Not Met the Audit Requirement for Contract 
Years 2001-2005 and Has Not Yet Met It for Contract Year 2006: 

CMS's ACR Audit Process Was Ineffective: 

Bid Audits Report Findings That Would Affect Premiums and Payments for 
Contract Year 2006, But CMS Does Not Address the Findings: 

Conclusions: 

Recommendations for Executive Action:

Agency Comments and Our Evaluation:

Appendix I: Scope and Methodology:

Appendix II: Actuarial Standards Applicable to Bid Preparers: 

Appendix III: Description of Bid Worksheets: 

Appendix IV: Other Reviews of Financial Records CMS Plans to Do to Meet 
Audit Requirement: 

Appendix V: Comments from the Department of Health and Human Services: 

Appendix VI: GAO Contact and Staff Acknowledgments: 

Related GAO Products: 

Tables: 

Table 1: Summary of Organizations Audited as a Percentage of Total 
Organizations and Audit Costs: 

Table 2: Summary of Audited Plans as a Percentage of Those Offered by 
Audited Organizations and All Participating Organizations: 

Table 3: Description of the Medicare Advantage Bid Form Worksheets for 
MA Plans for Contract Year 2006: 

Table 4: Description of the Medicare Prescription Drug Plan Bid Form 
Worksheets for Medicare Advantage Plans for Contract Year 2006: 

Table 5: CMS's Planned Reviews of Medicare Advantage and Medicare Part 
D to Meet Audit Requirement: 

Figure: 

Figure 1: Time Elapsed from Contract Year 2006 Bid Submissions to 
Reviews to Meet Audit Requirement: 

Abbreviations: 

ACR: adjusted community rate: 
ACRP: adjusted community rate proposal: 
ASOP: Actuarial Standards of Practice:
BBA: Balanced Budget Act of 1997 BIPAMedicare, Medicaid, and SCHIP: 
Benefits Improvement Protection Act of 2000: 
CBC: Center for Beneficiary Choices: 
CMS: Centers for Medicare & Medicaid Services 
FFS: fee-for-service: 
HHS: Department of Health and Human Services: 
HMO: health maintenance organization: 
HPMS: Health Plan Management System: 
MA: Medicare Advantage: 
MCHP: managed-care health plan: 
MMA: Medicare Prescription Drug, Improvement and Modernization Act of 
2003: 
OACT: Office of the Actuary 
OFM: Office of Financial Management: 
OIG: Office of Inspector General:
PPO: preferred provider organization PSOprovider-sponsored 
organization: 
RPPO: regional preferred provider organization: 

United States Government Accountability Office: 

Washington, DC 20548: 

July 30, 2007: 

The Honorable Max Baucus: 
Chairman: 
The Honorable Charles E. Grassley:
Ranking Member: 
Committee on Finance:
United States Senate: 

The Honorable John D. Dingell:
Chairman:
The Honorable Joe Barton: 
Ranking Member: 
Committee on Energy and Commerce: 
House of Representatives: 

The Honorable Charles B. Rangel: 
Chairman: 
The Honorable Jim McCrery: 
Ranking Member: 
Committee on Ways and Means: 
House of Representatives: 

In fiscal year 2006, the Centers for Medicare & Medicaid Services (CMS) 
estimated it spent over $51 billion on the Medicare Advantage program, 
which serves as an alternative to Medicare's traditional fee-for- 
service (FFS) program.[Footnote 1] Under the Medicare Advantage 
program, CMS approves private companies to offer health plan options to 
Medicare enrollees that include all Medicare-covered services. In 
addition, many plans under the program provide supplemental benefits, 
such as a reduction in required cost sharing (e.g., beneficiaries' Part 
B premiums)[Footnote 2] or coverage for items and services not included 
under the traditional FFS program, like dental care. According to CMS, 
in fiscal year 2006, over 16 percent, or about 7 million of the 
approximately 43 million Medicare members, were enrolled in a Medicare 
Advantage plan. 

Before 2006, companies choosing to participate in the Medicare 
Advantage program were required to annually submit an Adjusted 
Community Rate Proposal (ACRP) to CMS for review and approval for each 
plan it intended to offer.[Footnote 3] The ACRP consisted of two parts-
-a plan benefit package and the Adjusted Community Rate (ACR). The plan 
benefit package contained a detailed description of the benefits 
offered by the plan, and the ACR contained a detailed description of 
the costs that the plan estimated it would incur in providing a package 
of benefits to an enrolled Medicare beneficiary. These costs were to be 
calculated based on how much a plan would charge a commercial customer 
to provide the same benefit package if its members had the same 
expected use of services as Medicare beneficiaries. For each plan 
offered, the ACR was to provide an estimate of expected per person 
payments from Medicare, based on published Medicare+Choice payment 
rates and the characteristics of the plan's expected enrollees. If the 
estimated ACR costs were greater than the estimated payment rate, and 
if the organization still chose to participate, it agreed to accept the 
CMS payment rate in accordance with its ACRP. However, if the estimated 
ACR costs were less than the estimated payment rate, the organization 
had to (1) provide additional services, (2) reduce beneficiary premiums 
or copayments, (3) distribute the excess to a benefit stabilization 
fund, or (4) use a combination of these methods. CMS made payments to 
the companies monthly in advance of rendering services. 

In 2003, Congress enacted the Medicare Prescription Drug, Improvement 
and Modernization Act of 2003 (MMA).[Footnote 4] Among other things, 
MMA established a bid submission process to replace the ACRP submission 
process and authorized a new prescription drug benefit, both effective 
for 2006. Under the bid process, private companies--called Medicare 
Advantage (MA) organizations--choosing to participate in the program 
are required to annually submit bids for review and approval for each 
plan they intend to offer. The bid submission includes a bid form that 
provides each MA organization's estimate of the cost of delivering 
services to an enrolled Medicare beneficiary and a plan benefit package 
that provides a detailed description of the benefits offered in each 
plan. Additionally, each MA organization and prescription drug plan 
that offers prescription drug benefits under Part D[Footnote 5] is 
required to submit a separate prescription drug bid form, a 
formulary,[Footnote 6] and a plan benefit package to CMS for its review 
and approval. Within the bid forms, MA organizations include an 
estimate of the per person cost of providing Medicare-covered services. 
Unlike the cost estimates under the ACRP process, organizations develop 
CMS bid cost estimates by relying on reasonable projection methods that 
may include reliance on incurred costs for a base year, adjustments for 
estimated utilization, and other factors to project costs to the bid 
contract period. CMS compares the bid amounts to geographic-specific 
benchmarks to determine the total payment to the MA 
organization.[Footnote 7] If a bid amount is above the benchmark, the 
MA organization must require enrollees to pay the difference in the 
form of a premium. If the bid amount is below its benchmark, 75 percent 
of the difference (or savings), termed a rebate, must be provided to 
enrollees as extra benefits in the form of cost sharing reductions, 
premium reductions, or additional covered services.[Footnote 8] The 
remaining 25 percent of the savings is retained by the Federal 
Treasury.[Footnote 9] After bids are approved and payments are 
established, CMS makes payments to the companies monthly in advance of 
rendering services. 

Until the passage of the Balanced Budget Act of 1997 (BBA), which 
required CMS to annually audit the supporting financial records 
(including data relating to Medicare utilization, costs, and 
computation of the ACR) of at least one-third of the participating 
organizations,[Footnote 10] there was limited oversight by CMS of the 
ACR process. BBA also required that GAO monitor the audit activities 
mandated by the act. In fulfilling our responsibility, we first 
reviewed CMS's process for auditing ACRs approved for contract year 
2000.[Footnote 11] This was CMS's first effort to meet the audit 
requirement. We reported that the audits were of limited usefulness 
because CMS did not follow up on the audit results. In continuing to 
fulfill our audit monitoring responsibility, this report addresses the 
following questions: 

1. Has CMS met the requirement for auditing the financial records of at 
least one-third of the participating MA organizations for contract 
years 2001-2005 as required by the Balanced Budget Act of 1997 and bid 
submissions for contract year 2006? 

2. Did the ACRP audit process provide CMS sufficient information to 
assess potential impacts on beneficiaries and identify actions to 
address those impacts? 

3. How did CMS conduct audits of bids for 2006, what information did 
the bid audit process provide CMS, and how did CMS use that 
information? 

To determine whether CMS met requirements for auditing the financial 
records of at least one-third of the MA organizations for contract 
years 2001-2005 and the bid submissions for contract year 2006, we 
obtained from CMS a listing of the organizations that had their ACRPs 
or bids audited each year and compared it with the total number of 
approved ACRP and bid submissions for each year obtained from CMS's 
ACRP and bid management database, the Health Plan Management System 
(HPMS). We also interviewed CMS staff and officials. 

To determine whether information provided by the ACRP audit process was 
sufficient for CMS to assess potential impacts on beneficiaries and 
address those impacts, we obtained and reviewed audit reports for 
contract years 2001-2004 and reports prepared by a contractor that 
reviewed and analyzed the audits for contract year 2003. We interviewed 
CMS staff and officials about what they did with the audit results, and 
we discussed CMS's review of an analysis of contract year 2003 ACR 
audits performed by the contractor. 

To determine how CMS conducted bid audits for contract year 2006, what 
information the bid audit process provided CMS, and how CMS used that 
information, we obtained and reviewed CMS's instructions and guidance 
for bid auditors, bid audit reports for contract year 2006, planned 
audit procedures, and bid certifications records. We interviewed the 
bid audit firms and CMS staff and officials about the bid audit process 
and discussed with CMS how it used the results of the contract year 
2006 audits and its plans for future use. 

See appendix I for details about our scope and methodology. We 
requested written comments on a draft of this report from the Secretary 
of Health and Human Services (HHS) or his designee. We conducted our 
review from November 2006 to June 2007 in accordance with generally 
accepted government auditing standards. 

Results in Brief: 

CMS did not document its process to determine whether it met the one- 
third audit requirement. However, on the basis of our analysis of 
available CMS data, CMS has not met the statutory requirement to audit 
the financial records of at least one-third of the participating MA 
organizations for contract years 2001-2005, nor has it done so yet for 
the contract year 2006 bid submissions. With respect to contract year 
2006, CMS officials acknowledged the one-third requirement, but stated 
that they did not intend for the audits of contract year 2006 bid 
submissions to meet the one-third audit requirement. Instead they said 
they plan to conduct other reviews of the financial records of 
participating MA organizations and prescription drug plans that will 
contribute to satisfying the requirement. However, CMS has not clearly 
laid out how any of these reviews will be conducted to meet the one- 
third requirement. Further, CMS will not complete these other financial 
reviews until almost 3 years after the bid submission date for each 
contract year, in part because it must first reconcile payment data 
that prescription drug plans are not required to submit to CMS until 6 
months after the contract year is over. Such an extended cycle for 
conducting audits and reviews to meet the one-third requirement will 
likely affect CMS's ability to recommend and implement any actions 
needed to address any identified deficiencies in MA organizations' and 
prescription drug plans' bid processes in a timely manner. 

CMS contracted with accounting firms for audits of the ACRs for a 
selected number of MA organizations for contract years 2001-2005, but 
did not consistently ensure that the audit process provided information 
to assess the potential impact on beneficiaries' benefits or payments 
to the MA organizations. In 2001, we reported that CMS planned to 
require auditors, where applicable, to quantify in their audit reports 
the overall impact of errors. CMS did not implement steps to determine 
such impact until after the audits for contract year 2003 were 
completed, when CMS contracted with a firm to review all of the 2003 
ACR audits and determine if there were any errors identified by the 
auditors that would affect beneficiaries.[Footnote 12] On the basis of 
that review, the contractor reported to CMS that it identified errors 
in ACRs that would have resulted in approximately $59 million that 
beneficiaries could have received in additional benefits, lower 
copayments, or lower premiums. Staff from CMS's Office of Financial 
Management (OFM) reviewed the auditors' and contractor's work to 
evaluate the amount reported by the contractor that would impact 
beneficiaries. OFM staff revised the amount to $34 million and 
concluded that they would make recommendations to CMS's Center for 
Beneficiary Choices (CBC) on whether corrective action plans or 
sanctions against MA organizations were warranted. However, in late May 
2007, CMS officials told us they were planning to close out the audits 
without pursuing financial recoveries because legal counsel had 
determined that the agency does not have the legal authority to recover 
funds from MA organizations based on ACR audit results. Subsequently, 
HHS legal counsel explained to us the department's position that CMS 
lacks the legal authority or the contractual right to pursue financial 
recoveries when audits determine that approved ACRs reflect errors, 
incorrect or unreasonable assumptions, or other misstatements. On the 
basis of our assessment of the statutes, CMS had the authority to 
pursue financial recoveries, but its rights under contracts with the 
organizations submitting ACRPs are limited because its implementing 
regulations did not require that each contract include provisions to 
inform organizations about the audits and about the steps that CMS 
would take to address identified deficiencies, including pursuit of 
financial recoveries. CMS officials acknowledged that they can impose 
sanctions in cases where an organization misrepresents information that 
is furnished under the program. However, CMS has never sanctioned an MA 
organization based on ACR audit results and did not say why it has not. 

CMS contracted with six firms to audit a selected number of contract 
year 2006 bids and plans to do so for subsequent years. In reviewing 
the 2006 bid audit reports, we determined that 18 (about 23 percent) of 
the 80 organizations audited had material findings that have an impact 
on beneficiaries or plan payments approved in bids. CMS defined 
material findings[Footnote 13] as those that would result in changes in 
the total bid amount of 1 percent or more or in the estimate for the 
costs per member per month of 10 percent or more for any bid element. 
Officials from CMS's Office of the Actuary (OACT) responsible for the 
bid audit process explained that they will use the audit results to 
help organizations improve their methods in preparing bids in 
subsequent years, but their audit follow-up process does not involve 
pursuing financial recoveries from organizations because CMS maintains 
that, as with ACRPs, it does not have the legal authority to do so. 
However, on the basis of our assessment of the statute, CMS has the 
authority to include terms in its contracts with MA organizations and 
prescription drug plan sponsors that would allow it to pursue financial 
recoveries based on the bid audit results. CMS also has the authority 
to sanction organizations. However, CMS has not sanctioned an MA 
organization based on contract year 2006 bid audit results. In the 
absence of changes to its procedures, CMS will continue to invest 
resources in audits that will likely provide limited value or return on 
investment. Another weakness that we noted in CMS's bid audit process 
was the lack of documentation to support steps taken to mitigate 
conflict of interest situations for the actuarial firms conducting the 
bid audits. Using available information, we were able to confirm that 
the actuarial firms did not audit the same bids for which the firms had 
acted as a consultant in preparing. However, we were not able to 
confirm the steps taken by CMS to avoid assigning actuarial firms to 
audit the same bids that the firms had reviewed because information was 
not available by the end of our fieldwork in June 2007. 

This report makes five recommendations to CMS to address ACRP audit 
results, enhance its approach for meeting the one-third audit 
requirement, improve its implementing regulations for the Medicare 
Advantage and Prescription Drug Programs, expand its procedures for 
following up on bid audit and financial review results, and reinforce 
the steps it takes to address conflicts of interest with firms that 
perform bid audits. In written comments on a draft of this report, CMS 
concurred with our recommendations and stated that it is in the process 
of implementing some of the recommendations including modifying its 
procedures for selecting MA organizations and prescription drug plans 
to meet the one-third audit requirement. CMS's comments are discussed 
in the Agency Comments and Our Evaluation section and reprinted in 
appendix V. CMS and HHS's Office of the Inspector General (OIG) also 
provided technical comments, which we incorporated as appropriate. 

Background: 

The Medicare program has a long-standing history of offering its 
beneficiaries managed care coverage through private plans as an 
alternative to the traditional FFS program. In 1997, Congress passed 
the Balanced Budget Act of 1997,[Footnote 14] which replaced an 
existing managed care program with the Medicare+Choice program in an 
effort to expand beneficiaries' managed care options. For oversight of 
the program, the act also required that CMS annually audit the 
financial records of at least one-third of the organizations 
participating in the Medicare+Choice program, including the 
organizations' data relating to Medicare utilization, costs, and 
computation of the ACR.[Footnote 15] 

In 2003, Congress enacted the Medicare Prescription Drug, Improvement, 
and Modernization Act of 2003[Footnote 16] to expand the role of 
private entities in providing benefits to Medicare beneficiaries. Among 
its changes, the law renamed the Medicare+Choice program the Medicare 
Advantage program. Medicare+Choice organizations were renamed MA 
organizations.[Footnote 17] MMA also authorized new prescription drug 
benefits to Medicare beneficiaries beginning in 2006 and created new 
types of private health plans such as "regional" MA plans,[Footnote 18] 
special needs plans, and prescription drug plans that could be offered 
in addition to the plan types already being offered such as health 
maintenance organizations (HMO), preferred provider organizations 
(PPO), provider-sponsored organizations (PSO), medical savings 
accounts, and private FFS plans.[Footnote 19] 

MMA established a bid submission process to replace the ACRP submission 
process used under the Medicare+Choice program to annually approve the 
benefit packages and costs that organizations estimated they would 
incur in providing benefits to enrolled Medicare beneficiaries. MMA 
specified that organizations wishing to offer health benefits as part 
of the MA program and drug benefits must annually submit bids. The bid 
submission includes a MA bid form indicating each MA organization's 
estimate of the cost of delivering services to Medicare beneficiaries 
and a plan benefit package for each plan.[Footnote 20] Additionally, 
each organization that offers prescription drug benefits under Part D 
is required to submit a separate prescription drug bid form, a 
formulary, and a plan benefit package to CMS for its review and 
approval. 

MMA made changes to the methodology that MA organizations use in 
estimating the costs of benefits. Under the ACRP process, MA 
organizations were required to include an estimate of their per person 
cost of providing benefits based on how much they would charge a 
commercial customer to provide the same benefit package if their 
members had the same expected use of services as Medicare 
beneficiaries. The chief executive officer, chief financial officer, 
and the head marketing official of the MA organization were required to 
certify that the ACRP contained accurate information. 

Under the bid process, cost estimates are not based on commercial 
experience. Under CMS's bid submission instructions, organizations are 
required to include an estimate of the per person cost of providing 
Medicare-covered services by relying on reasonable projection methods 
that may include reliance on incurred costs for a base year, 
adjustments for estimated utilization, and other factors to project 
costs to the bid contract period. The allowed costs and additional cost 
sharing information are to be used to determine net medical costs. To 
this, nonmedical expenses, such as indirect administration and gain/ 
loss margins, are to be added to establish the required revenue for the 
contract year for each plan offered. The assumptions, data, and models 
used in developing cost estimates are prepared by the organizations' 
actuaries. CMS requires that the actuary who prepared the bid must 
submit a certification stating that the bid complies with laws, 
regulations, and the bid instructions and that the actuary has followed 
the appropriate actuarial standards in completing the bid. 

To determine the payments under the bid process, CMS compares the bid 
amounts to geographic-specific benchmarks.[Footnote 21] If a bid is 
above the benchmark, the enrollee must pay the difference in the form 
of a premium, referred to as the basic beneficiary premium. If a bid is 
below its benchmark, 75 percent of the difference (or savings), termed 
the rebate, must be provided to enrollees as extra benefits in the form 
of cost sharing reductions, premium reductions for Part B or Part D, or 
additional covered services. The remaining 25 percent of the savings is 
retained by the Federal Treasury. 

By law, organizations are required to submit bids for each contract 
year by the first Monday in June before the contract year begins. For 
contract year 2006, organizations had to submit bids to CMS by June 6, 
2005. The bids are submitted through HPMS. CMS subjects the bid forms 
to a desk review prior to approval. In contract year 2006, CMS 
contracted with six actuarial consulting firms to assist in reviewing 
the bid forms. The objective of the bid review was to determine whether 
the bid was reasonable and fair to the organization, the beneficiary, 
and CMS. In contract year 2006, the review of the bid forms consisted 
of a series of structured subreviews that examined the individual cost 
elements that collectively comprised each bid. CMS's OACT developed 
metrics for each bid and identified statistical outliers based on 
"acceptable thresholds" it defined. The contract reviewers investigated 
the outliers, requesting additional documentation from the organization 
as necessary, to assess the assumptions and methods supporting the bid 
elements and their reasonableness to support the overall bid. From 
early June 2005 through mid-September 2005, CMS contractors reviewed 
the bids, and CMS approved them.[Footnote 22] CMS awarded contracts for 
approved bids by mid-September 2005. 

After approval of the bids, CMS selects bids for audit.[Footnote 23] 
For audits of the contract year 2006 bid forms, OACT contracted with 
six firms in September 2005. CMS specified audit guidance for the 
auditors. This included procedures for reviewing the accuracy of 
organizations' financial data supporting the bid submissions and the 
reasonableness of assumptions used in the contract year financial 
projections. Auditors were also instructed to consider whether the bids 
were developed consistent with the Actuarial Standards of Practice 
(ASOP) designated by CMS and CMS's bid preparation instructions. (See 
appendix II for a description of the ASOPs.) Auditors generally 
reported preliminary findings by April 2006 and issued final reports by 
August 2006.[Footnote 24] 

In contract year 2006, OACT required MA organizations to report 
incurred revenue and expense information for contract year 2004. CMS 
calls this a 2-year look back. As of June 2007, OACT had made limited 
use of this 2-year look back information, but intends to use such 
information to assess the credibility of projected revenue and expenses 
reported by MA organizations. This would include a review of data to 
identify possible biases or inaccuracies in a MA organization's bid 
estimations. 

GAO Analysis Shows CMS Has Not Met the Audit Requirement for Contract 
Years 2001-2005 and Has Not Yet Met It for Contract Year 2006: 

CMS did not document its process to determine whether it met the one- 
third audit requirement. However, according to our analysis of 
available CMS data, CMS has not met the statutory requirement to audit 
the financial records of at least one-third of the participating MA 
organizations for contract years 2001-2005, nor has it done so yet for 
the contract year 2006 bid submissions. We performed an analysis to 
determine if CMS had met the requirement because CMS could not provide 
documentation to support the method it used to select the ACRs and bids 
for audit and to demonstrate that it had met the audit requirement for 
those years. With respect to contract year 2006, CMS officials 
acknowledged the one-third requirement, but they stated that they did 
not intend for the audits of contract year 2006 bid submissions to meet 
the one-third audit requirement. They explained that they plan to 
conduct other reviews of the financial records of MA organizations and 
prescription drug plans to meet the requirement for contract year 2006. 
However, CMS has not clearly laid out how these reviews will be 
conducted to meet the one-third requirement. Further, CMS is not likely 
to complete these other financial reviews until almost 3 years after 
the bid submission date for each contract year, in part because it must 
first reconcile payment data that prescription drug plans are not 
required to submit to CMS until 6 months after the contract year is 
over. Such an extended cycle for conducting these reviews to meet the 
one-third requirement limits their usefulness to CMS and hinders CMS's 
ability to timely identify any identified deficiencies in MA 
organizations' and prescription drug plans' bid processes that require 
corrective action. 

CMS Has Not Met Audit Requirement: 

The Secretary of Health and Human Services is required to provide for 
the annual auditing of the financial records (including data relating 
to Medicare utilization and costs) of at least one-third of the MA 
organizations.[Footnote 25] In defining what constituted an 
organization for the purpose of selecting one-third for audit, CMS 
officials explained that they determined the number of participating 
organizations based on the number of contracts that they 
awarded.[Footnote 26] Under each contract an organization can offer 
multiple plans.[Footnote 27] When CMS selects an organization for 
audit, some, but not all, of the plans offered under the organization's 
contract are audited. 

CMS did not document its approach for selecting ACRs for audit or how 
its approach was to meet the one-third annual audit requirement. 
Consequently, we performed an analysis comparing the organizations and 
plans audited as a percentage of organizations and plans that CMS 
approved under the Medicare+Choice, Medicare Advantage, and Part D 
programs from contract year 2001 through contract year 2006. We 
obtained data on the total number of organizations and plans from CMS's 
HPMS and data on the audited organizations from the audit 
reports.[Footnote 28] We determined that between 18.6 and 23.6 percent, 
or fewer than one-third, of the MA organizations offering plans for 
contract years 2001-2005 were audited. Similarly, we determined that 
only 13.9 percent of the MA organizations and prescription drug plans 
with approved bids for contract year 2006 were audited.[Footnote 29] 
Table 1 summarizes our results. 

Table 1: Summary of Organizations Audited as a Percentage of Total 
Organizations and Audit Costs: 

Contract year: 2001; 
Type of audit: ACRP; 
Number of organizations audited: 50; 
Number of organizations: 212; 
Percentage of organizations audited: 23.6; 
Audit costs (dollars in millions): $2.8. 

Contract year: 2002; 
Type of audit: ACRP; 
Number of organizations audited: 40; 
Number of organizations: 183; 
Percentage of organizations audited: 21.9; 
Audit costs (dollars in millions): $2.6. 

Contract year: 2003; 
Type of audit: ACRP; 
Number of organizations audited: 49; 
Number of organizations: 220; 
Percentage of organizations audited: 22.3; 
Audit costs (dollars in millions): $3.8. 

Contract year: 2004; 
Type of audit: ACRP; 
Number of organizations audited: 47; 
Number of organizations: 228; 
Percentage of organizations audited: 20.6; 
Audit costs (dollars in millions): $3.4. 

Contract year: 2005; 
Type of audit: ACRP; 
Number of organizations audited: 59; 
Number of organizations: 318; 
Percentage of organizations audited: 18.6; 
Audit costs (dollars in millions): $2.6. 

Contract year: 2006; 
Type of audit: Bid; 
Number of organizations audited: 80; 
Number of organizations: 577; 
Percentage of organizations audited: 13.9; 
Audit costs (dollars in millions): $3.3. 

Source: GAO analysis of CMS data and ACRP and bid audit reports. 

Note: Audit costs do not include CMS staff costs. 

[End of table] 

Although CMS selects organizations to meet the one-third audit 
requirement based on the number of organizations and not the total 
number of plans offered by organizations, we also analyzed the 
percentage of plans audited of the total number of plans offered by 
each audited organization. Our analysis shows that with the exception 
of contract year 2002, the level of audit coverage achieved by CMS 
audits has progressively decreased in terms of the percentage of plans 
audited for those organizations that were audited. Audit coverage has 
also decreased in terms of the percentage of plans audited of all plans 
offered by participating organizations each contract year. In contract 
year 2006, a large increase in the number of bid submissions meant that 
the 159 plans audited reflected only about 3 percent of all the plans 
offered. Table 2 summarizes our analysis. 

Table 2: Summary of Audited Plans as a Percentage of Those Offered by 
Audited Organizations and All Participating Organizations: 

Contract year: 2001; 
Type of audit: ACRP; 
Number of plans audited for audited organizations: 165; 
Number of plans offered by audited organizations: 216; 
Percentage of plans audited of all plans offered by audited 
organizations: 76.4; 
Number of plans offered by all participating organizations: 743; 
Percentage of plans audited of all plans offered by participating 
organizations: 22.2. 

Contract year: 2002; 
Type of audit: ACRP; 
Number of plans audited for audited organizations: 84; 
Number of plans offered by audited organizations: 93; 
Percentage of plans audited of all plans offered by audited 
organizations: 90.3; 
Number of plans offered by all participating organizations: 554; 
Percentage of plans audited of all plans offered by participating 
organizations: 15.2. 

Contract year: 2003; 
Type of audit: ACRP; 
Number of plans audited for audited organizations: 137; 
Number of plans offered by audited organizations: 254; 
Percentage of plans audited of all plans offered by audited 
organizations: 53.9; 
Number of plans offered by all participating organizations: 770; 
Percentage of plans audited of all plans offered by participating 
organizations: 17.8. 

Contract year: 2004; 
Type of audit: ACRP; 
Number of plans audited for audited organizations: 124; 
Number of plans offered by audited organizations: 257; 
Percentage of plans audited of all plans offered by audited 
organizations: 48.2; 
Number of plans offered by all participating organizations: 967; 
Percentage of plans audited of all plans offered by participating 
organizations: 12.8. 

Contract year: 2005; 
Type of audit: ACRP; 
Number of plans audited for audited organizations: 100; 
Number of plans offered by audited organizations: 476; 
Percentage of plans audited of all plans offered by audited 
organizations: 21.0; 
Number of plans offered by all participating organizations: 1,865; 
Percentage of plans audited of all plans offered by participating 
organizations: 5.3. 

Contract year: 2006; 
Type of audit: Bid; 
Number of plans audited for audited organizations: 159; 
Number of plans offered by audited organizations: 1,194; 
Percentage of plans audited of all plans offered by audited 
organizations: 13.3; 
Number of plans offered by all participating organizations: 4,920; 
Percentage of plans audited of all plans offered by participating 
organizations: 3.2. 

Source: GAO analysis of CMS data and ACRP and bid audit reports. 

[End of table] 

Regarding how CMS selected the organizations that were audited for 
contract years 2001-2004, CMS officials told us they did not know how 
the MA organizations were selected, and the documentation supporting 
the selections was either not created or not retained. For contract 
year 2005 audits, CMS officials told us that the selection criteria 
included several factors other than simply selecting one-third of the 
participating MA organizations that were awarded contracts. They said 
that the criteria considered whether the MA organization had a negative 
balance in the benefit stabilization fund and the MA organization had 
been audited previously and had significant issues. Late in June, CMS's 
OFM staff provided us a summary of the criteria used to select the 59 
organizations participating in the MA program that it selected for 
contract year 2005 ACR audits. However, the number of organizations 
used by the OFM staff in selecting the 59 organizations did not agree 
with the number CMS provided us from the HPMS that we used in our 
analysis. For this reason, we did not rely on the new information. 

For the audits of the contract year 2006 bids, CMS officials explained 
that they did not intend for the audits of contract year 2006 bid 
submissions to meet the one-third audit requirement and that they plan 
to conduct other reviews of the financial records of organizations to 
meet the requirement for contract year 2006. However, CMS has not 
clearly laid out how these reviews will be conducted to meet the one- 
third requirement. OACT officials explained that in selecting the bids 
for audit they (1) considered whether the organization had been audited 
within the last 12 months and excluded those because CMS did not want 
to burden the organization with another audit, (2) selected 25 percent 
of the organizations based on information collected through the initial 
bid review process, and (3) randomly selected organizations from the 
remaining 75 percent. 

CMS Has Not Yet Met the Audit Requirement for Contract Year 2006 and 
Has Not Determined How It Will Do So: 

As we just discussed, CMS has not yet met the one-third audit 
requirement for the contract year 2006 bid submissions. Further, CMS 
has not finalized its approach for how it will meet the requirement for 
contract year 2006 and beyond. During the course of our review, CMS 
officials provided differing information about CMS's plans for meeting 
the one-third audit requirement. Officials from CBC, OACT, and OFM 
initially told us in January and February 2007 that their plans for 
meeting the one-third requirement will likely include the bid audits 
currently directed by OACT and other reviews by OFM of financial 
records of organizations. In June 2007, however, OFM officials said the 
requirement will be met solely through their efforts. OFM is currently 
working with a contractor to develop the agency's overall approach to 
conducting reviews to meet the one-third audit requirement. But as of 
June 2007, CMS had not specified how these reviews will meet the one- 
third audit requirement. Draft audit procedures prepared by the 
contractor indicate that OFM plans to review solvency, risk scores, 
related parties, direct medical and administrative costs, and, where 
relevant, regional PPO cost reconciliation reports for MA bids. For 
Part D bids, OFM also plans to review other areas, including 
beneficiaries' true out-of-pocket costs.[Footnote 30] Appendix IV 
summarizes the reviews that CMS is currently planning to do for 
contract year 2006 and beyond, along with the objectives of those 
reviews. 

CMS will not complete the proposed financial reviews until almost 3 
years after the bids are submitted for each contract year, as shown in 
figure 1, in part because it must first reconcile Part D payment data 
that prescription drug plans are not required to submit to CMS until 6 
months after the contract year is over.[Footnote 31] Contract year 2006 
bids were submitted in June 2005. OFM officials said that they planned 
to start some of the reviews for MA organizations in August 2007 to 
test their audit approach. However, review of RPPOs and prescription 
drug plans will not start until later because RPPO risk-sharing cost 
reconciliations that OFM says it will review are not due to CMS until 
December 2007.[Footnote 32] OFM also plans to use Part D payment 
reconciliations that CBC will not be able to complete until June or 
July of 2007 because prescription drug plans are not required to submit 
payment data to CMS until June 2007. This means that reviews of 
financial records intended to meet the one-third audit requirement for 
contract year 2006 will not start until the fall of 2007 and will not 
be completed until sometime in 2008. Results of these reviews might be 
available to CMS before reviewing and approving bids for contract year 
2009 that organizations must submit in June 2008. CMS has not yet 
developed its approach for following up on the results of these 
reviews. Such an extended cycle for conducting reviews of financial 
records to meet the one-third requirement will affect CMS's ability to 
recommend and implement actions needed to address any identified 
deficiencies in MA organizations' and prescription drug plans' bid 
processes in a timely manner. 

Figure 1: Time Elapsed from Contract Year 2006 Bid Submissions to 
Reviews to Meet Audit Requirement: 

[See PDF for image] 

Source: GAO.

[End of figure] 

CMS's ACR Audit Process Was Ineffective: 

CMS contracted with accounting firms to audit the contract year 2001- 
2005 ACRs for a selected number of MA organizations, but did not 
consistently ensure that the audit process provided information to 
assess the potential impact on beneficiaries' benefits or the payments 
CMS makes to MA organizations. The auditors reported findings ranging 
from lack of supporting documentation to overstating or understating 
certain costs, but did not identify how the errors affected beneficiary 
benefits, copayments, or premiums. In 2001, we reported that CMS 
planned to require auditors, where applicable, to quantify in their 
audit reports the overall impact of errors.[Footnote 33] Further, 
during our prior work, CMS officials stated that they were in the 
process of determining the impact on beneficiaries and crafting a 
strategy for audit follow-up and resolving the audit results. CMS did 
not initiate any actions to attempt to determine such impact until 
after the audits for contract year 2003 were completed, when CMS 
contracted with a firm to review all of the 2003 ACR audits to identify 
any errors from the audits that would affect beneficiaries. The 
contractor reported to CMS that it had identified errors in ACRs that 
would have resulted in approximately $59 million that beneficiaries 
could have received in additional benefits, lower copayments, or lower 
premiums. CMS also contracted with a firm to review the 2004 ACR 
audits, but the work is not to be completed until August 31, 2007. The 
OFM staff reviewed the 2003 audit reports and the contractor's analysis 
of the audit reports. OFM revised the amount identified by the 
contractor's analysis from $59 million to $35 million and concluded 
that it would make recommendations to CBC on whether corrective action 
plans or sanctions against MA organizations were warranted. However, in 
late May 2007, CMS informed us that its legal counsel had determined 
that the agency does not have the legal authority to recover funds from 
MA organizations based on the findings from the ACR audits. On the 
basis of our assessment of the statutes, CMS had the authority to 
pursue financial recoveries, but its rights under the contracts for 
2001-2005 are limited because its implementing regulations did not 
require that each contract include provisions to inform organizations 
about the audits and about the steps that CMS would take to address 
identified deficiencies, including pursuit of financial 
recoveries.[Footnote 34] 

The ACR Audit Process Did Not Consistently Quantify Impacts on 
Beneficiaries: 

CMS contracted with audit firms at a cost of $15.2 million to audit 
ACRs for contract years 2001-2005, but did not ensure that the audit 
process consistently provided information to assess the potential 
impact on beneficiaries. The instructions and guidance that CMS 
provided to the auditors of the ACRs generally were not clear that the 
auditors should quantify and report on how errors identified in the 
ACRs would affect beneficiary benefits, copayments, or premiums. In our 
October 2001 report, we reported that for contract year 2001, CMS had 
planned to require auditors, where applicable, to do so.[Footnote 35] 
We recommended that CMS fully implement its plans to calculate the net 
effect of ACR audit findings and adjustments. Computing the net effect 
of the errors identified by the ACR audits is key to assessing the 
magnitude of the impact on beneficiaries and could aid in developing an 
appropriate follow-up protocol. In September 2001, CMS stated that it 
was already addressing this recommendation. 

Although CMS indicated it was planning to obtain a calculation of the 
net effect (i.e., impact on beneficiaries) of errors identified by 
auditors, the audit guidance and instructions provided by CMS for 
contract years 2001 and 2002 did not specify that the auditors should 
quantify the impact of the errors on beneficiary benefits, copayments, 
or premiums. Consequently, the audit reports did not quantify the 
impact on the beneficiaries. 

The audit guidance and instructions for contract years 2003 and 2004 
also did not contain a directive to quantify the impact on 
beneficiaries of the auditors' findings, and the audit reports did not 
contain this information. CMS contracted with a firm to review all of 
the 2003 ACR audit reports to identify any errors from the audits that 
would affect beneficiaries. The auditors categorized their results as 
findings and observations, with findings being more significant, 
depending on their materiality to the average payment rate reported in 
the ACR. The distinction between findings and observations, however, 
was based on judgment, and therefore varied among the different 
auditors. CMS asked the contractor to analyze the audit reports, 
including both findings and observations, and supporting documentation. 
After reviewing the ACR reports for the 49 organizations audited and 
related documentation, the contractor reported in December 2005 that it 
had identified errors for 41 of the 49 organizations that would have 
resulted in approximately $59 million that beneficiaries could have 
received in additional benefits, lower copayments, or lower premiums. 

OFM staff reviewed the contract year 2003 audit reports along with the 
contractor's analysis of the 2003 ACR audits to evaluate the amount 
reported by the contractor that would affect beneficiaries. After 
reviewing all 49 audit reports and the contractor's analysis, OFM staff 
determined that there were errors for 32 of the 49 organizations 
audited that would have resulted in approximately $35 million that 
beneficiaries could have received in additional benefits, lower 
copayments, or lower premiums. OFM staff told us they had identified 
what they considered errors in some of the contractor's work, such as 
misapplication of the instructions, and revised the amount of the 
beneficiary impact that the contractor had identified. OFM staff 
concluded that they would make recommendations to CBC on whether 
corrective action plans or sanctions against MA organizations were 
warranted. In September 2006, CMS also contracted with a firm to 
quantify the overall net effect resulting from the contract year 2004 
ACR audits. CMS officials told us that OFM staff were still working 
with the contractor on this project, which is not to be completed until 
August 31, 2007. 

For the contract year 2005 ACR audits, CMS's instructions to the 
auditors required them to clearly identify the net effect or impact of 
their findings. However, as of June 2007, we had not yet received the 
contract year 2005 audit reports, and therefore we cannot confirm 
whether these reports included information on the impact on 
beneficiaries of identified errors. According to CMS, the audits were 
delayed because management decided instead to allocate funds intended 
for this purpose to OACT for the audits of the contract year 2006 bids. 

CMS Did Not Act to Recover Funds from or Sanction MA Organizations 
Based on ACR Audit Results and Has Not Determined How to Close Out the 
Audits: 

In our 2001 report, we noted that CMS did not have a formal process in 
place to resolve the specific problems identified in the audits, and 
therefore the usefulness of the audit process was undermined. We 
recommended that CMS develop and implement a follow-up mechanism to 
address the audit findings in a timely manner and that CMS communicate 
to each MA organization specific corrective actions. In September 2001, 
CMS responded that such a process was under development. CMS told us it 
provided copies of the final audit reports to the MA organizations and 
instructed them to institute remedial actions in their subsequent ACR 
submissions and that CMS's intent was to follow up on the audit 
findings during subsequent audits. For this report, we reviewed audit 
reports for contract years 2001-2004 and discussed CMS's audit follow- 
up process with CMS officials and staff.[Footnote 36] The audit reports 
did not refer to past audit findings, so it is unclear whether the 
auditors had followed up on the past findings. The only action that CMS 
has taken was to provide copies of the audit reports to the MA 
organizations and instruct the organizations to take action in 
subsequent ACR filings. 

In late May 2007, CBC officials explained that they were responsible 
for resolving the issues resulting from the ACR audit reports and 
stated that they were working with OFM to develop an approach to 
address the results from the audit reports for contract years 2003 
through 2005,[Footnote 37] but had not yet decided on a plan of action. 
They also informed us that their legal counsel had determined that the 
agency does not have the legal authority to recover funds from MA 
organizations based on results of ACR audits. Subsequently, HHS legal 
counsel explained to us the department's position that CMS lacks the 
legal authority or the contractual right to pursue financial recoveries 
when audits determine that approved ACRs reflect errors, incorrect or 
unreasonable assumptions, or other misstatements. We were told that, 
based on a determination of the Secretary, general federal contract 
laws do not apply to the payments made under MA contracts.[Footnote 38] 
Instead, according to HHS, the contractual rights of CMS and the 
contracting MA organizations are limited to those set out in statute 
and the CMS implementing regulations. Those statutes and regulations do 
not expressly provide for corrective action based on CMS's ACR audits, 
such as returning funds to CMS or beneficiaries based on errors found 
during ACR audits when the audits indicate that each beneficiary in a 
plan should have received a certain amount of additional benefits. On 
the basis of our assessment of the statutes, CMS had the authority to 
include terms in its contracts with MA organizations that would allow 
it to pursue financial recoveries based on the ACR audit 
results.[Footnote 39] However, CMS's rights under the contracts for 
contract years 2001-2005 are limited because its implementing 
regulations for the Medicare+Choice Program did not require that each 
contract include provisions to inform organizations and plans about the 
audits and about the steps that CMS would take to address identified 
deficiencies, including pursuit of financial recoveries. 

CMS officials acknowledged that they can impose sanctions in cases 
where an organization misrepresents information that is furnished under 
the program and for other reasons.[Footnote 40] Intermediate sanction 
provisions allow for suspension of enrollment of individuals in MA 
plans, suspension of payments to MA organizations, and civil penalties 
in the amount of up to $100,000 for misrepresenting or falsifying 
information to CMS.[Footnote 41] However, CMS has never sanctioned an 
MA organization based on findings from the ACR audits and did not say 
why it has not. CMS officials told us that they plan to close out the 
audits without pursuing financial recoveries. They said that they are 
considering options, such as determining whether findings are 
applicable to the current bid process, that could be a basis for 
current action. CMS officials also stated that they are compiling a 
list of MA organizations whose contract year 2003 ACR audits resulted 
in significant findings and will refer the MA organizations to the HHS 
Office of Inspector General (OIG) for appropriate action, including 
assessing civil monetary penalties. However, CMS officials acknowledged 
that the opportunity to take corrective action may have passed, given 
the amount of time since the audits were completed. 

In the past, the OIG has audited ACRs and recommended in some cases 
that MA organizations return unsupported or unallowable payments to 
CMS. For example, the OIG conducted 53 of the 80 ACR audits for 
contract year 2000, the first year of such audits that we reported on 
in our previous report.[Footnote 42] The OIG reported findings that 
quantified the impact of ACR errors on beneficiaries in 7 of the 53 
reports. However, CMS did not take action on the findings. CMS also did 
not take action on findings from other audits of ACRs that the OIG did 
under its authority. For example, the OIG audited the modifications to 
the contract year 2001 ACRPs for six MA organizations to determine 
whether additional funding provided by the Benefits Improvement 
Protection Act (BIPA) of 2000 was used in a manner consistent with BIPA 
requirements and whether the modifications were adequately 
supported.[Footnote 43] The OIG also audited modifications to the 
contract year 2004 ACRPs for six MA organizations to determine whether 
the use of payment increases provided under MMA were adequately 
supported and allowable under MMA. In five of the BIPA audits and one 
of the MMA audits, the OIG found that the MA organizations did not 
support how they used the additional funds, or they determined that MA 
organizations did not use the funds in a manner consistent with the 
applicable law. In its reports dated June 2004 through January 2006, 
the OIG recommended that the six MA organizations return to CMS a total 
of almost $29 million or deposit the funds in a benefit stabilization 
fund for use in future years. 

In CMS's December 2006 management response to the OIG's 
recommendations, CMS's CBC stated that CMS did not concur with the 
OIG's recommendations to collect the funds and make them available for 
benefits because (1) the benefit stabilization fund was abolished with 
implementation of MMA, (2) a significant time has elapsed since the 
benefit year in question (2001),[Footnote 44] (3) the Medicare+Choice 
program no longer exists, and (4) the basis for payment has changed 
from reviews of ACRPs to bids. 

Bid Audits Report Findings That Would Affect Premiums and Payments for 
Contract Year 2006, But CMS Does Not Address the Findings: 

CMS contracted with six firms to audit a selected number of contract 
year 2006 bids and plans to do so for subsequent years. In reviewing 
the 2006 bid audit reports, we determined that 18 (about 23 percent) of 
the 80 organizations audited had material findings that have an impact 
on beneficiaries or plan payments approved in bids. CMS defined 
material findings as those that would result in changes in the total 
bid amount of 1 percent or more or in the estimate for the costs per 
member per month of 10 percent or more for any bid element.[Footnote 
45] OACT officials responsible for the bid audit process explained that 
they will use the audit results to help organizations improve their 
methods in preparing bids in subsequent years, but their audit follow- 
up process does not involve taking action to recover funds from 
organizations based on audit results because they maintain that CMS 
does not have the legal authority to do so. However, according to our 
assessment of the statute, CMS has the authority to include terms in 
contracts with MA organizations and prescription drug plan sponsors 
that would allow it to pursue financial recoveries based on the bid 
audit results. Another weakness that we noted in CMS's bid audit 
process was the lack of documentation to support steps taken to 
mitigate conflict of interest situations for the actuarial firms 
conducting the bid audits. Using available information, we were able to 
confirm that the actuarial firms did not audit the same bids that the 
firms had acted as a consultant in preparing. However, we were not able 
to confirm the steps taken by CMS to avoid assigning actuarial firms to 
audit the same bids that the firms had reviewed because information was 
not available by the end of our fieldwork in June 2007. 

Contract Year 2006 Bid Audit Results Identified Significant Impacts on 
Member Premiums and Medicare Payments: 

According to requirements in the audit contracts, the auditors were 
required to categorize the severity of the issues identified in the 
audits as either significant/material findings or nonsignificant 
observations.[Footnote 46] CMS defined material findings as those that 
would result in changes in the total bid amount of 1 percent or more or 
in the estimate for the costs per member per month of 10 percent or 
more for any bid element, which, if corrected, would be expected to 
result in (1) reduced payments from CMS to the organization, (2) 
additional benefits to enrollees, and (3) reduced enrollee premiums or 
copayments.[Footnote 47] CMS defined nonsignificant observations as 
deficiencies that are not considered material. 

The contract year 2006 bid audits covered 80 organizations. For 18 of 
these organizations (about 23 percent), auditors identified at least 
one material finding that affected the total bid amount or a particular 
bid element in an approved bid. Errors in the total bid amount or a bid 
element can affect the accuracy of Medicare payments. Errors can also 
affect members' premiums, copayments, and the level of services they 
are provided. The material findings arose from deficiencies identified 
by the auditors in how bid estimates were developed, including 
projected costs, risk scores, trend assumptions, cost sharing, manual 
rates, and utilization estimates among others. 

For the other 62 audited organizations, the auditors reported 
observations primarily relating to departures from CMS's detailed bid 
preparation instructions, including use of questionable data, 
assumptions, and methods, and inadequate documentation. CMS provides 
detailed instructions for organizations to prepare each of the seven 
spreadsheets that are part of the MA bid form. The instructions are a 
line-by-line description of the bid spreadsheets that identifies where 
user inputs are required. They also contain a glossary and identify the 
required supporting documentation, including a requirement for a 
completed certification executed by a qualified actuary. Similarly, CMS 
provides detailed line-by-line instructions for organizations to 
prepare each of the six spreadsheets that are part of the prescription 
drug plan bid form. 

CMS's Follow-up on Bid Audits Is Similar to Follow-up on the ACR 
Audits: 

OACT officials responsible for the bid audit process explained that 
they will use the audit results to help organizations improve their 
methods in preparing bids in subsequent years and to help OACT improve 
the overall bid process. Specifically, they told us they could improve 
the bid forms, bid instructions, training, and bid review process. 
OACT's audit follow-up process does not involve pursuing financial 
recoveries from organizations based on audit results because CMS 
maintains that, as with ACRPs, it does not have the legal authority to 
do so. As stated earlier, CMS officials believe that CMS lacks the 
statutory or contractual right to pursue financial recoveries based on 
audit findings. However, according to our assessment of the statute, 
CMS has the authority to include terms in its contracts with MA 
organizations and prescription drug plan sponsors that would allow it 
to pursue financial recoveries based on the bid audit results.[Footnote 
48] However, CMS's contractual rights are limited because its 
implementing regulations do not require that each contract include 
provisions to inform organizations and plans about the audits and about 
the steps that CMS will take to address identified deficiencies, 
including pursuit of financial recoveries. Such changes would be needed 
for CMS to be able to adjust the bid amounts after bid approval and 
pursue financial recoveries. 

CMS has authority to sanction organizations but did not identify any 
findings from the contract year 2006 bid audits where a sanction would 
be warranted. OACT officials believe the bid audits provide a "sentinel 
or deterrent effect" for organizations to properly prepare their bids 
since they do not know when the bids may be selected for a detailed 
audit. However, the officials acknowledged that the bid process relies 
heavily on certifying actuaries and that there is a low probability of 
the bid audits identifying intentional misrepresentations. 

Given the current audit coverage, CMS is unlikely to achieve 
significant deterrent effect, as only 14 percent of participating 
organizations for contract 2006 have been audited. Further, for those 
organizations that were audited, CMS's follow-up on the audit findings 
may not deter those organizations from making similar errors in future 
bids. For example, preliminary findings for most of the 2006 audits 
came out by April 2006, and according to OACT, organizations started 
preparing their bids for contract year 2007 by April 2006, which would 
have allowed them time to take corrective actions to address the audit 
findings. OACT officials noted that they updated the contract year 2007 
instructions for bid preparation as a result of audit results and other 
factors. However, they could not identify any specific revision arising 
out of the contract year 2006 audit results. Without a more targeted 
follow-up process to ensure that every finding and observation from the 
audits is addressed before approving the next year's bid, the value of 
the audits is limited. OACT officials said that their process for 
following up on the audit results will become more focused as each 
year's audits are conducted. Officials stated that CMS's 2007 
notification letter to organizations requires the contract year 2008 
bid submissions to document how the findings of the prior year audits 
were addressed in the subsequent bid submission. They also said the 
2008 bid review process includes a process for reviewing the prior 
year's audit findings for all bids that were audited in the prior year. 

CMS is currently developing an approach intended to ensure that one- 
third of the MA organizations and prescription drug plans are audited 
each year. As mentioned earlier, CMS plans to review financial issues 
including plan solvency, risk scores, related parties, direct medical 
and administrative costs, and beneficiaries' true out-of-pocket costs 
for prescription drug plans. However, CMS's approach does not clearly 
identify how it will follow up with organizations to ensure that issues 
identified in the financial reviews are addressed. Also, it is not 
clear if these financial reviews are being designed to identify 
misrepresentations and falsifications in the information furnished by 
organizations in order to impose sanctions, and CMS has not defined 
what it might consider to be a misrepresentation or falsification. As 
currently planned, CMS will not complete these financial reviews for 
contract year 2006 until sometime in 2008. Results might be available 
before CMS approves bids for contract year 2009 that must be submitted 
in June 2008. As we mentioned earlier, such an extended cycle for 
conducting reviews to meet the one-third requirement will affect CMS's 
ability to recommend and implement actions needed to address any 
identified deficiencies in bid processes in a timely manner. 

CMS Did Not Document Steps Taken to Mitigate Conflicts of Interest for 
Contractors That Audited Bids: 

As part of its contracting process for the audits of contract year 2006 
bids, CMS OACT officials said they took several steps to mitigate 
actual and potential conflicts of interests for the actuarial firms 
that completed the bid audits. For example, OACT officials considered 
whether the actuarial firms had acted as consultants in preparing bids 
or had other relationships with the organizations that they would be 
auditing. Information about organizations that the firms had prepared 
bids for, had other relationships with, or had reviewed their bids came 
from several sources, including the bid certifications, which identify 
the actuary that certified each bid submission. OACT officials also 
said that they asked the firms to self-report conflicts of interest at 
two phases in their process: (1) as part of the request for proposal, 
when firms were bidding for the audit contracts, and (2) after 
contracts were awarded, when firms were asked to respond to a list of 
organizations that that they were assigned to audit. CMS required that 
as part of the request for proposal, the firms include a listing of 
organizations for which the firms had a conflict of interest, including 
organizations for which the firm had prepared bids or had another non- 
Medicare relationship within the prior 12 months. After contracts were 
awarded to the six actuarial firms, OACT officials said that they 
obtained information from the firms regarding conflicts that they used 
to make audit reassignments. OACT maintains information to identify the 
actuary that performed the bid reviews in the HPMS database. 

OACT officials did not have documentation to support the statement that 
they took steps to avoid assigning actuarial firms to audit the same 
bids that the firms had prepared. However, we used the bid 
certifications and audit reports to confirm whether the actuarial firms 
had audited bids that the firms had also acted as a consultant in 
preparing. We compared the names of the actuaries on the bid 
certifications and their organizational affiliations and the names of 
the actuaries that provided audit opinions and their organizational 
affiliations as identified in the audit reports for the 80 
organizations that were audited in contract year 2006. We found no 
instances where the bid preparer and the bid auditor were the same 
individuals or companies. 

To confirm whether the actuarial firms audited bids for organizations 
with which the firms reported having a relationship, we obtained and 
reviewed the self-reported conflict of interest information submitted 
in response to the request for proposal by five of the six actuarial 
firms. OACT did not have the information for the other firm. We also 
requested the conflict of interest information that OACT said it 
obtained from the firms to make audit reassignments. However, OACT 
could not provide this information because it said it collected this 
information through an informal process and did not have documentation 
supporting the information it obtained. Using the available conflict of 
interest information, we found no instances where the five actuarial 
firms audited a bid when it reported having a relationship. 

Finally, OACT officials did not have documentation to support the steps 
they took to avoid assigning actuarial firms to audit the same bids 
that the firms had reviewed. Four of the six actuarial firms that 
performed the contract year 2006 bid audits also reviewed bids as part 
of CMS's bid review process. We were not able to confirm the steps OACT 
officials said they took because the information was not available by 
the end of our field work in June 2007. 

Conclusions: 

When CMS falls short in meeting the statutory audit requirement and in 
a timely manner resolving the findings arising from those audits, the 
intended oversight is not achieved and opportunities to determine if 
organizations have reasonably estimated the costs to provide benefits 
to Medicare enrollees are lost. Inaction or untimely audit resolution 
also undermines the presumed deterrent effect of audit efforts. 

CMS will continue to invest resources in its current bid audits and its 
planned reviews of the financial records of MA organizations and 
prescription drug plans that will likely have limited value in 
improving the programs if it does not implement a structured process 
for following up with organizations to make sure that they address 
deficiencies identified from the audits before approving subsequent 
year bids. The current bid audits provide CMS with information in a 
timely manner to address identified deficiencies. These bid audits 
identify how beneficiaries are adversely affected by errors, incorrect 
or unreasonable assumptions, or other misstatements in the information 
furnished to CMS and indicate how funds due to the Treasury are 
affected. 

While the statutory audit requirement does not expressly state the 
objective of the audits or how CMS should address the results of the 
audits, the statute does not preclude CMS from including terms in its 
contracts that allow it to pursue financial recoveries based on audit 
results. If CMS maintains the view that statute does not allow it to 
take certain actions, the utility of CMS's efforts is questionable. 
Further, if CMS cannot provide assurance that the firms performing the 
audits are free from potential or actual conflicts of interest, the 
integrity of the audit process is also threatened. 

Recommendations for Executive Action: 

To help fulfill CMS's responsibilities, we recommend that the 
Administrator of CMS take the following five actions: 

* Finalize a decision and establish implementing procedures on how the 
prior ACRP audit results will be addressed and closed. 

* Finalize an approach for meeting the one-third audit requirement for 
contract year 2006 and subsequent years. This approach should clearly 
address: 

- the procedures for annually identifying the organizations whose bid 
submissions and supporting financial records will be audited as part of 
the current OACT bid audits and those that will be reviewed as part of 
the planned financial reviews, 

- the supporting documentation that must be retained to show that the 
audit requirement was met, and: 

- the procedures for conducting planned financial reviews that clearly 
identify how the reviews will provide results in a timely manner and 
how the reviews will be designed to identify misrepresentations and 
falsifications in the information furnished under the program. 

* Amend the implementing regulations for the Medicare Advantage Program 
and Prescription Drug Program to provide that all contracts CMS enters 
into with Medicare Advantage organizations and prescription drug plan 
sponsors include terms that inform these organizations of the audits 
and give CMS authority to address identified deficiencies, including 
pursuit of financial recoveries. If CMS does not believe it has the 
authority to amend its implementing regulations for these purposes, it 
should ask Congress for express authority to do so. 

* Develop, as part of its approach for meeting the one-third audit 
requirement, additional procedures for following up on results of the 
OACT bid audits and results of the financial reviews. These procedures 
should clearly address: 

- how CMS will annually ensure that findings and observations from the 
bid audits are addressed before the next year's bids are approved, 

- how CMS will annually ensure that findings from the financial reviews 
are addressed before the subsequent year's bids are approved, 

- the supporting documentation that must be retained to show that the 
findings and observations from bid audits and findings from the 
financial reviews were addressed, and: 

- how CMS reviews audit findings to determine if intermediate sanctions 
are warranted. 

* Develop procedures to formalize the reviews and supporting 
documentation that must be retained to show that conflicts of interest 
arising from individuals or firms preparing, reviewing, or auditing the 
same bid have been addressed. 

Agency Comments and Our Evaluation: 

We received written comments on a draft of this report from CMS, which 
are reprinted in appendix V. CMS concurred with our recommendations and 
stated that it is in the process of implementing some of them. 
Specifically, CMS concurred with our recommendation to finalize an 
approach for meeting the one-third audit requirement that includes 
procedures for identifying and documenting the organizations that will 
be audited annually. CMS also commented it has modified and documented 
its procedures for selecting the MA organizations and Medicare 
prescription drug plans for audit and begun documenting standard 
operating procedures for the financial audit process (including 
procedures for contracting with audit firms, selecting the MA 
organizations and prescription drug plans for audit, and addressing 
audit findings.) 

CMS provided additional comments on several issues we reported on, 
including financial recoveries based on the bid audit and the 
timeliness of its planned audit process. Specifically, CMS noted that 
the ability to obtain financial recoveries based on the bid audits is 
extremely complicated and can result in future payments by CMS rather 
than reimbursements by the plans. We believe that these are issues CMS 
should address as it takes steps to amend its contractual rights with 
MA organizations and prescription drug plans. CMS also noted that we 
did not explain why the audit process can take up to 3 years to be 
completed. CMS stated that the normal cycle for a contract year is over 
2 years, followed by an additional 6 months for plans to submit data 
for reconciliation. We revised our report to acknowledge that CMS's 
financial reviews depend on data that is not required to be submitted 
until 6 months after the end of the contract year. However, the point 
remains that CMS's decision to develop an audit approach based solely 
on testing financial records that are not available until 6 months 
after the contract year and must be reconciled before testing can 
begin, will result in a 3-year cycle to complete reviews that will 
affect its ability to recommend and implement any actions needed to 
address identified audit deficiencies in a timely manner. 

We are sending copies of this report to interested congressional 
committees, the Secretary of Health and Human Services, the Acting 
Administrator of CMS, the Inspector General of HHS, and other 
interested parties. We will also make copies available to others upon 
request. In addition, this report will be available at no charge on 
GAO's Web site at [hyperlink, http://www.gao.gov]. Should you or your 
staff have any questions about this report, please contact Jeffrey 
Steinhoff at (202) 512-2600 or by e-mail at steinhoffj@gao.gov, or 
Kimberly Brooks, Assistant Director, at (202) 512-9038 or by e-mail at 
brooksk@gao.gov. Contact points for our Offices of Congressional 
Relations and Public Affairs can be found on the last page of this 
report. GAO staff who made major contributions to this report are 
listed in appendix VI. 

Signed by:

Jeffrey C. Steinhoff:
Managing Director: 
Financial Management and Assurance: 

[End of section] 

Appendix I: Scope and Methodology: 

To determine whether the Centers for Medicare & Medicaid Services (CMS) 
met the requirement for auditing Adjusted Community Rates (ACRs) for 
one-third of the Medicare Advantage (MA) organizations for contract 
years 2001 through 2005 and one-third of the bid submissions for 
contract year 2006, we first requested the criteria and analysis from 
CMS to show how it met the requirement. However, because CMS did not 
prepare or retain this information, we instead obtained from CMS a 
compilation of organizations that were audited for contract years 2001 
through 2006. We also obtained from CMS's Health Plan Management System 
(HPMS) a population of organizations and plans for which CMS had 
approved contracts to participate in the Medicare Advantage and Part D 
programs for contract years 2001-2006. 

To obtain reasonable assurance with respect to the completeness of 
CMS's compilation of audited organizations, we compared the 
organizations listed in CMS's compilation to lists of organizations 
assigned to each auditor that were contained in the contract files at 
CMS for contract years 2002 through 2005, where available. Because all 
of the contract files were not provided to us, we also compared the 
compilation to the audit reports we obtained from CMS.[Footnote 49] 

CMS provided us with a data extract from HPMS in an Excel spreadsheet. 
We took several steps to assess the reliability of the HPMS data 
provided by CMS, although we were not able to independently verify the 
completeness of the population files. To assess the reliability of the 
HPMS data provided by CMS, we tested specific data elements for 
reasonableness (e.g., contract year, contract identifier, and plan 
identifier). Our tests resulted in no exceptions. We also made 
inquiries with CMS officials to confirm the source of the data. We 
compared the contract numbers of organizations that were audited with 
contract numbers in the population files to determine if the audited 
organizations were included in the population. We found several audited 
organizations that were not included in the population files CMS 
originally sent us of organizations participating in the Medicare 
Advantage program for contract years 2001 through 2005. We communicated 
these differences to CMS and it responded by sending us new population 
files that included the MA organizations we identified plus additional 
MA organizations. CMS did not explain the increase in the number of MA 
organizations in the revised population files. On the basis of the 
revised population number, we performed an analysis comparing the 
number of organizations and plans audited as a percentage of 
organizations and plans that CMS approved to determine if CMS had met 
the requirement to audit one-third of participating organizations. On 
the basis of the collective information and interviews with CMS 
officials, we determined these data were adequate for assessing whether 
CMS had met the one-third auditing requirement. 

To determine whether information provided by the ACR audit process was 
sufficient for CMS to assess potential impacts on beneficiaries and 
address those impacts, we obtained and reviewed the following 
documents: 

* audit reports for contract years 2001 through 2004, 

* reports prepared by the contractor that reviewed and analyzed the 
2003 audit results, 

* CMS's analysis of the work performed by the contractor that reviewed 
and analyzed the 2003 audit results, 

* Statements of work from the contracts awarded to the firms to audit 
the ACRs, and: 

* CMS's instructions to the auditors (called Uniform Examination 
Program). 

To assess the reliability of the audit reports, we used guidance in 
GAO's Financial Audit Manual Section 650, Using the Work of Others, 
which focused on assessing the auditors' independence, objectivity, and 
qualifications. We reviewed contract files at CMS for the firms awarded 
contracts to audit ACRs. Specifically, in the contract files, we 
reviewed representations as to the firms' independence and objectivity 
that the firms submitted in response to CMS's requests for proposal and 
evaluations of the firms by technical evaluation panels. 

We also interviewed CMS staff and officials about (1) the audit 
process, (2) CMS's review of the reviewing contractor's analysis of 
2003 audit results, and (3) actions planned by CMS to address the audit 
findings. 

To determine how CMS conducted bid audits, what information the bid 
audit process provided CMS, and how CMS used that information, we 
obtained and reviewed related documentation including: 

* CMS's instructions and guidance for preparing bids for 2006 and 2007, 

* CMS's instructions and guidance for bid reviewers for 2006 and 2007, 

* CMS's instructions and guidance for bid auditors for 2006, 

* bid audit reports for contract year 2006, 

* certifications by actuaries that helped MA organizations prepare 
their bids, and: 

* draft agreed-upon procedures for the financial audit of MA 
organizations and prescription drug plans. 

We discussed with Office of Actuary (OACT) officials and five of the 
six bid auditors (for the 2006 bids) their roles and views of the bid 
audit process. To identify the information the bid audit process 
provided CMS, we reviewed the bid audit reports and summarized the 
nature and number of findings and observations identified by the bid 
auditors. 

We performed some limited testing to identify whether potential 
conflicts of interest existed among actuaries who helped organizations 
and plan sponsors prepare bids and those actuaries who audited the 
bids. Using (1) the bid certifications, which identified the actuaries 
and organizations that helped organizations prepare their bids; (2) 
self-reported conflicts of interest, which were transmitted to CMS with 
the responses to the request for proposal offers; and (3) bid audit 
reports, which identified the lead actuary performing the bid audit, we 
identified which particular actuaries (firms and individuals) helped 
prepare and audit bids. We compared the information on bid preparers to 
information on bid auditors to determine whether the actuarial 
consultants who assisted organizations in preparing their bids had also 
audited the same bids, which would create a conflict of interest. Our 
tests resulted in no exceptions. 

We interviewed CMS staff and officials from CMS's Center for 
Beneficiary Choices (CBC), Office of the Actuary (OACT), and Office of 
Financial Management (OFM) about the bid review and audit processes and 
discussed actions planned to address the bid audit findings. We also 
discussed actions CMS planned to take to fulfill the requirement for 
auditing bid submissions for contract year 2006 and beyond. In 
particular, we discussed OFM's plans for testing solvency, direct 
medical and administrative costs, risk scores, related party 
transactions, and other related testing for MA organizations and 
prescription drug plans. 

To assess the reliability of the bid audit reports, we used guidance in 
GAO's Financial Audit Manual Section 650, Using the Work of Others, 
which focused on assessing the auditors' independence, objectivity, and 
qualifications. We reviewed contract files at CMS for the firms awarded 
contracts to review bids and audit bids. Specifically, in the contract 
files, we reviewed representations as to the firms' independence and 
objectivity that the firms submitted in response to CMS's requests for 
proposal and evaluations of the firms by technical evaluation panels. 

We briefed officials from CMS on our findings and their implications. 
We requested written comments on a draft of this report from the 
Secretary of Health and Human Services or his designee on July 9, 2007. 
We received comments from CMS on July 19, 2007. We conducted our review 
from November 2006 to June 2007 in accordance with generally accepted 
government auditing standards. 

[End of section] 

Appendix II: Actuarial Standards Applicable to Bid Preparers: 

The Centers for Medicare & Medicaid Services requires an actuarial 
certification to accompany each bid. In preparing the actuarial 
certification, the actuary must consider whether the actuarial work 
supporting the bid conforms to Actuarial Standards of Practice (ASOP), 
as promulgated by the Actuarial Standards Board. While other ASOPs 
apply, CMS's instructions for the contract year 2006 bids placed 
particular emphasis on the following ASOPs. 

ASOP No. 5, Incurred Health and Disability Claims: 

* ASOP No. 5 provides guidance to actuaries preparing or reviewing 
financial reports, claims studies, rates, or other actuarial 
communications involving incurred claims within a valuation period 
under a health benefit plan. 

ASOP No. 8, Regulatory Filings for Rates and Financial Projections for 
Health Plans: 

(Particular focus is placed on the sections dealing with the 
Recognition of Benefit Plan Provisions, Consistency of Business Plan 
and Assumptions, Reasonableness of Assumptions, and Use of Past 
Experience to Project Future Results.) 

* This standard sets forth recommended practices for actuaries involved 
in the preparation or the review of actuarial memorandums or similar 
documents in connection with the filing of rates and financial 
projections for health plans. This standard applies to filings 
submitted to state insurance departments and other regulatory bodies 
for benefits provided by individual and group health plans and 
contracts and to filings made in conjunction with applications for 
licensure and rates for health maintenance organizations, hospitals, 
and medical service organizations. 

ASOP No. 16, Actuarial Practice Concerning Health Maintenance 
Organizations and Other Managed-Care Health Plans: 

* ASOP No. 16 sets forth recommended practices for actuaries dealing 
with health maintenance organizations (HMO) and other managed-care 
health plans (MCHP). This standard was intended to provide guidance on 
several important areas requiring special consideration for HMOs and 
other MCHPs. According to the Actuarial Standards Board, this standard 
was repealed for work performed on or after April 26, 2007, because 
much of the information in the standard was dated, and in general, it 
is believed that the guidance provided in the standard is covered, 
either explicitly or implicitly, in other ASOPs. 

ASOP No. 23, Data Quality: 

(Particular focus is placed on the sections dealing with Analysis of 
Issues and Recommended Practices and Communications and Disclosures.) 

* This ASOP gives guidance to the actuary in the areas of (1) selecting 
data that underlie the actuarial work product, (2) relying on data 
supplied by others, (3) reviewing data, (4) using data, and (5) making 
appropriate disclosures with regard to data quality. 

ASOP No. 25, Credibility Procedures Applicable to Accident and Health, 
Group Term Life, and Property/Casualty Coverage: 

* The purpose of this ASOP is to provide guidance to actuaries in the 
selection of a credibility procedure and the assignment of credibility 
values to sets of data including subject experience and related 
experience. Credibility procedures are an integral part of rate making 
and prospective experience rating, and may be used for other purposes. 
This standard of practice is applicable to accident and health, group 
term life, property/casualty coverage, and other forms of nonlife 
coverage. 

ASOP No. 31, Documentation in Health Benefit Plan Rate Making: 

* The purpose of this standard is to define the documentation 
responsibilities of an actuary in health benefit plan rate making. This 
standard does not apply to the establishment or documentation of 
prices, i.e., the amounts charged to the purchaser. Rather, it is 
limited to documentation related to the development of rates, i.e., the 
estimates of the expected value of future costs. This standard does not 
address other considerations that may affect price, such as marketing 
goals, competition, and legal restrictions. 

[End of section] 

Appendix III: Description of Bid Worksheets: 

Table 3: Description of the Medicare Advantage Bid Form Worksheets for 
MA Plans for Contract Year 2006: 

Worksheet: 1; 
Description: This worksheet summarizes the base period data and the key 
assumptions used to calculate the projected allowed costs for the MA 
plan. It also includes general plan information, base period background 
information, a summary of the base period data, and an illustration of 
the factors used to project the base period data to the contract 
period. 

Worksheet: 2; 
Description: This worksheet calculates the projected allowed costs for 
the contract year. For plans without fully credible experience, CMS 
requires plans to provide manual rate information. 

Worksheet: 3A/3B; 
Description: These worksheets summarize the expected MA cost sharing 
for the contract year. Worksheet 3A summarizes the plan's in-network 
cost sharing, such as copayments and coinsurance, whereas worksheet 3B 
summarizes the plan's out-of-network cost sharing. Further, the plans 
must provide plan-level deductible information, if applicable. The 
value of all cost sharing items must be reflected in the total per 
member per month amount. 

Worksheet: 4; 
Description: This worksheet uses the information from other worksheets 
to determine net medical costs. Nonmedical expenses and gain/loss 
margins are added to establish the required revenue for the contract 
year. Values are also allocated between Medicare-covered benefits and 
A/B Mandatory Supplemental Benefits. 

Worksheet: 5; 
Description: This worksheet calculates the A/B benchmark and evaluates 
whether the plan realizes a savings or needs to charge a basic member 
premium. Specifically, this worksheet outlines the development of the 
benchmarks and bids, outlines the development of the savings or basic 
member premium, blend of risk and demographic payment methodologies, 
and provides a summary of Statutory Component of Regional Benchmark and 
projected (plan-specific) information for counties within the service 
area. 

Worksheet: 6; 
Description: This worksheet contains the results of calculations from 
the bid forms. 

Worksheet: 7; 
Description: This worksheet contains the actuarial pricing elements for 
any optional supplemental benefit packages to be offered during the 
contract year. While supplemental benefits (either prescription drug or 
A/B) offered by the plan may be viewed as a single package of 
supplemental benefits, the two types of supplemental benefits are 
considered separately for bidding purposes. 

Source: CMS. 

[End of table] 

Table 4: Description of the Medicare Prescription Drug Plan Bid Form 
Worksheets for Medicare Advantage Plans for Contract Year 2006: 

Worksheet: 1; 
Description: Prescription Base-Period Experience--This worksheet should 
be completed for plans that have appropriate base- period experience 
for modeling the Part D benefit. The determination of the 
appropriateness of a plan's experience should include the evaluation of 
whether the group included in the experience is consistent with the 
group that the plan expects to cover. In addition, the experience 
should be representative of the benefits that will be offered in the 
contract period. Plans without appropriate base-period experience need 
to develop manual rates to be used in the pricing tool. Development of 
these manual rates should include the use of available data adjusted to 
reflect the expected population and the benefit design that will be 
offered. 

Worksheet: 2; 
Description: PDP Projection of Allowed/Non-Pharmacy-- This worksheet 
identifies the components of trend in the allowed prescription cost for 
covered Part D drugs and for nonpharmacy expenses between the base 
period and the contract period, and blends in manual rate information 
for plans that do not have fully credible base-period experience data. 

Worksheet: 3; 
Description: Contract Period Projection for Defined Standard Coverage--
This worksheet is used to develop the Defined Standard Bid Amount. All 
plans are required to fill out this worksheet. 

Worksheet: 4; 
Description: Standard Coverage with Actuarially Equivalent Cost 
Sharing--This worksheet is used only if the benefit plan being bid is 
for standard coverage with actuarially equivalent cost sharing. The two 
tests that must be met to demonstrate actuarial equivalence are: 

* The average coinsurance percentage for amounts between the deductible 
and the initial coverage limit must be actuarially equivalent to 25 
percent; 
* The average coinsurance percentage above the catastrophic 
limit must be actuarially equivalent to the percentage for defined 
standard coverage; The amount of the bid must be determined since the 
bid is based upon the cost of the proposed plan rather than the defined 
standard plan.

Worksheet: 5; 
Description: Alternative Coverage--This worksheet is used if the plan 
is offering alternative coverage. Basic alternative coverage would 
result in no supplemental premiums. The worksheet also calculates the 
supplemental premium for enhanced alternative coverage.

Worksheet: 6; 
Description: Script Projections for Defined Standard, Actuarially 
Equivalent or Alternative Coverage--This worksheet illustrates the 
underlying assumptions that are being used in the demonstration of the 
actuarial equivalence tests in Worksheets 4 and 5. The submitted data 
support an actuarial comparison of the proposed benefit to the defined 
standard benefit; it is not expected to be a detailed model of the cost 
sharing of the proposed plan design. All plans are required to develop 
projected utilization and costs for their proposed Defined Standard 
Benefit. In addition, plans submitting a bid for an actuarially 
equivalent or alternative benefit are required to report projected 
utilization and costs.

Source: CMS. 

[End of table] 

[End of section] 

Appendix IV: Other Reviews of Financial Records CMS Plans to Do to Meet 
Audit Requirement: 

Table 5: CMS's Planned Reviews of Medicare Advantage and Medicare Part 
D to Meet Audit Requirement: 

Review objectives: Solvency--consider organization's ability to bear 
the risk of potential financial losses; 
Medicare Advantage: Y; 
Part D: Y.

Review objectives: Risk Scores Review--assess self-reported diagnosis 
data; 
Medicare Advantage: Y; 
Part D: Y. 

Review objectives: Related Party Transactions--identify significant 
business transactions to identify related party transactions and to 
determine if the transactions were reported appropriately; 
Medicare Advantage: Y; 
Part D: Y. 

Review objectives: Direct Medical and Administrative Costs--evaluate 
organization's allocation of (1) expenses to Medicare and non-Medicare 
memberships and (2) administrative costs; 
Medicare Advantage: Y; 
Part D: Y. 

Review objectives: Part D Costs and Payments--review reconciliation 
methods of the four payment mechanisms for Part D: direct subsidy, low- 
income subsidy, reinsurance subsidy, and risk sharing; 
Medicare Advantage: [Empty]; 
Part D: Y. 

Review objectives: Direct/Indirect Remuneration--determine if amounts 
were reported appropriately and if allocation method is reasonable; 
Medicare Advantage: [Empty]; 
Part D: Y. 

Review objectives: True Out-of-Pocket Cost--verify that prescription 
drug plans are calculating true out-of-pocket costs accurately; 
Medicare Advantage: [Empty]; 
Part D: Y. 

Review objectives: Regional Preferred Provider Organizations (RPPO)-- 
assess risk-sharing computations, whether expenses and revenues are 
properly classified, and RPPO's compliance with its CMS contract; 
Medicare Advantage: Y; 
Part D: [Empty]. 

Source: CMS. 

[End of table]

[End of section] 

Appendix V: Comments from the Department of Health and Human Services:

Department of Health and Human Services:
Centers for Medicare & Medicaid Services:
Office of the Administrator:
Washington, DC 20201: 

Date: July 19, 2007

To: Jeffrey Steinhoff:
Managing Director, Financial Management and Assurance:
Government Accountability Office:

From: 
Signed by: 
Leslie V. Norwalk, Esq.
Acting Administrator:

Centers for Medicare & Medicaid Services:

Subject: Government Accountability Office (GAO) Draft Report: Medicare 
Advantage: Required Audits of Limited Value (GAO-07-945):

Thank you for the opportunity to review and comment on the above GAO 
Draft Report. The GAO's study focused on the annual audits of the 
Medicare Advantage organizations (MAOs) and provided the Centers for 
Medicare & Medicare Services (CMS) with recommendations to improve the 
auditing process. CMS appreciates the time and resources the GAO has 
invested in the study and is committed to improving the oversight of 
the MAOs. 

The CMS welcomes constructive suggestions for improving the audit 
process, and we are in the process of implementing some of the 
recommendations included in your report. For example, we have modified 
and documented our procedures for selecting the MAOs and Medicare 
prescription drug plans (PDPs) for financial audit. Also, we have begun 
documenting standard operating procedures that clearly describe the 
financial audit process. This document includes procedures for 
contracting with auditing firms, selecting the MAOs and PDPs for audit, 
and addressing audit findings. 

We believe you recognize there are key differences between the former 
adjusted community rate (ACR) audits and the planned financial audits 
beginning in plan year 2006. You noted that unlike the ACR audits, the 
financial audits include an analysis of actual costs and that 
identified findings may have a direct impact on payments to MAOs and 
PDPs. As a result, CMS can offset payments to the MAOs and PDPs based 
on the financial review findings. 

While the above listed remedies may be exercised for financial audit 
findings, the bid audit findings present a different scenario. The 
ability to obtain financial recoveries based on the bid audit is 
extremely complicated and can result in future payments by CMS rather 
than reimbursements by the plans. Additionally, changes to the bids 
based on the bid audit can have an adverse affect on the beneficiaries. 
(An example of this situation is when a beneficiary becomes caught-up 
in a plan that must reduce its benefits based on the bid audit 
findings.) 

Furthermore, it should be noted that the tools, instructions, and 
training programs for the 2007 bid audits were based on information 
collected from several sources, including the 2006 bid reviews, 2006 
bid audits, an industry survey, and updates to CMS guidance. 

Moreover, CMS believes GAO did not explain why the audit process can 
take up to 3 years to be completed. The normal cycle for a contract 
year is over 2 years. This is based on the initial bid period which 
occurs 6 months prior to the actual contract year beginning. This is 
followed by the actual contract year and an additional 6 months for the 
plan to submit its data for reconciliation. Final audits of those plans 
selected for audit is scheduled to begin within months of the final 
reconciliation. Therefore, CMS is confident that the 3-year period it 
has established to accept the bid, conduct the contract year, reconcile 
the data, and audit the reconciliation is consistent with this type of 
program. 

We address each of the report's "Recommendations for Executive Action" 
in the attached document. Also, we have included technical comments for 
your consideration. Centers for Medicare & Medicaid Services' (CMS) 
Comments to the Government Accountability Office's (GAO) Draft Report: 
Medicare Advantage: Required Audits of Limited Value (GAO-07-945) 

GAO Recommendation 1: Finalize a decision and establish implementing 
procedures on how the prior ACRP audit results will be addressed and 
closed. 

CMS Response: We concur with this recommendation. 

GAO Recommendation 2: Finalize an approach for meeting the one-third 
audit requirement for contract year 2006 and subsequent years. This 
approach should clearly address: • the procedures for annually 
identifying the organizations whose bid submissions and supporting 
financial records will be audited as part of the current OACT bid 
audits and those that will be reviewed as part of the planned financial 
reviews, • the supporting documentation that must be retained to show 
that the audit requirement was met; and • the procedures for conducting 
planned financial reviews that clearly identify how the reviews will 
provide results in a timely manner and how the reviews will be designed 
to identify misrepresentations and falsifications in the information 
furnished under the program. 

CMS Response: We concur with these recommendations. Our draft audit 
program was designed to meet the requirements of the one-third audits. 
We have begun testing the audit program and will make any necessary 
changes. 

GAO Recommendation 3: Amend the implementing regulations for the 
Medicare Advantage Program and Prescription Drug Program to provide 
that all contracts CMS enters into with Medicare Advantage 
organizations and Prescription Drug Plan sponsors include terms that 
inform these organizations of the audits and give CMS authority to 
address identified deficiencies, including pursuit of financial 
recoveries. If CMS does not believe it has the authority to amend its 
implementing regulations for these purposes, it should ask Congress for 
express authority to do so. 

CMS Response: We concur with this recommendation and will seek 
legislative authority, if necessary and it preserves the competitive 
nature of the bidding process. 

GAO Recommendation 4: Develop, as part of its approach for meeting the 
one-third audit requirement, additional procedures for following-up on 
results of the OACT bid audits and results of the financial reviews. 
These procedures should clearly address: 

• how CMS will annually ensure that findings and observations from the 
bid audits are addressed before the next year's bids are approved; 
• how CMS will annually ensure that findings from the financial reviews 
are addressed before subsequent years bids are approved; 
• the supporting documentation that must be retained to show that the 
findings and observations from bid audits and findings from the 
financial reviews were addressed; and 
* how CMS reviews audit findings to determine if intermediate sanctions 
are warranted. 

CMS Response: We agree with this recommendation. The 2007 bid audit 
results notification letters to the MAOs and PDPs state that the 2008 
contract year submissions must document how the findings of the audits 
were addressed in the subsequent bid submission. The 2008 bid review 
process includes a process for reviewing the prior year's audit 
findings for all bids that were audited in the prior year. We will 
maintain supporting documentation to show that the findings and 
observations were addressed. This will include proof of payments 
received from or paid to the MAOs and PDPs as a result of audit 
findings, etc. Also, CMS will develop a process for determining if 
intermediate sanctions are warranted. 

GAO Recommendation 5: Develop procedures to formalize the reviews and 
supporting documentation that must be retained to show that conflicts 
of interest arising from individuals or firms preparing, reviewing,or 
auditing the same bid have been addressed. 

CMS Response: We concur with this recommendation. Since the 2006 
contract year, the first year of bid audit. We have improved our 
documentation efforts since the 2006 contract year, the first year of 
bid audits, for clearing the conflict of interest concern, but 
maintaining a process that avoids any real or perceived conflicts of 
interest remains a top priority.

[End of section] 

Appendix VI: GAO Contacts and Staff Acknowledgments: 

GAO Contacts: 

Jeffrey Steinhoff, (202) 512-2600 or steinhoffj@gao.gov: 

Kimberly Brooks, (202) 512-9038 or brooksk@gao.gov: 

Acknowledgments: 

Staff members who made key contributions to this report include Robert 
Martin (Director), Kimberly Brooks (Assistant Director), Paul Caban 
(Assistant Director), Abe Dymond, Jason Kirwan, Tarunkant N. Mithani, 
and Diane Morris. 

[End of section] 

Related GAO Products: 

Department of Health and Human Services, Centers for Medicare & 
Medicaid Services: Medicare Program; Establishment of the Medicare 
Advantage Program. GAO-05-315R. Washington, D.C.: February 9, 2005. 

Medicare+Choice: Selected Program Requirements and Other Entities' 
Standards for HMOs. GAO-03-180. Washington, D.C.: October 31, 2002. 

Medicare+Choice: Recent Payment Increases Had Little Effect on Benefits 
or Plan Availability in 2001. GAO-02-202. Washington, D.C.: November 
21, 2001. 

Medicare+Choice Audits: Lack of Audit Follow-up Limits Usefulness. GAO- 
02-33. Washington, D.C.: October 9, 2001. 

Medicare: Program Designed to Inform Beneficiaries and Promote Choice 
Faces Challenges. GAO-01-1071. Washington, D.C.: September 28, 2001. 

Medicare+Choice: Oversight Lapses in HCFA's Review of Humana's 1998 
Florida Contract. GAO-01-176R. Washington, D.C.: November 27, 2000. 

Medicare+Choice: Plan Withdrawals Indicate Difficulty of Providing 
Choice While Achieving Savings. GAO/HEHS-00-183. Washington, D.C.: 
September 7, 2000. 

Medicare+Choice: Payments Exceed Cost of Fee-for-Service Benefits, 
Adding Billions to Spending. GAO/HEHS-00-161. Washington, D.C.: August 
23, 2000. 

FOOTNOTES 

[1] Total Medicare outlays in fiscal year 2006 were $381.9 billion. 

[2] Medicare Part B provides coverage for certain physician, outpatient 
hospital, laboratory, and other services to beneficiaries who pay 
monthly premiums. 

[3] Participating companies can offer multiple plans. The term "plan" 
refers to a specific package of benefits offered. 

[4] Pub. L. No. 108-173, 117 Stat. 2066 (Dec. 8, 2003). 

[5] Part D is the optional outpatient prescription drug benefit for 
Medicare established by MMA. 

[6] The formulary is a listing of prescription medications that are 
approved for use or coverage by the plan and that will be dispensed 
through participating pharmacies to covered enrollees. 

[7] Benchmarks are the maximum amount Medicare will pay a MA 
organization for delivering benefits in a specific geographic area. 
They are determined by the Secretary of Health and Human Services each 
year under a methodology provided in the Medicare law. 

[8] For prescription drug plans, CMS aggregates the bids for each plan 
to generate a single weighted national average monthly bid amount for 
Part D. If the standardized prescription bid exceeds the amount of the 
national average monthly bid, the plan can increase the base 
beneficiary premium by the difference. If the standardized prescription 
bid is below the amount of the national average monthly bid, the plan 
must decrease the base beneficiary premium by the difference. 

[9] For regional preferred provider organizations, 12.5 percent of the 
difference is retained by the Federal Treasury, and the remaining 12.5 
percent is directed to the MA Regional Plan Stabilization Fund. 

[10] Pub. L. No. 105-33, tit. IV, § 4001, 111 Stat. 251, 320 (Aug. 5, 
1997) (codified at 42 U.S.C. § 1395w-27(d)(1)). 

[11] GAO, Medicare+Choice Audits: Lack of Follow-up Limits Usefulness, 
GAO-02-33 (Washington, D.C.: Oct. 9, 2001). 

[12] CMS also contracted with a firm to review the 2004 ACR audits, but 
the work is not to be completed until August 31, 2007. 

[13] Findings also include any serious failure to follow applicable 
Actuarial Standards of Practice. Materiality for identifying 
observations included all other errors or deviations from the 
instructions or best actuarial practices that did not meet the criteria 
for being classified as findings. 

[14] Pub. L. No. 105-33, 111 Stat. 251 (Aug. 5, 1997). 

[15] See 42 U.S.C. § 1395w-27(d)(1). 

[16] Pub. L. No. 108-173, 117 Stat. 2066 (Dec. 8, 2003). 

[17] Throughout this report, we refer to organizations participating in 
the Medicare+Choice and MA programs as MA organizations. 

[18] A regional PPO is defined as an "MA regional plan" and MMA 
requires that each MA regional plan (1) have a network of providers 
that have agreed to a contractually specified reimbursement for covered 
benefits, (2) provide reimbursement for all covered services regardless 
of whether the benefits are provided by participating providers, and 
(3) cover the service area of at least one entire MA region. 

[19] HMOs are a type of managed care plan where a group of doctors, 
hospitals, and other health care providers agree to give health care to 
Medicare beneficiaries for a set amount of money every month. PPOs have 
comprehensive provider networks, but beneficiaries enrolled in PPOs may 
use out-of-network providers if they pay higher cost sharing. Private 
FFS plans pay qualified providers for each covered service delivered to 
its enrollees, and beneficiaries enrolled in FFS plans may go to any 
doctor or hospital they choose without a referral if the provider 
accepts the plan's payment terms. PSOs have a group of doctors, 
hospitals, and other health care providers that agree to give health 
care to Medicare beneficiaries for a set amount of money from Medicare 
every month. This type of managed care plan is run by the doctors and 
providers themselves, and not by an insurance company. 

[20] The bid form is a series of worksheets that contain actuarial 
estimates of plan cost and cost sharing for the contract year as well 
as computation of the benchmark, rebate, and basic member premium that 
is risk-adjusted based on the characteristics of individual plan 
enrollees. See appendix III for a further description of these 
worksheets. 

[21] For regional plans, organizations estimate regional plan 
benchmarks in their June bids until CMS determines the amount for the 
final regional benchmark and makes it available to the organizations in 
August. Then the organizations revise the benchmark amounts in their 
bids accordingly. 

[22] CMS does not have authority to review and negotiate medical 
savings accounts and private fee-for-service plans. 42 U.S.C. § 1395w- 
24(a)(5) and (a)(6)(B). 

[23] OACT is responsible for reviewing the bid forms. The audits that 
we discuss only relate to the bid forms. CBC's Division of Finance and 
Benefits is responsible for reviewing the MA plan benefit packages, and 
CBC's Division of Finance and Operations is responsible for reviewing 
the Part D formularies and prescription drug plan benefit packages. 

[24] The bid auditors held exit conferences or issued preliminary 
drafts for 45 of the 52 audit reports they issued by April 2006 and 
issued 34 final reports by August 2006. 

[25] 42 U.S.C. § 1395w-27(d)(1). Prior to contract year 2006, this 
audit was required to include the "computation of the adjusted 
community rate." Pub. L. No. 105-33, tit. IV, § 4001, 111 Stat. 251, 
320 (Aug. 5, 1997). 

[26] An MA organization is a public or private entity organized and 
licensed by a state that is certified by CMS as meeting the MA contract 
requirements. 

[27] MA organizations and the contracts that establish them are 
identified by four-digit contract numbers. The contract number and plan 
identifier jointly provide a unique identifier for each plan and 
identify each ACRP or bid submitted. Several plans may be offered by a 
MA organization in the same geographic area. For example, a high-option 
plan including a drug benefit and a low-option plan without a drug 
benefit may be offered by the same MA organization. 

[28] The audit reports for contract year 2005 were not available for 
our review, so we used a list of audits provided by CMS. 

[29] The 80 organizations audited for contract year 2006 included 60 MA 
organizations with prescription drug plans and 20 prescription drug 
plans. 

[30] True out-of-pocket costs are amounts paid by the enrollee or on 
behalf of the enrollee for covered Part D drugs that count toward the 
out-of-pocket limit that must be reached before the catastrophic 
benefit becomes available. 

[31] CMS will reconcile Part D prospective payments made to the 
organizations based on the approved bids to actual costs incurred by 
the organizations to provide year-end adjustments to the organizations 
resulting in payments or recoveries for each contract. The 
reconciliations are for low-income cost sharing, reinsurance payments 
to cover drug costs above the catastrophic threshold, and risk corridor 
payments for cost sharing between Medicare and the MA organizations 
within specified thresholds or corridors surrounding a drug-spending 
target. 

[32] CMS has developed a Risk-sharing Reconciliation Cost report that 
regional PPOs are to submit annually. CMS plans to use the report to 
collect allowable cost data and compare these data to target amounts. 
If the comparison demonstrates that the regional PPO incurred either 
savings or losses in the contract year, the regulations provide 
specific risk corridors for CMS to use in determining the risk-sharing 
reconciliation amount due to either the MA organization or CMS. For MA 
regional plans for 2006 and 2007, MMA expressly authorizes payment 
adjustments to reflect higher or lower allowable costs than estimated. 
See 42 U.S.C. § 1395w-27(a). 

[33] GAO-02-33, p. 20. 

[34] 42 U.S.C. § 1395w-27(e)(1) provides authority for CMS to include 
additional terms and conditions in MA contracts. See 42 C.F.R. § 
422.504(j). 

[35] GAO-02-33. 

[36] As discussed earlier, the audit reports for contract year 2005 
were not available for our review. 

[37] The CBC officials told us no further action was necessary for the 
2001 and 2002 audits. 

[38] 42 U.S.C. § 1395w-27(c)(5) provides authority for this 
determination. HHS legal counsel also told us that the common law of 
contracts does not apply to MA contracts. 

[39] 42 U.S.C. § 1395w-27(e)(1) provides authority for CMS to include 
additional terms and conditions in MA contracts. See 42 C.F.R. § 
422.504(j). 

[40] Authority to impose intermediate sanctions is provided under 42 
U.S.C. § 1395w-27(g). 

[41] 42 U.S.C. § 1395w-27(g)(2). Other intermediate sanctions vary 
depending upon the actual basis determined by CMS. 

[42] GAO-02-33. 

[43] Past legislation has provided for increased payments to MA 
organizations. The Medicare, Medicaid, and SCHIP Benefits Improvement 
Act of 2000 (BIPA) (Pub. L. No. 106-554, app. F, 114 Stat. 2763, 2763A- 
463 (Dec. 21, 2000)) provided for increased payments to MA 
organizations effective March 1, 2001, and required MA organizations 
with plans that received increased payments to submit revised ACRPs to 
show how they would use the increase during contract year 2001. 
Similarly, MMA provided for increased payments effective March 1, 2004, 
to MA organizations and required them to submit revised ACRPs showing 
how they would use the increased payments in contract year 2004. Both 
BIPA and MMA required MA organizations to use the increased payments to 
reduce beneficiary premiums and cost sharing, enhance benefits, 
contribute to a benefit stabilization fund, or stabilize or enhance 
beneficiary access to providers. 

[44] Five of the six OIG audits that contained recommendations related 
to 2001 ACRPs. The other OIG report related to a 2004 ACRP. 

[45] Findings also include any serious failure to follow applicable 
ASOPs. Materiality for identifying observations included all other 
errors or deviations from the instructions or best actuarial practices 
that did not meet the criteria for being classified as findings. 

[46] CMS uses actuaries to review all the bid forms received and assess 
the assumptions and methods supporting the bid elements and their 
reasonableness to support the overall bid prior to awarding contracts 
to the bid sponsors. After the bid contracts are awarded, CMS does a 
more detailed audit of a selection of bids to determine if the bid was 
developed according to CMS's bid preparation instructions and 
designated actuarial standards of practice. 

[47] CMS officials also stated that material findings include changes 
that, if corrected, could increase payments and result in additional or 
lesser benefits and reduced or increased enrollee premiums or 
copayments. As such, material audit findings may either increase or 
decrease bid amounts. 

[48] 42 U.S.C. § 1395w-27(e)(1); 42 C.F.R. § 422.504(j). This provision 
also applies to prescription drug plans under Part D. 42 U.S.C. § 1395w-
112(b)(3)(D). 

[49] CMS could not locate the contract files for our review for (1) the 
four firms awarded contracts to audit MA organizations for 2001, (2) 
three firms awarded contracts for 2002, and (3) two of the nine firms 
awarded contracts for 2004. The CY 2006 contract files did not contain 
a list of organizations assigned to each auditor. 

GAO's Mission: 

The Government Accountability Office, the audit, evaluation and 
investigative arm of Congress, exists to support Congress in meeting 
its constitutional responsibilities and to help improve the performance 
and accountability of the federal government for the American people. 
GAO examines the use of public funds; evaluates federal programs and 
policies; and provides analyses, recommendations, and other assistance 
to help Congress make informed oversight, policy, and funding 
decisions. GAO's commitment to good government is reflected in its core 
values of accountability, integrity, and reliability. 

Obtaining Copies of GAO Reports and Testimony: 

The fastest and easiest way to obtain copies of GAO documents at no 
cost is through GAO's Web site [hyperlink, http://www.gao.gov]. Each 
weekday, GAO posts newly released reports, testimony, and 
correspondence on its Web site. To have GAO e-mail you a list of newly 
posted products every afternoon, go to [hyperlink, http://www.gao.gov] 
and select "Subscribe to Updates." 

Order by Mail or Phone: 

The first copy of each printed report is free. Additional copies are $2 
each. A check or money order should be made out to the Superintendent 
of Documents. GAO also accepts VISA and Mastercard. Orders for 100 or 
more copies mailed to a single address are discounted 25 percent. 
Orders should be sent to: 

U.S. Government Accountability Office 441 G Street NW, Room LM 
Washington, D.C. 20548: 

To order by Phone: Voice: (202) 512-6000 TDD: (202) 512-2537 Fax: (202) 
512-6061: 

To Report Fraud, Waste, and Abuse in Federal Programs: 

Contact: 

Web site: [hyperlink, http://www.gao.gov/fraudnet/fraudnet.htm]: 

E-mail: fraudnet@gao.gov: 

Automated answering system: (800) 424-5454 or (202) 512-7470: 

Congressional Relations: 

Gloria Jarmon, Managing Director, JarmonG@gao.gov (202) 512-4400: 

U.S. Government Accountability Office, 441 G Street NW, Room 7125 
Washington, D.C. 20548: 

Public Affairs: 

Paul Anderson, Managing Director, AndersonP1@gao.gov (202) 512-4800: 

U.S. Government Accountability Office, 441 G Street NW, Room 7149 
Washington, D.C. 20548: