Medicaid Program Integrity: Opportunities Exist for CMS to Strengthen Use of State Auditor Findings and Collaboration
Fast Facts
States and the federal government work together to fund Medicaid and protect it from payment errors and fraud.
State auditors provide independent reviews of their state's compliance with federal funding requirements and other program rules. Their findings reveal problems such as ineligible beneficiaries and errors in state spending. Federal Medicaid officials started using these findings and collaborating with state auditors to improve the program, but they could do more.
For example, federal Medicaid officials are now using state auditors' findings to identify national trends; we recommended using them to inform further oversight activities.
Highlights
What GAO Found
State auditors play an important role in Medicaid oversight, such as conducting states' annual single audits: audits required of entities that expend $750,000 or more in federal funding in a fiscal year. From fiscal years 2019 through 2021, state auditors identified an average of over 300 Medicaid audit findings a year, including overpayments for services provided to beneficiaries and payments to providers not enrolled in Medicaid. The Centers for Medicare & Medicaid Services (CMS) monitors states' progress toward resolving these findings. GAO found nearly 60 percent of Medicaid single audit findings were repeated from the prior year, indicating incomplete or ineffective corrective actions.
Repeat Status of 923 Single Audit Medicaid Findings, Fiscal Years 2019-2021
State auditors faced challenges conducting Medicaid audits. For example, auditors from four selected states told GAO they faced resource challenges, such as a lack of training. Auditors from all selected states described challenges obtaining information from CMS or their state Medicaid agency necessary to conduct audits, such as information on program risks. CMS and other federal agencies have recently begun to address some of these challenges.
CMS has also used state auditor findings to inform some of its oversight activities, such as to identify states or topics for review. In January 2021, CMS started analyzing single audit findings to identify national trends. CMS also restarted efforts to collaborate with state auditors, which had paused due to the COVID-19 pandemic. Efforts include working together to identify updates to the Compliance Supplement, which serves as a guide for conducting the single audit.
These recent efforts are promising and consistent with CMS's pledge to collaborate with state auditors to improve Medicaid. However, CMS has an opportunity to strengthen these efforts. For example, CMS has not used its new analysis of national trends to inform its oversight, or shared results with state auditors. Enhanced collaboration with state auditors, such as continuing to work together each year to identify potential Compliance Supplement updates and sharing information on audit trends and CMS's activities to follow up on findings, could help target oversight to areas of greatest risk for noncompliance and improper payments, and fill gaps in program oversight.
Why GAO Did This Study
The size and growth of Medicaid present challenges for both the federal government and states, which share program oversight responsibilities. GAO has identified gaps in CMS's Medicaid oversight. GAO has also reported that CMS could use the work of state auditors, who are independent from their states' Medicaid programs, to help address those gaps.
GAO was asked to examine CMS and state auditor coordination. This report describes state auditors' Medicaid findings and the challenges they face auditing Medicaid. It also examines CMS's use of state auditors' findings and collaboration with auditors. GAO analyzed data on Medicaid single audit findings for fiscal years 2019 through 2021, which was the most recent data available. GAO also reviewed CMS documents and state auditor reports. In addition, GAO interviewed CMS officials and state auditors from seven selected states.
Recommendations
GAO is making two recommendations to CMS. CMS should (1) use analysis of trends in state auditor findings to inform its oversight; and (2) strengthen its collaboration with state auditors; for example, by sharing information on those trends and the status of actions to address audit findings, and continuing to identify Compliance Supplement updates. The agency said it believes it has already implemented the first recommendation and suggested removing it. GAO maintains that the recommendation is still valid because CMS has not yet used its analysis of trends to inform its oversight. The agency concurred with the second recommendation.
Recommendations for Executive Action
| Agency Affected | Recommendation | Status |
|---|---|---|
| Centers for Medicare & Medicaid Services | The Administrator of CMS should annually examine state auditors' Medicaid findings to identify trends across states and use this information to inform oversight activities and audit processes. (Recommendation 1) |
As of June 2024, CMS has taken some steps to address this recommendation. For example, CMS provided us with example analyses of state auditor findings completed in 2021, 2023, and 2024 to identify audit trends across states, such as the number of single audit findings by compliance area and by year. Further, CMS described how it has used state auditor findings to update the Medicaid section of the Single Audit Compliance Supplement, including developing a toolkit for its subject matter experts when reviewing and updating the compliance supplement. To fully implement this recommendation, CMS should demonstrate a pattern of analysis and identification of trends in state auditor findings over multiple years since we issued our report in 2023. Further, CMS should use that analysis and the trends it identifies to inform the agency's oversight activities, such as to identify best practices or approaches for addressing recurring and emerging audit trends. We will continue to monitor CMS's activities to address this recommendation.
|
| Centers for Medicare & Medicaid Services | The Administrator of CMS should build on the agency's efforts to collaborate with state auditors on Medicaid oversight activities. These collaboration efforts should include continuing to identify potential updates to the Compliance Supplement, having regular discussions to address auditor training needs, annually sharing information on trends in audit findings and program risks, and increasing auditor awareness of actions taken to address single audit findings. (Recommendation 2) |
As of June 2024, CMS has taken some steps to address this recommendation. For example, CMS has continued to participate in the Compliance Supplement Working Group. Through this working group, CMS has continued to collaborate with state auditors to identify updates to the Medicaid section of the Compliance Supplement, provided some training-related information to auditors, and shared some information on audit trends and program risks with state auditors. To fully address this recommendation, CMS should have regular discussions with state auditors about their training needs, which could involve including training needs on Compliance Supplement Working Group agendas. CMS should also demonstrate a pattern of sharing information on audit trends and program risks over multiple years since we issued our report in September 2023. Further, CMS should take steps to increase state auditor awareness on agency actions to address single audit findings, such as following-up on initial discussions with state auditors on sharing management decision letters. We will continue to monitor CMS's activities to address this recommendation.
|