	CMS Had Not Implemented a Risk- Based Approach in Reviewing Expenditures

Our review found that CMS had only recently begun to assess areas at greatest risk for improper payments. As a result, controls were not in place that focused on the highest risk areas and resources had not yet been deployed to areas of greatest risk. Since 1998, financial auditors responsible for the annual financial statement audit of Medicaid expenditures have noted that CMS failed to institute an oversight process that effectively reduced the risk of inappropriate Medicaid claims and payments. Regarding the auditor’s findings and recommendations, CMS officials attributed most of the weaknesses in its oversight to reductions in staff at the same time Medicaid expenditures and oversight responsibilities increased. CMS could gain valuable information for more accurately assessing the level of risk for improper payments in these 16 states as well as the appropriate level of federal oversight required. In fiscal year 2000, using neural networking, the Texas’ Medicaid Fraud and Abuse Detection System recovered $3.4 million. Within CMS, three units share responsibility for audit resolution activities related to the Medicaid program. This information is key to establishing a sound internal control environment for Medicaid finances throughout CMS.
What GAO Found

The Medicaid program served 33.4 million low-income families as well as elderly, blind, and disabled persons at a cost of $119 billion to the federal government and $88 billion to the states in fiscal year 2000. States are responsible for safeguarding Medicaid funds by making proper payments to providers, recovering misspent funds, and accurately reporting costs for federal reimbursement. At the federal level, the Centers for Medicare and Medicaid Services (CMS) is responsible for overseeing state financial activities and ensuring the propriety of expenditures reported for federal reimbursement. Audits of state Medicaid finances have identified millions of dollars of questionable or unallowable costs. In addition, annual financial statement audits have identified many internal control weaknesses in CMS oversight of state Medicaid operations. CMS has only recently begun to assess areas at greatest risk for improper payments. As a result, controls that focus on the highest risk areas and resources had not yet been deployed for areas of greatest risk. Since 1998, auditors have noted that CMS failed to institute an oversight process that effectively reduced the risk of inappropriate medical claims and payments. CMS attributed most of the weaknesses in its oversight to staff reductions at the same time Medicaid expenditures and oversight responsibilities have increased.