Pervasive Deficiencies in Control Procedures at the Contract Level Increase the Risk of Improper Payments or Waste

We found pervasive deficiencies in internal control over contracting and  payments to contractors. These deficiencies were  due in part to a lack of agency-specific policies and procedures to ensure  that FAR requirements and other control objectives were met. These internal control  deficiencies are a manifestation of CMS’s weak overall control  environment, which is discussed later. As a result of our work, we estimate that at least 84.3 percent of FAR- based contract actions made by CMS in fiscal year 2008 contained at least  one instance in which a key control was not adequately implemented. We also estimate  that at least 37.2 percent of FAR-based contract actions made in fiscal  year 2008 had three or more instances in which a key control was not  adequately implemented. We estimate that for at least 59.0 percent of fiscal year 2008  contract actions, the project officer did not always certify the  invoices. CMS’s control environment is  characterized by the lack of strategic planning to identify necessary  staffing and funding, a lack of reliable data for effectively carrying out  contract management responsibilities, very limited actions taken on the  recommendations we made in 2007 related to contracting and payments to  contractors, and a lack of procedures for managing contract audits which  are essential to managing and overseeing the growing value of contracting  activities. Without accurate data, CMS  program managers do not have adequate information to identify and  monitor areas that pose a high risk of improper payments or waste. Roles and responsibilities for implementation of CFA  responsibilities not clearly defined. In 2007,  we reported that CMS did not timely perform contract closeout  procedures resulting in a backlog of 1,300 contracts, of which 407  were overdue for closeout as of September 30, 2007. The continuing weaknesses in contracting activities and limited progress  in addressing known deficiencies raise questions concerning whether CMS  management has established an appropriate “tone at the top” regarding  contracting activities. It is imperative that CMS take immediate action to  address its serious contract-level control deficiencies and take action on  our previous recommendations to improve contract-level and overall  environment controls or CMS will continue to place billions of taxpayer  dollars at risk of fraud, or otherwise improper contract payments. Appendix I: Scope and Methodology

To determine the extent to which the Centers for Medicare and Medicaid  Services (CMS) implemented effective internal control procedures over  contract actions, we focused on contracts that were generally subjected to  the Federal Acquisition Regulation. We  selected 11 internal controls over contracting and payments to contractors  to test for this report, ranging from ensuring contractors had adequate  accounting systems prior to the use of a cost reimbursement contract to  certifying invoices for payment. 2.
Why GAO Did This Study

As a result of internal control deficiencies discussed in GAO's 2007 report on certain contracts at the Centers for Medicare and Medicaid Services (CMS), GAO was asked to identify the extent to which CMS (1) implemented effective control procedures over contract actions, and (2) established a strong control environment for contract management. GAO used a statistical random sample of 2008 CMS contract actions (including contract awards and modifications) to assess CMS internal control procedures. The results were projected to the population of 2008 CMS contract actions. GAO also determined the extent to which CMS implemented recommendations GAO made in 2007 to improve internal control over contracting and payments to contractors. GAO reviewed contract file documentation and interviewed senior acquisition management officials.

What GAO Found

Pervasive deficiencies in CMS contract management internal controlincrease the risk of improper payments or waste. Specifically, based on our statistical random sample of 2008 CMS contract actions, GAO estimates that at least 84.3 percent of fiscal year 2008 contract actions contained at least one instance where a key control was not adequately implemented. GAO also estimates that at least 37.2 percent of fiscal year 2008 contract actions had three or more instances in which a key control was not adequately implemented. The contract actions GAO evaluated were generally subject to the Federal Acquisition Regulation. For example, CMS used cost reimbursement contracts without first ensuring that the contractor had an adequate accounting system. Also, project officers did not always certify invoices for payment. These deficiencies were due in part to a lack of agency-specific policies and procedures to help ensure proper contracting expenditures. These control deficiencies also stem from a weak overall control environment as characterized primarily by inadequate strategic planning for staffing and funding resources. CMS also did not accurately capture data on the nature and extent of its contracting, which hinders CMS's ability to manage its acquisition function by identifying areas of risk, due to a lack of quality assurance procedures over data entry. CMS also has not substantially addressed seven of the nine recommendations made by GAO in 2007 to improve internal control over contracting and payments to contractors. For example, CMS has not made progress in clarifying the roles and responsibilities for implementing certain contractor oversight responsibilities and, as of July 2009, CMS still had a backlog of contacts that were overdue for closeout, putting CMS at increased risk of not identifying or recovering improper payments or waste. The continuing weaknesses in contracting activities and limited progress in addressing known deficiencies will continue to put billions of taxpayer dollars at risk of improper payments or waste.