To address the extent to which CMS established a strong control  environment for contract management, we obtained and reviewed  documentation regarding contract closeout, acquisition planning, and  other management information and interviewed officials in the Office of  Acquisition and Grants Management (OAGM) about its contract  management processes. Pervasive Deficiencies in Control Procedures at the Contract Level Increase the Risk of Improper Payments or Waste

Our October 2009 report identified pervasive deficiencies in internal  control over contracting and payments to contractors. Specifically, as a  result of our work, we estimated that at least 84.3 percent of FAR-based  contract actions made by CMS in fiscal year 2008 contained at least one  instance in which 1 of 11 key controls was not adequately implemented. The internal control deficiencies occurred  throughout the contracting process and increased the risk of improper  payments or waste. These deficiencies were due in part to a lack of  agency-specific policies and procedures to ensure that FAR requirements  and other control objectives were met. Further, CMS’s  Contract Review Board process had not been properly or effectively  implemented to help ensure proper contract award actions. We estimated that at least 46.0 percent of fiscal year 2008 CMS  contract actions did not meet the FAR requirements applicable to  the specific contract type awarded. For example, we found that CMS  used cost reimbursement contracts without first ensuring that the  contractor had an adequate accounting system. Weak Control Environment Hindered CMS’s Ability to Manage Its FAR-based Acquisition Process

The control deficiencies we identified in the statistical sample discussed in  our October 2009 report stemmed from a weak overall control  environment. CMS’s control environment was characterized by the lack of  (1) strategic planning to identify necessary staffing and funding;   (2) reliable data for effectively carrying out contract management  responsibilities; and (3) follow-up to track, investigate, and resolve  contract audit and evaluation findings for purposes of cost recovery and  future award decisions. A positive control environment sets the tone for  the overall quality of an entity’s internal control, and provides the  foundation for an entity to effectively manage contracts and payments to  contractors. Without a strong control environment, the control  deficiencies we identified will likely persist. GAO Has Made Numerous Recommendations to Improve CMS’s Contract Management Controls

		Seven of Nine GAO 2007 Recommendations Were Substantially Unresolved

As we reported in October 2009, CMS management had not taken  substantial actions to address our 2007 recommendations to improve  internal control in the contracting process.
Why GAO Did This Study

In November 2007, GAO reported significant deficiencies in internal control over certain contracts the Centers for Medicare and Medicaid Services (CMS) awarded under the Federal Acquisition Regulation (FAR). This Subcommittee and others in Congress asked GAO to perform an in-depth review of CMS's contract management practices. This testimony is based on GAO's October 2009 report on these issues and summarizes GAO's findings on the extent to which CMS (1) implemented effective control procedures over contract actions, (2) established a strong contract management control environment, and (3) implemented GAO's 2007 recommendations. GAO used a statistical random sample of 2008 CMS contract actions to assess CMS internal control procedures. The results were projected to the population of 2008 CMS contract actions. GAO reviewed contract file documentation and interviewed senior acquisition management officials.

What GAO Found

GAO reported in October 2009 that pervasive deficiencies in CMS contract management internal control increased the risk of improper payments or waste. Specifically, based on a statistical random sample of 2008 CMS contract actions, GAO estimated that at least 84.3 percent of fiscal year 2008 contract actions contained at least one instance where a key control was not adequately implemented. For example, CMS used cost reimbursement contracts without first ensuring that the contractor had an adequate accounting system, as required by the FAR. These deficiencies were due in part to a lack of agency-specific policies and procedures to help ensure proper contracting expenditures. These control deficiencies stemmed from a weak overall control environment characterized primarily by inadequate strategic planning for staffing and funding resources. CMS also did not accurately capture data on the nature and extent of its contracting, hindering CMS's ability to manage its acquisition function by identifying areas of risk. Finally, CMS did not track, investigate, and resolve contract audit and evaluation findings for purposes of cost recovery and future award decisions. A positive control environment sets the tone for the overall quality of internal control and provides the foundation for effective contract management. Without a strong control environment, the specific control deficiencies GAO identified will likely persist. As of the date of GAO's October 2009 report, CMS had not substantially addressed seven of the nine recommendations made by GAO in 2007 to improve internal control over contracting and payments to contractors. To the extent that CMS has continuing weaknesses in contracting activities, it will continue to put billions of taxpayer dollars at risk of improper payments or waste.