Further, CMS is not likely to complete these other financial  reviews until almost 3 years after the bid submission date for each  contract year, in part because it must first reconcile payment data that  prescription drug plans are not required to submit to CMS until 6 months  after the contract year is over. For the audits of the contract year 2006 bids, CMS officials explained that  they did not intend for the audits of contract year 2006 bid submissions to  meet the one-third audit requirement and that they plan to conduct other  reviews of the financial records of organizations to meet the requirement  for contract year 2006. However, in late May 2007, CMS informed us that its legal  counsel had determined that the agency does not have the legal authority  to recover funds from MA organizations based on the findings from the  ACR audits. On the basis of our assessment of the statutes, CMS had the  authority to pursue financial recoveries, but its rights under the contracts  for 2001–2005 are limited because its implementing regulations did not  require that each contract include provisions to inform organizations  about the audits and about the steps that CMS would take to address  identified deficiencies, including pursuit of financial recoveries. The ACR Audit Process Did Not Consistently Quantify Impacts on Beneficiaries

CMS contracted with audit firms at a cost of $15.2 million to audit ACRs  for contract years 2001-2005, but did not ensure that the audit process  consistently provided information to assess the potential impact on  beneficiaries. In our October 2001  report, we reported that for contract year 2001, CMS had planned to  require auditors, where applicable, to do so. CMS officials told us  that they plan to close out the audits without pursuing financial  recoveries. OACT officials responsible for  the bid audit process explained that they will use the audit results to help  organizations improve their methods in preparing bids in subsequent  years, but their audit follow-up process does not involve taking action to  recover funds from organizations based on audit results because they  maintain that CMS does not have the legal authority to do so. However, according to our  assessment of the statute, CMS has the authority to include terms in its  contracts with MA organizations and prescription drug plan sponsors that  would allow it to pursue financial recoveries based on the bid audit  results. CMS has authority to sanction organizations but did not identify any  findings from the contract year 2006 bid audits where a sanction would be  warranted. The current bid  audits provide CMS with information in a timely manner to address  identified deficiencies. Appendix I: Scope and Methodology

To determine whether the Centers for Medicare & Medicaid Services  (CMS) met the requirement for auditing Adjusted Community Rates  (ACRs) for one-third of the Medicare Advantage (MA) organizations for  contract years 2001 through 2005 and one-third of the bid submissions for  contract year 2006, we first requested the criteria and analysis from CMS  to show how it met the requirement.
Why GAO Did This Study

In fiscal year 2006, the Centers for Medicare & Medicaid Services (CMS) spent over $51 billion on the Medicare Advantage program, which serves as an alternative to the traditional fee-for-service program. Under the Medicare Advantage program, companies wishing to participate must annually submit bids (effective with contract year 2006) that identify the health services the company will provide to Medicare members and the estimated cost and revenue requirements for providing those services. For 2001 through 2005, the submissions were called Adjusted Community Rate (ACR) Proposals. The Balanced Budget Act (BBA) of 1997 requires CMS to annually audit the financial records supporting the submissions of at least one-third of participating organizations. BBA also requires that GAO monitor the audits. In this report, GAO examined (1) whether CMS met the one-third requirement for 2001 through 2006, (2) what information the ACR audits provided and how CMS used it, and (3) what information the bid audits provided and how CMS used it.

What GAO Found

CMS did not document its process to determine whether it met the requirement for auditing ACRs for one-third of the participating Medicare Advantage organizations for contract years 2001-2005. CMS is planning to conduct other financial reviews of organizations to meet the audit requirement for contract year 2006, but by the end of our fieldwork in June 2007, CMS had not finalized its plans. Further, CMS does not plan to complete the financial reviews until almost 3 years after the bid submission date each contract year. This will affect its ability to address deficiencies in a timely manner. CMS did not consistently ensure that the audit process for contract years 2001-2005 provided information to assess the impact on beneficiaries. After contract year 2003 audits were completed, CMS took steps to determine such impact and identified about $34 million from those audits that beneficiaries could have received in additional benefits. However, in late May 2007, CMS officials told us they were planning to close out the audits without pursuing financial recoveries because the agency does not have the legal authority to do so. According to our assessment of the statutes, CMS had the authority to pursue financial recoveries, but its rights under contracts for 2001-2005 are limited because its implementing regulations did not require that each contract include provisions to inform organizations about the audits and about the steps that CMS would take to address identified deficiencies, including pursuit of financial recoveries. CMS audited contract year 2006 bids for 80 organizations, and 18 had a material finding that affected amounts in approved bids. CMS officials said that they will use the audit results to help improve bids in subsequent years but took limited action to follow-up on contract year 2006 findings. CMS will not pursue financial recoveries based on audit results because it maintains that it does not have the legal authority to do so. However, according to our assessment of the statutes, CMS has the authority to include terms in bid contracts that would allow it to pursue financial recoveries. CMS also has the authority to sanction organizations but has not identified instances where sanctions are warranted. We also noted that CMS did not document steps taken to mitigate conflicts of interest for the firms performing audits.