CMS Had Not Implemented a Risk- Based Approach and Effective Control Activities for Financial Oversight

Although CMS is responsible for ensuring the propriety of over $100 billion  expended annually by the federal government for Medicaid, its financial  oversight process did not incorporate key standards for internal control  necessary to reduce the risk of inappropriate expenditures. The  comptroller general’s Standards for Internal Control in the Federal  Government requires that agency managers perform risk assessments and  then take actions to mitigate identified risks that could impede  achievement of agency objectives. Therefore, CMS did not have the requisite assurance that its  control activities were focused on areas of greatest risk. The initiative was started to aid states in their program  integrity efforts. The  control activities that CMS had in place to oversee state internal controls  and help ensure the propriety of Medicaid expenditures were not  effectively implemented. During our site visits we interviewed 11 regional financial analysts  responsible for overseeing the five states that accounted for over  $70 billion in Medicaid expenditures in fiscal year 2000. In addition, the CMS audit resolution  process did not ensure that audit findings were resolved promptly and did  not collect sufficient information on the status of audit findings. Establishing clear lines of  authority and performance standards for CMS oversight would also provide  for a more efficient, effective, and accountable Medicaid program. Monitoring Performance

We also recommend that the CMS administrator develop mechanisms to  routinely monitor, measure, and evaluate the quality and effectiveness of  financial oversight, including audit resolution, by collecting, analyzing, and comparing trend information on the results of  oversight control activities particularly deferral and disallowance  determinations, focused financial reviews, and technical assistance; using the information collected above to assess overall quality of  financial management oversight;  identifying standard reporting formats that can be used consistently  across regions for tracking open audit findings and reporting on the  status of corrective actions; and revising DAL audit tracking reports to ensure that all audits with  Medicaid related findings are identified and promptly reported to the  regions for timely resolution.
Why GAO Did This Study

The Medicaid program spent more than $200 billion in fiscal year 2000 to meet the health care needs of nearly 34 million poor, elderly, blind, and disabled persons. States are responsible for making proper payments to Medicaid providers, recovering misspent funds, and accurately reporting costs for federal reimbursement. At the federal level, the Centers for Medicare and Medicaid Services (CMS) oversee state financial activities and ensure the propriety of expenditures reported for federal reimbursement.

What GAO Found

GAO found that weak financial oversight by CMS leaves the program vulnerable to improper payments. The Comptroller General's Standards for Internal Control in the Federal Government requires that agency managers perform risk assessment, take steps to mitigate identified risks, and monitor the effectiveness of those actions. The standards also require that authority and responsibility for internal controls be clearly defined. CMS oversight had weaknesses in each of these areas. As a result, CMS did not know if its control efforts were focused on areas of greatest risk. CMS also was not effectively implementing the controls it had in place. Furthermore, managers had not established performance standards for financial oversight activities, particularly their expenditure review activity. Limited data were collected to assess regional financial analyst performance in overseeing state internal controls and expenditures. In addition, the CMS audit resolution procedures did not collect enough information on the status of audit findings or ensure that audit findings were resolved promptly. CMS' current organizational structure lacks clear lines of authority and responsibility between the regions and headquarters.