The CMS-64 is a series of forms that capture expenditure data for  different aspects of states’ Medicaid programs, such as different types of  services, populations, and different federal matching rates. States’ reporting may vary  depending on the features of their Medicaid program. CMS Oversight of State Expenditure Reporting

CMS is responsible for assuring that expenditures reported by states are  supported and allowable, meaning that the state actually made and  recorded the expenditure and that the expenditure is consistent with  Medicaid requirements. CMS Has Processes in Place to Assure that State-Reported Medicaid Expenditures Are Supported and Allowable, but Weaknesses Limit Its Ability to Effectively Target Risk

CMS uses a variety of processes to assure that state-reported  expenditures are supported during quarterly reviews and performs  focused financial management reviews on expenditures considered at  risk of not complying with Medicaid requirements. Although we found that  CMS was identifying errors and compliance issues using both review  methods, we also found weaknesses in how CMS targets its oversight  resources to address risks. Weaknesses Limit CMS’s Ability to Effectively Target Risk in Its Oversight of Expenditures

We identified two weaknesses in how CMS is allocating resources for  overseeing state-reported expenditures that limited the agency’s ability to  target risk in its efforts to assure that these expenditures are supported  and consistent with Medicaid requirements. CMS has allocated 2.2 staff to  review California’s expenditures in contrast to one person to review  Arkansas’ expenditures, which constitute 1 percent of federal Medicaid  expenditures, and Arkansas does not have a similar history of complex  reporting challenges. Second, CMS reported cancelling the FMR requirement for regional  offices in 17 out of 51 instances in the last 5 years when faced with  resource constraints. Without completing a comprehensive, national assessment of risk  and determining whether staff resources dedicated to financial oversight  are adequate and allocated commensurate with risk, CMS is missing an  opportunity to improve its ability to identify errors in reported expenditures  that could result in hundreds of millions of dollars in potential savings to  the Medicaid program. Vulnerabilities Exist in CMS’s Review of Expenditures for Which States Receive Higher Federal Matching Rates

CMS reviewers in the selected regional offices we reviewed did not  consistently perform variance analyses—which compare changes in  expenditures from the quarter under review to the previous quarter—of  higher matched expenditures during quarterly reviews. CMS Did Not Consistently Conduct Variance Analyses When Reviewing Certain Types of Expenditures that Receive Higher Federal Matching Rates

CMS has multiple procedures in place to review expenditures that receive  a higher federal matching rate. For example, both California and Arkansas have  expanded Medicaid under PPACA, and regional office staff told us  they reviewed claims for 30 expansion enrollees in each of the two  states, despite the fact that California has over 10 times as many  expansion enrollees as Arkansas. Federal standards for internal control related to risk assessment require  that agencies identify, analyze, and respond to risks. For example, in  fiscal year 2015, CMS resolved errors through  expenditure reviews that saved over $1.4  billion in federal funds. In fiscal years 2014 through 2017, CMS’s regional offices resolved  expenditure errors that reduced federal spending by over $5.1 billion, with  at least $1 billion in errors resolved in each of three of those four years. The financial significance of individual errors resolved by CMS’s regional  offices varied significantly. Conclusions

The growth of federal Medicaid expenditures, estimated at about $370  billion in fiscal year 2017, makes it critically important to assure  expenditures are consistent with Medicaid requirements. Although CMS has review  procedures in place to assure that the correct matching rate is applied for  services and populations receiving a higher federal matching rate, unclear  guidance has contributed to inconsistency in the extent to which these  reviews are conducted. The Administrator of CMS should revise the sampling methodology for  reviewing expenditures for the Medicaid expansion population to  better target reviews to areas of high risk.
Why GAO Did This Study

Medicaid has grown by over 50 percent over the last decade, with about $370 billion in federal spending in fiscal year 2017. CMS is responsible for assuring that expenditures—reported quarterly by states—are consistent with Medicaid requirements and matched with the correct amount of federal funds. CMS's review of reported expenditures has become increasingly complex due to variation in states' Medicaid programs and an increasing number of different matching rates.
GAO was asked to examine CMS's oversight of state-reported Medicaid expenditures. In this report, GAO examined how CMS assures that (1) expenditures are supported and consistent with requirements; and (2) the correct federal matching rates were applied to expenditures subject to a higher match. GAO also examined the financial impact of resolved errors. GAO reviewed documentation for the most recently completed quarterly reviews by 3 of CMS's 10 regional offices for six states that varied by Medicaid program expenditures and design. GAO also reviewed policies, procedures, and data on resolved errors; and interviewed CMS and state officials. GAO assessed CMS's oversight processes against federal standards for internal control.

What GAO Found

The Centers for Medicare & Medicaid Services (CMS), which oversees Medicaid, has various review processes in place to assure that expenditures reported by states are supported and consistent with Medicaid requirements. The agency also has processes to review that the correct federal matching rates were applied to expenditures receiving a higher than standard federal matching rate, which can include certain types of services and populations. These processes collectively have had a considerable federal financial benefit, with CMS resolving errors that reduced federal spending by over $5.1 billion in fiscal years 2014 through 2017.
However, GAO identified weaknesses in how CMS targets its resources to address risks when reviewing whether expenditures are supported and consistent with requirements.
CMS devotes similar levels of staff resources to review expenditures despite differing levels of risk across states. For example, the number of staff reviewing California's expenditures—which represent 15 percent of federal Medicaid spending—is similar to the number reviewing Arkansas' expenditures, which represents 1 percent of federal Medicaid spending.
CMS cancelled in-depth financial management reviews in 17 out of 51 instances over the last 5 years. These reviews target expenditures considered by CMS to be at risk of not meeting program requirements.
CMS told GAO that resource constraints contributed to both weaknesses. However, the agency has not completed a comprehensive assessment of risk to (1) determine whether oversight resources are adequate and (2) focus on the most significant areas of risk. Absent such an assessment, CMS is missing an opportunity to identify errors in reported expenditures that could result in substantial savings to the Medicaid program.
GAO also found limitations in CMS's processes for reviewing expenditures that receive a higher federal matching rate.
Internal guidance for examining variances in these expenditures was unclear, and not all reviewers in the three CMS regional offices GAO reviewed were investigating significant variances in quarter-to-quarter expenditures.
Review procedures for expenditures for individuals newly eligible for Medicaid under the Patient Protection and Affordable Care Act were not tailored to different risk levels among states. For example, in its reviews of a sample of claims for this population, CMS reviewed claims for the same number of enrollees—30—in California as for Arkansas, even though California had 10 times the number of newly eligible enrollees as Arkansas.
Without clear internal guidance and better targeting of risks in its review procedures for expenditures receiving higher matching rates, CMS may overpay states.

What GAO Recommends

GAO is making three recommendations, including that CMS improve its risk-based targeting of oversight efforts and resources, and clarify related internal guidance. The Department of Health and Human Services concurred with these recommendations.