Medicare Financial Management: Further Improvements Needed to Establish
Adequate Financial Control and Accountability (Letter Report, 03/15/2000,
GAO/AIMD-00-66).
Although the Health Care Financing Administration (HCFA) is supposed to
ensure that the billions of dollars spent on Medicare each year are
managed in a fiscally responsible way, it has yet to establish adequate
accountability and control over the program's financial operations.
HCFA's financial management activities--from evaluation and follow-ups
on audit findings to contractor monitoring and financial reporting--fall
short in addressing weaknesses repeatedly cited in audits and other
reviews. Unless these weaknesses are resolved, the government is at risk
of substantial losses. Financial statement audits have long criticized
claims contractors for internal control and financial reporting
weaknesses, including failure to safeguard checks received from
providers for overpayments and incorrectly recording billions of dollars
owed to Medicare for such overpayments. However, HCFA's procedures for
following up on audit findings and evaluating corrective actions remain
insufficient. Poor monitoring of contractors' financial activities is
another problem. Audit reports have also cited HCFA for inefficiencies
in its internal control financial reporting practices, including a lack
of documented policies and procedures. These deficiencies call into
question the reliability of the data that Congress and HCFA use to track
Medicare program costs and make decisions about future funding. HCFA
officials have launched several initiatives to strengthen the agency's
control and accountability, such as hiring outside consultants to
evaluate the contractors' internal controls. However, the agency still
lacks a comprehensive strategy to ensure successful implementation of
these initiatives, direct financial management activities, and sustain
improvements in the long term. Without such a strategy, billions of
dollars will remain vulnerable to fraud and abuse and HCFA's financial
management problems will likely persist. GAO summarized this report in
testimony before Congress; see: Medicare Financial Management: Further
Improvements Needed to Establish Adequate Financial Control and
Accountability, by Gloria Jarmon, Director of Accounting and Financial
Management Issues, before the Subcommittee on Government Management,
Information, and Technology, House Committee on Government Reform.
GAO/T-AIMD-00-118, Mar. 15 (22 pages).
--------------------------- Indexing Terms -----------------------------
REPORTNUM: AIMD-00-66
TITLE: Medicare Financial Management: Further Improvements Needed
to Establish Adequate Financial Control and
Accountability
DATE: 03/15/2000
SUBJECT: Claims processing
Internal controls
Contractor violations
Accountability
Financial management
Health insurance
Reporting requirements
Financial statement audits
Contract oversight
Federal agency accounting systems
IDENTIFIER: Medicare Program
HCFA Integrated General Ledger Accounting System
HCFA Accounts Receivable System
HCFA Recovery Management Accounting System
******************************************************************
** This file contains an ASCII representation of the text of a **
** GAO Testimony. **
** **
** No attempt has been made to display graphic images, although **
** figure captions are reproduced. Tables are included, but **
** may not resemble those in the printed version. **
** **
** Please see the PDF (Portable Document Format) file, when **
** available, for a complete electronic file of the printed **
** document's contents. **
** **
******************************************************************
GAO/AIMD-00-66
Appendix I: Comments From the Department of Health and Human Services
38
Appendix II: Financial Management/Internal Control Weaknesses
Included in Financial Statement Audits, Fiscal Years 1996-1999
51
Appendix III: Financial Management Improvement Projects
52
Appendix IV: GAO Contacts and Staff Acknowledgments
53
Figure 1: Flow of Medicare Program Dollars 9
CBS Center for Beneficiary Services
CFO Chief Financial Officer
CPE Contractor Performance Evaluation
EDP Electronic Data Processing
FFMIA Federal Financial Management Improvement Act
FSG Financial Services Group
GMRA Government Management Reform Act
GPRA Government Performance and Results Act
HCFA Health Care Financing Administration
HHS Department of Health and Human Services
HI Hospital Insurance
IGLAS Integrated General Ledger Accounting System
MARS Medicare Accounts Receivable System
MSP Medicare Secondary Payer
OFM Office of Financial Management
OIG Office of Inspector General
OMB Office of Management and Budget
ReMAS Recovery Management Accounting System
SGL U.S. Government Standard General Ledger
SAS Statement on Auditing Standards
SMI Supplementary Medical Insurance
Accounting and Information
Management Division
B-284462
March 15, 2000
The Honorable Nancy-Ann Min DeParle
Administrator
Health Care Financing Administration
Dear Ms. DeParle:
Medicare is the nation's largest health insurer, covering almost 40 million
beneficiaries at a cost of over $200 billion annually. Addressing the
financial management challenges associated with administering the Medicare
program is a daunting task given the size and complexity of the program. As
the Medicare program steward, the Health Care Financing Administration
(HCFA) is accountable for ensuring that funds are spent wisely and in
accordance with applicable Medicare laws and that the Medicare program is
well managed.
The Congress instituted comprehensive management reforms to assist federal
agencies in establishing accountability for programs like Medicare. The
Federal Managers' Financial Integrity Act of 1982 (Financial Integrity Act)
requires agency managers to annually assess the adequacy of their internal
control1 and accounting systems and report on material weaknesses found and
the plans for correcting the problems. The Financial Integrity Act also
requires the Comptroller General to issue standards for internal control in
government, which were issued in 1983 and recently updated in light of
advancing technology and refinements in internal control. The Comptroller
General's Standards for Internal Control in the Federal Government is issued
to help agencies establish and maintain effective internal control systems
that are designed to ensure that agencies achieve their goals and
objectives.2
Other laws, such as the Chief Financial Officers (CFO) Act of 1990, as
expanded by the Government Management Reform Act (GMRA) of 1994, and the
Government Performance and Results Act of 1993 (GPRA), prompted agencies to
improve financial management, internal control, and performance
measurement.3 The CFO Act and GMRA established CFO positions, required
audited financial statements annually, and set expectations for agencies to
deploy more modern financial management systems. GPRA required agencies to
develop multiyear and annual strategic goals, methods for measuring
performance toward achieving those goals, and annual reports on the results.
Like many agencies, HCFA has made strides toward implementing the
requirements of recent reform legislation by preparing agencywide financial
statements that have been subjected to independent audit since fiscal year
1996. HCFA has made progress in improving its audit opinions each year and
just recently received an unqualified or "clean" opinion on its fiscal year
1999 financial statements. At the same time, audits of HCFA's financial
statements have continuously cited the agency for serious financial
management weaknesses that affect its ability to establish adequate control
and accountability for Medicare finances. Many of these weaknesses continued
through fiscal year 1999.
The Medicare program has also received increased attention as a result of
investigations by the Department of Health and Human Services' (HHS) Office
of Inspector General (OIG) and the Department of Justice that cited HCFA's
Medicare claims contractors4 and providers, such as hospitals and
physicians, for payment errors and fraudulent billing practices. The OIG
estimated that for fiscal year 1999, claims contractors improperly paid an
estimated $13.5 billion in Medicare claims, mostly for medical services that
were not covered by Medicare or were not reasonable, necessary, or
appropriate. Also, we recently reported that although HCFA is implementing
several actions to improve its oversight of Medicare claims contractors,
organizational and oversight weaknesses impede the agency's ability to
ensure that providers are appropriately paid.5
Because of our concerns about the impact of continuing financial management
weaknesses on the integrity of the Medicare program and the potential for
losses, we evaluated HCFA's financial management activities, including
evaluation and follow-up on audit findings, monitoring of contractor
financial operations, internal financial reporting practices, and financial
management improvement initiatives, to determine if they are sufficient to
resolve financial management weaknesses identified through annual financial
statement audits and other management-type reviews of HCFA's Medicare
activities.
Although HCFA is responsible for ensuring that the billions of dollars
expended for Medicare each year are managed in a fiscally responsible way,
it has not yet established an adequate foundation for control and
accountability over the financial operations of the Medicare program. HCFA's
financial management activities, which include evaluation and follow-up on
audit findings, contractor monitoring, and financial reporting, are
insufficient to resolve the internal control and financial reporting
weaknesses identified through audits and other reviews. Resolving these
weaknesses is important because of the risk they pose to the Medicare
program. Unresolved weaknesses could result in losses to the government.
While HCFA set and achieved goals for improving its audit opinion, many
long-standing financial management weaknesses remain. Notably, HCFA received
an unqualified or "clean" opinion on its fiscal year 1999 financial
statements, and its audit report was issued on time. For HCFA, as well as
other federal agencies, annual financial audits represent an important means
to assure continued progress in improving financial management and pinpoint
significant weaknesses in financial management that require management's
attention. In fact, the audit report on HCFA's fiscal year 1999 financial
statements highlighted that many of the underlying control weaknesses
reported in previous audits still exist.
Financial statement audits have repeatedly cited claims contractors for
internal control and financial reporting weaknesses, including failure to
safeguard checks received from providers for overpayments and incorrectly
recording billions of dollars owed to the Medicare program for such
overpayments. Despite the impact that these and other financial management
weaknesses have on HCFA's ability to safeguard Medicare assets, HCFA's
procedures for following up on audit findings and evaluating corrective
actions to ensure they are appropriate and effectively implemented are
insufficient.
HCFA's monitoring of contractor financial activities is also insufficient.
Until recently, the scope of HCFA's oversight was limited, focusing mainly
on contractor compliance with administrative budgets, which total about $1.6
billion annually, instead of focusing on the significant financial
activities related to the approximately $170 billion expended each year to
pay Medicare benefit claims. Further, HCFA does not routinely analyze
contractor financial data to detect irregularities and assess risk as part
of day-to-day monitoring activities, nor has HCFA issued complete and
up-to-date instructions to contractors on key financial matters.
Audit reports have also cited HCFA for inefficiencies in its internal
financial reporting practices, including a lack of documented policies and
procedures. Overall, these shortcomings mean that HCFA cannot ensure the
reliability of data that the agency and the Congress on an ongoing basis use
to track the cost of the Medicare program and to help make informed
decisions about future funding.
HCFA officials have begun several initiatives to enhance HCFA's ability to
establish better control and accountability, such as hiring outside
consultants to evaluate contractor internal controls. These initiatives, if
successfully implemented, will assist HCFA in correcting some of its
long-standing financial management problems. However, HCFA does not have a
comprehensive strategy to ensure successful implementation of the
improvement initiatives, direct financial management activities, and sustain
improvements in the long term. HCFA lacks long- and short-range plans that
provide a basis for prioritizing financial management initiatives, clearly
defining goals and objectives, establishing time frames for completing
initiatives, assigning responsibilities, and measuring performance. In
addition, HCFA has not completed an assessment of financial management human
capital needs. In the absence of a comprehensive strategy, HCFA cannot
effectively direct and monitor its many initiatives, potentially putting
billions of dollars at risk of fraud and abuse and increasing the likelihood
that financial management problems will continue. We are making
recommendations designed to help HCFA resolve these problems. In comments on
a draft of this report, HCFA generally agreed with our recommendations and
described several initiatives it has planned or recently begun for resolving
the underlying financial management control issues.
The Medicare program provides health care coverage to people 65 and over and
to some disabled persons.6 For fiscal year 1999, total cost for the Medicare
program was over $200 billion, of which about $37 billion was expended for
Medicare beneficiaries that opt to enroll in prepaid health care plans
commonly referred to as managed care organizations and about $170 billion
was expended for the 85 percent of beneficiaries that have chosen Medicare's
traditional pay-per-visit or fee-for-service arrangement. Medicare Part
A--hospital insurance--covers inpatient hospital, some home health, skilled
nursing, and hospice services. Medicare Part B--supplementary medical
insurance--covers services provided by physicians, outpatient laboratories,
and an array of other providers and supplies.
HCFA has primary responsibility for administering the Medicare program. HCFA
contracts with 56 Medicare claims contractors to help administer the
Medicare program by processing fee-for-service claims, managing the billions
of dollars used to pay those claims, protecting Medicare from fraud and
abuse, and providing education and services to beneficiaries and providers.
Medicare claims contractors are called intermediaries or carriers, depending
on the type of claims they process. Intermediaries primarily process part A
claims for institutions such as hospitals and home health agencies. Carriers
process part B claims submitted by others, such as physicians and suppliers
of durable medical equipment. Each business day, contractors process about
3.5 million claims worth an average of more than $650 million.
Medicare claims contractors assume a large share of the responsibility for
managing the finances of the Medicare program. Medicare claims contractors
have financial management responsibilities that include
(1) establishing agreements with commercial banks to withdraw money from the
Medicare trust funds and expend those funds to pay Medicare claims, (2)
establishing budgets with HCFA to cover the administrative cost of carrying
out their Medicare responsibilities, (3) submitting various financial
reports to HCFA on activities such as funds withdrawn and funds expended,
and (4) certifying that their internal controls are in place and operating
effectively. Figure 1 depicts the flow of Medicare program dollars.
Figure 1: Flow of Medicare Program Dollars
Source: GAO analysis of HCFA documentation of Medicare financial management.
HCFA, as the Medicare program steward, is responsible for ensuring that
contractors do their jobs accurately and efficiently, including managing
Medicare funds in a fiscally responsible manner. HCFA is also responsible
for establishing an internal control system to safeguard Medicare assets. To
comply with the Comptroller General's Standards for Internal Control in the
Federal Government, HCFA is required to implement procedures for
(1) monitoring claims contractors' internal controls and (2) promptly
evaluating audit findings, determining proper actions in response to audit
findings, and completing or directing actions that correct identified
deficiencies.
HCFA's monitoring of contractors for both operational and financial
performance is a multitiered process. HCFA financial managers rely on two
annual processes as their mechanisms for overseeing contractor activities
and identifying deficiencies in contractor operation: the annual financial
statement audits and the annual Contractor Performance Evaluations (CPE). In
addition, HCFA does day-to-day monitoring of contractor operations.
HCFA financial managers rely on the annual financial statement audit done
under the CFO Act, as expanded by GMRA, as a tool for oversight of
contractors' financial activities. As part of the annual audit of HCFA's
financial statements, auditors (1) determine whether Medicare benefit
payments were made in accordance with applicable laws and regulations, (2)
review the financial reporting and internal control at Medicare contractors
and at HCFA's central office, and (3) review regional office oversight of
Medicare. When auditors identify specific weaknesses in contractor financial
management, HCFA's CFO and its Office of Financial Management (OFM) require
contractors to submit corrective action plans to address the deficiencies.
HCFA also relies on oversight of contractor financial activities as
performed under annual CPE reviews. CPE reviews are annual reviews to
evaluate contractors' performance in all aspects of their contractually
required duties. HCFA's central office and its 10 regional offices have
shared responsibility for overseeing contractor performance. The central
office staff in the Center for Beneficiary Services (CBS) provides guidance
and overall direction for contractor oversight. Regional staff generally
provide direct oversight and are responsible for annually evaluating
contractor activities in the following five areas: (1) fiscal
responsibility,
(2) claims processing, (3) payment safeguards, (4) administrative
activities, and (5) customer service. The CPE review areas most relevant to
financial managers are fiscal responsibility and administrative activities.
The CPE of contractor fiscal responsibilities requires a review of
contractors' compliance with their budgets and other financial reporting
processes. Since 1998, regions have completed contractor fiscal
responsibility reviews using procedures developed by OFM to evaluate
contractors' accounts receivable and accounts payable data.7 The CPE
criteria for contractor administrative activities require HCFA to review
contractors' internal controls. When HCFA identifies significant
deficiencies in performance, contractors are required to submit a
performance improvement plan describing their planned corrective actions to
resolve those deficiencies.
OFM is responsible for day-to-day monitoring of contractor financial data
and activities in addition to facilitating the annual financial statement
audit process, preparing financial statements, and executing daily internal
accounting functions. The Financial Services Group (FSG) within OFM
(1) collects financial reports from contractors, (2) monitors financial
activity such as withdrawals, expenditures, time account analyses,
receivables, and payables, (3) issues guidance on contractor internal
controls, and (4) incorporates contractor data into HCFA's financial
statements. OFM staff are expected to coordinate with HCFA's regional
offices for assistance in day-to-day monitoring of contractor financial
data.
Our objective was to evaluate whether HCFA's financial management
activities, including audit evaluation and follow-up, monitoring of
contractor financial operations, internal financial reporting practices, and
financial management improvement initiatives, are sufficient to resolve
financial management weaknesses identified through annual financial
statement audits and other reviews of HCFA's Medicare activities.
To review HCFA's financial management activities we (1) reviewed audit
reports and related documents describing financial management weaknesses
identified during audits covering fiscal years 1996 through 1998, (2)
reviewed our prior reports on Medicare activities, (3) interviewed various
Medicare contractor officials and HCFA officials, including the CFO and
staff within HCFA's OFM, CBS, and selected regional offices,
(4) reviewed financial management guidance and other documents prepared by
HCFA and Medicare contractors specifying financial management and reporting
requirements and describing efforts to address identified weaknesses, (5)
tested the adequacy of selected controls and the accuracy of reported
financial data at selected contractors, (6) reviewed guidance prepared by
HCFA for performing key financial management oversight and monitoring
activities and related documentation produced as a result of these
activities, such as CPE summary reports, (7) reviewed statements of work for
contracts between HCFA and outside entities for financial improvement
initiatives, (8) reviewed plans prepared in compliance with the CFO Act and
the Results Act, such as HCFA's quarterly input to update the HHS' CFO
Financial Management Status Report and 5-Year Plan and HCFA's performance
plans, and (9) reviewed various documents prepared by HCFA describing
financial management-related objectives and priorities.
We did our work from June 1999 through early January 2000, at HCFA's central
office in Baltimore, Maryland, and at the three HCFA regional
offices--Atlanta, Philadelphia, and San Francisco--responsible for oversight
of the contractors that we visited. We visited 7 of the 56 Medicare
contractors, including 4 previously subjected to CFO audit-related testing.
The seven represented a cross-section of large, medium, and small-sized
contractors: five are both fiscal intermediaries and carriers, one is a
fiscal intermediary only, and another is a carrier only.8 Collectively, the
seven accounted for approximately $44 billion or 26 percent of total
expenditures reported by Medicare claims contractors during fiscal year
1999. We did our work in accordance with generally accepted government
auditing standards. We requested and obtained written comments on a draft of
this report from the Administrator of HCFA. These comments are reprinted in
appendix I.
Accountability
Since fiscal year 1996, auditors of HCFA's financial statements have
reported serious weaknesses in accounting, internal control, and financial
reporting processes for the Medicare program, many of which continue today.
Despite the serious and long-standing nature of these problems, HCFA has not
yet implemented adequate processes to improve control and accountability
over the Medicare program. HCFA's procedures for evaluating audit findings
and following up are not effective to ensure that corrective actions are
implemented. In addition, HCFA has serious deficiencies in its oversight and
monitoring of contractor financial activities. For example, HCFA's annual
oversight reviews are limited in scope, and day-to-day monitoring of
contractor financial activities includes little analysis of contractor
financial data to detect irregularities. HCFA's guidance to contractors for
executing financial activities is incomplete and in some cases outdated.
Further, HCFA's internal accounting and financial reporting practices lack
documented procedures. These weaknesses in internal control and financial
reporting processes pose a risk to the Medicare program because such
weaknesses could result in losses to the government.
In its first audit of HCFA-wide financial statements, which covered fiscal
year 1996, the OIG cited HCFA for numerous financial management problems.
The OIG cited problems with fundamental recordkeeping and financial
reporting, incomplete documentation, weak internal control, and financial
systems weaknesses that prevented the agency from accurately reporting
significant assets and liabilities, such as accounts receivable and accounts
payable. In response, HCFA set and achieved goals of improving its audit
opinion each year. As a result, after 4 years of audit experience, HCFA
received its first unqualified or "clean" audit opinion on its fiscal year
1999 financial statements.
For HCFA, as well as other federal entities, obtaining an unqualified or
"clean" audit opinion on its financial statements is an important objective.
However, it is not an end in and of itself. The key for agencies is to take
steps to continuously improve internal control and underlying financial
information for programs like Medicare. As contemplated by FFMIA9 and the
CFO Act, HCFA must be able to generate reliable, timely, accurate, and
useful information for decision-making on an ongoing basis, not just as of
the end of the fiscal year.
While HCFA has made continuous improvement in its audit opinion, many of the
underlying internal control weaknesses in HCFA's operations continue. Audit
reports prior to the report on HCFA's fiscal year 1999 financial statements
included seven significant deficiencies in the design or operation of the
Medicare internal control structure.10 The significant deficiencies included
in the 1996 through 1998 audit reports were the result of over 400 specific
financial management problems found in contractor and HCFA central and
regional office operations. The majority of the specific financial
management problems related to contractor operations. Similarly, the report
on HCFA's fiscal year 1999 financial statements included many of the same
internal control, financial reporting, and electronic data processing
weaknesses that had been reported in prior audits. Appendix II summarizes
the significant weaknesses identified by the auditors.
In addition, the fiscal year 1999 financial statement audit report cited
HCFA's financial systems for continued substantial noncompliance with FFMIA.
Specifically, the auditors reported that HCFA does not have integrated
accounting systems to capture expenditures at the Medicare contractor level,
and certain aspects of the existing financial reporting system do not
conform to the financial system requirements currently specified by the
Joint Financial Management Improvement Program. At the same time, HCFA was
also cited by the auditors for continuing to use processes to prepare its
fiscal year 1999 statements that do not effectively accumulate, analyze, and
distribute reliable financial information in a timely manner, nor ensure
material misstatements are identified in a timely manner.
By obtaining a "clean" opinion on its financial statements, HCFA made
progress in addressing one of its significant financial management
weaknesses, Medicare accounts receivable.
For example, HCFA's fiscal year 1998 financial statements resulted in a
qualified opinion because HCFA was unable to reliably track accounts
receivable worth billions of dollars.11
To address the accounts receivable issue, HCFA entered into an interagency
agreement with the OIG to review accounts receivable. The OIG review was
done to assist HCFA in validating the accuracy and completeness of accounts
receivable balances as of September 30, 1998, and March 31, 1999, as well as
the activity for the first 6 months of fiscal year 1999. The review provided
additional detail on accounts receivable problems that had been previously
reported in financial statement audit reports. For example, the October 1999
OIG report identified more than $2.7 billion in accounts receivable
overstatements and understatements in amounts reported by contractors and
HCFA's central and regional offices. Of the $2.7 billion, $0.7 billion
related to receivable balances and activity for claims in which Medicare
should be the secondary rather than primary payer (referred to as Medicare
Secondary Payer (MSP)). Another
$1.8 billion related to balances and activity for non-MSP receivables, which
are contractor overpayments to providers, beneficiaries, physicians, and
suppliers. In addition, approximately $0.2 billion related to misstatements
in accounts receivable tracked by HCFA central and regional offices due
mostly to the lack of supporting documentation and improper recording of
amounts.
The report states that HCFA and its contractors are unable to properly
classify, summarize, and report Medicare accounts receivable activity and
balances using current accounting procedures. Contractors use ad hoc
spreadsheet applications and a wide variety of claims processing systems for
tracking receivables that often cannot be reconciled to control amounts. As
a result, some contractors inserted unsupported numbers in the accounts
receivable reports to force accounts receivable activity to agree with
reported accounts receivable balances. The report also stated that some
contractors were unable to support beginning balances for receivables and
others reported incorrect activity, including collections.
Recommendations in the OIG report stated that the ultimate solution for HCFA
to address many of the accounts receivable problems is the development of a
Medicare integrated financial management system for mandatory use by all
contractors. In addition, the OIG also recommended necessary adjustments for
some of the $2.7 billion in over-and-under statements to properly present
the ending accounts receivable balances as of March 31, 1999.
Recognizing that the ultimate solution to its accounts receivable problems
will take years to implement, HCFA implemented procedures to eliminate or
write off accounts receivable balances as had been recommended in previous
financial statement audit reports. HCFA wrote off almost
$3 billion of Medicare accounts receivable balances for fiscal year 1999.
The almost $3 billion in accounts receivable being written off consists of
$0.8 billion in non-MSP receivables (i.e., receivables that represent
contractor overpayments to providers, beneficiaries, physicians, and
suppliers) and $2.1 billion in MSP receivables (i.e., amounts owed by other
insurance companies that should have been primary payers). Support provided
to us during our review did not clarify how the adjustments recommended by
the OIG report relate to the amounts being written off. However, HCFA
officials stated that they worked closely with the auditors to ensure that
there was little to no overlap between the adjustments and write-offs.
HCFA officials stated that the $3 billion in receivables is being written
off in accordance with policy endorsed by the CFO Council or because
regulations preclude further collection action. HCFA officials also
explained that using tools provided by the Debt Collection Improvement Act,
they will refer some of the debt to the Department of the Treasury for
further collection. However, given the nature of some of the amounts being
written off, there is little likelihood of any future collections. For
example, the amounts being written off include debts owed by entities no
longer in business. Also, some of the write-offs are the amounts that HCFA
has determined may never be repaid due to either the age of the accounts
receivable or the lack of detailed records to substantiate the validity of
the debt. HCFA is writing off all balances that are (1) over 10 years old,
(2) from 6 to 10 years old, with no collection activity in the past 12
months, or (3) not supported by detailed records. It may be a normal
industry practice and consistent with federal laws and regulations to write
off accounts receivable balances that are deemed "uncollectible", but such
actions are troubling for taxpayers and a concern for a program like
Medicare where total costs borne by the elderly are rising at the same time
that billions of dollars are being written off. HCFA officials said that
they expect to solicit outside assistance again next year to assess the
accounts receivable amounts because the underlying accounts receivable
systems problems still exist.
Evaluating the financial management problems identified during audits and
implementing follow-up procedures is critical if HCFA is to resolve its
financial management problems and establish financial accountability. The
Comptroller General's Standards for Internal Control in the Federal
Government requires that agencies implement actions to ensure that the
findings of audits and other reviews are promptly resolved. Among the steps
to ensure that findings are promptly resolved is determining that proper
actions have occurred in response to findings and recommendations. Moreover,
the Office of Management and Budget's (OMB) implementing guidance for the
Financial Integrity Act12 emphasizes the importance of agency management
taking timely and effective action to correct identified deficiencies.
Responsibility for correcting deficiencies is an integral part of management
accountability and should be considered a priority by the agency.
As of January 2000, HCFA's procedures for ensuring that corrective actions
are effectively implemented to resolve financial management related audit
findings were ad hoc at best. The one documented audit follow-up practice
that HCFA has consistently taken is preparing a quarterly corrective action
plan that lists the actions HCFA plans to implement to address the
significant findings of the financial statement audit report, including
material weaknesses and reportable conditions. This corrective action plan
is included in the HHS' annual CFO Financial Management Status Report and
5-Year Plan, required by the CFO Act. HCFA's corrective action plans for
fiscal years 1997 and 1998 included specific steps to address some of the
financial management related weaknesses. However, our review showed that the
plans lacked sufficient detail on corrective actions to address other key
financial management weaknesses that impact the reliability of data used to
track financial activities of the Medicare program and to help make informed
decisions. For example, the fiscal year 1998 corrective action plan did not
include detailed steps or target completion dates for correcting (1) the
inadequacy of HCFA's procedures to detect errors in data used in Medicare
accounts payable estimates, (2) the lack of regional office oversight to
monitor the reliability of contractor reports on Medicare funds expended,
and (3) the lack of contractor control procedures to provide independent
checks of the validity, accuracy, and completeness of amounts reported to
HCFA.
In discussions with HCFA officials about the lack of specificity in its
financial statement audit corrective action plans, HCFA officials explained
that more detailed steps to address each audit finding are provided by
contractors in the corrective action plans that HCFA requires them to
submit. According to HCFA OFM staff, since the fiscal year 1996 audit, HCFA
has asked its claims contractors to develop and implement corrective actions
that address the deficiencies identified by the financial statement
auditors. The contractors' corrective action plans are to be sent to OFM for
review and approval. However, HCFA has not established written procedures
for tracking receipt of corrective action plans prepared by contractors.
While OFM staff could describe their procedures for tracking contractor
corrective action plans, they said they were just beginning to document
them. OFM provided us with draft written procedures that describe the
process. However, when we requested copies of the contractors' corrective
action plans addressing the fiscal year 1998 audit, OFM officials said they
were not available because the CFO audit coordinator had failed to request
them from the contractors. OFM eventually provided us copies of the
corrective action plans after they requested them from the contractors more
than 6 months after the completion of the fiscal year 1998 audit. While the
contractor corrective action plans included steps to address the audit
findings and target completion dates, we found that HCFA does not follow up
at contractor sites to ensure that corrective actions are being implemented.
HCFA has not developed written procedures that require HCFA central or
regional office staff to follow up at contractor sites, although HCFA
officials had plans to do so. The Financial Integrity Act requires agency
management to track progress to ensure timely and effective results.
However, OFM staff said that until they implement procedures to ensure that
HCFA staff follow up at contractor sites, they would continue to rely on the
auditors to follow up as part of subsequent year financial statement audits.
Since the first audit, auditors have followed up with 24 of the 41
contractors included in audits of fiscal years 1996, 1997, 1998, and 1999
financial statements. However, the auditors did not follow up with 12 of the
41 contractors because they were not included in subsequent audits. The
other five contractors no longer participate in the Medicare program.
Weaknesses in HCFA's follow-up have hindered prompt resolution of financial
management problems. In fact, during our contractor visits for this review,
we found that several contractors included in previous audits had weaknesses
in their internal controls over Medicare activities similar to weaknesses
found in previous audits. For example, two contractors did not have adequate
control procedures in place for independent review of key financial data
reported to HCFA on funds expended and bank account activity. Also, these
two contractors did not have adequate controls to ensure the accuracy of the
outstanding check amounts reported to HCFA. For the two contractors,
outstanding check amounts totaled over
$100 million as of September 30, 1999.
We also found that OFM did not implement procedures to evaluate whether the
financial management problems identified at the contractors under audit are
systemic in the operations of contractors not included in the audit. Our
review found that two contractors not included in previous audits had
problems in controls over cash and review of financial data, similar to
findings reported at contractors in prior audits. For example, one
contractor that receives cash from providers and other sources averaging
about $20 million a month did not physically secure checks while awaiting
deposits, thus increasing the risk of lost checks and untimely deposits of
Medicare funds. Another contractor with cash receipts of about
$1.5 million monthly did not record the amounts in a log when first
received, thus creating opportunities for theft.
When daily financial operations of a program as complex as Medicare are
delegated to outside entities, oversight mechanisms are important tools for
maintaining financial control and accountability. The Comptroller General's
Standards for Internal Control in the Federal Government states that with
increased delegation of authority and responsibility, agency management
should have effective procedures to monitor results and hold individuals
accountable for their decisions and actions. In delegating authority to
accomplish an agency's mission, a critical internal control challenge is to
delegate enough to achieve the objectives of the agency, but not so much
that internal control is significantly weakened. In addition, the standards
state that because conditions change over time, agency management must
determine if internal control continues to address new or changed risks by
implementing a combination of ongoing monitoring activities and separate
evaluations. Ongoing monitoring activities are performed continually to
provide important feedback on the internal control and are usually more
effective than separate evaluations. Separate evaluations of control can be
useful because they focus directly on the controls' effectiveness at a
specific time.
HCFA's oversight of contractor financial activities for the Medicare program
has not focused on ensuring that contractors have the necessary internal
controls in place to account for and report on all financial activities
related to the Medicare program. Until fiscal year 1998, HCFA's CPEs, the
primary tool for evaluating contractor operations, included limited review
of contractor financial activities and the controls over those activities.
HCFA regional office CPE reviews of contractor financial responsibilities
largely focused on contractor compliance with the annual budget HCFA
establishes to pay contractors for administering the Medicare
program--approximately $1.6 billion a year. The financial responsibility
reviews did not focus on some of the significant financial activities and
data related to the about $170 billion expended each year to pay providers'
claims, such as Medicare accounts receivable, accounts payable, and funds
withdrawal activities. In addition, regional oversight reviewers did not
adequately examine contractor internal controls to gain assurance that
contractors' reports on financial data were reliable.
In the past, HCFA officials have raised concerns about having the necessary
resources, including the staff expertise, to provide oversight in critical
areas such as financial management and review of contractor data. For
example, we reported in July 1999 that HCFA officials believe that staff
resources were not adequate to perform detailed testing and validation
procedures necessary to ensure the accuracy of contractor-reported data.13
The Comptroller General's Standards for Internal Control in the Federal
Government states that an agency's control environment is significantly
affected by the competence of its personnel and the agency's ability to
(1) identify appropriate knowledge and skills needed for various jobs and
(2) provide needed training to maintain skill levels for particular jobs.
HCFA's difficulties in applying resources to oversight activities in the
past resulted in limited examination of essential contractor financial data
thus limiting the information HCFA has to assess the integrity and
reliability of contractor operations and develop solutions.
Recognizing the shortcomings of the HCFA annual oversight process, in fiscal
year 1998, the CFO took steps to address weaknesses in oversight of
financial activities. HCFA's OFM developed procedures for the regions to use
in checking and testing financial data related to accounts receivable and
accounts payable for several of the large contractors. OFM also provided
staff to assist regional reviewers in an attempt to develop and leverage the
skills and expertise of staff conducting the reviews.
Although several reviews were done under the new approach, the reviews were
not sufficient to address the serious deficiencies in contractor data for
accounts receivable and accounts payable identified from previous audits
because the scope of the procedures was limited. The procedures required
testing of only a few receivable amounts at each contractor site selected
from various types of reported receivables balances and related activity.
The procedures did not require the selection of tested items to be based on
a statistically valid selection methodology. OFM staff explained that the
procedures were not developed as a detailed audit tool; therefore, they do
not include the level of testing that audit procedures would include. OFM
staff said that the procedures were developed to give HCFA indications of
possible receivable problems that require additional review.
HCFA could better identify the root causes of receivable problems and
enhance the agency's ability to address the problems if tests were performed
on a larger number of items that are selected based on the nature and size
of the various receivable-related populations and if a statistically valid
methodology is used for selecting the items.
Similarly, we found deficiencies in the accounts payable audit procedures.
The procedures did not provide reviewers with guidance for determining the
number of items to select for testing and for performing procedures to
ensure that all payable amounts are accounted for. As a result, HCFA
reviewers may have been limited in thoroughly evaluating the accuracy of
contractor-reported accounts payable data.
The procedures did not cover other key financial activities, such as
contractor bank balances and funds withdrawal procedures. Contractors and
the commercial banks that act on behalf of contractors withdraw the
approximately $170 billion required annually to pay Medicare benefit claims.
Despite the magnitude of dollars that flow in and out of contractor bank
accounts, HCFA has not developed detailed procedures to review contractor
bank balances and the amount of funds withdrawn. We have discussed with the
CFO the need for expanded evaluation procedures to cover these areas. The
CFO agreed and has begun discussions with officials in the HCFA headquarters
unit responsible for contractor oversight about expanding financial
management oversight.
In fiscal year 1999, instead of relying solely on CPE reviews for financial
management oversight, the CFO solicited outside help to assess
(1) accounts receivable balances reported by contractors and
(2) contractor internal controls. As discussed earlier, HCFA entered into a
reimbursable interagency agreement with the OIG to assess the accuracy and
controls over reported accounts receivable. HCFA also contracted with
outside consultants to validate internal control at contractors in response
to a GAO finding that HCFA does not regularly check contractors' internal
controls.14
HCFA officials said that they plan to continue both the accounts receivable
and internal control reviews in the future. While these two efforts
demonstrate that HCFA is acting to address its longstanding problems, we are
concerned that HCFA's financial managers have not taken steps to
comprehensively assess how the agency will sustain strong oversight in these
two areas in the future or address the recommendations that will likely
result from these reviews. For example, financial managers have not
completed assessments of HCFA's human capital needs for oversight of
contractor financial operations in a coordinated effort with the central
office unit and regional offices responsible for oversight. It is also
unclear whether HCFA's financial managers plan to continue developing and
improving procedures for oversight of contractor financial operations
through CPEs or if such procedures will be replaced and supplemented by
outside consultant reviews.
Insufficient
In addition to annual CPEs not providing adequate oversight of contractor
financial activities, HCFA's day-to-day monitoring of contractor data has
also been insufficient. HCFA does not routinely analyze key contractor
financial data to detect irregularities in contractor financial activities
and assess risk, despite the importance of such mechanisms in establishing
sound internal control. In addition, accountability for several of HCFA's
day-to-day monitoring practices has not been clearly defined.
The Comptroller General's Standards for Internal Control in the Federal
Government states that ongoing monitoring activities should include
comparisons and reconciliations to identify inaccuracies or exceptions that
alert management to any internal control problems. The standards also state
that agency internal control should provide for assessing the risks that an
agency faces by estimating the significance of identified risks, assessing
the likelihood of occurrence, and deciding how to manage the risks. Another
important control activity included in the standards is assigning authority
and responsibility in a manner that ensures each individual knows how his or
her actions interrelate and contribute to meeting the agency objectives.
Despite the billions of Medicare dollars flowing through contractor bank
accounts and the risk posed by these activities, HCFA does not have adequate
mechanisms that indicate whether bank activity conducted on behalf of
contractors is reasonable. In early 1999, examiners from the Federal Deposit
Insurance Corporation discovered and reported to HCFA that one bank, which
provides banking services for eight contractors, had a practice of drawing
funds from the U.S. Treasury on the day before the bank needed the money to
pay Medicare claims. The bank was selling the amount to another bank
overnight to earn interest and transferring it back to its accounts the next
morning without HCFA's knowledge. When HCFA was made aware of the situation,
the CFO issued a letter to the bank president to (1) inform the bank that
the practice was not in accordance with provisions of the Medicare program
bank agreement and Treasury's regulations concerning collateral requirements
for federal funds and
(2) request that the bank immediately stop the practice. However, because
HCFA does not routinely monitor information on contractor bank activities
and does so little analysis, it could not fully determine the extent of
irregular activities by this bank.
At the request of HCFA, the OIG is currently investigating the bank in part
to determine the amount of profit the bank made from this practice. HCFA
officials said that they are awaiting the results of this report to
determine what actions against the bank are needed, including disciplinary
actions. In addition, HCFA officials said that they requested the OIG to
conduct a separate review of bank procedures for a sample of banks
participating in the Medicare program to determine if other banks are
unfairly profiting from similar practices and to identify areas of potential
vulnerability.
HCFA does not routinely analyze other data critical to ensuring the
integrity of contractor operations. For example, the contractors'
reconciliation of "total funds expended" is an important control which
ensures that all amounts reported to HCFA by Medicare contractors are
accurate, supported, complete, and properly classified. The reconciliation
requires contractors to reconcile total monthly expenditures to the number
of Medicare claims processed and to payment amounts including
(1) periodic interim payments to providers that cover their estimated cost
of providing Medicare services, (2) cost settlement payments that cover the
difference between provider periodic interim payments and actual costs
incurred, and (3) cash recovered from provider overpayments. Contractors
must reconcile the expenditure amounts listed with detailed supporting data
from their financial records and systems. HCFA requires that the contractors
prepare and submit the reconciliations monthly, but it does not track
receipt of them or review the reconciliations to detect irregularities or
assess risk. By not reviewing these reports and requesting the supporting
schedules necessary to ensure the accuracy of amounts reported by Medicare
contractors, HCFA's ability to hold Medicare contractors accountable for
submitting accurate financial data is hindered.
HCFA financial managers explained that they do not analyze the
reconciliations received from all contractors because they do not receive
any supporting documents from the contractors to determine if the amounts
are accurate. Although such analysis is an agency management responsibility,
HCFA relies on the OIG review of the reconciliations that are done for the
sample of contractors selected as part of the annual financial statement
audit. HCFA officials said that they do not currently perform any procedures
for the other contractors not selected for the audit.
HCFA could analyze certain reconciliation amounts reported over time to
obtain useful information for monitoring all contractors, although
contractors do not submit supporting schedules for each amount. Analyzing
significant increases or decreases in the amounts of various types of
expenditures and receipts for overpayment recoveries reported on the
reconciliation could indicate whether a contractor is experiencing
difficulties. For example, an analysis identifying a significant decrease in
monthly receipts for overpayments could assist in highlighting potential
collection problems. Similarly, an analysis identifying a significant
decrease in cost settlement payments could assist in highlighting potential
problems related to the contractors' processing of provider cost
settlements.
In evaluating HCFA's monitoring activities, we also found that some HCFA
staff are not aware of the extent to which they are accountable for certain
agency activities. For example, HCFA's monitoring activities are supposed to
be carried out by staff in OFM at HCFA's central office and with assistance
from staff in the regional offices. HCFA receives monthly and quarterly
contractor financial data related to (1) contractor bank charges and
collateral, (2) contractor withdrawals and expenditures for benefits, (3)
contractor administrative withdrawals, and (4) contractor accounts
receivable and payable. However, we found that clear lines of responsibility
have not been established for analysis done by OFM and the regions, and
analysis is limited.
OFM has one staff person that monitors the Medicare bank account
balances--about 20 commercial banks maintain the accounts for the
56 Medicare contractors. The staff person said that because of other
responsibilities, he only reviews bank account reports for about 2 or 3 of
the 56 Medicare contractors each quarter. When we asked to review his
analysis, the staff person could not provide any support or written analysis
procedures. The OFM staff person told us that regional staff might routinely
analyze bank activity, but he does not coordinate with the regions to ensure
that they do. Staff at the three regions we visited told us that they do not
routinely analyze contractor bank balances and referred us to the OFM staff
person.
Deficiencies
HCFA's ability to address long-standing financial management weaknesses is
also hampered because financial managers have not issued complete,
up-to-date guidance to contractors for financial activities. Contractors we
visited said they need additional guidance from HCFA to assist in correcting
control weaknesses. According to contractors, one specific area where
instructions are needed is the allocation of cash receipts between the two
Medicare trust funds.15 Because HCFA has not issued specific instructions in
this area, contractors have adopted different methodologies that in some
cases lead to inaccurate trust fund balances. One contractor adopted a
procedure where all overpayments received were allocated to the Hospital
Insurance (HI) trust fund. The contractor did not take any steps to
determine if the overpayments were related to previous Supplementary Medical
Insurance (SMI) or HI benefit payments. After adopting procedures to
determine if receipts were related to HI or SMI, the contractor reviewed its
allocation for a 9-month period in fiscal year 1999 and found that $33
million, which should have been allocated to the SMI trust fund, had been
incorrectly allocated to the HI trust fund. This error is significant
because accurate data on Medicare trust fund balances are essential in
managing and monitoring trust fund activities and funding needs.
HCFA's CFO acknowledged that more detailed instructions to contractors are
needed because HCFA's contracting documents do not include enough
specificity to contractors on their fiscal responsibilities. Also, we found
several financial-related sections of the contractor manuals that had not
been updated since the 1970s. Because HCFA lacks baseline data on its
financial management instructions, it has hired a contractor to determine
what financial guidance has been issued and to develop a manual of financial
and internal control guidance. This effort has just begun, and it is too
soon to tell whether it will succeed in addressing these fundamental
problems.
Past financial statement audits have identified weaknesses in HCFA's
internal financial reporting processes. Specifically, auditors reported that
significant staffing constraints within HCFA's Division of Accounting limit
its ability to conduct the annual financial statement preparation process
and contribute to lax procedures and controls for preparing and safeguarding
financial data. However, HCFA has not acted to ensure that it has
knowledgeable financial management staff and clearly documented procedures
for executing accounting and financial reporting activities.
HCFA's financial statement reporting process is not clearly documented.
Uniform policies and procedures for the financial statement preparation
process are critical to ensuring that accounting personnel can produce
complete, accurate, and consistent financial statements in a timely manner.
However, HCFA's current financial statement preparation process relies
primarily on the experience of a few key personnel who have prepared the
financial statements in previous years. The key personnel have not
documented their procedures. This approach renders HCFA vulnerable to loss
of financial reporting institutional knowledge through normal staff
attrition, and thereby creates significant risks that information supporting
the financial statements will not be complete, accurate, properly
authorized, and consistent from year to year.
We also found that HCFA does not have an updated accounting manual to direct
accounting staff in performing routine accounting procedures for the
Medicare program. OFM officials said that staff are instructed to use
accounting guidance provided by HHS and tailor the guidance as necessary. A
recent error in HCFA's financial reporting demonstrates the importance of
written accounting procedures that are specific to HCFA operations. In
October 1999, HCFA discovered misstatements in its reports to Treasury on
amounts expended from the HI and SMI trust funds. Treasury relies on the
amounts reported for expenditures because Medicare trust fund amounts not
necessary to meet current expenditures are invested in interest-bearing
securities of the U.S. government each month.
Senior OFM officials said that the staff person who prepared the report had
assumed responsibilities of a former employee but had not received adequate
training. Because of HCFA's errors, the Medicare trust fund balances that
Treasury invested for several months were incorrect, thus resulting in a
loss of investment interest income of about $80 million to the Medicare
program.16 HCFA is currently taking steps to enhance its procedures for
reporting trust fund balances.
HCFA has not developed a comprehensive strategy to direct its financial
management activities. A comprehensive financial management strategy, along
with plans for implementing the strategy, is important because of the size
and complexity of the Medicare program and the recurring financial
management weaknesses and problems identified by HCFA's auditors. A key part
of HCFA's strategic planning should be assessing human capital because
managing an organization's employees is essential to achieving results.
Without a comprehensive plan for improving financial management, resolution
of problems may be delayed and the billions of dollars related to the
Medicare program will continue to be at risk.
Initiatives
While HCFA has several initiatives underway to improve financial management
and operations, it has not developed a comprehensive implementation plan. A
comprehensive plan would include long- and short-range plans with clearly
defined objectives and goals. The plan should include specific corrective
actions and target dates and resources necessary to implement those actions.
A comprehensive plan would also assign accountability by identifying offices
and staff responsible for carrying out the corrective actions. Establishing
accountability is important for increasing the chances of successful
implementation and outcomes.
HCFA prepares agencywide strategic plans and annual performance plans as
required by GPRA and provides input into the HHS' annual CFO 5-year plan
required by the CFO Act; however, these plans are broader in scope and focus
on different goals and objectives. They do not provide an adequate
substitute for a specific HCFA financial management improvement plan. Also,
each division and branch of OFM sets annual unit work priorities. These
priorities likewise do not adequately substitute for a financial management
plan because their focus is narrower.
HCFA has initiated several projects intended to correct problems identified
during financial statement audits. These projects include (1) developing an
integrated accounting system to include both overpayment tracking and
financial reporting, (2) developing two new systems to improve oversight and
financial reporting over Medicare receivables, (3) reviewing contractors
internal control, and (4) developing a comprehensive contractor financial
management manual. (See appendix III, which contains more information on
these projects.) While these projects have the potential to provide major
improvements in HCFA's financial management, the chances of success could be
significantly improved if HCFA established and documented a specific
implementation plan for completing the projects and using the results. HCFA
officials provided us broad conceptual ideas of how the initiatives would
need to be implemented. However, as of January 2000, HCFA was in the early
stages of drafting more specific details for these projects.
For example, three of the initiatives involve developing new financial
management systems to improve oversight and financial reporting over
Medicare receivables and developing an integrated accounting system. While
these systems are in their early design phases, HCFA has not fully developed
detailed plans for coordinating implementation and integration of these
systems. One step HCFA officials stated that they have taken is to hire an
experienced systems design specialist to lead the integrated account system
project. Still, delays in developing detailed plans could cause problems as
the projects progress. In January 1999, we issued a special series of
reports17 that discusses major management challenges and program risks that
must be addressed to improve the performance, management, and accountability
of federal agencies. In this series of reports, we reported that a challenge
for agencies is to ensure that modern information technology management
practices are consistently defined and properly implemented. As underscored
by the Clinger-Cohen Act,18 complete and enforceable systems
architectures--blueprints to guide systems development--are essential
foundations on which the interoperability and coordination of related
business processes and systems are built. Lack of well-defined systems
architectures often leads to problems in systems interface and data
exchange, confusion for users, and delays in program operations.
Another financial management improvement initiative that HCFA has underway
is to review contractors' internal control structures to identify poor
internal control and needed improvements. HCFA has contracted with
independent public accounting firms to perform these reviews. A documented,
comprehensive plan is important to avoid duplication of effort when
conducting these reviews. Auditors of HCFA's financial statements have
already reviewed the internal controls of some of the Medicare contractors
included in these reviews. HCFA officials envision that these contracted
reviews will continue in future years, but HCFA has not determined what
resources will be needed to do the reviews or respond to the resultant
recommendations. In addition, HCFA officials do not have alternative plans
in the event these reviews cannot be continued. Without alternative plans,
this critical activity could be interrupted.
The project to develop a comprehensive contractor financial management
manual, which is well underway, also lacks a clear plan for how the manual
will be used. Documentation for the project consists of a statement of work
describing the procedures an independent consultant is to perform to develop
the manual. HCFA has not documented plans for how it intends to implement
the new manual, including (1) how training will be provided and (2) how the
manual will be kept current.
Effectively managing an organization's employees--or human capital--is
essential to achieving the goals of the organization. The CFO Act recognizes
the importance of human capital to achieving financial management objectives
by stating that an agency CFO shall direct, manage, and provide policy
guidance and oversight of agency financial management personnel, activities,
and operations, including the recruitment, selection, and training of
personnel to carry out agency financial management functions. Similarly, a
comprehensive financial management strategy at HCFA should include human
capital planning.
We issued an exposure draft of an executive guide designed to help federal
agencies achieve federal financial management objectives.19 The guide
discusses best practices of leading private and public sector finance
organizations. One of the best practices for creating world-class financial
management is to build a team that delivers results. Our guide identified
leading finance organizations that have developed finance teams with the
right mix of skills and competencies. The guide offers three critical
elements for developing a first-rate team: (1) determining required skills
and competencies, (2) measuring the gap between what the organization needs
and what it has, and (3) developing strategies and detailed plans to address
current or expected future deficiencies.
HCFA officials stated that they recently initiated an agencywide workforce
planning project. This project consists of a four-phased model that plans to
incorporate critical elements similar to those mentioned in our guide. To
date, the results of this project have provided HCFA with limited
information, and more detailed assessments to analyze current and future
work functions and competencies have not been completed. HCFA's current
plans are to use results from its project to formalize hiring, staffing, and
learning plans for fiscal year 2001. Having staff with appropriate skills is
key to achieving financial management improvements. Currently, HCFA
officials acknowledged that they are constrained by the resources and staff
skills available to perform financial functions such as analysis of
financial data to detect irregularities and internal financial reporting
processes. Given the limited resource and staff skills available to perform
key financial functions, emphasis on completing more detailed human capital
planning within HCFA's proposed time frames is important.
We recently issued a discussion draft that provides a human capital
self-assessment guide to help agencies assess their human capital systems
and identify both the opportunities available and barriers standing in the
way.20 Agencies that focus on valuing employees and aligning their policies
to support organizational performance goals start with a human capital
assessment. Part of the impetus for valuing human capital comes from GPRA,
which requires agencies to pursue performance-based management, including
strategic planning, results-oriented goalsetting, and performance
measurement. The results of such an assessment could help determine the
resources needed to implement the comprehensive financial management plan.
Further, without a formal assessment of its requirements and needs, and a
strategy for addressing them, HCFA's efforts can become piecemeal and
incomplete. A comprehensive needs assessment and plan, including time frames
for improving its human capital position, could also strengthen the agency's
ability to support its human capital budget requests.
A comprehensive financial management strategy is a crucial tool for
financial managers. A sufficiently detailed strategy that includes a plan
for integrating the implementation and results of each of HCFA's financial
management improvement initiatives, including the human capital resources
needed, would provide a "road map" for HCFA's management and staff to help
in resolving financial management problems and ensure Medicare funds are
spent responsibly. We have testified that congressional committees, as part
of annual appropriation or oversight hearings, could use agencies'
corrective action plans, along with financial statement audits and other
financial related reports, to measure the progress agencies are making
toward improving financial management. 21 We have also discussed the need
for the plans to be sufficiently detailed so that agency management and
staff can resolve financial management problems.
With billions of dollars at risk in the Medicare program, the importance of
ensuring that Medicare assets are properly accounted for and that adequate
controls are in place to safeguard them cannot be overstated. In this
respect, HCFA continues to face difficulties. Financial statement audits and
other assessments and reviews have identified significant financial problems
at HCFA and its Medicare contractors year after year. Despite these
problems, HCFA's follow-up on audit findings and recommendations, evaluation
of contractors' corrective action plans, analysis of available financial
data to detect inappropriate financial management activities, and financial
guidance for HCFA and contractor staff is limited. Further, it is difficult
for HCFA to improve and expand oversight of contractor financial operations
without first determining the required staff skills and competencies needed.
In addition, HCFA's internal financial reporting processes render HCFA
vulnerable to errors in critical data needed to administer the Medicare
program.
The significance of the financial management issues facing HCFA emphasizes
the need for a comprehensive strategy to direct its financial activities and
assess its human capital needs. This strategy would help HCFA establish
seamless systems and processes to improve financial management and
accountability.
To improve financial management and accountability in the Medicare program,
we recommend that the HCFA Administrator direct the Chief Financial Officer
to take the following actions:
� Improve procedures for evaluating and resolving findings from annual
financial statements audits by developing, documenting, and implementing
procedures so that managers promptly evaluate audit findings, determine
proper actions in response to audit findings, and complete within
established time frames all actions that resolve the findings brought to
management's attention.
� In developing the procedures, coordinate with the central and regional
office staff responsible for contractor oversight to ensure that resources
are applied appropriately for timely follow-up with contractors on
implementation of corrective actions to address financial statement audit
findings.
� Improve oversight of contractor financial activities by working with the
central and regional office staff responsible for annual contractor
performance evaluations to (1) refine and expand procedures for review of
contractor financial activities, (2) provide staff with the necessary skills
to evaluate contractor financial activities, and (3) identify specific
contractors and financial activities to be reviewed.
� Improve the agency's ability to detect irregular financial activities and
identify high risk contractors by (1) developing analysis and risk
assessment procedures that detect unusual variances and patterns in the
amounts of funds withdrawn, funds expended, bank balances, accounts
receivable, accounts payable, and other key financial data reported by
contractors and (2) coordinating and sharing analysis and risk assessment
methodologies with central and regional office staff responsible for
contractor monitoring and oversight.
� Improve guidance to contractors for executing Medicare financial
activities by ensuring that the current initiative to develop a
comprehensive contractor financial management manual (1) solicits input from
contractors on the areas where better guidance is needed to address
long-standing internal control weaknesses, such as specific instructions on
allocation of cash receipts between the two Medicare trust funds, (2)
includes steps for ongoing updating of guidance,
(3) articulates how the manual will be used and implemented, (4) uses the
results of audit findings and oversight reviews to determine areas where
more complete and detailed guidance to contractors is needed, and (5)
reviews the contractor fiscal intermediary and carrier manuals to determine
which sections need updating.
� Improve internal financial reporting processes by developing comprehensive
policies and procedures that clearly define (1) the process to be followed
in preparing the financial statements, (2) the routine accounting procedures
performed by OFM, and (3) the number of staff and skills needed to carry out
OFM accounting and financial reporting responsibilities.
� Develop a comprehensive financial management strategy that clearly
(1) defines financial management objectives and goals, (2) specifies
corrective actions to address financial management weaknesses,
(3) includes target dates and resources necessary to implement corrective
actions, (4) identifies offices/staff responsible for carrying out the
corrective actions, (5) provides clear implementation plans that link the
various financial management improvement initiatives currently underway and
alternative plans in the event these reviews cannot be continued, (6)
provides details on the systems architecture and requirements needed for its
integrated financial management systems, and (7) includes a human capital
needs assessment.
In written comments (reprinted in appendix I) on a draft of this report, HHS
and HCFA officials agreed with our recommendations and discussed steps that
they have begun or are planning to take to address HCFA's financial
management challenges. In their comments, HHS and HCFA officials reaffirmed
their commitment to addressing the most serious deficiencies in HCFA's
financial management system. They also provided technical comments, which we
incorporated in this report as appropriate.
We agree with HHS and HCFA, as stated in their comments, that HCFA has taken
a number of steps to improve the opinion on HCFA's financial statements and
to address internal control weaknesses. However, many of the actions that
HCFA cites in its comments as major strides toward addressing serious,
longstanding financial management weaknesses are either still being
developed or are not yet fully implemented. As a result, it is too soon to
conclude whether these actions will be effective. For example, HCFA has
hired independent certified public accounting firms to analyze the internal
control systems of its largest Medicare contractors. When these reviews are
completed, HCFA plans to use the results to ensure that contractors take
corrective actions to resolve identified weaknesses. HCFA also plans to
solicit external assistance next fiscal year to validate Medicare accounts
receivable. Similarly, HCFA plans to require more specificity in contractor
corrective action plans and is starting an agencywide workforce planning
project. Until these initiatives have been fully implemented and evaluated,
HCFA cannot ensure that it has resolved the underlying causes of its most
serious audit findings as evidenced by persistent material internal control
weaknesses cited in the audit report on HCFA's fiscal year 1999 financial
statements.22
This report contains recommendations to you. The head of a federal agency is
required by 31 U.S.C. 720 to submit a written statement on actions taken on
these recommendations. You should send your statement to the Senate
Committee on Governmental Affairs and the House Committee on Government
Reform within 60 days of the date of this report. A written statement must
also be sent to the House and Senate Committees on Appropriations with the
agency's first request for appropriations made over 60 days after the date
of this report.
We are sending copies of this report to Senator Tom Harkin, Senator James
Jeffords, Senator Edward Kennedy, Senator Joseph Lierberman, Senator Daniel
Patrick Moynihan, Senator William Roth, Senator Arlen Specter, and Senator
Fred Thompson and to Representative Bill Archer, Representative Dan Burton,
Representative David Obey, Representative John Edward Porter, Representative
Charles Rangel, and Representative Henry Waxman, in their capacities as
Chairmen or Ranking Minority Members of Senate and House Committees and
Subcommittees. We are also sending copies of this report to the Honorable
Donna Shalala, Secretary of Health and Human Services, and the Honorable
Jacob J. Lew, Director of the Office of Management and Budget. Copies will
be made available to others upon request.
Please contact me at (202) 512-4476 or by e-mail at jarmong.aimd@gao.gov if
you have any questions about this report. Other GAO contacts and staff
acknowledgments are listed in appendix IV.
Sincerely yours,
Gloria L. Jarmon
Director, Health, Education, and Human Services
Accounting and Financial Management
Comments From the Department of Health and Human Services
The following are GAO's comments on the Department of Health and Human
Service's letter dated March 2, 2000.
1. See "Agency Comments and Our Evaluation" section.
2. We have modified the report to reflect development of written procedures
related to contractor corrective action plans.
3. We have modified the report to reflect this project.
Financial Management/Internal Control Weaknesses Included in Financial
Statement Audits, Fiscal Years 1996-1999
FY 1996 FY 1997 FY 1998 FY 1999
Finding: Weaknesses in contractors'
ability to accurately report financial
data due to insufficient accounting
systems, inadequate independent
verification of reported amounts, and
lack of other financial controls.
Effect: HCFA has limited assurance that
amounts reported by contractors are
properly classified, summarized, and
supported by appropriate detailed
records to ensure their validity.
Finding: HCFA preparation of annual
financial statements is manually
intensive, requiring extensive
adjustments due to lack of an accounting
software package to automatically
manipulate data for development of
financial statements.
Effect: HCFA cannot timely prepare
financial statements and material errors
may not be detected timely.
Finding: HCFA lacked adequate procedures
to detect errors in data used to
estimate the entitlement benefits due
and payable liability.
Effect: The liability could be
inaccurately reported in financial
statements.
Finding: Contractor EDP controls over
data processing systems do not provide
adequate safeguards to reduce improper
access to and manipulation of data.
Effect: Confidential medical data may be
disclosed and Medicare claims improperly
processed or paid.
Finding: Contractor controls to properly
account for cash balances and activity
do not provide adequate safeguards to
reduce the opportunities for theft and
irregularities in cash procedures.
Effect: Medicare funds could be misused.
Finding: HCFA lacked detailed records to
support overpayments owed back to the
Medicare program by providers and other
entities when Medicare is the secondary
payer of claims.
Effect: Potential losses in collecting
millions from accounts receivables that
are deemed uncollectible due to lack of
support.
Finding: HCFA lacked oversight and
monitoring practices to ensure that
material errors in contractor financial
data are detected promptly.
Effect: HCFA could not accurately and
timely account for Medicare finances.
Source: GAO analysis of HHS OIG reports on the financial statement audits of
the Health Care Financing Administration for fiscal years 1996-1999.
Financial Management Improvement Projects
Current
Project name Project phase Project objective(s) projected
completion
date
Develop an
integrated general
Integrated General LedgerDevelopment of system ledger accounting
Accounting System (IGLAS)requirements system at the After 2004
contractor and HCFA
levels.
Develop an
integrated system to
manage and account
for the recovery of
Medicare payments
Recovery Management Development of system made in error July 2001
Accounting System (ReMAS)requirements because the or later
beneficiary has
other insurance
(Medicare as the
secondary payer,
MSP).
Design, develop, and
implement a computer
system which will
receive accounts
receivable data from
the
Medicare-contractor
Medicare Accounts Development of system selected systems
Receivable System (MARS) requirements and, from this data, July 2001
will produce
information needed
by HCFA staff in
debt collection and
financial reporting
activities (non-MSP
receivables).
Develop a manual
that will be the one
source for
contractors
Identification of the regarding financial
Internal Control Review current sources of management
(consolidation of HCFA's financial management requirements and August 31,
financial management guidance (program instructions. A 2000
guidance into one manual)memorandums, users' manual would
carrier/financial also be written to
intermediary manuals) be used by
auditors/reviewers
to assess contractor
compliance with the
guidance.
Validate the
accuracy and
completeness of
Medicare accounts Complete for FY 1999; Medicare
receivable consulting similar effort planned for contractors' Not yet
efforts FY 2000 accounts receivable finalized
balances at fiscal
year-end and through
the subsequent 6
months of activity.
To perform internal
control reviews at
selected Medicare
Funding has been approved contractors as part
SAS-70/Self-Certificationfor the performance of of HCFA's
Reviews SAS-70/self-certification performance April 2000
reviews at 26 Medicare evaluation to ensure
contractors that these
contractors meet
their contractual
obligations.
Source: GAO analysis of documents and oral statements provided by HCFA
staff.
GAO Contacts and Staff Acknowledgments
Kay Daly, (202) 512-9312
Kimberly Brooks, (202) 512-9038
Jim Kernen, (404) 679-1938
In addition to those named above, Shawn Ahmed, Ed Brown, Ray Bush, Don
Hunts, Wayne Marsh, Meg Mills, Timothy Murray, Dave Shoemaker, Sabrina
Springfield, and Cynthia Teddleton made key contributions to this report.
(916281)
Figure 1: Flow of Medicare Program Dollars 9
1. The term internal control is synonymous with the term management control
(as used in Office of Management and Budget Circular A-123) that covers all
aspects of an agency's operations (programmatic, financial, and compliance).
2. The standards define internal control as an integral component of an
organization's management that provides reasonable assurance that the
following objectives are being achieved: (1) effectiveness and efficiency of
operations, including the use of the entity's resources, and (2) reliability
of financial reporting, including reports on budget execution, financial
statements and other reports, and compliance with applicable laws and
regulations.
3. Other management reform legislation that has had an impact on financial
management includes (1) the Federal Financial Management Improvement Act
(FFMIA) of 1996 and
(2) the Clinger-Cohen Act of 1996.
4. Contractors are intermediaries and carriers with whom HCFA contracts to
administer the Medicare fee-for-service claims.
5. Medicare Contractors: Despite Its Efforts, HCFA Cannot Ensure Their
Effectiveness or Integrity (GAO/HEHS-99-115, July 14, 1999).
6. The 1965 legislation establishing Medicare originally covered people 65
and over. Legislation in 1972 broadened the program to cover certain
disabled people and those with permanent kidney failure.
7. Contractors report basic balance sheet and income statement information
on HCFA Form 750 and detailed accounts receivable information on HCFA Form
751.
8. Most intermediaries and carriers are local Blue Cross Blue Shield
companies.
9. FFMIA requires agencies to substantially comply with (1) federal
financial management systems requirements, (2) applicable federal accounting
standards, and (3) the U.S. Government Standard General Ledger (SGL) at the
transaction level.
10. The audit reports classified the deficiencies as reportable conditions
or material weaknesses, which are conditions in which the design or
operation of one or more of the internal control components do not reduce to
a relatively low level the risk that misstatements caused by errors, fraud,
or noncompliance in amounts that would be material to the financial
statements may occur and not be detected promptly by employees in the normal
course of performing their duties.
11. A qualified opinion states that except for the effects of the matter to
which the qualification relates the statements are free from material
misstatements.
12. OMB Circular No. A-123 Revised, June 21, 1995, Management Accountability
and Control.
13. GAO/HEHS-99-115, July 14, 1999.
14. GAO/HEHS-99-115, July 14, 1999.
15. Congress established two trust funds for Medicare. The Hospital
Insurance (HI) trust fund is used to pay Medicare Part A claims and is
funded primarily by employment taxes. The Supplementary Medical Insurance
(SMI) trust fund is used to pay Part B claims and is primarily funded by
Medicare premiums and a federal matching contribution.
16. Although incorrect balances in the Medicare trust funds resulted in a
net loss of interest income to the Medicare program, other Treasury
investments earned the interest lost by the Medicare program. As a result,
these events did not result in a net loss to the U.S. government.
17. Major Management Challenges and Program Risks: A Governmentwide
Perspective (GAO/OGC-99-1, January 1999).
18. The Clinger-Cohen Act of 1996 builds on the best practices of leading
public and private organizations by requiring agencies to better link
information technology planning and investment decisions to program missions
and goals.
19. Executive Guide: Creating Value Through World-Class Financial Management
(GAO/AIMD-99-45, August 1999, exposure draft).
20. Human Capital: A Self-Assessment Checklist for Agency Leaders
(GAO/GGD-99-179, Sept. 1999).
21. Financial Management: Fostering the Effective Implementation of
Legislative Goals (GAO/T-AIMD-98-215, June 1998).
22. Health Care Financing Administration, Fiscal Year 1999 Consolidated
Financial Statements, Ernst & Young LLP, February 2000.
*** End of document. ***