Medicaid Financial Management: Better Oversight of State Claims  
for Federal Reimbursement Needed (28-FEB-02, GAO-02-300).	 
                                                                 
The Medicaid program spent more than $200 billion in fiscal year 
2000 to meet the health care needs of nearly 34 million poor,	 
elderly, blind, and disabled persons. States are responsible for 
making proper payments to Medicaid providers, recovering misspent
funds, and accurately reporting costs for federal reimbursement. 
At the federal level, the Centers for Medicare and Medicaid	 
Services (CMS) oversee state financial activities and ensure the 
propriety of expenditures reported for federal reimbursement. GAO
found that weak financial oversight by CMS leaves the program	 
vulnerable to improper payments. The Comptroller General's	 
Standards for Internal Control in the Federal Government requires
that agency managers perform risk assessment, take steps to	 
mitigate identified risks, and monitor the effectiveness of those
actions. The standards also require that authority and		 
responsibility for internal controls be clearly defined. CMS	 
oversight had weaknesses in each of these areas. As a result, CMS
did not know if its control efforts were focused on areas of	 
greatest risk. CMS also was not effectively implementing the	 
controls it had in place.  Furthermore, managers had not	 
established performance standards for financial oversight	 
activities, particularly their expenditure review activity.	 
Limited data were collected to assess regional financial analyst 
performance in overseeing state internal controls and		 
expenditures. In addition, the CMS audit resolution procedures	 
did not collect enough information on the status of audit	 
findings or ensure that audit findings were resolved promptly.	 
CMS' current organizational structure lacks clear lines of	 
authority and responsibility between the regions and		 
headquarters.							 
-------------------------Indexing Terms------------------------- 
REPORTNUM:   GAO-02-300 					        
    ACCNO:   A02818						        
  TITLE:     Medicaid Financial Management: Better Oversight of State 
Claims for Federal Reimbursement Needed 			 
     DATE:   02/28/2002 
  SUBJECT:   Erroneous payments 				 
	     Financial management				 
	     Health care costs					 
	     Internal controls					 
	     Reporting requirements				 
	     Risk management					 
	     Medicaid Program					 
	     State Children's Health Insurance			 
	     Program						 
                                                                 

******************************************************************
** This file contains an ASCII representation of the text of a  **
** GAO Product.                                                 **
**                                                              **
** No attempt has been made to display graphic images, although **
** figure captions are reproduced.  Tables are included, but    **
** may not resemble those in the printed version.               **
**                                                              **
** Please see the PDF (Portable Document Format) file, when     **
** available, for a complete electronic file of the printed     **
** document's contents.                                         **
**                                                              **
******************************************************************
GAO-02-300
     
United States General Accounting Office

GAO Report to the Subcommittee on Government Efficiency, Financial
Management and Intergovernmental Relations, Committee on Government Reform,
House of Representatives

February 2002

MEDICAID FINANCIAL MANAGEMENT

Better Oversight of State Claims for Federal Reimbursement Needed

                                      a

GAO-02-300

Contents

Letter

Results in Brief
Background
Objectives, Scope, and Methodology
CMS Had Not Implemented a Risk-Based Approach and Effective

Control Activities for Financial Oversight Monitoring Activities Were
Limited in Scope and Effectiveness Organizational Structure Impedes
Effective Oversight Conclusion Recommendations for Executive Action Agency
Comments and Our Evaluation

                                                                   1 2 4 10

12 27 31 35 35 37

Appendix

Appendix I: Comments from  the U.S. Department of Health and Human Services'
Centers for Medicare and Medicaid Services

Related GAO Products

 Tables            Table 1: Expenditure and Budget Forms Submitted by States             7
                       Table 2: External Oversight Activities by Entity                  9
                           Table 3: Examples of State Medicaid Prepayment Reviews and
                                   Other Prevention Efforts                             16
                      Table 4: Examples of State Postpayment Detection Activities and
                                   Payment Accuracy Studies                             18
                         Table 5: Regional Office Oversight Activities                  21

Figures   Figure 1: CMS Organization Chart Figure 2: Medicaid Financial Management and
                                                                    Oversight Process  6 8
                       Figure 3: Change in Financial Analysts (FTEs) versus Change in
                          Federal Medicaid Expenditures 1992 and 2000                   14

Contents

Abbreviations

CMS Centers for Medicare and Medicaid Services
CMSO Center for Medicaid and State Operations
DAL Division of Audit Liaison
DFM Division of Financial Management
DSH Disproportionate Share Hospital
FTE full time equivalent
HCFA Health Care Financing Administration
HHS Department of Health and Human Services
MCO Managed Care Organization
MSIS Medicaid Statistical Information System
OIG Office of Inspector General
OMB Office of Management and Budget
PARIS Public Assistance Reporting Information System
RO Regional Office
SCHIP State Children's Health Insurance Program
SSA Social Security Administration

A

United States General Accounting Office Washington, D.C. 20548

February 28, 2002

The Honorable Stephen Horn

Chairman

The Honorable Janet D. Schakowsky

Ranking Member

Subcommittee on Government Efficiency, Financial Management and
Intergovernmental Relations Committee on Government Reform House of
Representatives

The federal government and states share responsibility for the fiscal
integrity and financial management of the jointly funded Medicaid program.
During fiscal year 2000, the Medicaid program served about 33.4 million
low-income families as well as certain elderly, blind, and disabled persons
at a cost of $119 billion to the federal government and $88 billion to the
states for program payments and administrative expenses. States are the
first line of defense in safeguarding Medicaid financial management, as they
are responsible for making proper payments to Medicaid providers, recovering
misspent funds, and accurately reporting costs for federal reimbursement. At
the federal level, the Centers for Medicare and Medicaid Services (CMS) is
responsible for overseeing state financial activities and ensuring the
propriety of expenditures reported by states for federal reimbursement.1

How well states manage Medicaid finances and how well CMS oversees state
financial management are important concerns because of the size and nature
of the program. Audits of state Medicaid finances conducted in accordance
with the Single Audit Act of 1984, as amended, annually identify millions of
dollars in questionable or unallowable costs incurred by state Medicaid
agencies. In addition, annual financial statement audits required under the
Chief Financial Officers Act have identified many internal control
weaknesses in regards to CMS's oversight of state Medicaid financial
operations.

In light of these concerns, you requested that we review the adequacy of
CMS's financial oversight process for Medicaid. Our review assesses whether
(1) CMS has an adequate oversight process to help ensure the propriety of
Medicaid expenditures, (2) CMS adequately evaluates and

1Until June 2001, CMS was known as the Health Care Financing Administration
(HCFA).

monitors the results of its oversight process and makes adjustments as
warranted, and (3) the current CMS organizational structure for financial
management is conducive to effectively directing its oversight process and
sustaining future improvements. This report responds to your request.

Results in Brief Although CMS is responsible for overseeing the more than
$100 billion that the federal government expends annually for Medicaid, its
financial oversight has weaknesses that leave the program vulnerable to
improper payments. The comptroller general's Standards for Internal Control
in the Federal Government2 requires that agency managers perform risk
assessments, take actions to mitigate identified risks, and then monitor the
effectiveness of those actions. In addition, the standards provide that
agencies should ensure that the organizational structure is designed so that
authority and responsibility for internal controls are clear. CMS oversight
had weaknesses in each of these areas.

Our review found that CMS had only recently begun to assess areas of
greatest risk for improper payments, and thus did not have controls in place
that focused on the highest risk areas. As a result, CMS did not have the
requisite assurance that its control activities were focused on areas of
greatest risk. CMS also was not effectively implementing the controls it had
in place. For example, analysts across the 10 regions did not consistently
conduct focused financial reviews that are beneficial in identifying
unallowable costs in specific Medicaid service areas; only 8 such reviews
were conducted in fiscal year 2000 as compared to 90 reviews in fiscal year
1992, which CMS attributes to lack of resources. Recognizing its oversight
deficiencies and resource constraints, CMS began efforts in April 2001 to
develop a risk-based approach and revise its control activities. These
efforts did not, however, integrate information available from state
financial oversight program activities or consider other control techniques
that could enable CMS to more efficiently and effectively carry out its
oversight responsibilities.

Our review also found that CMS had few mechanisms in place to continuously
monitor the effectiveness of its oversight. Managers had not established
performance standards for financial oversight activities, particularly their
expenditure review activity. Limited data were collected

2 U.S. General  Accounting  Office,  Standards for  Internal Control  in the
Federal Government, GAO/AIMD-00-21.3.1 (Washington D.C.: 1999).

to assess regional financial analyst performance in overseeing state
internal controls and expenditures. In addition, the CMS audit resolution
procedures did not collect sufficient information on the status of audit
findings or ensure that audit findings were resolved promptly.

The current organizational structure of CMS has created challenges to
effective oversight because of unclear lines of authority and responsibility
between the regions and headquarters. Although the 10 regional offices are
the CMS frontline defense in overseeing state financial management and
Medicaid expenditures, there are no reporting relationships to the
headquarters unit responsible for Medicaid financial management. As a
result, CMS lacks consistency in its approach to establish and enforce
standards, evaluate regional office oversight, and implement changes to
improve financial oversight.

Improving the oversight of Medicaid finances will require commitment from
top-level managers to formulate a workable financial management strategy,
ensure accountability for its implementation, and allocate sufficient
resources. This report makes recommendations on ways CMS can revise its risk
assessment efforts, restructure its financial control activities, improve
monitoring, and address accountability and authority issues posed by its
organizational structure.

In written comments on a draft of this report, CMS outlined a series of
actions it has planned or recently begun to address its Medicaid financial
management challenges. CMS stated that these efforts substantially address,
within current resource constraints, the four areas of our recommendations.
In supplementary oral comments, however, CMS did not agree with our
recommendations related to audit tracking and resolution reports, stating
that the current reports are adequate. We disagree that the reports are
adequate given the omission of information from the reports on the status of
numerous audit findings and believe that CMS needs to work cooperatively
with the HHS-OIG to ensure that its audit tracking information is current
and complete. Accordingly, we continue to believe that CMS should take steps
to ensure that tracking reports provide agency management with the necessary
information to determine that actions are taken promptly to prevent Medicaid
financial management weaknesses from continuing. Additional details on CMS
comments and our assessment of its position appear in the Agency Comments
and Our Evaluation section at the end of this report.

Background CMS, a component of the Department of Health and Human Services
(HHS), administers the Medicaid program. Medicaid is the third largest
social program in the federal budget and is one of the largest components of
state budgets. Although it is one federal program, Medicaid consists of 56
distinct state-level programs-one for each state, territory, Puerto Rico,
and the District of Columbia.3

Each of the states has a designated Medicaid agency that administers the
Medicaid program. The federal government matches state Medicaid spending for
medical assistance according to a formula based on each state's per capita
income. The federal share can range from 50 to 83 cents of every state
dollar spent.

In accordance with the Medicaid statute and within broad federal guidelines,
each state establishes its own eligibility standards; determines the type,
amount, duration, and scope of covered services; sets payment rates; and
develops its administrative structure. Each state Medicaid agency is also
responsible for establishing and maintaining an adequate internal control
structure to ensure that the Medicaid program is managed with integrity and
in compliance with applicable law. States are required to describe the
nature and scope of their programs in comprehensive written plans submitted
to CMS-with federal funding for state Medicaid services contingent on CMS
approval of the plans. This approval hinges on whether CMS determines that
state Medicaid plans meet all applicable federal laws and regulations.

At the federal level, the Center for Medicaid and State Operations (CMSO)
within CMS is responsible for approving state Medicaid plans, working with
the states on program integrity and other program administration functions,
and overseeing state financial management and internal control processes.
CMSO shares Medicaid program administration and financial management
responsibilities with the 10 CMS regional offices (RO). The Division of
Financial Management (DFM), within CMSO's Finance, Systems and Quality
Group, has primary responsibility for Medicaid financial management. DFM, in
conjunction with the 10 regions, establishes and maintains the internal
control structure for Medicaid financial management and state oversight.

3Hereafter, all will be referred to as states.

As is the case for all major federal agency programs, the internal control
structure established by CMS for Medicaid should meet requirements of Office
of Management and Budget (OMB) Circular A-123, Management Accountability and
Control, and the Standards for Internal Control in the Federal Government.
According to Circular A-123, management controls are the organization
policies and procedures used to reasonably ensure that programs are
protected from waste, fraud, and mismanagement and achieve their intended
results. Establishing good management controls requires, according to the
circular, that agency managers take systematic and proactive measures to
implement appropriate management controls, assess the adequacy of the
controls, identify needed improvements, and take corresponding corrective
action. The Standards for Internal Control in the Federal Government
includes five standards that provide a roadmap for agencies to establish
control for all aspects of their operations and a basis against which
agencies' control structures can be evaluated. The standards are defined as
follows:

* Control environment-creating a culture of accountability by establishing a
positive and supportive attitude toward improvement and the achievement of
established program outcomes.

* Risk assessment-performing comprehensive reviews and analyses of program
operations to determine if risks exist and the nature and extent of the
risks identified.

* Control activities-taking actions to address identified risk areas and
help ensure that management's decisions and plans are carried out and
program objectives are met.

* Information and communication-using and sharing relevant, reliable, and
timely financial and nonfinancial information in managing operations.

* Monitoring-tracking improvement initiatives over time, and identifying
additional actions needed to further improve program efficiency and
effectiveness.

The internal control structure and financial oversight process that CMS has
designed for Medicaid includes activities for (1) approving and awarding
grants to make funds available to the states for the efficient operation of
the Medicaid program, (2) overseeing state financial management and internal
control processes, (3) ensuring the reasonableness of budgets reported to
estimate federal funding requirements, and (4) ensuring the propriety of
expenditures reported for federal matching funds. DFM shares these
responsibilities with about 76 regional financial analysts and

   branch chiefs, who report to their respective regional administrators.
   Figure 1 outlines CMS's organizational structure related to Medicaid.

                      Figure 1: CMS Organization Chart

Regional financial analysts are  key to CMS financial management activities,
as they are responsible for performing frontline activities to oversee state

financial management and internal control processes. Some of the key
oversight activities performed by regional analysts are (1) reviewing state
quarterly budget estimates and expenditure reports, (2) preparing decision
reports that document approvals for federal reimbursement and reimbursement
deferral actions, (3) providing technical assistance to states on financial
matters, and (4) serving as liaison to the states and audit entities. DFM
staff in headquarters rely on regional decision reports to help determine
and issue state grant awards.

States submit various federal reporting forms that provide regional
financial analysts with the budget and expenditure data to execute their
financial management and oversight responsibilities. When the State
Children's Health Insurance Program (SCHIP) was created through the Balanced
Budget Act of 1997 to provide health insurance to children of low-income
families who would not qualify for Medicaid, states have been required to
submit expenditure and budget data on both Medicaid and SCHIP. The Medicaid
and SCHIP forms are submitted quarterly through the Medicaid and SCHIP
Budget and Expenditure System (MBES). See table 1 below for a brief
description of the contents of the reporting forms.

         Table 1: Expenditure and Budget Forms Submitted by States

Form Description

CMS 64 - Quarterly Medicaid State The accounting statements that the state
agency, in accordance with 42 CFR 430.30(c),

Expenditures Report submits each quarter under Title XIX of the Social
Security Act. The expenditure report shows how the state expended its
federal Medicaid grant funds for the quarter being reported as well as any
adjustments to expenditures, which relate to previous quarters. It is a
summary of actual expenditures derived from source documents including
invoices, cost reports, and eligibility records.

CMS 37 - Quarterly Medicaid Program Budget A financial report submitted by
the state in accordance with 42 CFR 430.30(b). The

Report report provides the state's Medicaid funding requirements for a
certified quarter and estimates the underlying assumptions for 2 fiscal
years, current and budget. In order to receive the federal share of state
Medicaid expenditures, referred to as the Federal Financial Participation
(FFP), the state must verify that the requisite matching state and local
funds are, or will be, available for the certified quarter.

CMS 21 - State Children's Health Insurance The accounting statement that the
state submits each quarter in accordance with Program (SCHIP) Statement of
Expenditures Sections 2105 (e) and 2107 (b)(1) of the Social Security Act.
The statement is a for Title XXI summary of actual expenditures derived from
source documents including invoices, cost

                     reports, and eligibility reports.

CMS 21B - State Children's Health Insurance A financial report submitted by
the state in accordance with Sections 2105 (e) and 2107

Program (SCHIP) Budget Report for Title XXI (b) of the Social Security Act.
The report provides a statement of the state's expenditure plan and funding
requirements for a certified quarter and estimates for 2 fiscal years,
current and budget. States must verify that the requisite matching state and
local funds are, or will be, available for the certified quarter.

Reviews of the Medicaid and SCHIP expenditure reports (CMS 64 and 21) are
the primary oversight control activities performed by regional financial
analysts. These reviews are used to determine if Medicaid expenditures are
complete, properly supported by the state's accounting records, claimed at
appropriate federal matching rates, and allowable in accordance with
existing federal laws and regulations. Regional analysts are expected to
obtain knowledge about state financial management and internal control
processes to aid in assessing the expenditures reported for federal
reimbursement. Figure 2 shows an overview of the financial management and
oversight process.

       Figure 2: Medicaid Financial Management and Oversight Process

a CMS  transmits  award  amounts to  HHS's  Program  Support Center.  States
withdraw funds to pay the expenses of the Medicaid program.

b Health care  providers include  physicians, dentists, nurses,  home health
care providers, rural health clinics, and nursing facilities.

Oversight of state expenditures and internal controls by CMS regional
financial analysts is not the only federal oversight mechanism for ensuring
the propriety of Medicaid finances. Medicaid expenditures and requisite
internal controls are reviewed annually by auditors under requirements of
the Single Audit Act of 1984. The Congress established the Single Audit Act
to gain reasonable assurance that federal financial assistance programs are
managed in accordance with applicable laws and regulations. The Single Audit
Act requires audits of state and local government entities that expend at
least $300,000 in federal awards annually.4 The results of these audits are
provided to the state and responsible federal agency. The federal agency is
responsible for following up with the state to ensure that the state takes
action to correct the deficiencies identified from the audit.

Other entities have responsibilities for routinely reviewing Medicaid
finances and Medicaid internal controls. Table 2 explains various oversight
activities by entities outside of CMS.

              Table 2: External Oversight Activities by Entity

                         Entity Oversight activity

HHS  Office  of  Inspector  *  HHS/OIG  oversees the  annual  CFO  financial
statement

General  (HHS/OIG) audit  of CMS,  which includes  an audit of  the Medicaid
program's financial statements.

* HHS/OIG performs program and financial audits.

* HHS/OIG tracks open recommendations and performs follow-up inquiries.

State auditors * State auditors perform the state single audit in accordance
with the Single Audit Act.

* The auditors perform state audits and reviews.

State Medicaid  agencies *  State Medicaid agencies  administer the Medicaid
program to local beneficiaries.

* The agencies pay the providers for Medicaid services.

*  The  agencies  ensure  proper payment  and  recovery  of  funds paid  for
unallowable claims.

State Medicaid fraud control * State Medicaid Fraud Control Units are
responsible for units investigating and ensuring prosecution of Medicaid
fraud.

4 In some  instances,  states hire  independent public  accounting  firms to
perform the state single audit.

Objectives, Scope, and Methodology

Our objectives were to determine if (1) CMS has an adequate oversight
process to help ensure the propriety of Medicaid expenditures, (2) CMS
adequately evaluates and monitors the results of its oversight process and
makes adjustments as warranted, and (3) the current CMS organizational
structure for financial management is conducive to effectively directing its
oversight process and sustaining future improvements.

To evaluate CMS financial oversight, the control activities used to help
ensure the propriety of Medicaid expenditures, and CMS's efforts to monitor
its financial oversight, we performed work at CMS regional and headquarters
offices, surveyed financial management staff, and reviewed CMS manuals and
other documentation, as well as audit reports.

* As agreed with your offices, we visited 5 of the 10 CMS regional offices
(Atlanta, Boston, Chicago, New York, and San Francisco) to observe and
interview the financial management staff. We selected the five regions based
on geographical dispersion across the country and based on the total amount
of Medicaid expenditures processed by each region. The five regions were
collectively responsible for overseeing more than half of the total Medicaid
expenditures for fiscal year 2000. We discussed recent program changes,
which significantly increased financial management oversight activities for
regional analysts. We questioned staff about the extent to which certain
activities, such as focused financial management reviews, were conducted and
reviewed any reports and corresponding workpapers that were available. Key
CMS financial managers at headquarters in Baltimore were also interviewed to
gain a comprehensive understanding of overall financial management
objectives for the Medicaid program. We also discussed performance and
budget reporting as well as efforts to coordinate with state auditors.

* We administered a Web-based survey to regional financial management
members to gain a better understanding of the control activities being
performed by regional offices. The survey was sent to all regional office
branch chiefs and staff classified as financial analysts who are responsible
for overseeing state financial management and internal controls for
Medicaid. All of the 11 branch chiefs responded and 59 of the 65 analysts
responded, for a 92 percent response rate-the 6 analysts who did not respond
were from one regional office. The survey obtained information on how
oversight for Medicaid financial management is designed and implemented, as
well as the frontline staff perspective on effectiveness. Survey respondents
answered questions relating to review procedures performed, use of state
single audits,

follow-up of audit findings, and communications with state auditors and
offices of inspectors general. Many of the questions asked the analysts to
respond based on their performance of activities for the period from October
1, 1999, through the date of the survey. The practical difficulties in
conducting any survey can introduce errors, commonly referred to as
nonsampling errors. We included steps in both the data collection and data
analysis to minimize such nonsampling errors. Multiple versions of the
questionnaire were pretested with regional financial analysts before the
final survey was administered. A 92 percent response rate was achieved, and
the respondents directly entered the responses into the database via the
Internet survey. Data checks were performed and a second independent analyst
reviewed computer analyses.

* We obtained and reviewed CMS documents and manuals that described current
financial oversight activities and performance reporting previously used to
monitor oversight. We reviewed audit reports that included findings related
to Medicaid financial management, including the CMS/HCFA financial reports
for fiscal years 1998 through 2000 and Single Audit Act reports for fiscal
years 1999 and 2000. To help judge the adequacy of CMS's Medicaid financial
management oversight process, we evaluated CMS oversight against the
comptroller general's Standards for Internal Control in the Federal
Government. We also consulted with state auditors during our regional site
visits to obtain an understanding of their oversight activities for the
Medicaid program, including the level of audit coverage given to Medicaid
financial operations and the control techniques used.

To determine whether CMS's organizational structure for financial management
is conducive to effectively directing its oversight process and sustaining
future improvements, we interviewed the director and deputy director of the
CMSO Finance Systems and Quality Group as well as managers within the
Division of Financial Management. We also conducted interviews with managers
at the five regional offices. In addition, we compared information that we
gathered about the current organizational structure, regional and central
office communications, and improvement initiatives with the standards for
control environment and information and communication components of internal
control as described in the Standards for Internal Control in the Federal
Government.

We performed our fieldwork from October 2000 through September 2001, at the
CMS central office in Baltimore, Md., and the five regional offices
mentioned above. We focused on the internal control processes in place

during fiscal years 2000 and 2001. All work was performed in accordance with
generally accepted government auditing standards. We requested written
comments on a draft of this report from the administrator of CMS. These
comments are reprinted in appendix I. We also received supplementary oral
comments from the Director of the CMS Division of Audit Liaison.

CMS Had Not Implemented a Risk-Based Approach and Effective Control
Activities for Financial Oversight

Although CMS is responsible for ensuring the propriety of over $100 billion
expended annually by the federal government for Medicaid, its financial
oversight process did not incorporate key standards for internal control
necessary to reduce the risk of inappropriate expenditures. The comptroller
general's Standards for Internal Control in the Federal Government requires
that agency managers perform risk assessments and then take actions to
mitigate identified risks that could impede achievement of agency
objectives. However, until recently, the oversight process that CMS used for
Medicaid expenditures did not include assessments that identified the areas
of greatest risk of improper payments. Therefore, CMS did not have the
requisite assurance that its control activities were focused on areas of
greatest risk. In addition, the controls that were in place were not
effectively implemented. As a result, CMS was not deploying its limited
oversight resources efficiently and effectively to detect improper
expenditures. CMS managers recognized the deficiencies of its oversight and
began efforts in April 2001 to develop a risk-based approach and revise
control activities. However, these efforts did not specifically consider
information on state financial oversight and program integrity activities
such as pre-and postpayment detection methods, and payment accuracy studies
and initiatives to prevent fraud and abuse, or consider advanced control
techniques for detecting improper Medicaid payments.

CMS Did Not Use a Risk-Based Approach in Reviewing Expenditures

Federal internal control standards require managers to perform risk
assessments to identify areas at greatest risk of fraud, waste, abuse, and
mismanagement. The standards require that once risks are identified, they
should be analyzed for their possible effect by estimating their
significance and assessing the likelihood of losses due to the risks
identified. Despite repeated auditor recommendations, CMS had not developed
and implemented a systematic risk assessment method in its oversight process
to help ensure that states expend federal funds in accordance with laws and
to identify amounts inappropriately claimed for federal

reimbursement. In April 2001, CMS took action to develop a risk assessment;
however, this analysis has not yet been used to deploy resources to areas of
greatest risk and requires several improvements to enhance its usefulness in
the oversight process.

Since 1998, financial auditors responsible for the annual financial
statement audit of Medicaid expenditures have recommended that CMS implement
a risk-based approach for overseeing state internal control processes and
reviewing expenditures. In performing audits of CMS's financial statements
for fiscal years 1998, 1999, and 2000, auditors have noted that CMS failed
to institute an oversight process that effectively reduced the risk that
inappropriate expenditures could be claimed and paid.5 In addition, the
auditors identified internal control weaknesses that increased the risk of
improper payments. These weaknesses included (1) a significant reduction in
the level of detailed analysis performed by regional financial analysts in
reviewing state Medicaid expenses, (2) minimal review of state Medicaid
financial information systems, and (3) lack of a methodology for estimating
the range of Medicaid improper payments on a national level.

CMS Medicaid officials attributed most of the weaknesses identified by the
auditors to reductions in staff resources and the multiple oversight
activities that its staff is responsible for carrying out. According to
Medicaid financial managers, changes in the Medicaid program since fiscal
year 1998, specifically the addition of SCHIP, created additional oversight
responsibilities for CMS financial management staff. Particularly, financial
analysts are required to handle more state inquiries regarding technical
financial issues that must be addressed promptly. At the same time, however,
financial analyst resources previously devoted to oversight activities
declined. Medicaid financial managers provided us with data to show that
from fiscal year 1992 to September 2000, full-time equivalent (FTE)
positions for regional financial staffs declined by 32 percent from 95 to
approximately 65 FTEs. At the same time, federal Medicaid expenditures
increased 74 percent from $69 billion to $120 billion. On average, each of
the 64 regional financial analysts is now responsible for reviewing almost
$1.9 billion in federal Medicaid expenditures each fiscal year as compared
to an average of about $0.7 billion a decade ago. Figure 3

5In some instances, these findings were included in the management letters
that accompanied the audited financial statements in fiscal years 2000,
1999, and 1998.

depicts the decrease in  financial analysts (i.e., FTEs) and the increase in
Medicaid expenditures between the years 1992 and 2000.

Figure 3: Change in Financial Analysts (FTEs) versus Change in Federal
Medicaid Expenditures 1992 and 2000a

Number of analysts Federal expenditures (dollars in billions)

100 95 FTEs 140

                              120 
80

100

60 
60 40

40

20 20

00

1992 2000 1992 2000

aThe $120 billion in expenditures in 2000 is equal to $97.8 billion in 1992
dollars when adjusted for inflation.

Source: CMS.

Until recently, Medicaid financial managers had not taken action to
implement a risk-based approach for Medicaid financial oversight. Managers
stated that the Medicaid financial oversight process had been based on the
presumption that financial analysts adequately applied the inherent
knowledge of program risks acquired from years of experience in reviewing
state Medicaid expenditures and providing technical assistance to states in
operating their Medicaid programs. However, as Medicaid program expenditures
have increased, CMS managers acknowledged that they needed to revise their
oversight approach. As a result, during our review, CMS began in April 2001
to develop a risk-based approach for determining how best to deploy its
resources in reviewing Medicaid expenditures.

The Medicaid risk assessment effort required each regional office to provide
data on the states and territories in its jurisdiction based on regional
analyst experience and knowledge. For each type of Medicaid

service and administrative expense, the Medicaid risk analysis estimates the
likelihood of risk based on the dollar amount expended annually and measures
the significance of risk based on factors such as unclear federal payment
policy, state payment involving county and local government, and results of
federal audits. The risk analysis provides a risk score for each state that
is intended to specify the Medicaid service and administrative expense
categories that are of greatest risk for improper payments in the state.

Medicaid financial managers also tabulated a national risk score for each
type of Medicaid service and administrative expense using the state risk
scores. However, CMS had not taken steps to use the risk analysis in
deploying its regional financial oversight resources. Medicaid financial
managers in headquarters and the regional offices plan to develop work plans
that will allocate resources based on the risks identified from its
analysis. CMS expects to implement these work plans in reviewing the state's
quarterly expenditure reports for fiscal year 2003.

In evaluating the Medicaid risk analysis, we considered strategies that
leading organizations used in successfully implementing risk management
processes. Two such strategies, which are included in our executive guide,
Strategies to Manage Improper Payments6 are as follows.

* Information developed from risk assessments should help form the
foundation or basis upon which management can determine the nature and type
of corrective actions needed, and should give management baseline data for
measuring progress in reducing payment inaccuracies and other errors.

* Management should reassess risks on a recurring basis to evaluate the
impact of changing conditions, both external and internal, on program
operations.

While the Medicaid risk analysis is a good start, we identified several
improvements that should be made to the assessment before it is used in
deploying resources. The issues we identified could hinder the quality of
baseline information gathered and, accordingly, affect management's ability
to thoroughly reassess risks and measure the impact of corrective actions on
a recurring basis. First, the analysis does not sufficiently take

6U.S.  General Accounting Office,  Strategies to Manage Improper  Payments :
Learning   From  Public   and  Private  Sector  Organizations ,   GAO-02-69G
(Washington D.C.: 2001).

into account state financial oversight activities in assessing the risks for
improper payments in each state. Regional financial analysts were instructed
to rate the adequacy of each state Medicaid agency's financial oversight as
one of the risk factors in determining the likelihood and significance of
risk in each state. The analysts were instructed to consider whether a state
regularly reviews claims submitted by local government entities that provide
Medicaid services and whether state audits were conducted regularly.
However, the analysts were not specifically instructed to consider states'
use of (1) prepayment edits and reviews to help prevent improper payments,
(2) screening procedures to prevent dishonest providers from entering the
Medicaid program, (3) postpayment reviews to detect inappropriate payments
after the fact, and (4) payment accuracy studies to measure the extent of
improper payments.

Several states have implemented cost-effective prevention efforts to protect
Medicaid program dollars, such as prepayment computer "edits," manual
reviews of claims before payment, and thoroughly checking the credentials of
individuals applying to be program providers. Table 3 shows examples of
prepayment reviews currently being used by some states.

Table 3: Examples of  State Medicaid Prepayment Reviews and Other Prevention
Efforts

                             State State effort

California Bars providers with previously questionable billing patterns from
submitting claims electronically and performs a manual review before making
payment. This saved more than $17 million in fiscal years 1998 and 1999.

New  Jersey  Uses  off-the-shelf software  to  analyze  claims for  aberrant
patterns before payments are made.

Washington Uses an on-line drug claims management system to finalize
pharmaceutical claims when the pharmacist fills the beneficiary's
prescription. The system screens for duplicate claims and drugs requiring
prior authorization, and provides alerts to such factors as insufficient or
excessive dosages and interactions with other drugs. If appropriate, it
approves payment.

(Continued From Previous Page)

State State effort

Florida Requires providers such as physicians, pharmacists, dentists, and
others who are not employees of institutions like hospitals to undergo
fingerprinting and criminal background screening. All officers, directors,
managers, and owners of 5 percent or more of a provider business must be
screened. Fingerprints are checked with both state and federal law
enforcement agencies.

Connecticut, Florida, Georgia, Structure provider agreements so that they
can terminate

and Texas providers from their program without cause, allowing for more
expeditious removal of providers who are billing inappropriately.

Florida and Texas Implement tighter enrollment standards-through enhanced
background checks. Recently required existing providers to reenroll under
stricter new standards.

New Jersey Institutes more stringent enrollment procedures for provider
categories with higher risk of payment problems, such as pharmacies,
independent laboratories, and transportation companies.

Florida,  Georgia, and  New  Conduct preenrollment  site visits,  usually to
higher-risk

Jersey  provider types,  such  as pharmacies  and durable  medical equipment
suppliers.

Source: U.S. General Accounting Office, Medicaid: State Efforts to Control
Improper Payments Vary, GAO-01-662 (Washington D.C.: 2001).

Many states have also developed postpayment detection systems and payment
accuracy studies to improve their ability to detect, investigate, and
measure potential improper payments. Kentucky and Washington, for example,
have hired private contractors to develop or use advanced computer systems
to analyze claims payment data that identified several million dollars in
overpayments. Table 4 describes these and other state postpayment efforts
and related program savings.

   Table 4: Examples of State Postpayment Detection Activities and Payment
                              Accuracy Studies

        Action             State                        State effort
    Automated claims                Uses a state-of-the-art system intended to integrate
      processing           Texas                detection and investigation
                                     capabilities, including "neural networking," which
        systems                                 helped identify potentially
                                    fraudulent patterns from large volumes of medical
                                    claims and patient and provider
                                     history data. In the first year of operation,Texas
                                                 collected $2.2 million in
                                                       overpayments.
                                       Uses an advanced computer system to analyze claims
                         Kentucky                             payment data. Using claims
                                            data from January 1995 through June 1998, the
                                                   contractor identified $137 million in
                                                       overpayments.
                                        Uses an advanced computer system to analyze data.
                        Washington                        Since the program started, the
                                    state has identified overpayments totaling more than
                                                       $2.95 million.

  Advanced technology and   New Jersey     Conducted special audits of transportation
                                                services, cross-matching data on
   special investigative                     transportation claims to beneficiary medical
         protocols                                 appointments. Also audited pharmacies
                                        with abnormally large numbers of claims for a
                                        newly covered, high-priced drug;
                                        audited the pharmacies' purchases from
                                        wholesalers; and discovered pharmacies
                                        were billing for larger amounts of this drug than
                                                   had been shipped to them.

Beneficiary alerts Multiple states Established hotlines that beneficiaries
can use to report suspected improprieties. Mail explanation-of-benefit
statements to beneficiaries to increase awareness of the services being
billed.

Payment accuracy studies Illinois Implemented payment accuracy studies that
involved reviewing medical records and interviewing patients to verify that
services were rendered and medically necessary. As a result, the state
identified key areas of weakness and targeted several areas needing
improvement. For example, because the Illinois payment accuracy review
indicated that nearly one-third of payments to nonemergency transportation
providers were in error, the Illinois Medicaid program has taken a number of
steps to improve the accuracy of payments to this provider type.

Texas Developed a methodology for estimating payment accuracy for acute
medical care. In doing so, the state identified ways to reduce improper
payments through expanded use of computerized fraud detection tools, such as
matching Medicaid eligibility records with vital statistics databases to
avoid payments for deceased beneficiaries.

Kansas Implemented payment accuracy studies that involved reviewing medical
records and interviewing patients to verify that services were rendered and
medically necessary. The payment accuracy study recommended increased
provider and consumer education, as well as improvements to computerized
payment systems. In addition, Kansas officials undertook focused reviews of
certain types of claims that were identified as vulnerable to abuse.

Source: U.S. General Accounting Office, Medicaid: State Efforts to Control
Improper Payments Vary, GAO-01-662 (Washington D.C.: 2001).

While regional financial analysts may know about many activities like these
from performing their oversight responsibilities, analysts or staff in the
Division of Financial Management did not collect and document information on
the nature and results of each state's financial oversight activities.
Without such information being documented, CMS did not have a complete
picture or profile of the level of risk for improper payments in

each state and thus did not have comprehensive information to determine the
appropriate level of federal oversight that should be applied.

A second deficiency we found in the Medicaid risk analysis is that it did
not specifically integrate information about state fraud and abuse
prevention efforts in making risk assessments for each state. Regional
financial analysts were instructed to report on the level of regional
oversight of each state's Medicaid finances as one of the risk factors in
determining the likelihood and significance of risk in each state.
Specifically, analysts were instructed to consider the last time the
regional office or HHS/OIG conducted a review or audit. However, the
analysts were not specifically instructed to consider results from reviews
of state efforts to prevent fraud and abuse recently conducted under the CMS
Medicaid Alliance for Program Safeguards.7

In 1997, CMS established the Medicaid Alliance for Program Safeguards
staffed with program analysts from the 10 CMS regions and staff within the
Policy Coordination and Planning Group of the Center for Medicaid and State
Operations. The initiative was started to aid states in their program
integrity efforts. Since its inception, a fraud statute Web site has been
established and seminars on innovations and obstacles in safeguarding
Medicaid have been developed. In fiscal year 2000, regional staff conducted
structured site reviews of program safeguards in eight states, and in fiscal
year 2001 reviews were conducted in another eight states. Plans are to
perform reviews in additional states until all states are covered. These
reviews examined how state Medicaid agencies identify and address potential
fraud or abuse, whether state agencies are complying with appropriate laws
and regulations-such as how they check to ensure that only qualified
providers participate in the program-and potential areas for improvement.
CMS would gain valuable information from these reviews to more accurately
assess the level of risk for improper payments in these 16 states and the
appropriate level of federal oversight required.

A third deficiency we found is that the Medicaid risk analysis did not
include mechanisms to ensure that such analysis would be conducted
continuously in directing financial oversight. Agency managers should have
methods in place to revisit risk analysis to determine where risks have
decreased and where new risks have emerged, as identified risks are
addressed and control activities are changed. As such, risk analysis should

7Formally known as the National Medicaid Fraud and Abuse Initiative.

be iterative. Medicaid financial managers had not determined how they would
continuously revise and update their Medicaid risk analysis.

Finally, the Medicaid risk analysis would be strengthened if states were
systematically estimating the level of improper payments in their programs.
Identifying the dollar amount of improper payments is a critical step in
determining where the greatest problems exist and the most cost-beneficial
approach to addressing the problems. CMS management has recognized this and
has begun efforts to develop an approach for estimating improper Medicaid
payments. In September 2001, nine states responded to a CMS solicitation to
participate in pilot studies to develop payment accuracy measurement
methodologies. The objective is to assess whether it is feasible to develop
a single methodology that could be used by the diverse state Medicaid
programs and to explore the feasibility of estimating the range of improper
Medicaid payments on a national level. Each of the nine states involved is
developing a different measurement methodology. CMS has assigned a senior
Medicaid manager with responsibility for directing this effort. According to
this manager, CMS has hired a consultant experienced in program integrity
reviews to oversee the state pilots. CMS managers expect the states to
complete the pilots during fiscal year 2003, after which time the consultant
and the Medicaid manager plan to select several of the state methodologies
as test cases for fiscal year 2004. It is important that CMS continues to
place emphasis on development of these payment accuracy reviews on a
state-by-state basis and ultimately on a national level, since this is a key
baseline measure for managing improper payments in the Medicaid program.

Control Activities Were Not Effectively Implemented

The comptroller general's Standards for Internal Control in the Federal
Government states that managers must establish adequate control activities
to address identified risks and ensure that program objectives are met.
Internal control activities are the policies, procedures, techniques, and
mechanisms that help ensure that management's directives to mitigate risk
are carried out. Control activities are an integral part of an
organization's efforts to address risks that lead to fraud and error. For
the Medicaid program, both the states and federal government share
responsibility for ensuring that adequate control activities are in place.
The control activities that CMS had in place to oversee state internal
controls and help ensure the propriety of Medicaid expenditures were not
effectively implemented. Given the current level of resources and the size
and complexity of the program, a different approach is needed that

incorporates new oversight techniques and strategies, as well as the results
of the risk assessment discussed previously.

CMS regional financial analysts are tasked with performing multiple control
activities designed to (1) oversee state financial management and internal
control processes, (2) help ensure that states expend federal funds in
accordance with laws, and (3) identify amounts inappropriately claimed for
federal reimbursement. These activities include providing technical
assistance to states on a variety of financial issues to help improve state
accountability and help prevent payment inaccuracies as well as examining
state expenditures to defer improperly supported payments and disallow those
payments8 that do not comply with Medicaid regulations. Analysts also are
responsible for following up on and resolving findings from audits related
to improper or questionable payments and weaknesses in state internal
controls. Table 5 summarizes the control activities that regional analysts
are responsible for carrying out.

               Table 5: Regional Office Oversight Activities

Financial analysis and review activities

* Review state expenditure and budget reports.

* Prepare and submit regional decision reports summarizing the results of
expenditure and budget reviews.

* Identify, defer, and disallow unsupported and unallowable expenditures.

* Perform focused financial management reviews of specific Medicaid service
and administrative expenditures.

* Perform audit resolution tasks and coordinate with state auditors and
HHS/OIG.

Technical assistance activities

* Meet and interact with state Medicaid agency officials to provide
technical assistance on a variety of financial and administrative policy
issues.

* Review and assist CMS program analysts with analyzing the financial
aspects of plans submitted by states to amend their Medicaid program or to
obtain waivers of certain Medicaid provisions.

* Review plans submitted by states indicating how overhead and other
administrative costs are allocated (cost allocation plans) and plans
explaining state methodologies for claiming certain administrative costs.

Note: Activities are performed for both Medicaid and SCHIP programs.

8A deferral is an action taken to withhold funds from the states until
additional clarification or documentation is received from the states
regarding Medicaid costs claimed. A disallowance is a determination by CMS
that a claim or portion of a claim by a state for federal funds is
unallowable.

As Medicaid expenditures have grown and resources devoted to Medicaid
financial oversight have decreased, regional financial analysts have faced
significant challenges in monitoring state internal controls, providing
technical assistance, scrutinizing expenditures, and following up on audit
findings for all state Medicaid programs. In an attempt to address these
challenges, in 1994 regional offices began refocusing oversight activities
from emphasizing detailed review of Medicaid expenditure data to increasing
the level of technical assistance provided to states. However, auditors of
CMS financial statements found that, as a result, regional offices were not
providing appropriate review and oversight of state Medicaid programs. As
mentioned previously, auditors have reported since 1998 that regional
offices significantly reduced or inconsistently performed control activities
to detect potential errors and irregularities in state expenditures, thus
increasing the risk that errors and misappropriation could occur and go
undetected. In our review, we found that these weaknesses were still
present.

In August 2001, we conducted a survey of regional financial analysts to
obtain their perspectives on the design and implementation of the Medicaid
financial oversight process, covering the period from October 1, 1999,
through the date of the survey. In comments to the survey, some regional
analysts indicated that they were inundated with responsibility for multiple
control activities and unable to perform them effectively. Our survey asked
the analysts to rate each of the control activities that they perform in
terms of how important they believe the activity is in overseeing state
Medicaid programs. The activity rated most important was quarterly
expenditure reviews performed on-site at state Medicaid agencies; 89 percent
rated the activity as having the "highest" or "high" level of importance-83
percent "highest" and 6 percent "high." However, when asked about the
adequacy in which they performed on-site expenditure reviews, almost 36
percent rated the adequacy of their performance "inadequate" or
"marginal"-13 percent inadequate and 23 percent marginal. In discussions
with regional financial analysts during our site visits and in comments to
our survey, many financial analysts attributed deficiencies in quarterly
reviews to inadequate staff resources, the low priority placed on financial
management oversight, lack of training, and conflicting priorities.

During our site visits we interviewed 11 regional financial analysts
responsible for overseeing the five states that accounted for over $70
billion in Medicaid expenditures in fiscal year 2000. We reviewed these
analysts' workpapers related to their review of quarterly expenditure
reports submitted for the quarter ended December 31, 2000. Workpapers

prepared for three of the states to document their reviews did not contain
sufficient evidence that expenditures had been traced to original documents.
Instead, the analysts had checked information against summary schedules
prepared by the states. Without proper documentation, there is little
assurance that these reviews are being adequately performed.

Survey respondents also rated activities to (1) defer and disallow Medicaid
expenditures and (2) perform in-depth analysis of specific Medicaid costs
where problems have been found (i.e., focused financial management reviews)
as important in overseeing the propriety of Medicaid expenditures. Some 89
percent of analysts rated deferral and disallowance determinations as having
"highest" or "high" level of importance and focused financial management
reviews were rated by 77 percent as "highest" or "high." Data provided by
CMS indicate, however, that the amount of Medicaid expenditures disallowed
by regional analysts has declined in years after 1996, when oversight
emphasis shifted from detailed reviews, and so did the number of focused
financial management reviews conducted each year. For example, from 1990
through 1993, analysts disallowed on average $239 million9 annually in
expenditures reported by states for federal reimbursement. However, from
fiscal years 1997 through 2000, analysts disallowed on average about $43
million annually, which represents an 82 percent decline from previous
years. Also, during these periods, Medicaid expenditures went from an
average of $58 billion annually to $106 billion annually-an increase of 83
percent.10

Similarly, focused financial management reviews have declined. Focused
financial management reviews generally involve selecting a sample of paid
claims for review related to certain types of Medicaid services provided.
These reviews have been useful in identifying unallowable costs outside of
those detected through the review of quarterly expenditure reports as well
as deficiencies in states' financial management policies. According to CMS
managers, in fiscal year 1992, analysts performed approximately 90 in-depth
reviews of specific Medicaid issues that identified approximately $216
million in unallowable Medicaid costs. In fiscal year 2000, analysts only
performed eight focused financial management reviews, but these

9The calculation of this amount does not include $1.15 billion in
disallowances of Medicaid amounts for Disproportionate Share Hospital (DSH)
claims in fiscal year 1992 that resulted from a change in the legislation
related to DSH. Including this amount would increase the average
disallowance to $527 million for fiscal years 1990 through 1993.

10Expenditure and disallowance data provided by CMS.

reviews resulted in almost $45 million in disallowed costs-an average of
about $5.6 million per review. As demonstrated, this control activity is
effective in detecting unallowable Medicaid costs; however, it must be
consistently performed for cost savings to be discovered.

According to the director of DFM, the division is taking actions to improve
oversight by beginning a comprehensive assessment of CMS's Medicaid
oversight activities. The division would like to increase several oversight
activities, such as focused financial management reviews, to address the
risks identified in CMS's new risk-based approach. However, Medicaid
financial managers are concerned that efforts to effectively address
identified risks may be hindered without additional oversight resources. In
the interim, CMS plans to use the current oversight process (i.e., quarterly
expenditure reviews and technical assistance) for targeting those Medicaid
issues that the new risk analysis identifies.

In assessing what steps CMS could take to more efficiently and effectively
carry out its responsibility on the federal level for helping ensure the
propriety of Medicaid finances, we considered strategies that other entities
have used in successfully addressing risks that lead to fraud, error, or
improper payments. As discussed in our executive guide on strategies to
manage improper payments, key strategies include taking action to

* select appropriate control activities based on an analysis of the specific
risks facing the organization, taking into consideration the nature of the
organization and the environment in which it operates;

* perform a cost-benefit analysis of potential control activities before
implementation to ensure that the cost of the activities is not greater than
the benefit; and

* contract out activities to firms that specialize in specific areas like
neural networking, where in-house expertise is not available.

Our executive guide points out that many organizations have implemented
control techniques, including data mining, data sharing, and neural
networking, to address identified risk areas and help ensure that program
objectives are met. These techniques could help CMS better utilize its
limited resources in applying effective oversight of Medicaid finances at
the federal level.

Some state Medicaid agencies have already implemented data mining, data
sharing, and neural networking techniques to carry out their
responsibilities on the state level for ensuring Medicaid program integrity.

State auditors and HHS/OIG staff have also had success using these
techniques in overseeing state Medicaid programs. However, resources devoted
to protecting Medicaid program integrity and the use of these techniques
varies significantly by state. From a federal standpoint, CMS should take
into consideration the control activities performed at the state level in
designing its Medicaid financial oversight control activities. CMS should
use the results from states that are already using data mining, data
sharing, and neural networking techniques in determining the extent and type
of control techniques that its regional financial analysts should use in
overseeing each state. And, for states where these techniques are not being
used, CMS should consider using these tools in its oversight process.

As illustrated in the following examples, data mining, data sharing, and
neural networking techniques have been shown to achieve significant savings
by identifying and detecting improper payments that have been made.

* Data mining is a technique in which relationships among data are analyzed
to discover new patterns, associations, or sequences. The incidence of
improper payments among Medicaid claims can, if sufficiently analyzed and
related to other Medicaid data, reveal a correlation with a particular
health care provider or providers. Using data mining software, the Illinois
Department of Public Aid, in partnership with HHS/OIG, identified 232
hospital transfers that may have been miscoded as discharges, creating a
potential overpayment of $1.7 million.

* Data sharing allows entities to compare information from different sources
to help ensure that Medicaid expenditures are appropriate. Data sharing is
particularly useful in confirming the initial or continuing eligibility of
participants and in identifying improper payments that have already been
made. We recently reported on a data sharing project called the Public
Assistance Reporting Information System interstate match (PARIS) that has
identified millions of dollars in costs savings for states.11 PARIS helps
states share information on public assistance programs, such as Food Stamps
and eligibility data for Medicaid, to identify individuals who may be
receiving benefits in more than one state simultaneously. Using the PARIS
data match for the first time in 1997, Maryland identified numerous
individuals who no longer lived in

11U.S. General Accounting Office, Public Assistance: PARIS Project Can Help
States Reduce Improper Benefit Payments (Washington D.C.: 2001).

the state but on whose behalf the state was continuing to pay a Medicaid

managed care organization (MCO) as part of the MCO's prospective

monthly payment. The match identified $7.3 million in savings for the

Medicaid program. * Neural networking is a technique used to extract and
analyze data. A neural network is intended to simulate the way a brain
processes information, learns, and remembers. For example, this technique
can help identify perpetrators of both known and unknown fraud schemes
through the analysis of utilization trends, patterns, and complex
interrelationships in the data. In 1997, the Texas legislature mandated the
use of neural networks in the Medicaid program. Large volumes of medical
claims and patient and provider history data are examined using neural
network technology to identify fraudulent patterns. The Texas Medicaid Fraud
and Abuse Detection System used neural networking to recover $3.4 million in
fiscal year 2000.

Based on consultations with state auditors, we noted that some auditors are
performing audits that incorporate the advanced oversight techniques
described above. New York and Texas are instituting data sharing and
matching techniques at the state level to confirm initial eligibility of
Medicaid participants and to identify improper payments that have already
been made. Texas is using private contractors to design, develop, install,
and train staff to use a system intended to integrate detection and
investigation capabilities. This system includes a neural network that will
allow the state to uncover potentially problematic payment patterns.

Similarly, a large portion of the audit work that the HHS/OIG conducts to
oversee the Medicaid expenditures for Massachusetts, Ohio, and Maine is
conducted through electronic data matches of Medicaid claims data contained
in the Medicaid Statistical Information System (MSIS). MSIS is the primary
source of Medicaid program statistical information. As of the date of our
report, 47 states were submitting Medicaid data electronically to MSIS.
Information that the HHS/OIG finds as a result of electronic data matches is
subsequently made available to regions and states for additional detailed
work.

CMS managers acknowledge that systems like MSIS could provide them with the
capabilities to implement more advanced control techniques. While
implementing control techniques such as data sharing, data mining, and
neural networking may require up-front investment of resources, use of these
techniques has the potential to result in significant savings to the
Medicaid program.

Monitoring Activities Were Limited in Scope and Effectiveness

Having mechanisms in place to monitor the quality of an agency's performance
in carrying out program activities over time is critical to program
management. The federal internal control standard for monitoring requires
that agency managers implement monitoring activities to continuously assess
the effectiveness of control activities put in place to address identified
risks. Monitoring activities should include procedures to ensure that
findings from all audits are reviewed and promptly resolved. The standards
also state that pertinent information should be recorded and communicated to
managers and staff promptly, to allow effective monitoring of events and
activities as well as to allow prompt reactions. However, CMS had few
mechanisms in place to continuously monitor the effectiveness of its control
activities in overseeing the Medicaid program and collected limited
information on the quality of Medicaid financial oversight performance.
Specifically, CMS had not established performance standards to measure the
effectiveness of its control activities, in particular its expenditure
review activity. In addition, the CMS audit resolution process did not
ensure that audit findings were resolved promptly and did not collect
sufficient information on the status of audit findings. Without effective
monitoring, CMS did not have the information needed to help assure the
propriety of Medicaid expenditures.

Few Steps Were Taken to Monitor Performance

DFM financial managers responsible for monitoring the effectiveness of
Medicaid internal control processes had established few mechanisms to do so.
CMS did not establish performance standards and did not analyze or compare
trend information on the results of its control activities, including the
amount and type of Medicaid expenditures deferred and disallowed by regional
analysts across all 10 regions.

Medicaid financial managers told us that, before 1993, CMS collected
information to monitor the performance of its oversight process. The
performance reporting process required each region to submit quarterly data
on

* the amount of expenditures disallowed;

* the number of focused financial management reviews conducted, and the
related expenditures identified and recovered as a result of the reviews;

* the amount of inappropriate expenditures averted by providing technical
assistance to states before payment;

* the number of regional financial analysts and related salary costs devoted
to financial oversight; and

* the amount of travel dollars devoted to Medicaid financial oversight.

Medicaid financial managers in DFM used this information to prepare national
performance reports that calculated a return on investment for each region
and a national return on investment. CMS managers said that they
discontinued efforts to collect, analyze, and maintain performance data
after 1993 because of staff reductions in the regions and headquarters.

DFM managers currently collect some performance information, but it is not
used to evaluate regional performance. For example, staff in DFM collect
information on the amount of expenditures deferred and disallowed each
quarter by each region. These data are used to adjust total expenditures for
financial reporting purposes but not to assess regional oversight
activities. DFM also maintains a spreadsheet that includes information on
the types of expenditures disallowed. This information is not distributed to
regional analysts. In addition, information on the types of expenditures
deferred by each regional analyst is not consolidated and disseminated
across regions. Regional analysts include the types of expenditures deferred
in their own regional decision reports, but do not have the benefit of
nationwide information because DFM does not prepare summary reports.
Comprehensive information on the type of expenditures deferred and
disallowed would help identify the types of Medicaid expenditures for which
improper payments commonly occur and measure whether corrective actions or
control techniques applied to certain Medicaid expenditures are effective in
reducing improper payments.

The director of DFM told us that steps would be taken within the next year
to begin monitoring the effectiveness of the Medicaid financial oversight
process. Medicaid financial managers plan to reinstitute the performance
reporting process that was in place prior to 1993. While this is a good
step, the previous performance reporting process lacked several elements
necessary for effective internal control monitoring. For example, the
performance reporting process did not establish agency-specific goals and
measures for evaluating regional performance in reducing payment errors and
inaccuracies. In addition, there were no formal criteria or standard
estimation methodologies for regions to use in measuring the amount of
unallowable costs that the states avoided because of technical assistance
provided before payment. As discussed in our executive guide, Strategies to
Manage Improper Payments, establishing such goals and measures is key to
tracking the success of improvement initiatives.

Audit Resolution Activities Are Not Effective

Standards for Internal Control in the Federal Government requires that
agencies' internal control monitoring activities include policies and
procedures to ensure that audit and review findings are promptly resolved.
According to the standards, agency managers should implement policies and
procedures for reporting findings to the appropriate level of management,
evaluating the findings, and ensuring that corrective actions are taken
promptly in response to the findings. In our review, we found that the audit
resolution and monitoring activities performed by CMS and its regional
offices were limited. In addition, we found that audit resolution activities
were inconsistently performed across regions. Further, pertinent information
was not identified, documented, and distributed among those responsible for
audit resolution. These conditions hamper CMS's ability to resolve audit
findings promptly and slow the recovery of millions of dollars in federal
funds due from the states.

Within CMS, three units share responsibility for audit resolution activities
related to the Medicaid program. These are regional administrators and
regional financial analysts, the Division of Audit Liaison (DAL), and DFM.

Regional administrators and regional financial analysts have responsibility
to perform the following audit resolution activities required by the HHS
Grants Administration Manual:12

* coordinate resolution of findings with the pertinent auditee (i.e., state
Medicaid agency or providers);

* ensure that the related questioned costs due the federal government are
recovered within established timeframes;

* verify that corrective actions have been developed and implemented for
each finding; and

* prepare quarterly reports documenting the status of audit resolution.

DAL is responsible for maintaining a tracking system for each audit report
and related findings, monitoring the timeliness and adequacy of audit
resolution activities, distributing all audit clearance documents, and
preparing monthly reports on the status of audit resolution and collection
activities. DFM has one headquarters staff person responsible for

12The Grants Administration Manual, issued by HHS, provides guidance on
implementing HHS policies on the administration of HHS grants. Chapter 1-105
of the manual addresses the resolution of audit findings.

coordinating and interacting with DAL and regional analysts to ensure that
Medicaid related findings are resolved.

An important part of regional analyst audit resolution activities involves
following up on state Single Audit Act reports. Under the Single Audit Act,
state auditors issue reports that include assessments of the internal
controls related to major federal programs, including the Medicaid program,
and compliance with laws, regulations, and provisions of contract or grant
agreements. These reports generally include findings related to weaknesses
identified in the financial management of state Medicaid programs as well as
expenditures deemed erroneous or improper (e.g., questioned costs) for which
states may owe money back to the federal government.

Regional analysts are responsible for resolving audit findings, including
determining whether the questioned costs related to audit findings reported
by state auditors represent actual costs to be recovered from the state, and
ensuring that they are actually recovered. In our discussions with regional
staff during our review of state single audit findings, analysts admitted
that they spend very little time on resolving state audit findings due to
competing oversight responsibilities. Audit follow-up is one step of many
performed during their quarterly state Medicaid expenditure reviews. As a
result, state single audit findings are not always resolved, and related
questioned costs are not promptly recovered.

For example, we identified questioned costs totaling $24 million that had
not been recovered. The audit reports that included the $24 million in
questioned costs had been issued for years prior to fiscal year 1999.
However, as of September 30, 2001, regional analysts had not completed
actions to recover these costs.

In addition, we found that, as of September 30, 2001, regional analysts had
not determined whether corrective actions had been developed and/or
implemented to resolve 85 of a total of 288 Medicaid findings included in
state single audit reports for fiscal year 1999. These findings related to
problems with state financial reporting, computer systems, and cash
management. Lack of timely follow-up on financial management and internal
control issues increases the risk that corrective actions have not been
taken by the auditee and erroneous or improper payments are continuing to be
made.

In our review, we also found that the regional financial analysts
inconsistently followed procedures for monitoring, tracking, and reporting
on the resolution of Single Audit Act and HHS/OIG audit findings. For
example, 3 of the 10 regions had not prepared quarterly status reports that
are intended to provide information on corrective actions that states have
taken to resolve audit findings.

Further, pertinent information was not identified, documented, and
distributed among those responsible for audit resolution. The internal
control standard related to information and communication provides that
pertinent information be identified, captured, and distributed to the
appropriate areas in sufficient detail and at the appropriate time to enable
the entity to carry out its duties and responsibilities efficiently and
effectively.

In our review, we found that the monthly report prepared by DAL that is
intended to provide a complete list of all audits with unresolved Medicaid
findings did not meet this standard. We analyzed a list provided by the
HHS/OIG, which included 23 Medicaid related reports issued by the HHS/OIG
and state auditors in fiscal year 2001. We found four reports from the
HHS/OIG list that were not included in DAL monthly reports related to the
second, third, and fourth quarters of that year. This information is
critical and must be distributed to the regions to ensure that they are
taking action to resolve all Medicaid related findings.

We also found that the regions did not document information critical to
tracking unresolved audits in their regional quarterly status reports. The
regions reported which audits had been resolved. They did not report
information on audits that they were reviewing that had not yet been
resolved. This makes it difficult to track audit status.

Organizational Structure Impedes Effective Oversight

A sound organizational structure is a key factor that contributes to whether
agency management can establish a positive control environment. Standards
for Internal Control in the Federal Government provides that managers should
ensure that an agency organizational structure is appropriate for the nature
of its operations and designed so that authority and internal control
responsibility is defined and well understood. Although CMS's 10 regional
offices are the federal government's frontline for overseeing state Medicaid
financial operations and expenditures, there are no reporting lines to the
headquarters unit responsible for Medicaid financial management and few
other mechanisms to ensure performance

accountability. This structural relationship has created challenges in (1)
establishing and enforcing minimum standards for performing financial
oversight activities, (2) routinely evaluating the regional office
oversight, and (3) implementing efforts to improve financial oversight. As a
result, CMS lacks a consistent approach to monitor and improve performance
among the units that share responsibility for financial management and
ingrain a sound internal control environment for Medicaid finances
throughout CMS.

Many Oversight Weaknesses Are a Result of Current Structure

During the time of our review, there were no formal reporting relationships
between the regional financial analysts and CMSO's DFM or any other division
or unit within CMSO. Regional offices reported directly to the CMS
administrator through their respective regional administrators. This
structural relationship does not lend itself to instituting standards for
oversight control activities that can be consistently and effectively
implemented.

To illustrate, the CMS financial management strategy workgroup, headed by
the director of DFM, updated guidance for expenditure reviews in September
2000 to provide uniform review procedures and address concerns raised by
auditors about the inconsistency in expenditure reviews across regions.
While the guide strongly encouraged regional analysts to complete all of its
procedures, it did not mandate that analysts do so. Headquarters financial
managers do not have direct authority to enforce such a directive and
regional managers have discretion in how resources are utilized. Similarly,
the guide allowed regional branch managers wide discretion in performing
supervisory review of regional analysts' expenditure review workpapers. The
guide provides that a supervisor can assure that the analysts' work measures
up to CMS requirements in the review guide by either directly and
selectively reviewing the work papers or by obtaining written or verbal
assurance from the reviewer that the procedures have been completed.
Supervisory reviews are a key internal control activity. By allowing
supervisors to satisfy this responsibility merely with verbal assurance, CMS
is minimizing the effectiveness of this basic control. During our site
visits, we found evidence that supervisory reviews were not conducted. We
reviewed regional analysts' workpapers related to reviews of quarterly
expenditure reports for five states submitted for the quarter ended December
31, 2000. These five states represent the largest states within the regions
visited. Analysts' workpapers for three of the five state quarterly
expenditure reviews had no evidence of supervisory

"sign off" and, when asked if the supervisors had reviewed the workpapers or
discussed the results of the review, the analysts said they had not.

The CMS organizational structure also hindered efforts to evaluate and
monitor regional office performance. Currently, there are few formal
requirements for regions to report to headquarters and CMS does not collect,
analyze, or evaluate consistent information on the quality of regional
financial oversight for Medicaid across the country. As mentioned
previously, efforts to monitor performance were discontinued because
regional staff resources were not available to collect and submit the data
to headquarters managers. Headquarters managers did not have the authority
to require regions to collect such data. As a result, Medicaid financial
managers in headquarters were not in a position to provide formal feedback
to region financial management staff to improve their performance and
therefore have not been in a position to assess the effectiveness of
Medicaid oversight activities.

The current organizational structure also poses challenges to implementing
corrective actions aimed at addressing oversight weaknesses and improving
accountability. Over the past 2 years, headquarters financial managers have
taken steps to develop and implement improvements to the financial oversight
process. As previously mentioned, Medicaid staff are currently

* developing risk analysis to identify expenditures of greatest risk,

* working with states to develop methodologies for estimating Medicaid
improper payments,

* developing work plans that guide efforts to allocate financial oversight
staff and travel resources based on the risk analysis, and

* developing performance-reporting mechanisms.

Medicaid staff have also recently

* formed a financial management strategy workgroup of headquarters and
regional financial management staff members to review the entire Medicaid
financial oversight process and determine the proper structure for an
adequate oversight process,

* updated its expenditure and budget review guides, and

* gathered information on how regional financial analyst staff time is
allocated between oversight responsibilities.

Headquarters DFM managers recognize that regional office commitment is
critical to successfully implementing and sustaining its improvement
initiatives. The current structural relationship could diminish the chances
of such success. Headquarters managers expressed concern that despite recent
efforts to develop risk analysis and implement work plans that allocate
resources based on identified risks, regional managers will still have the
authority to decide how oversight resources are used. Given the multiple
oversight activities that regional financial analysts are responsible for,
headquarters managers have no assurance that review areas included in the
work plans will be given priority in each region. Headquarters managers may
experience similar difficulties in reestablishing performance reporting.
According to one senior Medicaid manager, some regions have already
petitioned headquarters managers not to use data on the amount of
expenditures deferred and disallowed in gauging performance.

During our review, we asked regional financial analysts about several recent
improvement initiatives to gauge their knowledge of and participation in
such initiatives. Several analysts we spoke with during site visits did not
think the risk assessment effort was useful because they felt that they were
already aware of the risks within the states that they were responsible for
and did not need a formal assessment to identify the risks. In addition,
some said that they resented the headquarters managers trying to tell them
where they needed to focus their efforts. In our survey, we asked regional
financial analysts to rate the importance of the risk assessment, staff time
allocation effort, and review guide updates to overall financial oversight.
Approximately 50 percent of survey respondents thought the initiatives were
of marginal or little importance. During pretests of our survey, several
analysts said they did not understand the purpose of the initiatives, even
though they had provided input. According to the analysts, no one had
communicated to them how the information was going to be used.

In discussions with headquarters managers, they acknowledged that a written
plan or strategy, which describes the initiatives and the responsibility for
implementing them, is currently being drafted. Such a plan or strategy could
be very useful in soliciting regional analyst support. More important,
headquarters managers acknowledged that performance accountability
mechanisms for the regions are needed to implement improvements
successfully. CMS is currently planning some changes that may improve
mechanisms to hold CMS financial managers, including regional managers and
administrators, accountable for critical tasks. A Restructuring and
Management Plan recently developed by the CMS chief

operating officer seeks to add specific responsibilities that are tied to
specific agency goals into senior managers' performance agreements. CMS has
not determined how Medicaid financial management oversight and the various
aspects of oversight responsibilities that can be evaluated will be included
in the plan. Inclusion of such information is key to establishing a sound
internal control environment for Medicaid finances throughout CMS.

Conclusion While CMS is taking steps to improve its financial oversight of
the Medicaid program, the increasing size and complexity of the program,
coupled with diminishing oversight resources, requires a new approach to
address these challenges. Developing baseline information on Medicaid issues
at greatest risk for improper payments and measuring improvements in program
management against that baseline are key to achieving effective financial
oversight. Determining the level of state activities to monitor and control
Medicaid finances is also critical to CMS determining the extent and type of
control techniques as well as the amount of resources it must apply at the
federal level to adequately oversee the program. Establishing clear lines of
authority and performance standards for CMS oversight would also provide for
a more efficient, effective, and accountable Medicaid program. CMS's ability
to make the kind of changes that are needed will require top-level
management commitment, a comprehensive financial oversight strategy that is
clearly communicated to all those responsible for program oversight, and
clear expectations for implementation of the changes.

Recommendations for To strengthen Medicaid internal controls and the
financial oversight process that CMS has in place to ensure the propriety of
Medicaid finances,

Executive Action we make the following recommendations to the CMS
administrator.

Risk Assessment We recommend that the CMS administrator revise current risk
assessment efforts in order to more effectively and efficiently target
oversight resources towards areas most vulnerable to improper payments by

* collecting, summarizing, and incorporating profiles of state financial
oversight activities, that include information on state prepayment edits,
provider screening procedures, postpayment detection efforts, and payment
accuracy studies;

* incorporating information from reviews of state initiatives to prevent
Medicaid fraud and abuse;

* developing and instituting feedback mechanisms to make risk assessment a
continuous process and to measure whether risks have changed as a result of
corrective actions taken to address them; and

* completing efforts to develop an approach to payment accuracy reviews at
the state and national levels.

Financial Oversight Control Activities

In addition, we recommend that the CMS administrator restructure oversight
control activities by

* increasing in-depth oversight of areas of higher risk as identified from
the risk assessment efforts and applying fewer resources to lower risk
areas;

* incorporating advanced control techniques, such as data mining, data
sharing, and neural networking, where practical to detect potential improper
payments; and

* using comprehensive Medicaid payment data that states must provide in the
legislatively mandated national MSIS database.

Monitoring Performance We also recommend that the CMS administrator develop
mechanisms to routinely monitor, measure, and evaluate the quality and
effectiveness of financial oversight, including audit resolution, by

* collecting, analyzing, and comparing trend information on the results of
oversight control activities particularly deferral and disallowance
determinations, focused financial reviews, and technical assistance;

* using the information collected above to assess overall quality of
financial management oversight;

* identifying standard reporting formats that can be used consistently
across regions for tracking open audit findings and reporting on the status
of corrective actions; and

* revising DAL audit tracking reports to ensure that all audits with
Medicaid related findings are identified and promptly reported to the
regions for timely resolution.

Organizational Structure Finally, we recommend that the CMS administrator
establish mechanisms to help ensure accountability and clarify authority and
internal control responsibility between regional office and headquarters
financial managers by

* including specific Medicaid financial oversight performance standards in
senior managers' performance agreements; and

* developing a written plan and strategy, which clearly defines and
communicates the goals of Medicaid financial oversight and responsibilities
for implementing and sustaining improvements.

Agency Comments and Our Evaluation

CMS provided written comments on a draft of this report (reprinted in app.
I), as well as supplementary oral comments. In its written comments, CMS
outlined a series of actions it has begun to take to address its Medicaid
financial management challenges. In supplementary oral comments, CMS
disagreed with our recommendations related to its audit tracking and
resolution reports.

In outlining actions taken to address Medicaid financial management
challenges, CMS stated that its efforts substantially address, within
current resource constraints, the four areas of our recommendations. CMS
improvement efforts include (1) a structured financial workplan process that
has been incorporated into its formal Restructuring and Management Plan, (2)
actions to strengthen exchange of information with state oversight agencies,
and (3) pilot projects aimed at clarifying authority and internal control
responsibility between regional and headquarters managers. As many of these
efforts are in the planning or early implementation stages, it is too soon
to conclude whether they will effectively address our recommendations and
improve Medicaid financial management. Additionally, given CMS concerns
about resource constraints, prioritizing the planned actions and developing
projected implementation schedules is key to ensuring that progress is made
toward improving Medicaid financial management.

In oral comments, CMS disagreed with our recommendations for strengthening
its audit tracking and resolution functions. Regarding our recommendation to
standardize the audit tracking reports among CMS regions, CMS stated that
although the current format of audit tracking reports is not consistent
across regions, the reports provide agency management with sufficient
information to ensure that audit findings are resolved in a timely manner.
We disagree. As stated in our report, the current reporting formats did not
provide CMS with sufficient information to determine whether action had been
taken to recover approximately $24 million in questioned costs identified in
audit reports more than 2 years ago.

Regarding our recommendation to revise its audit tracking reports, CMS
stated that the reports are as complete as they can be given the information
that they receive from the HHS-OIG. CMS offered a number of reasons for lack
of complete data. CMS stated that the HHS-OIG does not consistently provide
timely copies of Medicaid audit reports or make audit reports available
on-line in a timely manner. Further, CMS said that the reports do not
contain the information it needs to enter the report and related findings
into the CMS tracking system properly, such as audit findings categorized by
type (i.e., questioned cost or management related).

HHS/OIG officials acknowledged that they sometimes fail to send some audit
reports that CMS is responsible for tracking and resolving but said that
they attempt to provide reports promptly when CMS contacts them. In our
view, CMS and the HHS-OIG share responsibility in audit resolution.
Accordingly, we continue to believe that CMS needs to be proactive in
ensuring its tracking mechanisms promptly identify Medicaid findings for
resolution and in following up to ensure that actions are taken to prevent
Medicaid financial management weaknesses from continuing.

As agreed with your office, unless you publicly announce the contents of
this report earlier, we plan no further distribution until 30 days from its
date. At that time, we will send copies to the chairmen and ranking minority
members of the Senate Committee on Governmental Affairs and House Committee
on Government Reform. We are also sending copies of this report to the
secretary of health and human services, administrator of CMS, inspector
general of HHS, and other interested parties. Copies will also be made
available to those who request them.

Please contact me or Kimberly Brooks at (202) 512-9508 if you or your staff
have any questions about this report or need additional information. W. Ed
Brown, Lisa Crye, Carolyn Frye, Chanetta Reed, Vera Seekins, Taya Tasse, and
Cynthia Teddleton made key contributions to this report.

Sincerely yours,

Linda M. Calbom Director, Financial Management and Assurance

Appendix I

Comments from the U.S.  Department of Health and Human Services' Centers for
Medicare and Medicaid Services

Appendix I
Comments from the U.S. Department of
Health and Human Services' Centers for
Medicare and Medicaid Services

Appendix I
Comments from the U.S. Department of
Health and Human Services' Centers for
Medicare and Medicaid Services

Appendix I
Comments from the U.S. Department of
Health and Human Services' Centers for
Medicare and Medicaid Services

Related GAO Products

Strategies  to Manage Improper  Payments: Learning  From Public and  Private
Sector Organizations (GAO-02-69G, Oct. 2001).

Public  Assistance: PARIS Project  Can Help  States Reduce Improper  Benefit
Payments (GAO-01-935, Sept. 2001).

Internal Control Management and Evaluation Tool (GAO-01-1008G, Aug. 2001).

Medicaid: State Efforts to  Control Improper Payments Vary (GAO-01-662, June
2001).

Medicaid in Schools: Improper Payments Demand Improvements in HCFA Oversight
(GAO/HEHS/OSI-00-69, Apr. 2000).

Standards for Internal Control in the Federal Government
(GAO/AIMD-00-21.3.1, Nov. 1999).

Medicaid Enrollment:  Amid Declines, State Efforts  to Ensure Coverage After
Welfare Reform Vary (GAO/HEHS-99-163, Sept. 1999).

GAO's Mission The General Accounting Office, the investigative arm of
Congress, exists to support Congress in meeting its constitutional
responsibilities and to help improve the performance and accountability of
the federal government for the American people. GAO examines the use of
public funds; evaluates federal programs and policies; and provides
analyses, recommendations, and other assistance to help Congress make
informed oversight, policy, and funding decisions. GAO's commitment to good
government is reflected in its core values of accountability, integrity, and
reliability.

Obtaining Copies of GAO Reports and Testimony

The fastest and easiest way to obtain copies of GAO documents is through the
Internet. GAO's Web site (www.gao.gov) contains abstracts and full-text
files of current reports and testimony and an expanding archive of older
products. The Web site features a search engine to help you locate documents
using key words and phrases. You can print these documents in their
entirety, including charts and other graphics.

Each day, GAO issues a list of newly released reports, testimony, and
correspondence. GAO posts this list, known as "Today's Reports," on its Web
site daily. The list contains links to the full-text document files. To have
GAO E-mail this list to you every afternoon, go to www.gao.gov and select
"Subscribe to daily e-mail alert for newly released products" under the GAO
Reports heading.

Order by Mail or Phone The first copy of each printed report is free.
Additional copies are $2 each. A check or money order should be made out to
the Superintendent of Documents. GAO also accepts VISA and Mastercard.
Orders for 100 or more copies mailed to a single address are discounted 25
percent. Orders should be sent to:

U.S. General Accounting Office
P.O. Box 37050
Washington, D.C. 20013

To order by Phone: Voice: (202) 512-6000 TDD: (202) 512-2537 Fax: (202)
512-6061

Visit GAO's Document GAO Building

Room 1100, 700 4th  Street, NW (corner of 4th and G Streets, NW)Distribution
Center Washington, D.C. 20013

To Report Fraud, Contact:

Web site: www.gao.gov/fraudnet/fraudnet.htm,Waste, and Abuse in E-mail:
[email protected], orFederal Programs 1-800-424-5454 or (202) 512-7470
(automated answering system).

Public Affairs Jeff Nelligan, Managing Director, [email protected] (202)
512-4800 U.S. General Accounting Office, 441 G. Street NW, Room 7149,
Washington, D.C. 20548

                             Presorted Standard
                             Postage & Fees Paid
                                     GAO
                               Permit No. GI00

United States
General Accounting Office
Washington, D.C. 20548-0001

Official Business
Penalty for Private Use $300

Address Correction Requested
*** End of document. ***