Medicaid Financial Management: Better Oversight of State Claims
for Federal Reimbursement Needed (13-JUN-02, GAO-02-706T).
The Medicaid program served 33.4 million low-income families as
well as elderly, blind, and disabled persons at a cost of $119
billion to the federal government and $88 billion to the states
in fiscal year 2000. States are responsible for safeguarding
Medicaid funds by making proper payments to providers, recovering
misspent funds, and accurately reporting costs for federal
reimbursement. At the federal level, the Centers for Medicare and
Medicaid Services (CMS) is responsible for overseeing state
financial activities and ensuring the propriety of expenditures
reported for federal reimbursement. Audits of state Medicaid
finances have identified millions of dollars of questionable or
unallowable costs. In addition, annual financial statement audits
have identified many internal control weaknesses in CMS oversight
of state Medicaid operations. CMS has only recently begun to
assess areas at greatest risk for improper payments. As a result,
controls that focus on the highest risk areas and resources had
not yet been deployed for areas of greatest risk. Since 1998,
auditors have noted that CMS failed to institute an oversight
process that effectively reduced the risk of inappropriate
medical claims and payments. CMS attributed most of the
weaknesses in its oversight to reductions in staff at the same
time Medicaid expenditures and oversight responsibilities have
increased.
-------------------------Indexing Terms-------------------------
REPORTNUM: GAO-02-706T
ACCNO: A03594
TITLE: Medicaid Financial Management: Better Oversight of State
Claims for Federal Reimbursement Needed
DATE: 06/13/2002
SUBJECT: Erroneous payments
Financial management
Financial statement audits
Health care costs
Federal/state relations
Risk management
HHS Public Assistance Reporting
Information System
Medicaid Program
******************************************************************
** This file contains an ASCII representation of the text of a **
** GAO Product. **
** **
** No attempt has been made to display graphic images, although **
** figure captions are reproduced. Tables are included, but **
** may not resemble those in the printed version. **
** **
** Please see the PDF (Portable Document Format) file, when **
** available, for a complete electronic file of the printed **
** document's contents. **
** **
******************************************************************
GAO-02-706T
Testimony Before the Subcommittee on Government Efficiency, Financial
Management and Intergovernmental Relations, Committee on Government Reform,
House of Representatives
United States General Accounting Office
GAO For Release on Delivery Expected at 10 a. m. Thursday, June 13, 2002
MEDICAID FINANCIAL
MANAGEMENT Better Oversight of State Claims for Federal Reimbursement Needed
Statement of Linda M. Calbom Director, Financial Management and Assurance
GAO- 02- 706T
Page 1 GAO- 02- 706T Medicaid Financial Management
Mr. Chairman and Members of the Subcommittee: I am pleased to be here today
to discuss the results of our review of Medicaid financial management by the
Centers for Medicare and Medicaid Services (CMS). My testimony today
summarizes our report to the Subcommittee, published in February of this
year, 1 which discusses the need to improve federal oversight of state
Medicaid financial activities.
As you know, the federal government and the states share responsibility for
the fiscal integrity and financial management of the jointly funded Medicaid
program. In fiscal year 2000, the Medicaid program served about 33.4 million
low- income families as well as certain elderly, blind, and disabled persons
at a cost of $119 billion to the federal government and $88 billion to the
states for program payments and administrative expenses.
States are the first line of defense in safeguarding Medicaid funds through
their responsibilities for making proper payments to providers, recovering
misspent funds, and accurately reporting costs for federal reimbursement. At
the federal level, CMS is responsible for overseeing state financial
activities and ensuring the propriety of expenditures reported by the states
for federal reimbursement.
Audits of state Medicaid finances conducted annually in accordance with the
Single Audit Act, as amended, have identified millions of dollars of
questionable or unallowable costs incurred by state Medicaid agencies. In
addition, annual financial statement audits required under the Chief
Financial Officers Act of 1990, as expanded by the Government Management
Reform Act of 1994, have identified many internal control weaknesses in CMS
oversight of state Medicaid operations.
In light of these findings, you asked that we review the adequacy of CMS?s
financial oversight process for Medicaid. We assessed whether (1) CMS has an
adequate oversight process to help ensure proper Medicaid expenditures, (2)
CMS adequately evaluates and monitors its oversight process, making
adjustments as necessary, and (3) the current CMS
1 U. S. General Accounting Office, Medicaid Financial Management: Better
Oversight of State Claims for Federal Reimbursement Needed, GAO- 02- 300
(Washington D. C.: Feb. 28, 2002).
Page 2 GAO- 02- 706T Medicaid Financial Management
organizational structure for financial management is conducive to directing
its oversight process and sustaining future improvements.
To evaluate financial oversight and monitoring at CMS, along with the
control activities used to help ensure the propriety of Medicaid
expenditures, we performed work at CMS headquarters and regional offices,
surveyed regional financial management staff and reviewed CMS manuals and
other documentation and audit reports. To determine whether CMS?s
organizational structure for financial management is conducive to
effectively directing its oversight process and sustaining future
improvements, we interviewed directors, managers responsible for financial
management at headquarters, and managers in five regions. We compared
information we gathered about organizational structure, communications, and
improvement initiatives with the Comptroller General?s Standards for
Internal Control in the Federal Government 2 . We performed our work from
October 2000 through September 2001 in accordance with generally accepted
government auditing standards.
As discussed in our February 2002 report, we found that CMS has financial
oversight weaknesses that leave the Medicaid program vulnerable to improper
payments. The Comptroller General?s Standards for Internal Control in the
Federal Government requires that agency managers perform risk assessments,
act to mitigate identified risks, and then monitor the effectiveness of
those actions. In addition, the standards provide that agencies should
ensure that the organizational structure is designed so that authority and
responsibility for internal controls are clear. CMS oversight had weaknesses
in each of these four areas, which I will discuss in turn.
Our review found that CMS had only recently begun to assess areas at
greatest risk for improper payments. As a result, controls were not in place
that focused on the highest risk areas and resources had not yet been
deployed to areas of greatest risk. The Comptroller General?s Standards for
Internal Control in the Federal Government requires that agency managers
perform risk assessments and then act to mitigate identified risks that
could impede achievement of agency objectives.
2 U. S. General Accounting Office, Standards for Internal Control in the
Federal Government, GAO/ AIMD- 00- 21. 3. 1 (Washington D. C.: Nov. 1999).
CMS Had Not
Implemented a RiskBased Approach in Reviewing Expenditures
Page 3 GAO- 02- 706T Medicaid Financial Management
Since 1998, financial auditors responsible for the annual financial
statement audit of Medicaid expenditures have noted that CMS failed to
institute an oversight process that effectively reduced the risk of
inappropriate Medicaid claims and payments. 3 Financial auditors identified
internal control weaknesses that increased the risk of improper payments,
including a significant reduction in the level of detailed analysis
performed by regional financial analysts in reviewing state Medicaid
expenses; minimal review of state Medicaid financial information systems;
and lack of a methodology for estimating the range of Medicaid improper
payments on a national level. The auditors recommended that CMS implement a
riskbased approach for overseeing state internal control processes and
reviewing Medicaid expenditures.
Regarding the auditor?s findings and recommendations, CMS officials
attributed most of the weaknesses in its oversight to reductions in staff at
the same time Medicaid expenditures and oversight responsibilities
increased. CMS data show a 32 percent drop in regional financial management
staff from 95 full- time equivalent positions in FY 1992 to approximately 65
in FY 2000. At the same time, federal Medicaid expenditures increased 74
percent from $69 billion to $120 billion. 4 On average, each of the 64
regional financial analysts is now responsible for reviewing almost $1.9
billion in federal Medicaid expenditures each fiscal year as compared to an
average of about $0.7 billion a decade ago.
In light of these conditions, CMS managers acknowledged that they needed to
revise their oversight approach and in April 2001, began to develop a risk-
based approach for determining how best to deploy CMS resources in reviewing
Medicaid expenditures.
This new assessment effort required each regional office to provide data on
the states and territories in its jurisdiction based on regional analyst
experience and knowledge. For each type of Medicaid service and
administrative expense, the Medicaid risk analysis estimates the likelihood
and significance of risk based on dollars expended annually and measures
risk based on factors such as unclear payment policies; state payments
involving county and local government; and federal audit results. The risk
3 In some instances, these findings were included in the management letters
that accompanied the audited financial statements for fiscal years 2000,
1999, and 1998. 4 The $120 billion in expenditures in 2000 is equal to $97.8
billion in 1992 dollars when adjusted for inflation.
Page 4 GAO- 02- 706T Medicaid Financial Management
analysis provides a score for each state that is intended to specify the
areas of greatest risk for improper payments.
Medicaid financial managers also tabulated a national risk score for each
type of Medicaid service and administrative expense using the state risk
scores. However, at the time of our review, CMS had not taken steps to use
the risk analysis in deploying its regional financial oversight resources.
Medicaid financial managers in headquarters and the regional offices plan to
develop work plans that will allocate resources based on the risks
identified from the analysis. CMS expects to implement these work plans in
reviewing the state?s quarterly expenditure reports for fiscal year 2003.
In evaluating the Medicaid risk analysis, we considered strategies that
leading organizations used in successfully implementing risk management
processes. Our executive guide, Strategies to Manage Improper Payments 5
included two risk assessment strategies that are particularly applicable to
CMS. These are that management should
use information developed from risk assessments to form the basis from
which it determines the nature of any corrective actions, and to provide
baseline data for measuring progress in reducing payment inaccuracies and
other errors; and
reassess risks regularly to evaluate the effect of changing conditions,
both internal and external, on program operations.
While the Medicaid risk analysis is a good start, we identified several
improvements that should be made to the assessment before it is used to
deploy resources. First, the analysis does not sufficiently take into
account state financial oversight activities in assessing the risks for
improper payments in each state. Several states have implemented techniques
such as (1) prepayment edits and reviews to help prevent improper payments,
(2) screening procedures to prevent dishonest providers from entering the
Medicaid program, (3) postpayment reviews to detect inappropriate payments
after the fact, and (4) payment accuracy studies to measure the extent of
improper payments. CMS did not ask the regional financial analysts to
consider whether states use these techniques, which have identified millions
of dollars in overpayments. While regional financial
5 U. S. General Accounting Office, Strategies to Manage Improper Payments:
Learning From Public and Private Sector Organizations, GAO- 02- 69G
(Washington D. C.: Oct. 1, 2001).
Page 5 GAO- 02- 706T Medicaid Financial Management
analysts may know about many activities like these through their oversight
responsibilities, without collecting and documenting this information, CMS
does not have a complete picture of the risk for improper payments in each
state; nor will it have comprehensive information to determine the
appropriate level of federal oversight that should be applied.
A second deficiency we found in the Medicaid risk analysis is that it did
not specifically integrate information about state anti- fraud and -abuse
efforts in assessing risks for each state. Regional financial analysts were
instructed to consider the last time the regional office or HHS/ OIG
conducted a review or audit as one of the factors in determining the
likelihood and significance of risk in each state. However, the analysts
were not specifically instructed to consider results from reviews of state
anti- fraud and -abuse efforts recently conducted by the CMS Medicaid
Alliance for Program Safeguards, which has performed structured reviews in
16 states and plans to continue the reviews until all states are covered.
CMS could gain valuable information for more accurately assessing the level
of risk for improper payments in these 16 states as well as the appropriate
level of federal oversight required.
Third, we found that the Medicaid risk analysis did not include mechanisms
to ensure that such analysis would be an ongoing part of financial
oversight. As identified risks are addressed and control activities are
changed, agency managers should have methods in place to revisit their
analysis to determine where risks have decreased and new ones have emerged.
Medicaid financial managers had not determined how they would accomplish
this.
Finally, the Medicaid risk analysis would be strengthened if states were
systematically estimating the level of improper payments in their programs.
CMS management has recognized this and has begun efforts to develop an
approach for estimating improper Medicaid payments. In September 2001, nine
states responded to a CMS solicitation to participate in pilot studies to
develop payment accuracy measurement methodologies. The objective is to
assess whether it is feasible to develop a single methodology for the
diverse state Medicaid programs and to explore whether the range of improper
Medicaid payments can be estimated nationally. Each of the nine states
involved is developing a different measurement methodology. CMS managers
expect the states to complete the pilots during fiscal year 2003, after
which time CMS will select several of the state methodologies as test cases
for fiscal year 2004. It is important that CMS continues to emphasize
development of these payment accuracy reviews on a state- by- state basis
and ultimately on a national level, since
Page 6 GAO- 02- 706T Medicaid Financial Management
this is a key baseline measure for managing improper payments in the
Medicaid program.
Our review also found that while CMS had certain control activities in place
to oversee Medicaid programs, it was not effectively implementing them, and
therefore not mitigating identified risks. Control activities are an
integral part of an organization?s efforts to address risks that lead to
fraud and abuse. Given the current level of resources and the size and
complexity of the Medicaid program, CMS needs a different approach that
incorporates new oversight techniques and strategies as well as the results
of the risk assessment discussed previously.
In 1994, CMS began changing its oversight approach in an attempt to address
resource challenges and growth in Medicaid expenditures. At that time,
regional offices shifted from emphasizing detailed review of Medicaid
expenditure data to increasing the level of technical assistance provided to
states. Auditors of CMS financial statements found that as a result of this
shift, regional offices were not providing appropriate review and oversight
of state Medicaid programs, thus increasing the risk that errors and
misappropriation could occur and go undetected. In our review, we found that
the weaknesses identified by the auditors were still present.
In August 2001, we surveyed regional financial analysts to obtain their
perspectives on the design and implementation of the Medicaid financial
oversight process, covering the period from October 1, 1999, through the
date of the survey. In comments to the survey, some regional analysts
indicated that they were inundated with responsibility for multiple control
activities and unable to perform them effectively. We asked the analysts to
rate each of the control activities that they perform. The activity rated
most important by 89 percent of those surveyed was quarterly expenditure
reviews performed on- site at state Medicaid agencies. However, when asked
about the adequacy with which they performed on- site expenditure reviews,
almost 36 percent rated their performance ?inadequate? or
?marginal.? In discussions, many financial analysts attributed deficiencies
in expenditure reviews to inadequate staff resources, the low priority
placed on financial management oversight, lack of training, and conflicting
priorities. Control Activities
Were Not Effectively Implemented
Page 7 GAO- 02- 706T Medicaid Financial Management
Survey respondents also rated two other activities as important in
overseeing the propriety of Medicaid activities- these were activities to
(1) defer and disallow 6 Medicaid expenditures and (2) perform focused
financial management reviews. While more than 75 percent of analysts rated
these activities as highly important, data provided by CMS indicate,
however, that the amount of Medicaid expenditures disallowed by regional
analysts has declined. For example, from 1990 to 1993, analysts disallowed
on average $239 7 million in expenditures annually. However, for fiscal
years 1997 through 2000, analysts disallowed on average $43 million
annually, which represents an 82 percent decline. During the same period,
Medicaid expenditures went from an average of $58 billion annually to $106
billion annually- an increase of 83 percent. 8
Similarly, focused financial management reviews declined. These reviews
generally involve selecting a sample of paid claims related to certain types
of Medicaid services provided. The reviews have been useful in identifying
unallowable costs outside of those detected by reviewing quarterly
expenditure reports. According to CMS managers, in fiscal year 1992,
analysts performed about 90 in- depth reviews of specific Medicaid issues
that identified approximately $216 million in unallowable Medicaid costs. In
fiscal year 2000, analysts only performed 8 focused financial management
reviews but these 8 reviews resulted in almost $45 million in disallowed
costs- an average of about $5.6 million per review. As demonstrated, this
control activity is effective in detecting unallowable Medicaid costs;
however, it must be consistently performed for cost savings to be realized.
CMS is taking actions to improve oversight by beginning a comprehensive
assessment of its Medicaid oversight activities. However, agency managers
are concerned that their ability to address identified risks effectively may
be hindered without additional oversight resources. In the interim, CMS
plans to use the current oversight process (i. e., quarterly expenditure
6 A deferral is an action taken to withhold funds from the states until
additional clarification or documentation is received from the states
regarding Medicaid costs claimed. A disallowance is a determination by CMS
that a claim or portion of a claim by a state for federal funds is
unallowable.
7 The calculation of this amount does not include $1. 15 billion in
disallowances of Medicaid amounts for Disproportionate Share Hospital (DSH)
claims in FY ?92 that resulted from a change in the legislation related to
DSH. Including this amount would increase the average disallowance to $527
million for FY ?90 - ?93.
8 Expenditure and disallowance data provided by CMS.
Page 8 GAO- 02- 706T Medicaid Financial Management
reviews and technical assistance) for targeting those Medicaid issues that
the new risk analysis identifies.
In assessing what steps CMS could take to more efficiently and effectively
carry out its responsibilities to help ensure the propriety of Medicaid
finances, we considered strategies that other organizations have used in
successfully addressing risks that lead to fraud, error, or improper
payments. As discussed in our executive guide on Strategies to Manage
Improper Payments, key strategies include
selecting appropriate control activities based on an analysis of the
specific risks facing the organization, taking into consideration the nature
of the organization and the environment in which it operates.
performing a cost- benefit analysis of potential control activities before
implementation to ensure the cost of the activities is not greater than the
benefit.
contracting activities out to firms that specialize in specific areas like
neural networking, where in- house expertise is not available.
Our executive guide points out that many organizations have implemented
control techniques including data mining, data sharing, and neural
networking to address identified risk areas and help ensure that program
objectives are met.
Data mining is a technique in which relationships among data are analyzed
to discover new patterns, associations, or sequences. Using data mining
software, the Illinois Department of Public Aid, in partnership with the
Office of Inspector General at the Department of Health and Human Services,
identified 232 hospital transfers that may have been miscoded as discharges,
creating a potential overpayment of $1. 7 million.
Data sharing allows entities to compare information from different sources
to help ensure that Medicaid expenditures are appropriate. Last year we
reported on a data sharing project called the Public Assistance Reporting
Information System (PARIS) that has identified millions of dollars in costs
savings for states. 9 PARIS helps states share information on public
assistance programs, in order to identify individuals who may be receiving
benefits in more than one state simultaneously. Using the PARIS data match
for the first time in 1997, Maryland identified numerous
9 U. S. General Accounting Office, Public Assistance: PARIS Project Can Help
States Reduce Improper Benefit Payments, GAO- 01- 935 (Washington, D. C.:
Sept. 6, 2001)
Page 9 GAO- 02- 706T Medicaid Financial Management
individuals who no longer lived in the state but for whom the state was
continuing to pay a Medicaid managed care organization. The match identified
$7.3 million in savings for the Medicaid program.
Neural networking is a technique used to extract and analyze data. A
neural network is intended to simulate the way a brain processes
information, learns, and remembers. This technique can help identify fraud
schemes by analyzing utilization trends, patterns, and complex
interrelationships in the data. In 1997, the Texas legislature mandated the
use of neural networks in the Medicaid program. In fiscal year 2000, using
neural networking, the Texas? Medicaid Fraud and Abuse Detection System
recovered $3.4 million.
These techniques, which have been shown to achieve significant savings by
identifying and detecting improper payments, could help CMS better utilize
its limited resources in applying effective oversight of Medicaid finances
at the federal level.
Some state Medicaid agencies have already implemented data mining, data
sharing, and neural networking techniques to help ensure Medicaid program
integrity. State auditors and HHS/ OIG staff have also had success using
these techniques in overseeing state Medicaid programs. However, resources
devoted to protecting Medicaid program integrity and the use of these
techniques varies significantly state by state. When designing its Medicaid
financial oversight control activities, CMS should take into consideration
the use of data mining, data sharing, and neural networking as well as other
control activities performed at the state level. In states where these
techniques are not being used, CMS should consider using these tools in its
oversight process.
The Comptroller General?s Standards for Internal Control in the Federal
Government requires that agency managers implement monitoring activities to
continuously assess the effectiveness of control activities put in place to
address identified risks. Our review found that CMS had few mechanisms in
place to continuously monitor the effectiveness of its oversight. Managers
had not established performance standards for financial oversight
activities, particularly their expenditure review activity. Limited data
were collected to assess regional financial analyst performance in
overseeing state Medicaid programs. Without effective monitoring, CMS did
not have the information needed to help assure the propriety of Medicaid
expenditures. Monitoring Activities
Were Limited in Scope and Effectiveness
Page 10 GAO- 02- 706T Medicaid Financial Management
A CMS official told us that steps would be taken within the next year to
begin monitoring the effectiveness of the Medicaid financial oversight
process. Medicaid financial managers plan to reinstitute a performance
reporting process that was in place prior to 1993. While this is a good
step, the previous process lacked several elements necessary for effective
internal control monitoring. For example, the performance reporting process
did not establish agency- specific goals and measures for evaluating
regional performance in reducing payment errors and inaccuracies. In
addition, there were no formal criteria or standard estimation methodologies
for regions to use in measuring the amount of unallowable costs that the
states avoided because of technical assistance provided before payment. As
discussed in our executive guide, Strategies to Manage Improper Payments,
establishing such goals and measures is key to tracking the success of
improvement initiatives.
In addition, the CMS audit resolution procedures did not collect sufficient
information on the status of audit findings or ensure their timely
resolution, as required by federal internal control standards. We found that
audit resolution and monitoring activities performed by CMS and its regional
offices were limited. Audit resolution activities were also inconsistently
performed across the regions.
Within CMS, three units share responsibility for audit resolution activities
related to the Medicaid program. In accordance with the HHS Grants
Administration Manual, 10 regional financial analysts are responsible for
working with auditors to resolve findings, ensure questioned costs are
recovered, verify that corrective actions have been taken, and document the
status of audit resolution in quarterly reports. The Division of Audit
Liaison (DAL) is responsible for maintaining a tracking system for each
audit report and related findings, monitoring the timeliness and adequacy of
audit resolution activities, distributing all audit clearance documents, and
preparing monthly reports on the status of audit resolution and collection
activities. The Division of Financial Management (DFM), the headquarters
unit responsible for Medicaid financial management, has one headquarters
staff person responsible for coordinating and interacting with DAL and
regional analysts to ensure that Medicaid related findings
10 The Grants Administration Manual, issued by HHS, provides guidance on
implementing HHS policies on the administration of HHS grants. Chapter 1-
105 of the manual addresses the resolution of audit findings.
Page 11 GAO- 02- 706T Medicaid Financial Management
are resolved. We found that many of these responsibilities were not being
effectively carried out or were carried out inconsistently.
For instance, in discussions with regional financial analysts, we found that
they spend very little time resolving state single audit findings due to
competing oversight responsibilities. As a result, these findings are not
always resolved, and related questioned costs are not promptly recovered. We
found unrecovered questioned costs totaling $24 million that were identified
in audit reports that had been issued for years prior to fiscal year 1999.
In addition, we found that as of September 30, 2001, regional analysts had
not determined whether actions had been taken to resolve 85 Medicaid
findings included in state single audit reports for fiscal year 1999. Lack
of timely follow- up on financial management and internal control issues
increases the risk that corrective actions may not have been taken, and that
erroneous or improper payments are continuing to be made.
We also found that the regional financial analysts inconsistently followed
procedures for monitoring, tracking, and reporting on the resolution of
single audit and HHS/ OIG audit findings. For example, 3 of the 10 regions
had not prepared quarterly status reports that are intended to provide
information on corrective actions that states have taken to resolve audit
findings.
Further, pertinent information was not identified, documented, and
distributed among those responsible for audit resolution. The internal
control standard related to information and communication provides that
pertinent information be identified, recorded, and distributed to the
appropriate areas in sufficient detail, and at the appropriate time to
enable the entity to carry out its duties and responsibilities efficiently
and effectively. In our review, we found that the monthly DAL report
intended to provide a complete list of all audits with unresolved Medicaid
findings did not meet this standard. We analyzed a list provided by the HHS/
OIG that included 23 Medicaid related reports issued by the HHS/ OIG and
state auditors in fiscal year 2001. We found four reports from the HHS/ OIG
list that were not included in DAL monthly reports related to the second,
third, and fourth quarters of that year. This information is critical and
must be distributed to the regions to ensure that they are acting to resolve
all Medicaid related findings.
We also found that the regions did not document information critical to
tracking unresolved audits in their regional quarterly status reports. The
regions reported which audits had been resolved but not the status of those
still under review. This makes it difficult to track audit status.
Page 12 GAO- 02- 706T Medicaid Financial Management
The current organizational structure of CMS compounds the weaknesses I have
highlighted today. This organizational structure has created challenges to
effective oversight because of unclear lines of authority and responsibility
between the regions and headquarters. Although the 10 regional offices are
the CMS front line in overseeing state financial management and Medicaid
expenditures, there are no reporting relationships to DFM, the headquarters
unit responsible for Medicaid financial management.
For example, a working group headed by the director of DFM updated guidance
for expenditure reviews in September 2000 in response to concerns raised by
auditors about the inconsistency in expenditure reviews across regions.
While the guide strongly encouraged regional analysts to perform all
procedures, it did not mandate that they do so. Headquarters financial
managers do not have direct authority to enforce such a directive and
regional managers have discretion in how resources are utilized. Similarly,
the guide allowed regional branch managers the discretion to review regional
analyst?s expenditure review workpapers for compliance with the guide or
simply to obtain written or verbal assurance from the analyst that the
procedures were performed. By allowing supervisors to satisfy their review
responsibilities merely with verbal assurance, CMS minimized the
effectiveness of this basic control. During our site reviews, we found
evidence that supervisory reviews were not conducted.
The CMS organizational structure also hindered efforts to evaluate and
monitor regional office performance. At the time of our review, there were
few formal requirements for regions to report to headquarters and CMS did
not collect, analyze, or evaluate consistent information on the quality of
regional financial oversight for Medicaid across the country. Previous
efforts to monitor performance were discontinued because regional staff
resources were not available to collect and submit the data to headquarters
managers. Headquarters managers, in turn, did not have the authority to
require regions to collect such data. As a result, Medicaid financial
managers in headquarters were not in a position to provide formal feedback
to region financial management staff to improve their performance and
therefore have not been in a position to assess the effectiveness of
Medicaid oversight activities.
The current organizational structure also poses challenges to implementing
corrective actions aimed at addressing oversight weaknesses and improving
accountability. Over the past 2 years, headquarters financial managers have
taken steps to develop and Organizational
Structure Impedes Effective Oversight
Page 13 GAO- 02- 706T Medicaid Financial Management
implement improvements to the financial oversight process. Medicaid staff
are currently
developing risk analysis to identify expenditures of greatest risk;
working with states to develop methodologies for estimating Medicaid
improper payments;
developing work plans that guide efforts to allocate financial oversight
staff and travel resources based on the risk analysis; and
developing performance- reporting mechanisms. Medicaid staff have also
recently
formed a financial management strategy workgroup of headquarters and
regional financial management staff to review the entire Medicaid financial
oversight process and determine the proper structure for an adequate
oversight process;
updated its expenditure and budget review guides; and
gathered information on how regional financial analyst staff time is
allocated between oversight responsibilities.
Headquarters DFM managers recognize that regional office commitment is
critical to successfully implementing and sustaining its improvement
initiatives. The current structural relationship could diminish the chances
of such success. Headquarters managers expressed concern that despite recent
efforts to develop risk analysis and implement work plans that allocate
resources based on identified risks, regional managers will still have the
authority to decide how oversight resources are utilized. Given the multiple
oversight activities that regional financial analysts are responsible for,
headquarters managers have no assurance that review areas included in the
work plans will be given priority in each region. Headquarters managers may
experience similar difficulties in reestablishing performance reporting.
According to one senior Medicaid manager, some regions have already
petitioned headquarters managers not to use data on the amount of
expenditures deferred and disallowed in gauging performance.
During our review, we asked regional financial analysts about several recent
improvement initiatives to gauge their knowledge and participation in the
initiatives. Several analysts we spoke with did not think the risk
assessment effort was useful because they felt that they already knew the
risks within the states that they were responsible for and did not need a
formal assessment to tell them that. In our survey, we asked regional
financial analysts to rate the importance of the risk assessment, staff time
Page 14 GAO- 02- 706T Medicaid Financial Management
allocation effort, and review guide updates to overall financial oversight.
Approximately half of the survey respondents thought the initiatives were of
marginal or little importance. During pretests of our survey, several
analysts said they did not understand the purpose of the initiatives because
no one had communicated to them how the information was going to be used.
In discussions with headquarters managers, they acknowledged that a written
plan or strategy that describes the initiatives and the responsibility for
implementing them was still being drafted. Such a plan or strategy could be
very useful in soliciting regional analyst support. More importantly,
headquarters managers acknowledged that performance accountability
mechanisms for the regions are needed to implement improvements
successfully. CMS is currently planning some changes that may improve
mechanisms to hold CMS financial managers, including regional managers and
administrators, accountable for critical tasks. CMS has developed a
restructuring and management plan that seeks to add specific
responsibilities tied to agency goals into senior managers? performance
agreements. CMS has not determined how Medicaid financial management
oversight responsibilities that can be evaluated will be included in the
plan. This information is key to establishing a sound internal control
environment for Medicaid finances throughout CMS.
As you can see, this structural relationship has created challenges in (1)
establishing and enforcing minimum standards for performing financial
oversight activities, (2) routinely evaluating the regional office
oversight, and (3) implementing efforts to improve financial oversight. As a
result, CMS lacks a consistent approach to monitor and improve performance
among the units that share responsibility for financial management and
ingrain a sound internal control environment for Medicaid finances
throughout CMS.
In closing, Mr. Chairman, I want to emphasize that while CMS is acting to
improve its financial oversight of the Medicaid program, the increasing size
and complexity of the program, coupled with diminishing oversight resources,
requires a new approach to address these challenges. Developing baseline
information on Medicaid issues at greatest risk for improper payments and
measuring improvements in program management against that baseline is key to
achieving effective financial oversight. Determining the level of state
activities in place to monitor and control Medicaid finances is also
critical to determining the extent and type of control techniques as well as
the amount of resources CMS must apply at
Page 15 GAO- 02- 706T Medicaid Financial Management
the federal level to oversee the program adequately. Establishing clear
lines of authority and performance standards for CMS oversight would also
provide for a more efficient, effective, and accountable Medicaid program.
Our report includes recommendations in each of these areas. CMS?s ability to
make the kind of changes that we are recommending will require top- level
management commitment, a comprehensive financial oversight strategy that is
clearly communicated to all those responsible for program oversight, and
clear expectations for implementation of the changes.
Mr. Chairman, this concludes my statement. I would be happy to answer any
questions you or other members of the subcommittee may have.
For information about this statement, please contact Linda Calbom, Director,
Financial Management and Assurance, at (202) 512- 9508 or at
calboml@ gao. gov. Individuals making key contributions to this statement
include Kimberly Brooks, W. Ed Brown, Lisa Crye, Chanetta Reed, Vera
Seekins, Taya Tasse and Cynthia Teddleton. Contact and
Acknowledgments
*** End of document. ***