Medicare Advantage: Required Audits of Limited Value (30-JUL-07, 
GAO-07-945).							 
                                                                 
In fiscal year 2006, the Centers for Medicare & Medicaid Services
(CMS) spent over $51 billion on the Medicare Advantage program,  
which serves as an alternative to the traditional fee-for-service
program. Under the Medicare Advantage program, companies wishing 
to participate must annually submit bids (effective with contract
year 2006) that identify the health services the company will	 
provide to Medicare members and the estimated cost and revenue	 
requirements for providing those services. For 2001 through 2005,
the submissions were called Adjusted Community Rate (ACR)	 
Proposals. The Balanced Budget Act (BBA) of 1997 requires CMS to 
annually audit the financial records supporting the submissions  
of at least one-third of participating organizations. BBA also	 
requires that GAO monitor the audits. In this report, GAO	 
examined (1) whether CMS met the one-third requirement for 2001  
through 2006, (2) what information the ACR audits provided and	 
how CMS used it, and (3) what information the bid audits provided
and how CMS used it.						 
-------------------------Indexing Terms------------------------- 
REPORTNUM:   GAO-07-945 					        
    ACCNO:   A73701						        
  TITLE:     Medicare Advantage: Required Audits of Limited Value     
     DATE:   07/30/2007 
  SUBJECT:   Audit reports					 
	     Auditing procedures				 
	     Auditing standards 				 
	     Audits						 
	     Financial analysis 				 
	     Health care programs				 
	     Medicare						 
	     Program evaluation 				 
	     Reporting requirements				 
	     Conflict of interests				 
	     Documentation					 
	     Medicare Advantage Program 			 

******************************************************************
** This file contains an ASCII representation of the text of a  **
** GAO Product.                                                 **
**                                                              **
** No attempt has been made to display graphic images, although **
** figure captions are reproduced.  Tables are included, but    **
** may not resemble those in the printed version.               **
**                                                              **
** Please see the PDF (Portable Document Format) file, when     **
** available, for a complete electronic file of the printed     **
** document's contents.                                         **
**                                                              **
******************************************************************
GAO-07-945

   

     * [1]Results in Brief
     * [2]Background
     * [3]GAO Analysis Shows CMS Has Not Met the Audit Requirement for

          * [4]CMS Has Not Met Audit Requirement
          * [5]CMS Has Not Yet Met the Audit Requirement for Contract Year

     * [6]CMS's ACR Audit Process Was Ineffective

          * [7]The ACR Audit Process Did Not Consistently Quantify Impacts
          * [8]CMS Did Not Act to Recover Funds from or Sanction MA Organiz

     * [9]Bid Audits Report Findings That Would Affect Premiums and Pa

          * [10]Contract Year 2006 Bid Audit Results Identified Significant
          * [11]CMS's Follow-up on Bid Audits Is Similar to Follow-up on the
          * [12]CMS Did Not Document Steps Taken to Mitigate Conflicts of In

     * [13]Conclusions
     * [14]Recommendations for Executive Action
     * [15]Agency Comments and Our Evaluation
     * [16]GAO Contacts
     * [17]Acknowledgments
     * [18]GAO's Mission
     * [19]Obtaining Copies of GAO Reports and Testimony

          * [20]Order by Mail or Phone

     * [21]To Report Fraud, Waste, and Abuse in Federal Programs
     * [22]Congressional Relations
     * [23]Public Affairs

Report to Congressional Committees

United States Government Accountability Office

GAO

July 2007

MEDICARE ADVANTAGE

Required Audits of Limited Value

GAO-07-945

Contents

Letter 1

Results in Brief 5
Background 8
GAO Analysis Shows CMS Has Not Met the Audit Requirement for Contract
Years 2001-2005 and Has Not Yet Met It for Contract Year 2006 12
CMS's ACR Audit Process Was Ineffective 17
Bid Audits Report Findings That Would Affect Premiums and Payments for
Contract Year 2006, But CMS Does Not Address the Findings 23
Conclusions 28
Recommendations for Executive Action 29
Agency Comments and Our Evaluation 30
Appendix I Scope and Methodology 32
Appendix II Actuarial Standards Applicable to Bid Preparers 36
Appendix III Description of Bid Worksheets 38
Appendix IV Other Reviews of Financial Records CMS Plans to Do to Meet
Audit Requirement 40
Appendix V Comments from the Department of Health and Human Services 41
Appendix VI GAO Contact and Staff Acknowledgments 45
Related GAO Products 46

Tables

Table 1: Summary of Organizations Audited as a Percentage of Total
Organizations and Audit Costs 13
Table 2: Summary of Audited Plans as a Percentage of Those Offered by
Audited Organizations and All Participating Organizations 14
Table 3: Description of the Medicare Advantage Bid Form Worksheets for MA
Plans for Contract Year 2006 38
Table 4: Description of the Medicare Prescription Drug Plan Bid Form
Worksheets for Medicare Advantage Plans for Contract Year 2006 39
Table 5: CMS's Planned Reviews of Medicare Advantage and Medicare Part D
to Meet Audit Requirement 40

Figure

Figure 1: Time Elapsed from Contract Year 2006 Bid Submissions to Reviews
to Meet Audit Requirement 17

Abbreviations

ACR adjusted community rate
ACRP adjusted community rate proposal
ASOP Actuarial Standards of Practice
BBA Balanced Budget Act of 1997
BIPA Medicare, Medicaid, and SCHIP Benefits Improvement Protection Act of 2000
CBC Center for Beneficiary Choices
CMS Centers for Medicare & Medicaid Services
FFS fee-for-service
HHS Department of Health and Human Services
HMO health maintenance organization
HPMS Health Plan Management System
MA Medicare Advantage
MCHP managed-care health plan
MMA Medicare Prescription Drug, Improvement and Modernization Act of 2003
OACT Office of the Actuary
OFM Office of Financial Management
OIG Office of Inspector General
PPO preferred provider organization
PSO provider-sponsored organization
RPPO regional preferred provider organization

This is a work of the U.S. government and is not subject to copyright
protection in the United States. It may be reproduced and distributed in
its entirety without further permission from GAO. However, because this
work may contain copyrighted images or other material, permission from the
copyright holder may be necessary if you wish to reproduce this material
separately.

United States Government Accountability Office

Washington, DC 20548

July 30, 2007

The Honorable Max Baucus
Chairman
The Honorable Charles E. Grassley
Ranking Member
Committee on Finance
United States Senate

The Honorable John D. Dingell
Chairman
The Honorable Joe Barton
Ranking Member
Committee on Energy and Commerce
House of Representatives

The Honorable Charles B. Rangel
Chairman
The Honorable Jim McCrery
Ranking Member
Committee on Ways and Means
House of Representatives

In fiscal year 2006, the Centers for Medicare & Medicaid Services (CMS)
estimated it spent over $51 billion on the Medicare Advantage program,
which serves as an alternative to Medicare's traditional fee-for-service
(FFS) program.1 Under the Medicare Advantage program, CMS approves private
companies to offer health plan options to Medicare enrollees that include
all Medicare-covered services. In addition, many plans under the program
provide supplemental benefits, such as a reduction in required cost
sharing (e.g., beneficiaries' Part B premiums)2 or coverage for items and
services not included under the traditional FFS program, like dental care.
According to CMS, in fiscal year 2006, over 16 percent, or about 7 million
of the approximately 43 million Medicare members, were enrolled in a
Medicare Advantage plan.

1Total Medicare outlays in fiscal year 2006 were $381.9 billion.

2Medicare Part B provides coverage for certain physician, outpatient
hospital, laboratory, and other services to beneficiaries who pay monthly
premiums.

Before 2006, companies choosing to participate in the Medicare Advantage
program were required to annually submit an Adjusted Community Rate
Proposal (ACRP) to CMS for review and approval for each plan it intended
to offer.3 The ACRP consisted of two parts--a plan benefit package and the
Adjusted Community Rate (ACR). The plan benefit package contained a
detailed description of the benefits offered by the plan, and the ACR
contained a detailed description of the costs that the plan estimated it
would incur in providing a package of benefits to an enrolled Medicare
beneficiary. These costs were to be calculated based on how much a plan
would charge a commercial customer to provide the same benefit package if
its members had the same expected use of services as Medicare
beneficiaries. For each plan offered, the ACR was to provide an estimate
of expected per person payments from Medicare, based on published
Medicare+Choice payment rates and the characteristics of the plan's
expected enrollees. If the estimated ACR costs were greater than the
estimated payment rate, and if the organization still chose to
participate, it agreed to accept the CMS payment rate in accordance with
its ACRP. However, if the estimated ACR costs were less than the estimated
payment rate, the organization had to (1) provide additional services, (2)
reduce beneficiary premiums or copayments, (3) distribute the excess to a
benefit stabilization fund, or (4) use a combination of these methods. CMS
made payments to the companies monthly in advance of rendering services.

In 2003, Congress enacted the Medicare Prescription Drug, Improvement and
Modernization Act of 2003 (MMA).4 Among other things, MMA established a
bid submission process to replace the ACRP submission process and
authorized a new prescription drug benefit, both effective for 2006. Under
the bid process, private companies--called Medicare Advantage (MA)
organizations--choosing to participate in the program are required to
annually submit bids for review and approval for each plan they intend to
offer. The bid submission includes a bid form that provides each MA
organization's estimate of the cost of delivering services to an enrolled
Medicare beneficiary and a plan benefit package that provides a detailed
description of the benefits offered in each plan. Additionally, each MA
organization and prescription drug plan that offers prescription drug
benefits under Part D5 is required to submit a separate prescription drug
bid form, a formulary,6 and a plan benefit package to CMS for its review
and approval. Within the bid forms, MA organizations include an estimate
of the per person cost of providing Medicare-covered services. Unlike the
cost estimates under the ACRP process, organizations develop CMS bid cost
estimates by relying on reasonable projection methods that may include
reliance on incurred costs for a base year, adjustments for estimated
utilization, and other factors to project costs to the bid contract
period. CMS compares the bid amounts to geographic-specific benchmarks to
determine the total payment to the MA organization.7 If a bid amount is
above the benchmark, the MA organization must require enrollees to pay the
difference in the form of a premium. If the bid amount is below its
benchmark, 75 percent of the difference (or savings), termed a rebate,
must be provided to enrollees as extra benefits in the form of cost
sharing reductions, premium reductions, or additional covered services.8
The remaining 25 percent of the savings is retained by the Federal
Treasury.9 After bids are approved and payments are established, CMS makes
payments to the companies monthly in advance of rendering services.

3Participating companies can offer multiple plans. The term "plan" refers
to a specific package of benefits offered.

4Pub. L. No. 108-173, 117 Stat. 2066 (Dec. 8, 2003).

Until the passage of the Balanced Budget Act of 1997 (BBA), which required
CMS to annually audit the supporting financial records (including data
relating to Medicare utilization, costs, and computation of the ACR) of at
least one-third of the participating organizations,10 there was limited
oversight by CMS of the ACR process. BBA also required that GAO monitor
the audit activities mandated by the act. In fulfilling our
responsibility, we first reviewed CMS's process for auditing ACRs approved
for contract year 2000.11 This was CMS's first effort to meet the audit
requirement. We reported that the audits were of limited usefulness
because CMS did not follow up on the audit results. In continuing to
fulfill our audit monitoring responsibility, this report addresses the
following questions:

5Part D is the optional outpatient prescription drug benefit for Medicare
established by MMA.

6The formulary is a listing of prescription medications that are approved
for use or coverage by the plan and that will be dispensed through
participating pharmacies to covered enrollees.

7Benchmarks are the maximum amount Medicare will pay a MA organization for
delivering benefits in a specific geographic area. They are determined by
the Secretary of Health and Human Services each year under a methodology
provided in the Medicare law.

8For prescription drug plans, CMS aggregates the bids for each plan to
generate a single weighted national average monthly bid amount for Part D.
If the standardized prescription bid exceeds the amount of the national
average monthly bid, the plan can increase the base beneficiary premium by
the difference. If the standardized prescription bid is below the amount
of the national average monthly bid, the plan must decrease the base
beneficiary premium by the difference.

9For regional preferred provider organizations, 12.5 percent of the
difference is retained by the Federal Treasury, and the remaining 12.5
percent is directed to the MA Regional Plan Stabilization Fund.

           1. Has CMS met the requirement for auditing the financial records
           of at least one-third of the participating MA organizations for
           contract years 2001-2005 as required by the Balanced Budget Act of
           1997 and bid submissions for contract year 2006?

           2. Did the ACRP audit process provide CMS sufficient information
           to assess potential impacts on beneficiaries and identify actions
           to address those impacts?

           3. How did CMS conduct audits of bids for 2006, what information
           did the bid audit process provide CMS, and how did CMS use that
           information?

           To determine whether CMS met requirements for auditing the
           financial records of at least one-third of the MA organizations
           for contract years 2001-2005 and the bid submissions for contract
           year 2006, we obtained from CMS a listing of the organizations
           that had their ACRPs or bids audited each year and compared it
           with the total number of approved ACRP and bid submissions for
           each year obtained from CMS's ACRP and bid management database,
           the Health Plan Management System (HPMS). We also interviewed CMS
           staff and officials.

           To determine whether information provided by the ACRP audit
           process was sufficient for CMS to assess potential impacts on
           beneficiaries and address those impacts, we obtained and reviewed
           audit reports for contract years 2001-2004 and reports prepared by
           a contractor that reviewed and analyzed the audits for contract
           year 2003. We interviewed CMS staff and officials about what they
           did with the audit results, and we discussed CMS's review of an
           analysis of contract year 2003 ACR audits performed by the
           contractor.
			  
10Pub. L. No. 105-33, tit. IV, S 4001, 111 Stat. 251, 320 (Aug. 5, 1997)
(codified at 42 U.S.C. S 1395w-27(d)(1)).

11GAO, Medicare+Choice Audits: Lack of Follow-up Limits Usefulness,
[24]GAO-02-33 (Washington, D.C.: Oct. 9, 2001).			  

           To determine how CMS conducted bid audits for contract year 2006,
           what information the bid audit process provided CMS, and how CMS
           used that information, we obtained and reviewed CMS's instructions
           and guidance for bid auditors, bid audit reports for contract year
           2006, planned audit procedures, and bid certifications records. We
           interviewed the bid audit firms and CMS staff and officials about
           the bid audit process and discussed with CMS how it used the
           results of the contract year 2006 audits and its plans for future
           use.

           See appendix I for details about our scope and methodology. We
           requested written comments on a draft of this report from the
           Secretary of Health and Human Services (HHS) or his designee. We
           conducted our review from November 2006 to June 2007 in accordance
           with generally accepted government auditing standards.
			  
			  Results in Brief

           CMS did not document its process to determine whether it met the
           one-third audit requirement. However, on the basis of our analysis
           of available CMS data, CMS has not met the statutory requirement
           to audit the financial records of at least one-third of the
           participating MA organizations for contract years 2001-2005, nor
           has it done so yet for the contract year 2006 bid submissions.
           With respect to contract year 2006, CMS officials acknowledged the
           one-third requirement, but stated that they did not intend for the
           audits of contract year 2006 bid submissions to meet the one-third
           audit requirement. Instead they said they plan to conduct other
           reviews of the financial records of participating MA organizations
           and prescription drug plans that will contribute to satisfying the
           requirement. However, CMS has not clearly laid out how any of
           these reviews will be conducted to meet the one-third requirement.
           Further, CMS will not complete these other financial reviews until
           almost 3 years after the bid submission date for each contract
           year, in part because it must first reconcile payment data that
           prescription drug plans are not required to submit to CMS until 6
           months after the contract year is over. Such an extended cycle for
           conducting audits and reviews to meet the one-third requirement
           will likely affect CMS's ability to recommend and implement any
           actions needed to address any identified deficiencies in MA
           organizations' and prescription drug plans' bid processes in a
           timely manner.

           CMS contracted with accounting firms for audits of the ACRs for a
           selected number of MA organizations for contract years 2001-2005,
           but did not consistently ensure that the audit process provided
           information to assess the potential impact on beneficiaries'
           benefits or payments to the MA organizations. In 2001, we reported
           that CMS planned to require auditors, where applicable, to
           quantify in their audit reports the overall impact of errors. CMS
           did not implement steps to determine such impact until after the
           audits for contract year 2003 were completed, when CMS contracted
           with a firm to review all of the 2003 ACR audits and determine if
           there were any errors identified by the auditors that would affect
           beneficiaries.12 On the basis of that review, the contractor
           reported to CMS that it identified errors in ACRs that would have
           resulted in approximately $59 million that beneficiaries could
           have received in additional benefits, lower copayments, or lower
           premiums. Staff from CMS's Office of Financial Management (OFM)
           reviewed the auditors' and contractor's work to evaluate the
           amount reported by the contractor that would impact beneficiaries.
           OFM staff revised the amount to $34 million and concluded that
           they would make recommendations to CMS's Center for Beneficiary
           Choices (CBC) on whether corrective action plans or sanctions
           against MA organizations were warranted. However, in late May
           2007, CMS officials told us they were planning to close out the
           audits without pursuing financial recoveries because legal counsel
           had determined that the agency does not have the legal authority
           to recover funds from MA organizations based on ACR audit results.
           Subsequently, HHS legal counsel explained to us the department's
           position that CMS lacks the legal authority or the contractual
           right to pursue financial recoveries when audits determine that
           approved ACRs reflect errors, incorrect or unreasonable
           assumptions, or other misstatements. On the basis of our
           assessment of the statutes, CMS had the authority to pursue
           financial recoveries, but its rights under contracts with the
           organizations submitting ACRPs are limited because its
           implementing regulations did not require that each contract
           include provisions to inform organizations about the audits and
           about the steps that CMS would take to address identified
           deficiencies, including pursuit of financial recoveries. CMS
           officials acknowledged that they can impose sanctions in cases
           where an organization misrepresents information that is furnished
           under the program. However, CMS has never sanctioned an MA
           organization based on ACR audit results and did not say why it has
           not.
			  
12CMS also contracted with a firm to review the 2004 ACR audits, but the
work is not to be completed until August 31, 2007.

           CMS contracted with six firms to audit a selected number of
           contract year 2006 bids and plans to do so for subsequent years.
           In reviewing the 2006 bid audit reports, we determined that 18
           (about 23 percent) of the 80 organizations audited had material
           findings that have an impact on beneficiaries or plan payments
           approved in bids. CMS defined material findings13 as those that
           would result in changes in the total bid amount of 1 percent or
           more or in the estimate for the costs per member per month of 10
           percent or more for any bid element. Officials from CMS's Office
           of the Actuary (OACT) responsible for the bid audit process
           explained that they will use the audit results to help
           organizations improve their methods in preparing bids in
           subsequent years, but their audit follow-up process does not
           involve pursuing financial recoveries from organizations because
           CMS maintains that, as with ACRPs, it does not have the legal
           authority to do so. However, on the basis of our assessment of the
           statute, CMS has the authority to include terms in its contracts
           with MA organizations and prescription drug plan sponsors that
           would allow it to pursue financial recoveries based on the bid
           audit results. CMS also has the authority to sanction
           organizations. However, CMS has not sanctioned an MA organization
           based on contract year 2006 bid audit results. In the absence of
           changes to its procedures, CMS will continue to invest resources
           in audits that will likely provide limited value or return on
           investment. Another weakness that we noted in CMS's bid audit
           process was the lack of documentation to support steps taken to
           mitigate conflict of interest situations for the actuarial firms
           conducting the bid audits. Using available information, we were
           able to confirm that the actuarial firms did not audit the same
           bids for which the firms had acted as a consultant in preparing.
           However, we were not able to confirm the steps taken by CMS to
           avoid assigning actuarial firms to audit the same bids that the
           firms had reviewed because information was not available by the
           end of our fieldwork in June 2007.

           This report makes five recommendations to CMS to address ACRP
           audit results, enhance its approach for meeting the one-third
           audit requirement, improve its implementing regulations for the
           Medicare Advantage and Prescription Drug Programs, expand its
           procedures for following up on bid audit and financial review
           results, and reinforce the steps it takes to address conflicts of
           interest with firms that perform bid audits. In written comments
           on a draft of this report, CMS concurred with our recommendations
           and stated that it is in the process of implementing some of the
           recommendations including modifying its procedures for selecting
           MA organizations and prescription drug plans to meet the one-third
           audit requirement. CMS's comments are discussed in the Agency
           Comments and Our Evaluation section and reprinted in appendix V.
           CMS and HHS's Office of the Inspector General (OIG) also provided
           technical comments, which we incorporated as appropriate.
			  
13Findings also include any serious failure to follow applicable Actuarial
Standards of Practice. Materiality for identifying observations included
all other errors or deviations from the instructions or best actuarial
practices that did not meet the criteria for being classified as findings.

           Background

           The Medicare program has a long-standing history of offering its
           beneficiaries managed care coverage through private plans as an
           alternative to the traditional FFS program. In 1997, Congress
           passed the Balanced Budget Act of 1997,14 which replaced an
           existing managed care program with the Medicare+Choice program in
           an effort to expand beneficiaries' managed care options. For
           oversight of the program, the act also required that CMS annually
           audit the financial records of at least one-third of the
           organizations participating in the Medicare+Choice program,
           including the organizations' data relating to Medicare
           utilization, costs, and computation of the ACR.15

           In 2003, Congress enacted the Medicare Prescription Drug,
           Improvement, and Modernization Act of 200316 to expand the role of
           private entities in providing benefits to Medicare beneficiaries.
           Among its changes, the law renamed the Medicare+Choice program the
           Medicare Advantage program. Medicare+Choice organizations were
           renamed MA organizations.17 MMA also authorized new prescription
           drug benefits to Medicare beneficiaries beginning in 2006 and
           created new types of private health plans such as "regional" MA
           plans,18 special needs plans, and prescription drug plans that
           could be offered in addition to the plan types already being
           offered such as health maintenance organizations (HMO), preferred
           provider organizations (PPO), provider-sponsored organizations
           (PSO), medical savings accounts, and private FFS plans.19

14Pub. L. No. 105-33, 111 Stat. 251 (Aug. 5, 1997).

15See 42 U.S.C. S 1395w-27(d)(1).

16Pub. L. No. 108-173, 117 Stat. 2066 (Dec. 8, 2003).

17Throughout this report, we refer to organizations participating in the
Medicare+Choice and MA programs as MA organizations.

18A regional PPO is defined as an "MA regional plan" and MMA requires that
each MA regional plan (1) have a network of providers that have agreed to
a contractually specified reimbursement for covered benefits, (2) provide
reimbursement for all covered services regardless of whether the benefits
are provided by participating providers, and (3) cover the service area of
at least one entire MA region.

           MMA established a bid submission process to replace the ACRP
           submission process used under the Medicare+Choice program to
           annually approve the benefit packages and costs that organizations
           estimated they would incur in providing benefits to enrolled
           Medicare beneficiaries. MMA specified that organizations wishing
           to offer health benefits as part of the MA program and drug
           benefits must annually submit bids. The bid submission includes a
           MA bid form indicating each MA organization's estimate of the cost
           of delivering services to Medicare beneficiaries and a plan
           benefit package for each plan.20 Additionally, each organization
           that offers prescription drug benefits under Part D is required to
           submit a separate prescription drug bid form, a formulary, and a
           plan benefit package to CMS for its review and approval.

           MMA made changes to the methodology that MA organizations use in
           estimating the costs of benefits. Under the ACRP process, MA
           organizations were required to include an estimate of their per
           person cost of providing benefits based on how much they would
           charge a commercial customer to provide the same benefit package
           if their members had the same expected use of services as Medicare
           beneficiaries. The chief executive officer, chief financial
           officer, and the head marketing official of the MA organization
           were required to certify that the ACRP contained accurate
           information.

19HMOs are a type of managed care plan where a group of doctors,
hospitals, and other health care providers agree to give health care to
Medicare beneficiaries for a set amount of money every month. PPOs have
comprehensive provider networks, but beneficiaries enrolled in PPOs may
use out-of-network providers if they pay higher cost sharing. Private FFS
plans pay qualified providers for each covered service delivered to its
enrollees, and beneficiaries enrolled in FFS plans may go to any doctor or
hospital they choose without a referral if the provider accepts the plan's
payment terms. PSOs have a group of doctors, hospitals, and other health
care providers that agree to give health care to Medicare beneficiaries
for a set amount of money from Medicare every month. This type of managed
care plan is run by the doctors and providers themselves, and not by an
insurance company.

20The bid form is a series of worksheets that contain actuarial estimates
of plan cost and cost sharing for the contract year as well as computation
of the benchmark, rebate, and basic member premium that is risk-adjusted
based on the characteristics of individual plan enrollees. See appendix
III for a further description of these worksheets.

           Under the bid process, cost estimates are not based on commercial
           experience. Under CMS's bid submission instructions, organizations
           are required to include an estimate of the per person cost of
           providing Medicare-covered services by relying on reasonable
           projection methods that may include reliance on incurred costs for
           a base year, adjustments for estimated utilization, and other
           factors to project costs to the bid contract period. The allowed
           costs and additional cost sharing information are to be used to
           determine net medical costs. To this, nonmedical expenses, such as
           indirect administration and gain/loss margins, are to be added to
           establish the required revenue for the contract year for each plan
           offered. The assumptions, data, and models used in developing cost
           estimates are prepared by the organizations' actuaries. CMS
           requires that the actuary who prepared the bid must submit a
           certification stating that the bid complies with laws,
           regulations, and the bid instructions and that the actuary has
           followed the appropriate actuarial standards in completing the
           bid.

           To determine the payments under the bid process, CMS compares the
           bid amounts to geographic-specific benchmarks.21 If a bid is above
           the benchmark, the enrollee must pay the difference in the form of
           a premium, referred to as the basic beneficiary premium. If a bid
           is below its benchmark, 75 percent of the difference (or savings),
           termed the rebate, must be provided to enrollees as extra benefits
           in the form of cost sharing reductions, premium reductions for
           Part B or Part D, or additional covered services. The remaining 25
           percent of the savings is retained by the Federal Treasury.

           By law, organizations are required to submit bids for each
           contract year by the first Monday in June before the contract year
           begins. For contract year 2006, organizations had to submit bids
           to CMS by June 6, 2005. The bids are submitted through HPMS. CMS
           subjects the bid forms to a desk review prior to approval. In
           contract year 2006, CMS contracted with six actuarial consulting
           firms to assist in reviewing the bid forms. The objective of the
           bid review was to determine whether the bid was reasonable and
           fair to the organization, the beneficiary, and CMS. In contract
           year 2006, the review of the bid forms consisted of a series of
           structured subreviews that examined the individual cost elements
           that collectively comprised each bid. CMS's OACT developed metrics
           for each bid and identified statistical outliers based on
           "acceptable thresholds" it defined. The contract reviewers
           investigated the outliers, requesting additional documentation
           from the organization as necessary, to assess the assumptions and
           methods supporting the bid elements and their reasonableness to
           support the overall bid. From early June 2005 through
           mid-September 2005, CMS contractors reviewed the bids, and CMS
           approved them.22 CMS awarded contracts for approved bids by
           mid-September 2005.
			  
21For regional plans, organizations estimate regional plan benchmarks in
their June bids until CMS determines the amount for the final regional
benchmark and makes it available to the organizations in August. Then the
organizations revise the benchmark amounts in their bids accordingly.

           After approval of the bids, CMS selects bids for audit.23 For
           audits of the contract year 2006 bid forms, OACT contracted with
           six firms in September 2005. CMS specified audit guidance for the
           auditors. This included procedures for reviewing the accuracy of
           organizations' financial data supporting the bid submissions and
           the reasonableness of assumptions used in the contract year
           financial projections. Auditors were also instructed to consider
           whether the bids were developed consistent with the Actuarial
           Standards of Practice (ASOP) designated by CMS and CMS's bid
           preparation instructions. (See appendix II for a description of
           the ASOPs.) Auditors generally reported preliminary findings by
           April 2006 and issued final reports by August 2006.24

           In contract year 2006, OACT required MA organizations to report
           incurred revenue and expense information for contract year 2004.
           CMS calls this a 2-year look back. As of June 2007, OACT had made
           limited use of this 2-year look back information, but intends to
           use such information to assess the credibility of projected
           revenue and expenses reported by MA organizations. This would
           include a review of data to identify possible biases or
           inaccuracies in a MA organization's bid estimations.

22CMS does not have authority to review and negotiate medical savings
accounts and private fee-for-service plans. 42 U.S.C. S 1395w-24(a)(5) and
(a)(6)(B).

23OACT is responsible for reviewing the bid forms. The audits that we
discuss only relate to the bid forms. CBC's Division of Finance and
Benefits is responsible for reviewing the MA plan benefit packages, and
CBC's Division of Finance and Operations is responsible for reviewing the
Part D formularies and prescription drug plan benefit packages.

24 The bid auditors held exit conferences or issued preliminary drafts for
45 of the 52 audit reports they issued by April 2006 and issued 34 final
reports by August 2006.

           GAO Analysis Shows CMS Has Not Met the Audit Requirement for
			  Contract Years 2001-2005 and Has Not Yet Met It for Contract Year
			  2006

           CMS did not document its process to determine whether it met the
           one-third audit requirement. However, according to our analysis of
           available CMS data, CMS has not met the statutory requirement to
           audit the financial records of at least one-third of the
           participating MA organizations for contract years 2001-2005, nor
           has it done so yet for the contract year 2006 bid submissions. We
           performed an analysis to determine if CMS had met the requirement
           because CMS could not provide documentation to support the method
           it used to select the ACRs and bids for audit and to demonstrate
           that it had met the audit requirement for those years. With
           respect to contract year 2006, CMS officials acknowledged the
           one-third requirement, but they stated that they did not intend
           for the audits of contract year 2006 bid submissions to meet the
           one-third audit requirement. They explained that they plan to
           conduct other reviews of the financial records of MA organizations
           and prescription drug plans to meet the requirement for contract
           year 2006. However, CMS has not clearly laid out how these reviews
           will be conducted to meet the one-third requirement. Further, CMS
           is not likely to complete these other financial reviews until
           almost 3 years after the bid submission date for each contract
           year, in part because it must first reconcile payment data that
           prescription drug plans are not required to submit to CMS until 6
           months after the contract year is over. Such an extended cycle for
           conducting these reviews to meet the one-third requirement limits
           their usefulness to CMS and hinders CMS's ability to timely
           identify any identified deficiencies in MA organizations' and
           prescription drug plans' bid processes that require corrective
           action.
			  
			  CMS Has Not Met Audit Requirement

           The Secretary of Health and Human Services is required to provide
           for the annual auditing of the financial records (including data
           relating to Medicare utilization and costs) of at least one-third
           of the MA organizations.25 In defining what constituted an
           organization for the purpose of selecting one-third for audit, CMS
           officials explained that they determined the number of
           participating organizations based on the number of contracts that
           they awarded.26 Under each contract an organization can offer
           multiple plans.27 When CMS selects an organization for audit,
           some, but not all, of the plans offered under the organization's
           contract are audited.
			  
2542 U.S.C. S 1395w-27(d)(1). Prior to contract year 2006, this audit was
required to include the "computation of the adjusted community rate." Pub.
L. No. 105-33, tit. IV, S 4001, 111 Stat. 251, 320 (Aug. 5, 1997).

26An MA organization is a public or private entity organized and licensed
by a state that is certified by CMS as meeting the MA contract
requirements.

           CMS did not document its approach for selecting ACRs for audit or
           how its approach was to meet the one-third annual audit
           requirement. Consequently, we performed an analysis comparing the
           organizations and plans audited as a percentage of organizations
           and plans that CMS approved under the Medicare+Choice, Medicare
           Advantage, and Part D programs from contract year 2001 through
           contract year 2006. We obtained data on the total number of
           organizations and plans from CMS's HPMS and data on the audited
           organizations from the audit reports.28 We determined that between
           18.6 and 23.6 percent, or fewer than one-third, of the MA
           organizations offering plans for contract years 2001-2005 were
           audited. Similarly, we determined that only 13.9 percent of the MA
           organizations and prescription drug plans with approved bids for
           contract year 2006 were audited.29 Table 1 summarizes our results.

Table 1: Summary of Organizations Audited as a Percentage of Total
Organizations and Audit Costs

                                                                        Audit 
                                                                        costs 
                        Number of                     Percentage of  (dollars 
Contract Type of organizations     Number of       organizations        in 
year     audit         audited organizations             audited millions) 
2001     ACRP               50           212                23.6      $2.8 
2002     ACRP               40           183                21.9      $2.6 
2003     ACRP               49           220                22.3      $3.8 
2004     ACRP               47           228                20.6      $3.4 
2005     ACRP               59           318                18.6      $2.6 
2006     Bid                80           577                13.9      $3.3 

Source: GAO analysis of CMS data and ACRP and bid audit reports.

Note: Audit costs do not include CMS staff costs.

27MA organizations and the contracts that establish them are identified by
four-digit contract numbers. The contract number and plan identifier
jointly provide a unique identifier for each plan and identify each ACRP
or bid submitted. Several plans may be offered by a MA organization in the
same geographic area. For example, a high-option plan including a drug
benefit and a low-option plan without a drug benefit may be offered by the
same MA organization.

28The audit reports for contract year 2005 were not available for our
review, so we used a list of audits provided by CMS.

29The 80 organizations audited for contract year 2006 included 60 MA
organizations with prescription drug plans and 20 prescription drug plans.

Although CMS selects organizations to meet the one-third audit requirement
based on the number of organizations and not the total number of plans
offered by organizations, we also analyzed the percentage of plans audited
of the total number of plans offered by each audited organization. Our
analysis shows that with the exception of contract year 2002, the level of
audit coverage achieved by CMS audits has progressively decreased in terms
of the percentage of plans audited for those organizations that were
audited. Audit coverage has also decreased in terms of the percentage of
plans audited of all plans offered by participating organizations each
contract year. In contract year 2006, a large increase in the number of
bid submissions meant that the 159 plans audited reflected only about 3
percent of all the plans offered. Table 2 summarizes our analysis.

Table 2: Summary of Audited Plans as a Percentage of Those Offered by
Audited Organizations and All Participating Organizations

                                           Percentage of               Percentage of 
                                           plans audited     Number of plans audited 
                   Number of     Number of  of all plans plans offered  of all plans 
         Type  plans audited plans offered    offered by        by all    offered by 
Contract of      for audited    by audited       audited participating participating 
year     audit organizations organizations organizations organizations organizations 
2001     ACRP            165           216          76.4           743          22.2 
2002     ACRP             84            93          90.3           554          15.2 
2003     ACRP            137           254          53.9           770          17.8 
2004     ACRP            124           257          48.2           967          12.8 
2005     ACRP            100           476          21.0         1,865           5.3 
2006     Bid             159         1,194          13.3         4,920           3.2 

Source: GAO analysis of CMS data and ACRP and bid audit reports.

Regarding how CMS selected the organizations that were audited for
contract years 2001-2004, CMS officials told us they did not know how the
MA organizations were selected, and the documentation supporting the
selections was either not created or not retained. For contract year 2005
audits, CMS officials told us that the selection criteria included several
factors other than simply selecting one-third of the participating MA
organizations that were awarded contracts. They said that the criteria
considered whether the MA organization had a negative balance in the
benefit stabilization fund and the MA organization had been audited
previously and had significant issues. Late in June, CMS's OFM staff
provided us a summary of the criteria used to select the 59 organizations
participating in the MA program that it selected for contract year 2005
ACR audits. However, the number of organizations used by the OFM staff in
selecting the 59 organizations did not agree with the number CMS provided
us from the HPMS that we used in our analysis. For this reason, we did not
rely on the new information.

For the audits of the contract year 2006 bids, CMS officials explained
that they did not intend for the audits of contract year 2006 bid
submissions to meet the one-third audit requirement and that they plan to
conduct other reviews of the financial records of organizations to meet
the requirement for contract year 2006. However, CMS has not clearly laid
out how these reviews will be conducted to meet the one-third requirement.
OACT officials explained that in selecting the bids for audit they (1)
considered whether the organization had been audited within the last 12
months and excluded those because CMS did not want to burden the
organization with another audit, (2) selected 25 percent of the
organizations based on information collected through the initial bid
review process, and (3) randomly selected organizations from the remaining
75 percent.

CMS Has Not Yet Met the Audit Requirement for Contract Year 2006 and Has Not
Determined How It Will Do So

As we just discussed, CMS has not yet met the one-third audit requirement
for the contract year 2006 bid submissions. Further, CMS has not finalized
its approach for how it will meet the requirement for contract year 2006
and beyond. During the course of our review, CMS officials provided
differing information about CMS's plans for meeting the one-third audit
requirement. Officials from CBC, OACT, and OFM initially told us in
January and February 2007 that their plans for meeting the one-third
requirement will likely include the bid audits currently directed by OACT
and other reviews by OFM of financial records of organizations. In June
2007, however, OFM officials said the requirement will be met solely
through their efforts. OFM is currently working with a contractor to
develop the agency's overall approach to conducting reviews to meet the
one-third audit requirement. But as of June 2007, CMS had not specified
how these reviews will meet the one-third audit requirement. Draft audit
procedures prepared by the contractor indicate that OFM plans to review
solvency, risk scores, related parties, direct medical and administrative
costs, and, where relevant, regional PPO cost reconciliation reports for
MA bids. For Part D bids, OFM also plans to review other areas, including
beneficiaries' true out-of-pocket costs.30 Appendix IV summarizes the
reviews that CMS is currently planning to do for contract year 2006 and
beyond, along with the objectives of those reviews.

30True out-of-pocket costs are amounts paid by the enrollee or on behalf
of the enrollee for covered Part D drugs that count toward the
out-of-pocket limit that must be reached before the catastrophic benefit
becomes available.

CMS will not complete the proposed financial reviews until almost 3 years
after the bids are submitted for each contract year, as shown in figure 1,
in part because it must first reconcile Part D payment data that
prescription drug plans are not required to submit to CMS until 6 months
after the contract year is over.31 Contract year 2006 bids were submitted
in June 2005. OFM officials said that they planned to start some of the
reviews for MA organizations in August 2007 to test their audit approach.
However, review of RPPOs and prescription drug plans will not start until
later because RPPO risk-sharing cost reconciliations that OFM says it will
review are not due to CMS until December 2007.32 OFM also plans to use
Part D payment reconciliations that CBC will not be able to complete until
June or July of 2007 because prescription drug plans are not required to
submit payment data to CMS until June 2007. This means that reviews of
financial records intended to meet the one-third audit requirement for
contract year 2006 will not start until the fall of 2007 and will not be
completed until sometime in 2008. Results of these reviews might be
available to CMS before reviewing and approving bids for contract year
2009 that organizations must submit in June 2008. CMS has not yet
developed its approach for following up on the results of these reviews.
Such an extended cycle for conducting reviews of financial records to meet
the one-third requirement will affect CMS's ability to recommend and
implement actions needed to address any identified deficiencies in MA
organizations' and prescription drug plans' bid processes in a timely
manner.

31CMS will reconcile Part D prospective payments made to the organizations
based on the approved bids to actual costs incurred by the organizations
to provide year-end adjustments to the organizations resulting in payments
or recoveries for each contract. The reconciliations are for low-income
cost sharing, reinsurance payments to cover drug costs above the
catastrophic threshold, and risk corridor payments for cost sharing
between Medicare and the MA organizations within specified thresholds or
corridors surrounding a drug-spending target.

32CMS has developed a Risk-sharing Reconciliation Cost report that
regional PPOs are to submit annually. CMS plans to use the report to
collect allowable cost data and compare these data to target amounts. If
the comparison demonstrates that the regional PPO incurred either savings
or losses in the contract year, the regulations provide specific risk
corridors for CMS to use in determining the risk-sharing reconciliation
amount due to either the MA organization or CMS. For MA regional plans for
2006 and 2007, MMA expressly authorizes payment adjustments to reflect
higher or lower allowable costs than estimated. See 42 U.S.C. S
1395w-27(a).

Figure 1: Time Elapsed from Contract Year 2006 Bid Submissions to Reviews
to Meet Audit Requirement

CMS's ACR Audit Process Was Ineffective

CMS contracted with accounting firms to audit the contract year 2001-2005
ACRs for a selected number of MA organizations, but did not consistently
ensure that the audit process provided information to assess the potential
impact on beneficiaries' benefits or the payments CMS makes to MA
organizations. The auditors reported findings ranging from lack of
supporting documentation to overstating or understating certain costs, but
did not identify how the errors affected beneficiary benefits, copayments,
or premiums. In 2001, we reported that CMS planned to require auditors,
where applicable, to quantify in their audit reports the overall impact of
errors.33 Further, during our prior work, CMS officials stated that they
were in the process of determining the impact on beneficiaries and
crafting a strategy for audit follow-up and resolving the audit results.
CMS did not initiate any actions to attempt to determine such impact until
after the audits for contract year 2003 were completed, when CMS
contracted with a firm to review all of the 2003 ACR audits to identify
any errors from the audits that would affect beneficiaries. The contractor
reported to CMS that it had identified errors in ACRs that would have
resulted in approximately $59 million that beneficiaries could have
received in additional benefits, lower copayments, or lower premiums. CMS
also contracted with a firm to review the 2004 ACR audits, but the work is
not to be completed until August 31, 2007. The OFM staff reviewed the 2003
audit reports and the contractor's analysis of the audit reports. OFM
revised the amount identified by the contractor's analysis from $59
million to $35 million and concluded that it would make recommendations to
CBC on whether corrective action plans or sanctions against MA
organizations were warranted. However, in late May 2007, CMS informed us
that its legal counsel had determined that the agency does not have the
legal authority to recover funds from MA organizations based on the
findings from the ACR audits. On the basis of our assessment of the
statutes, CMS had the authority to pursue financial recoveries, but its
rights under the contracts for 2001-2005 are limited because its
implementing regulations did not require that each contract include
provisions to inform organizations about the audits and about the steps
that CMS would take to address identified deficiencies, including pursuit
of financial recoveries.34

33 [25]GAO-02-33 , p. 20.

The ACR Audit Process Did Not Consistently Quantify Impacts on Beneficiaries

CMS contracted with audit firms at a cost of $15.2 million to audit ACRs
for contract years 2001-2005, but did not ensure that the audit process
consistently provided information to assess the potential impact on
beneficiaries. The instructions and guidance that CMS provided to the
auditors of the ACRs generally were not clear that the auditors should
quantify and report on how errors identified in the ACRs would affect
beneficiary benefits, copayments, or premiums. In our October 2001 report,
we reported that for contract year 2001, CMS had planned to require
auditors, where applicable, to do so.35 We recommended that CMS fully
implement its plans to calculate the net effect of ACR audit findings and
adjustments. Computing the net effect of the errors identified by the ACR
audits is key to assessing the magnitude of the impact on beneficiaries
and could aid in developing an appropriate follow-up protocol. In
September 2001, CMS stated that it was already addressing this
recommendation.

3442 U.S.C. S 1395w-27(e)(1) provides authority for CMS to include
additional terms and conditions in MA contracts. See 42 C.F.R. S
422.504(j).

35 [26]GAO-02-33 .

Although CMS indicated it was planning to obtain a calculation of the net
effect (i.e., impact on beneficiaries) of errors identified by auditors,
the audit guidance and instructions provided by CMS for contract years
2001 and 2002 did not specify that the auditors should quantify the impact
of the errors on beneficiary benefits, copayments, or premiums.
Consequently, the audit reports did not quantify the impact on the
beneficiaries.

The audit guidance and instructions for contract years 2003 and 2004 also
did not contain a directive to quantify the impact on beneficiaries of the
auditors' findings, and the audit reports did not contain this
information. CMS contracted with a firm to review all of the 2003 ACR
audit reports to identify any errors from the audits that would affect
beneficiaries. The auditors categorized their results as findings and
observations, with findings being more significant, depending on their
materiality to the average payment rate reported in the ACR. The
distinction between findings and observations, however, was based on
judgment, and therefore varied among the different auditors. CMS asked the
contractor to analyze the audit reports, including both findings and
observations, and supporting documentation. After reviewing the ACR
reports for the 49 organizations audited and related documentation, the
contractor reported in December 2005 that it had identified errors for 41
of the 49 organizations that would have resulted in approximately $59
million that beneficiaries could have received in additional benefits,
lower copayments, or lower premiums.

OFM staff reviewed the contract year 2003 audit reports along with the
contractor's analysis of the 2003 ACR audits to evaluate the amount
reported by the contractor that would affect beneficiaries. After
reviewing all 49 audit reports and the contractor's analysis, OFM staff
determined that there were errors for 32 of the 49 organizations audited
that would have resulted in approximately $35 million that beneficiaries
could have received in additional benefits, lower copayments, or lower
premiums. OFM staff told us they had identified what they considered
errors in some of the contractor's work, such as misapplication of the
instructions, and revised the amount of the beneficiary impact that the
contractor had identified. OFM staff concluded that they would make
recommendations to CBC on whether corrective action plans or sanctions
against MA organizations were warranted. In September 2006, CMS also
contracted with a firm to quantify the overall net effect resulting from
the contract year 2004 ACR audits. CMS officials told us that OFM staff
were still working with the contractor on this project, which is not to be
completed until August 31, 2007.

For the contract year 2005 ACR audits, CMS's instructions to the auditors
required them to clearly identify the net effect or impact of their
findings. However, as of June 2007, we had not yet received the contract
year 2005 audit reports, and therefore we cannot confirm whether these
reports included information on the impact on beneficiaries of identified
errors. According to CMS, the audits were delayed because management
decided instead to allocate funds intended for this purpose to OACT for
the audits of the contract year 2006 bids.

CMS Did Not Act to Recover Funds from or Sanction MA Organizations Based on ACR
Audit Results and Has Not Determined How to Close Out the Audits

In our 2001 report, we noted that CMS did not have a formal process in
place to resolve the specific problems identified in the audits, and
therefore the usefulness of the audit process was undermined. We
recommended that CMS develop and implement a follow-up mechanism to
address the audit findings in a timely manner and that CMS communicate to
each MA organization specific corrective actions. In September 2001, CMS
responded that such a process was under development. CMS told us it
provided copies of the final audit reports to the MA organizations and
instructed them to institute remedial actions in their subsequent ACR
submissions and that CMS's intent was to follow up on the audit findings
during subsequent audits. For this report, we reviewed audit reports for
contract years 2001-2004 and discussed CMS's audit follow-up process with
CMS officials and staff.36 The audit reports did not refer to past audit
findings, so it is unclear whether the auditors had followed up on the
past findings. The only action that CMS has taken was to provide copies of
the audit reports to the MA organizations and instruct the organizations
to take action in subsequent ACR filings.

In late May 2007, CBC officials explained that they were responsible for
resolving the issues resulting from the ACR audit reports and stated that
they were working with OFM to develop an approach to address the results
from the audit reports for contract years 2003 through 2005,37 but had not
yet decided on a plan of action. They also informed us that their legal
counsel had determined that the agency does not have the legal authority
to recover funds from MA organizations based on results of ACR audits.
Subsequently, HHS legal counsel explained to us the department's position
that CMS lacks the legal authority or the contractual right to pursue
financial recoveries when audits determine that approved ACRs reflect
errors, incorrect or unreasonable assumptions, or other misstatements. We
were told that, based on a determination of the Secretary, general federal
contract laws do not apply to the payments made under MA contracts.38
Instead, according to HHS, the contractual rights of CMS and the
contracting MA organizations are limited to those set out in statute and
the CMS implementing regulations. Those statutes and regulations do not
expressly provide for corrective action based on CMS's ACR audits, such as
returning funds to CMS or beneficiaries based on errors found during ACR
audits when the audits indicate that each beneficiary in a plan should
have received a certain amount of additional benefits. On the basis of our
assessment of the statutes, CMS had the authority to include terms in its
contracts with MA organizations that would allow it to pursue financial
recoveries based on the ACR audit results.39 However, CMS's rights under
the contracts for contract years 2001-2005 are limited because its
implementing regulations for the Medicare+Choice Program did not require
that each contract include provisions to inform organizations and plans
about the audits and about the steps that CMS would take to address
identified deficiencies, including pursuit of financial recoveries.

36As discussed earlier, the audit reports for contract year 2005 were not
available for our review.

37The CBC officials told us no further action was necessary for the 2001
and 2002 audits.

CMS officials acknowledged that they can impose sanctions in cases where
an organization misrepresents information that is furnished under the
program and for other reasons.40 Intermediate sanction provisions allow
for suspension of enrollment of individuals in MA plans, suspension of
payments to MA organizations, and civil penalties in the amount of up to
$100,000 for misrepresenting or falsifying information to CMS.41 However,
CMS has never sanctioned an MA organization based on findings from the ACR
audits and did not say why it has not. CMS officials told us that they
plan to close out the audits without pursuing financial recoveries. They
said that they are considering options, such as determining whether
findings are applicable to the current bid process, that could be a basis
for current action. CMS officials also stated that they are compiling a
list of MA organizations whose contract year 2003 ACR audits resulted in
significant findings and will refer the MA organizations to the HHS Office
of Inspector General (OIG) for appropriate action, including assessing
civil monetary penalties. However, CMS officials acknowledged that the
opportunity to take corrective action may have passed, given the amount of
time since the audits were completed.

3842 U.S.C. S 1395w-27(c)(5) provides authority for this determination.
HHS legal counsel also told us that the common law of contracts does not
apply to MA contracts.

3942 U.S.C. S 1395w-27(e)(1) provides authority for CMS to include
additional terms and conditions in MA contracts. See 42 C.F.R. S
422.504(j).

40Authority to impose intermediate sanctions is provided under 42 U.S.C. S
1395w-27(g).

4142 U.S.C. S 1395w-27(g)(2). Other intermediate sanctions vary depending
upon the actual basis determined by CMS.

In the past, the OIG has audited ACRs and recommended in some cases that
MA organizations return unsupported or unallowable payments to CMS. For
example, the OIG conducted 53 of the 80 ACR audits for contract year 2000,
the first year of such audits that we reported on in our previous
report.42 The OIG reported findings that quantified the impact of ACR
errors on beneficiaries in 7 of the 53 reports. However, CMS did not take
action on the findings. CMS also did not take action on findings from
other audits of ACRs that the OIG did under its authority. For example,
the OIG audited the modifications to the contract year 2001 ACRPs for six
MA organizations to determine whether additional funding provided by the
Benefits Improvement Protection Act (BIPA) of 2000 was used in a manner
consistent with BIPA requirements and whether the modifications were
adequately supported.43 The OIG also audited modifications to the contract
year 2004 ACRPs for six MA organizations to determine whether the use of
payment increases provided under MMA were adequately supported and
allowable under MMA. In five of the BIPA audits and one of the MMA audits,
the OIG found that the MA organizations did not support how they used the
additional funds, or they determined that MA organizations did not use the
funds in a manner consistent with the applicable law. In its reports dated
June 2004 through January 2006, the OIG recommended that the six MA
organizations return to CMS a total of almost $29 million or deposit the
funds in a benefit stabilization fund for use in future years.

42 [27]GAO-02-33 .

43Past legislation has provided for increased payments to MA
organizations. The Medicare, Medicaid, and SCHIP Benefits Improvement Act
of 2000 (BIPA) (Pub. L. No. 106-554, app. F, 114 Stat. 2763, 2763A-463
(Dec. 21, 2000)) provided for increased payments to MA organizations
effective March 1, 2001, and required MA organizations with plans that
received increased payments to submit revised ACRPs to show how they would
use the increase during contract year 2001. Similarly, MMA provided for
increased payments effective March 1, 2004, to MA organizations and
required them to submit revised ACRPs showing how they would use the
increased payments in contract year 2004. Both BIPA and MMA required MA
organizations to use the increased payments to reduce beneficiary premiums
and cost sharing, enhance benefits, contribute to a benefit stabilization
fund, or stabilize or enhance beneficiary access to providers.

In CMS's December 2006 management response to the OIG's recommendations,
CMS's CBC stated that CMS did not concur with the OIG's recommendations to
collect the funds and make them available for benefits because (1) the
benefit stabilization fund was abolished with implementation of MMA, (2) a
significant time has elapsed since the benefit year in question (2001),44
(3) the Medicare+Choice program no longer exists, and (4) the basis for
payment has changed from reviews of ACRPs to bids.

Bid Audits Report Findings That Would Affect Premiums and Payments for Contract
Year 2006, But CMS Does Not Address the Findings

CMS contracted with six firms to audit a selected number of contract year
2006 bids and plans to do so for subsequent years. In reviewing the 2006
bid audit reports, we determined that 18 (about 23 percent) of the 80
organizations audited had material findings that have an impact on
beneficiaries or plan payments approved in bids. CMS defined material
findings as those that would result in changes in the total bid amount of
1 percent or more or in the estimate for the costs per member per month of
10 percent or more for any bid element.45 OACT officials responsible for
the bid audit process explained that they will use the audit results to
help organizations improve their methods in preparing bids in subsequent
years, but their audit follow-up process does not involve taking action to
recover funds from organizations based on audit results because they
maintain that CMS does not have the legal authority to do so. However,
according to our assessment of the statute, CMS has the authority to
include terms in contracts with MA organizations and prescription drug
plan sponsors that would allow it to pursue financial recoveries based on
the bid audit results. Another weakness that we noted in CMS's bid audit
process was the lack of documentation to support steps taken to mitigate
conflict of interest situations for the actuarial firms conducting the bid
audits. Using available information, we were able to confirm that the
actuarial firms did not audit the same bids that the firms had acted as a
consultant in preparing. However, we were not able to confirm the steps
taken by CMS to avoid assigning actuarial firms to audit the same bids
that the firms had reviewed because information was not available by the
end of our fieldwork in June 2007.

44Five of the six OIG audits that contained recommendations related to
2001 ACRPs. The other OIG report related to a 2004 ACRP.

45Findings also include any serious failure to follow applicable ASOPs.
Materiality for identifying observations included all other errors or
deviations from the instructions or best actuarial practices that did not
meet the criteria for being classified as findings.

Contract Year 2006 Bid Audit Results Identified Significant Impacts on Member
Premiums and Medicare Payments

According to requirements in the audit contracts, the auditors were
required to categorize the severity of the issues identified in the audits
as either significant/material findings or nonsignificant observations.46
CMS defined material findings as those that would result in changes in the
total bid amount of 1 percent or more or in the estimate for the costs per
member per month of 10 percent or more for any bid element, which, if
corrected, would be expected to result in (1) reduced payments from CMS to
the organization, (2) additional benefits to enrollees, and (3) reduced
enrollee premiums or copayments.47 CMS defined nonsignificant observations
as deficiencies that are not considered material.

The contract year 2006 bid audits covered 80 organizations. For 18 of
these organizations (about 23 percent), auditors identified at least one
material finding that affected the total bid amount or a particular bid
element in an approved bid. Errors in the total bid amount or a bid
element can affect the accuracy of Medicare payments. Errors can also
affect members' premiums, copayments, and the level of services they are
provided. The material findings arose from deficiencies identified by the
auditors in how bid estimates were developed, including projected costs,
risk scores, trend assumptions, cost sharing, manual rates, and
utilization estimates among others.

46CMS uses actuaries to review all the bid forms received and assess the
assumptions and methods supporting the bid elements and their
reasonableness to support the overall bid prior to awarding contracts to
the bid sponsors. After the bid contracts are awarded, CMS does a more
detailed audit of a selection of bids to determine if the bid was
developed according to CMS's bid preparation instructions and designated
actuarial standards of practice.

47CMS officials also stated that material findings include changes that,
if corrected, could increase payments and result in additional or lesser
benefits and reduced or increased enrollee premiums or copayments. As
such, material audit findings may either increase or decrease bid amounts.

For the other 62 audited organizations, the auditors reported observations
primarily relating to departures from CMS's detailed bid preparation
instructions, including use of questionable data, assumptions, and
methods, and inadequate documentation. CMS provides detailed instructions
for organizations to prepare each of the seven spreadsheets that are part
of the MA bid form. The instructions are a line-by-line description of the
bid spreadsheets that identifies where user inputs are required. They also
contain a glossary and identify the required supporting documentation,
including a requirement for a completed certification executed by a
qualified actuary. Similarly, CMS provides detailed line-by-line
instructions for organizations to prepare each of the six spreadsheets
that are part of the prescription drug plan bid form.

CMS's Follow-up on Bid Audits Is Similar to Follow-up on the ACR Audits

OACT officials responsible for the bid audit process explained that they
will use the audit results to help organizations improve their methods in
preparing bids in subsequent years and to help OACT improve the overall
bid process. Specifically, they told us they could improve the bid forms,
bid instructions, training, and bid review process. OACT's audit follow-up
process does not involve pursuing financial recoveries from organizations
based on audit results because CMS maintains that, as with ACRPs, it does
not have the legal authority to do so. As stated earlier, CMS officials
believe that CMS lacks the statutory or contractual right to pursue
financial recoveries based on audit findings. However, according to our
assessment of the statute, CMS has the authority to include terms in its
contracts with MA organizations and prescription drug plan sponsors that
would allow it to pursue financial recoveries based on the bid audit
results.48 However, CMS's contractual rights are limited because its
implementing regulations do not require that each contract include
provisions to inform organizations and plans about the audits and about
the steps that CMS will take to address identified deficiencies, including
pursuit of financial recoveries. Such changes would be needed for CMS to
be able to adjust the bid amounts after bid approval and pursue financial
recoveries.

CMS has authority to sanction organizations but did not identify any
findings from the contract year 2006 bid audits where a sanction would be
warranted. OACT officials believe the bid audits provide a "sentinel or
deterrent effect" for organizations to properly prepare their bids since
they do not know when the bids may be selected for a detailed audit.
However, the officials acknowledged that the bid process relies heavily on
certifying actuaries and that there is a low probability of the bid audits
identifying intentional misrepresentations.

4842 U.S.C. S 1395w-27(e)(1); 42 C.F.R. S 422.504(j). This provision also
applies to prescription drug plans under Part D. 42 U.S.C. S
1395w-112(b)(3)(D).

Given the current audit coverage, CMS is unlikely to achieve significant
deterrent effect, as only 14 percent of participating organizations for
contract 2006 have been audited. Further, for those organizations that
were audited, CMS's follow-up on the audit findings may not deter those
organizations from making similar errors in future bids. For example,
preliminary findings for most of the 2006 audits came out by April 2006,
and according to OACT, organizations started preparing their bids for
contract year 2007 by April 2006, which would have allowed them time to
take corrective actions to address the audit findings. OACT officials
noted that they updated the contract year 2007 instructions for bid
preparation as a result of audit results and other factors. However, they
could not identify any specific revision arising out of the contract year
2006 audit results. Without a more targeted follow-up process to ensure
that every finding and observation from the audits is addressed before
approving the next year's bid, the value of the audits is limited. OACT
officials said that their process for following up on the audit results
will become more focused as each year's audits are conducted. Officials
stated that CMS's 2007 notification letter to organizations requires the
contract year 2008 bid submissions to document how the findings of the
prior year audits were addressed in the subsequent bid submission. They
also said the 2008 bid review process includes a process for reviewing the
prior year's audit findings for all bids that were audited in the prior
year.

CMS is currently developing an approach intended to ensure that one-third
of the MA organizations and prescription drug plans are audited each year.
As mentioned earlier, CMS plans to review financial issues including plan
solvency, risk scores, related parties, direct medical and administrative
costs, and beneficiaries' true out-of-pocket costs for prescription drug
plans. However, CMS's approach does not clearly identify how it will
follow up with organizations to ensure that issues identified in the
financial reviews are addressed. Also, it is not clear if these financial
reviews are being designed to identify misrepresentations and
falsifications in the information furnished by organizations in order to
impose sanctions, and CMS has not defined what it might consider to be a
misrepresentation or falsification. As currently planned, CMS will not
complete these financial reviews for contract year 2006 until sometime in
2008. Results might be available before CMS approves bids for contract
year 2009 that must be submitted in June 2008. As we mentioned earlier,
such an extended cycle for conducting reviews to meet the one-third
requirement will affect CMS's ability to recommend and implement actions
needed to address any identified deficiencies in bid processes in a timely
manner.

CMS Did Not Document Steps Taken to Mitigate Conflicts of Interest for
Contractors That Audited Bids

As part of its contracting process for the audits of contract year 2006
bids, CMS OACT officials said they took several steps to mitigate actual
and potential conflicts of interests for the actuarial firms that
completed the bid audits. For example, OACT officials considered whether
the actuarial firms had acted as consultants in preparing bids or had
other relationships with the organizations that they would be auditing.
Information about organizations that the firms had prepared bids for, had
other relationships with, or had reviewed their bids came from several
sources, including the bid certifications, which identify the actuary that
certified each bid submission. OACT officials also said that they asked
the firms to self-report conflicts of interest at two phases in their
process: (1) as part of the request for proposal, when firms were bidding
for the audit contracts, and (2) after contracts were awarded, when firms
were asked to respond to a list of organizations that that they were
assigned to audit. CMS required that as part of the request for proposal,
the firms include a listing of organizations for which the firms had a
conflict of interest, including organizations for which the firm had
prepared bids or had another non-Medicare relationship within the prior 12
months. After contracts were awarded to the six actuarial firms, OACT
officials said that they obtained information from the firms regarding
conflicts that they used to make audit reassignments. OACT maintains
information to identify the actuary that performed the bid reviews in the
HPMS database.

OACT officials did not have documentation to support the statement that
they took steps to avoid assigning actuarial firms to audit the same bids
that the firms had prepared. However, we used the bid certifications and
audit reports to confirm whether the actuarial firms had audited bids that
the firms had also acted as a consultant in preparing. We compared the
names of the actuaries on the bid certifications and their organizational
affiliations and the names of the actuaries that provided audit opinions
and their organizational affiliations as identified in the audit reports
for the 80 organizations that were audited in contract year 2006. We found
no instances where the bid preparer and the bid auditor were the same
individuals or companies.

To confirm whether the actuarial firms audited bids for organizations with
which the firms reported having a relationship, we obtained and reviewed
the self-reported conflict of interest information submitted in response
to the request for proposal by five of the six actuarial firms. OACT did
not have the information for the other firm. We also requested the
conflict of interest information that OACT said it obtained from the firms
to make audit reassignments. However, OACT could not provide this
information because it said it collected this information through an
informal process and did not have documentation supporting the information
it obtained. Using the available conflict of interest information, we
found no instances where the five actuarial firms audited a bid when it
reported having a relationship.

Finally, OACT officials did not have documentation to support the steps
they took to avoid assigning actuarial firms to audit the same bids that
the firms had reviewed. Four of the six actuarial firms that performed the
contract year 2006 bid audits also reviewed bids as part of CMS's bid
review process. We were not able to confirm the steps OACT officials said
they took because the information was not available by the end of our
field work in June 2007.

Conclusions

When CMS falls short in meeting the statutory audit requirement and in a
timely manner resolving the findings arising from those audits, the
intended oversight is not achieved and opportunities to determine if
organizations have reasonably estimated the costs to provide benefits to
Medicare enrollees are lost. Inaction or untimely audit resolution also
undermines the presumed deterrent effect of audit efforts.

CMS will continue to invest resources in its current bid audits and its
planned reviews of the financial records of MA organizations and
prescription drug plans that will likely have limited value in improving
the programs if it does not implement a structured process for following
up with organizations to make sure that they address deficiencies
identified from the audits before approving subsequent year bids. The
current bid audits provide CMS with information in a timely manner to
address identified deficiencies. These bid audits identify how
beneficiaries are adversely affected by errors, incorrect or unreasonable
assumptions, or other misstatements in the information furnished to CMS
and indicate how funds due to the Treasury are affected.

While the statutory audit requirement does not expressly state the
objective of the audits or how CMS should address the results of the
audits, the statute does not preclude CMS from including terms in its
contracts that allow it to pursue financial recoveries based on audit
results. If CMS maintains the view that statute does not allow it to take
certain actions, the utility of CMS's efforts is questionable. Further, if
CMS cannot provide assurance that the firms performing the audits are free
from potential or actual conflicts of interest, the integrity of the audit
process is also threatened.

Recommendations for Executive Action

To help fulfill CMS's responsibilities, we recommend that the
Administrator of CMS take the following five actions:

           o Finalize a decision and establish implementing procedures on how
           the prior ACRP audit results will be addressed and closed.
           o Finalize an approach for meeting the one-third audit requirement
           for contract year 2006 and subsequent years. This approach should
           clearly address:

                        o the procedures for annually identifying the
                        organizations whose bid submissions and supporting
                        financial records will be audited as part of the
                        current OACT bid audits and those that will be
                        reviewed as part of the planned financial reviews,
                        o the supporting documentation that must be retained
                        to show that the audit requirement was met, and
                        o the procedures for conducting planned financial
                        reviews that clearly identify how the reviews will
                        provide results in a timely manner and how the
                        reviews will be designed to identify
                        misrepresentations and falsifications in the
                        information furnished under the program.

           o Amend the implementing regulations for the Medicare Advantage
           Program and Prescription Drug Program to provide that all
           contracts CMS enters into with Medicare Advantage organizations
           and prescription drug plan sponsors include terms that inform
           these organizations of the audits and give CMS authority to
           address identified deficiencies, including pursuit of financial
           recoveries. If CMS does not believe it has the authority to amend
           its implementing regulations for these purposes, it should ask
           Congress for express authority to do so.
           o Develop, as part of its approach for meeting the one-third audit
           requirement, additional procedures for following up on results of
           the OACT bid audits and results of the financial reviews. These
           procedures should clearly address:

                        o how CMS will annually ensure that findings and
                        observations from the bid audits are addressed before
                        the next year's bids are approved,
                        o how CMS will annually ensure that findings from the
                        financial reviews are addressed before the subsequent
                        year's bids are approved,
                        o the supporting documentation that must be retained
                        to show that the findings and observations from bid
                        audits and findings from the financial reviews were
                        addressed, and
                        o how CMS reviews audit findings to determine if
                        intermediate sanctions are warranted.

           o Develop procedures to formalize the reviews and supporting
           documentation that must be retained to show that conflicts of
           interest arising from individuals or firms preparing, reviewing,
           or auditing the same bid have been addressed.
			  
			  Agency Comments and Our Evaluation

           We received written comments on a draft of this report from CMS,
           which are reprinted in appendix V. CMS concurred with our
           recommendations and stated that it is in the process of
           implementing some of them. Specifically, CMS concurred with our
           recommendation to finalize an approach for meeting the one-third
           audit requirement that includes procedures for identifying and
           documenting the organizations that will be audited annually. CMS
           also commented it has modified and documented its procedures for
           selecting the MA organizations and Medicare prescription drug
           plans for audit and begun documenting standard operating
           procedures for the financial audit process (including procedures
           for contracting with audit firms, selecting the MA organizations
           and prescription drug plans for audit, and addressing audit
           findings.)

           CMS provided additional comments on several issues we reported on,
           including financial recoveries based on the bid audit and the
           timeliness of its planned audit process. Specifically, CMS noted
           that the ability to obtain financial recoveries based on the bid
           audits is extremely complicated and can result in future payments
           by CMS rather than reimbursements by the plans. We believe that
           these are issues CMS should address as it takes steps to amend its
           contractual rights with MA organizations and prescription drug
           plans. CMS also noted that we did not explain why the audit
           process can take up to 3 years to be completed. CMS stated that
           the normal cycle for a contract year is over 2 years, followed by
           an additional 6 months for plans to submit data for
           reconciliation. We revised our report to acknowledge that CMS's
           financial reviews depend on data that is not required to be
           submitted until 6 months after the end of the contract year.
           However, the point remains that CMS's decision to develop an audit
           approach based solely on testing financial records that are not
           available until 6 months after the contract year and must be
           reconciled before testing can begin, will result in a 3-year cycle
           to complete reviews that will affect its ability to recommend and
           implement any actions needed to address identified audit
           deficiencies in a timely manner.

           We are sending copies of this report to interested congressional
           committees, the Secretary of Health and Human Services, the Acting
           Administrator of CMS, the Inspector General of HHS, and other
           interested parties. We will also make copies available to others
           upon request. In addition, this report will be available at no
           charge on GAO's Web site at http://www.gao.gov. Should you or your
           staff have any questions about this report, please contact Jeffrey
           Steinhoff at (202) 512-2600 or by e-mail at [email protected], or
           Kimberly Brooks, Assistant Director, at (202) 512-9038 or by
           e-mail at [email protected]. Contact points for our Offices of
           Congressional Relations and Public Affairs can be found on the
           last page of this report. GAO staff who made major contributions
           to this report are listed in appendix VI.

           Jeffrey C. Steinhoff
			  Managing Director
			  Financial Management and Assurance
			  
			  Appendix I: Scope and Methodology

           To determine whether the Centers for Medicare & Medicaid Services
           (CMS) met the requirement for auditing Adjusted Community Rates
           (ACRs) for one-third of the Medicare Advantage (MA) organizations
           for contract years 2001 through 2005 and one-third of the bid
           submissions for contract year 2006, we first requested the
           criteria and analysis from CMS to show how it met the requirement.
           However, because CMS did not prepare or retain this information,
           we instead obtained from CMS a compilation of organizations that
           were audited for contract years 2001 through 2006. We also
           obtained from CMS's Health Plan Management System (HPMS) a
           population of organizations and plans for which CMS had approved
           contracts to participate in the Medicare Advantage and Part D
           programs for contract years 2001-2006.

           To obtain reasonable assurance with respect to the completeness of
           CMS's compilation of audited organizations, we compared the
           organizations listed in CMS's compilation to lists of
           organizations assigned to each auditor that were contained in the
           contract files at CMS for contract years 2002 through 2005, where
           available. Because all of the contract files were not provided to
           us, we also compared the compilation to the audit reports we
           obtained from CMS.1

           CMS provided us with a data extract from HPMS in an Excel
           spreadsheet. We took several steps to assess the reliability of
           the HPMS data provided by CMS, although we were not able to
           independently verify the completeness of the population files. To
           assess the reliability of the HPMS data provided by CMS, we tested
           specific data elements for reasonableness (e.g., contract year,
           contract identifier, and plan identifier). Our tests resulted in
           no exceptions. We also made inquiries with CMS officials to
           confirm the source of the data. We compared the contract numbers
           of organizations that were audited with contract numbers in the
           population files to determine if the audited organizations were
           included in the population. We found several audited organizations
           that were not included in the population files CMS originally sent
           us of organizations participating in the Medicare Advantage
           program for contract years 2001 through 2005. We communicated
           these differences to CMS and it responded by sending us new
           population files that included the MA organizations we identified
           plus additional MA organizations. CMS did not explain the increase
           in the number of MA organizations in the revised population files.
           On the basis of the revised population number, we performed an
           analysis comparing the number of organizations and plans audited
           as a percentage of organizations and plans that CMS approved to
           determine if CMS had met the requirement to audit one-third of
           participating organizations. On the basis of the collective
           information and interviews with CMS officials, we determined these
           data were adequate for assessing whether CMS had met the one-third
           auditing requirement.
			  
1CMS could not locate the contract files for our review for (1) the four
firms awarded contracts to audit MA organizations for 2001, (2) three
firms awarded contracts for 2002, and (3) two of the nine firms awarded
contracts for 2004. The CY 2006 contract files did not contain a list of
organizations assigned to each auditor.			  

           To determine whether information provided by the ACR audit process
           was sufficient for CMS to assess potential impacts on
           beneficiaries and address those impacts, we obtained and reviewed
           the following documents:

           o audit reports for contract years 2001 through 2004,
           o reports prepared by the contractor that reviewed and analyzed
           the 2003 audit results,
           o CMS's analysis of the work performed by the contractor that
           reviewed and analyzed the 2003 audit results,
           o Statements of work from the contracts awarded to the firms to
           audit the ACRs, and
           o CMS's instructions to the auditors (called Uniform Examination
           Program).

           To assess the reliability of the audit reports, we used guidance
           in GAO's Financial Audit Manual Section 650, Using the Work of
           Others, which focused on assessing the auditors' independence,
           objectivity, and qualifications. We reviewed contract files at CMS
           for the firms awarded contracts to audit ACRs. Specifically, in
           the contract files, we reviewed representations as to the firms'
           independence and objectivity that the firms submitted in response
           to CMS's requests for proposal and evaluations of the firms by
           technical evaluation panels.

           We also interviewed CMS staff and officials about (1) the audit
           process, (2) CMS's review of the reviewing contractor's analysis
           of 2003 audit results, and (3) actions planned by CMS to address
           the audit findings.

           To determine how CMS conducted bid audits, what information the
           bid audit process provided CMS, and how CMS used that information,
           we obtained and reviewed related documentation including:

           o CMS's instructions and guidance for preparing bids for 2006 and
           2007,
           o CMS's instructions and guidance for bid reviewers for 2006 and
           2007,
           o CMS's instructions and guidance for bid auditors for 2006,
           o bid audit reports for contract year 2006,
           o certifications by actuaries that helped MA organizations prepare
           their bids, and
           o draft agreed-upon procedures for the financial audit of MA
           organizations and prescription drug plans.

           We discussed with Office of Actuary (OACT) officials and five of
           the six bid auditors (for the 2006 bids) their roles and views of
           the bid audit process. To identify the information the bid audit
           process provided CMS, we reviewed the bid audit reports and
           summarized the nature and number of findings and observations
           identified by the bid auditors.

           We performed some limited testing to identify whether potential
           conflicts of interest existed among actuaries who helped
           organizations and plan sponsors prepare bids and those actuaries
           who audited the bids. Using (1) the bid certifications, which
           identified the actuaries and organizations that helped
           organizations prepare their bids; (2) self-reported conflicts of
           interest, which were transmitted to CMS with the responses to the
           request for proposal offers; and (3) bid audit reports, which
           identified the lead actuary performing the bid audit, we
           identified which particular actuaries (firms and individuals)
           helped prepare and audit bids. We compared the information on bid
           preparers to information on bid auditors to determine whether the
           actuarial consultants who assisted organizations in preparing
           their bids had also audited the same bids, which would create a
           conflict of interest. Our tests resulted in no exceptions.

           We interviewed CMS staff and officials from CMS's Center for
           Beneficiary Choices (CBC), Office of the Actuary (OACT), and
           Office of Financial Management (OFM) about the bid review and
           audit processes and discussed actions planned to address the bid
           audit findings. We also discussed actions CMS planned to take to
           fulfill the requirement for auditing bid submissions for contract
           year 2006 and beyond. In particular, we discussed OFM's plans for
           testing solvency, direct medical and administrative costs, risk
           scores, related party transactions, and other related testing for
           MA organizations and prescription drug plans.

           To assess the reliability of the bid audit reports, we used
           guidance in GAO's Financial Audit Manual Section 650, Using the
           Work of Others, which focused on assessing the auditors'
           independence, objectivity, and qualifications. We reviewed
           contract files at CMS for the firms awarded contracts to review
           bids and audit bids. Specifically, in the contract files, we
           reviewed representations as to the firms' independence and
           objectivity that the firms submitted in response to CMS's requests
           for proposal and evaluations of the firms by technical evaluation
           panels.

           We briefed officials from CMS on our findings and their
           implications. We requested written comments on a draft of this
           report from the Secretary of Health and Human Services or his
           designee on July 9, 2007. We received comments from CMS on July
           19, 2007. We conducted our review from November 2006 to June 2007
           in accordance with generally accepted government auditing
           standards.
			  
			  Appendix II: Actuarial Standards Applicable to Bid Preparers

           The Centers for Medicare & Medicaid Services requires an actuarial
           certification to accompany each bid. In preparing the actuarial
           certification, the actuary must consider whether the actuarial
           work supporting the bid conforms to Actuarial Standards of
           Practice (ASOP), as promulgated by the Actuarial Standards Board.
           While other ASOPs apply, CMS's instructions for the contract year
           2006 bids placed particular emphasis on the following ASOPs.

           ASOP No. 5, Incurred Health and Disability Claims

           o ASOP No. 5 provides guidance to actuaries preparing or reviewing
           financial reports, claims studies, rates, or other actuarial
           communications involving incurred claims within a valuation period
           under a health benefit plan.

           ASOP No. 8, Regulatory Filings for Rates and Financial Projections
           for Health Plans

           (Particular focus is placed on the sections dealing with the
           Recognition of Benefit Plan Provisions, Consistency of Business
           Plan and Assumptions, Reasonableness of Assumptions, and Use of
           Past Experience to Project Future Results.)

           o This standard sets forth recommended practices for actuaries
           involved in the preparation or the review of actuarial memorandums
           or similar documents in connection with the filing of rates and
           financial projections for health plans. This standard applies to
           filings submitted to state insurance departments and other
           regulatory bodies for benefits provided by individual and group
           health plans and contracts and to filings made in conjunction with
           applications for licensure and rates for health maintenance
           organizations, hospitals, and medical service organizations.

           ASOP No. 16, Actuarial Practice Concerning Health Maintenance
           Organizations and Other Managed-Care Health Plans

           o ASOP No. 16 sets forth recommended practices for actuaries
           dealing with health maintenance organizations (HMO) and other
           managed-care health plans (MCHP). This standard was intended to
           provide guidance on several important areas requiring special
           consideration for HMOs and other MCHPs. According to the Actuarial
           Standards Board, this standard was repealed for work performed on
           or after April 26, 2007, because much of the information in the
           standard was dated, and in general, it is believed that the
           guidance provided in the standard is covered, either explicitly or
           implicitly, in other ASOPs.

           ASOP No. 23, Data Quality

           (Particular focus is placed on the sections dealing with Analysis
           of Issues and Recommended Practices and Communications and
           Disclosures.)

           o This ASOP gives guidance to the actuary in the areas of (1)
           selecting data that underlie the actuarial work product, (2)
           relying on data supplied by others, (3) reviewing data, (4) using
           data, and (5) making appropriate disclosures with regard to data
           quality.

           ASOP No. 25, Credibility Procedures Applicable to Accident and
           Health, Group Term Life, and Property/Casualty Coverage

           o The purpose of this ASOP is to provide guidance to actuaries in
           the selection of a credibility procedure and the assignment of
           credibility values to sets of data including subject experience
           and related experience. Credibility procedures are an integral
           part of rate making and prospective experience rating, and may be
           used for other purposes. This standard of practice is applicable
           to accident and health, group term life, property/casualty
           coverage, and other forms of nonlife coverage.

           ASOP No. 31, Documentation in Health Benefit Plan Rate Making

           o The purpose of this standard is to define the documentation
           responsibilities of an actuary in health benefit plan rate making.
           This standard does not apply to the establishment or documentation
           of prices, i.e., the amounts charged to the purchaser. Rather, it
           is limited to documentation related to the development of rates,
           i.e., the estimates of the expected value of future costs. This
           standard does not address other considerations that may affect
           price, such as marketing goals, competition, and legal
           restrictions.
			  
			  Appendix III: Description of Bid Worksheets

           Table 3: Description of the Medicare Advantage Bid Form Worksheets
           for MA Plans for Contract Year 2006
			  
Worksheet Description                                                      
1         This worksheet summarizes the base period data and the key       
             assumptions used to calculate the projected allowed costs for    
             the MA plan. It also includes general plan information, base     
             period background information, a summary of the base period      
             data, and an illustration of the factors used to project the     
             base period data to the contract period.                         
2         This worksheet calculates the projected allowed costs for the    
             contract year. For plans without fully credible experience, CMS  
             requires plans to provide manual rate information.               
3A/3B     These worksheets summarize the expected MA cost sharing for the  
             contract year. Worksheet 3A summarizes the plan's in-network     
             cost sharing, such as copayments and coinsurance, whereas        
             worksheet 3B summarizes the plan's out-of-network cost sharing.  
             Further, the plans must provide plan-level deductible            
             information, if applicable. The value of all cost sharing items  
             must be reflected in the total per member per month amount.      
4         This worksheet uses the information from other worksheets to     
             determine net medical costs. Nonmedical expenses and gain/loss   
             margins are added to establish the required revenue for the      
             contract year. Values are also allocated between                 
             Medicare-covered benefits and A/B Mandatory Supplemental         
             Benefits.                                                        
5         This worksheet calculates the A/B benchmark and evaluates        
             whether the plan realizes a savings or needs to charge a basic   
             member premium. Specifically, this worksheet outlines the        
             development of the benchmarks and bids, outlines the development 
             of the savings or basic member premium, blend of risk and        
             demographic payment methodologies, and provides a summary of     
             Statutory Component of Regional Benchmark and projected          
             (plan-specific) information for counties within the service      
             area.                                                            
6         This worksheet contains the results of calculations from the bid 
             forms.                                                           
7         This worksheet contains the actuarial pricing elements for any   
             optional supplemental benefit packages to be offered during the  
             contract year. While supplemental benefits (either prescription  
             drug or A/B) offered by the plan may be viewed as a single       
             package of supplemental benefits, the two types of supplemental  
             benefits are considered separately for bidding purposes.         

           Source: CMS.

           Table 4: Description of the Medicare Prescription Drug Plan Bid
           Form Worksheets for Medicare Advantage Plans for Contract Year
           2006
			  
Worksheet Description                                                      
1         Prescription Base-Period Experience--This worksheet should be    
             completed for plans that have appropriate base-period experience 
             for modeling the Part D benefit. The determination of the        
             appropriateness of a plan's experience should include the        
             evaluation of whether the group included in the experience is    
             consistent with the group that the plan expects to cover. In     
             addition, the experience should be representative of the         
             benefits that will be offered in the contract period. Plans      
             without appropriate base-period experience need to develop       
             manual rates to be used in the pricing tool. Development of      
             these manual rates should include the use of available data      
             adjusted to reflect the expected population and the benefit      
             design that will be offered.                                     
2         PDP Projection of Allowed/Non-Pharmacy--This worksheet           
             identifies the components of trend in the allowed prescription   
             cost for covered Part D drugs and for nonpharmacy expenses       
             between the base period and the contract period, and blends in   
             manual rate information for plans that do not have fully         
             credible base-period experience data.                            
3         Contract Period Projection for Defined Standard Coverage--This   
             worksheet is used to develop the Defined Standard Bid Amount.    
             All plans are required to fill out this worksheet.               
4         Standard Coverage with Actuarially Equivalent Cost Sharing--This 
             worksheet is used only if the benefit plan being bid is for      
             standard coverage with actuarially equivalent cost sharing. The  
             two tests that must be met to demonstrate actuarial equivalence  
             are:                                                             
                                                                              
                o The average coinsurance percentage for amounts between the  
                deductible and the initial coverage limit must be actuarially 
                equivalent to 25 percent.                                     
                o The average coinsurance percentage above the catastrophic   
                limit must be actuarially equivalent to the percentage for    
                defined standard coverage.                                    
                                                                              
             The amount of the bid must be determined since the bid is based  
             upon the cost of the proposed plan rather than the defined       
             standard plan.                                                   
5         Alternative Coverage--This worksheet is used if the plan is      
             offering alternative coverage. Basic alternative coverage would  
             result in no supplemental premiums. The worksheet also           
             calculates the supplemental premium for enhanced alternative     
             coverage.                                                        
6         Script Projections for Defined Standard, Actuarially Equivalent  
             or Alternative Coverage--This worksheet illustrates the          
             underlying assumptions that are being used in the demonstration  
             of the actuarial equivalence tests in Worksheets 4 and 5. The    
             submitted data support an actuarial comparison of the proposed   
             benefit to the defined standard benefit; it is not expected to   
             be a detailed model of the cost sharing of the proposed plan     
             design. All plans are required to develop projected utilization  
             and costs for their proposed Defined Standard Benefit. In        
             addition, plans submitting a bid for an actuarially equivalent   
             or alternative benefit are required to report projected          
             utilization and costs.                                           

           Source: CMS.
			  
			  Appendix IV: Other Reviews of Financial Records CMS Plans to Do
			  to Meet Audit Requirement

           Table 5: CMS's Planned Reviews of Medicare Advantage and Medicare
           Part D to Meet Audit Requirement
			  
                                                             Medicare         
Review objectives                                         Advantage Part D 
Solvency--consider organization's ability to bear the         Y       Y    
risk of potential financial losses                                         
Risk Scores Review--assess self-reported diagnosis data       Y       Y    
Related Party Transactions--identify significant business     Y       Y    
transactions to identify related party transactions and                    
to determine if the transactions were reported                             
appropriately                                                              
Direct Medical and Administrative Costs--evaluate             Y       Y    
organization's allocation of (1) expenses to Medicare and                  
non-Medicare memberships and (2) administrative costs                      
Part D Costs and Payments--review reconciliation methods              Y    
of the four payment mechanisms for Part D: direct                          
subsidy, low- income subsidy, reinsurance subsidy, and                     
risk sharing                                                               
Direct/Indirect Remuneration--determine if amounts were               Y    
reported appropriately and if allocation method is                         
reasonable                                                                 
True Out-of-Pocket Cost--verify that prescription drug                Y    
plans are calculating true out-of-pocket costs accurately                  
Regional Preferred Provider Organizations (RPPO)--assess      Y            
risk-sharing computations, whether expenses and revenues                   
are properly classified, and RPPO's compliance with its                    
CMS contract                                                               

           Source: CMS.
			  
           Appendix V: Comments from the Department of Health and Human Services
			  
			  Appendix VI: GAO Contacts and Staff Acknowledgments
			  
			  GAO Contacts

           Jeffrey Steinhoff, (202) 512-2600 or [email protected]
			  
			  Acknowledgments

           Kimberly Brooks, (202) 512-9038 or [email protected]

           Staff members who made key contributions to this report include
           Robert Martin (Director), Kimberly Brooks (Assistant Director),
           Paul Caban (Assistant Director), Abe Dymond, Jason Kirwan,
           Tarunkant N. Mithani, and Diane Morris.
			  
			  Related GAO Products

           Department of Health and Human Services, Centers for Medicare &
           Medicaid Services: Medicare Program; Establishment of the Medicare
           Advantage Program. [28]GAO-05-315R . Washington, D.C.: February 9,
           2005.

           Medicare+Choice: Selected Program Requirements and Other Entities'
           Standards for HMOs. [29]GAO-03-180 . Washington, D.C.: October 31,
           2002.

           Medicare+Choice: Recent Payment Increases Had Little Effect on
           Benefits or Plan Availability in 2001. [30]GAO-02-202 .
           Washington, D.C.: November 21, 2001.

           Medicare+Choice Audits: Lack of Audit Follow-up Limits Usefulness.
           [31]GAO-02-33 . Washington, D.C.: October 9, 2001.

           Medicare: Program Designed to Inform Beneficiaries and Promote
           Choice Faces Challenges. [32]GAO-01-1071 . Washington, D.C.:
           September 28, 2001.

           Medicare+Choice: Oversight Lapses in HCFA's Review of Humana's
           1998 Florida Contract. [33]GAO-01-176R . Washington, D.C.:
           November 27, 2000.

           Medicare+Choice: Plan Withdrawals Indicate Difficulty of Providing
           Choice While Achieving Savings. GAO/ [34]HEHS-00-183 . Washington,
           D.C.: September 7, 2000.

           Medicare+Choice: Payments Exceed Cost of Fee-for-Service Benefits,
           Adding Billions to Spending. GAO/ [35]HEHS-00-161 . Washington,
           D.C.: August 23, 2000.
			  
			  GAO's Mission

           The Government Accountability Office, the audit, evaluation and
           investigative arm of Congress, exists to support Congress in
           meeting its constitutional responsibilities and to help improve
           the performance and accountability of the federal government for
           the American people. GAO examines the use of public funds;
           evaluates federal programs and policies; and provides analyses,
           recommendations, and other assistance to help Congress make
           informed oversight, policy, and funding decisions. GAO's
           commitment to good government is reflected in its core values of
           accountability, integrity, and reliability.
			  
			  Obtaining Copies of GAO Reports and Testimony

           The fastest and easiest way to obtain copies of GAO documents at
           no cost is through GAO's Web site ( [36]www.gao.gov ). Each
           weekday, GAO posts newly released reports, testimony, and
           correspondence on its Web site. To have GAO e-mail you a list of
           newly posted products every afternoon, go to [37]www.gao.gov and
           select "Subscribe to Updates."
			  
			  Order by Mail or Phone

           The first copy of each printed report is free. Additional copies
           are $2 each. A check or money order should be made out to the
           Superintendent of Documents. GAO also accepts VISA and Mastercard.
           Orders for 100 or more copies mailed to a single address are
           discounted 25 percent. Orders should be sent to:

           U.S. Government Accountability Office 441 G Street NW, Room LM
           Washington, D.C. 20548

           To order by Phone: Voice: (202) 512-6000
			  TDD: (202) 512-2537
			  Fax: (202) 512-6061
			  
			  To Report Fraud, Waste, and Abuse in Federal Programs

           Contact:

           Web site: [38]www.gao.gov/fraudnet/fraudnet.htm
			  E-mail: [39][email protected]
			  Automated answering system: (800) 424-5454 or (202) 512-7470
			  
			  Congressional Relations

           Gloria Jarmon, Managing Director, [40][email protected] (202)
           512-4400 U.S. Government Accountability Office, 441 G Street NW,
           Room 7125 Washington, D.C. 20548

			  Public Affairs

           Paul Anderson, Managing Director, [41][email protected] (202)
           512-4800 U.S. Government Accountability Office, 441 G Street NW,
           Room 7149 Washington, D.C. 20548

(197017)

[42]www.gao.gov/cgi-bin/getrpt?GAO-07-945 .

To view the full product, including the scope
and methodology, click on the link above.

For more information, contact Jeffrey Steinhoff at 202-512-2600 or
[email protected].

Highlights of [43]GAO-07-945 , a report to congressional committees

July 2007

MEDICARE ADVANTAGE

Required Audits of Limited Value

In fiscal year 2006, the Centers for Medicare & Medicaid Services (CMS)
spent over $51 billion on the Medicare Advantage program, which serves as
an alternative to the traditional fee-for-service program. Under the
Medicare Advantage program, companies wishing to participate must annually
submit bids (effective with contract year 2006) that identify the health
services the company will provide to Medicare members and the estimated
cost and revenue requirements for providing those services. For 2001
through 2005, the submissions were called Adjusted Community Rate (ACR)
Proposals. The Balanced Budget Act (BBA) of 1997 requires CMS to annually
audit the financial records supporting the submissions of at least
one-third of participating organizations. BBA also requires that GAO
monitor the audits. In this report, GAO examined (1) whether CMS met the
one-third requirement for 2001 through 2006, (2) what information the ACR
audits provided and how CMS used it, and (3) what information the bid
audits provided and how CMS used it.

[44]What GAO Recommends

GAO makes five recommendations to CMS for meeting the one-third audit
requirement, enhancing its audit follow-up, and improving the bid audit
process. CMS concurred with our recommendations.

CMS did not document its process to determine whether it met the
requirement for auditing ACRs for one-third of the participating Medicare
Advantage organizations for contract years 2001-2005. CMS is planning to
conduct other financial reviews of organizations to meet the audit
requirement for contract year 2006, but by the end of our fieldwork in
June 2007, CMS had not finalized its plans. Further, CMS does not plan to
complete the financial reviews until almost 3 years after the bid
submission date each contract year. This will affect its ability to
address deficiencies in a timely manner.

CMS did not consistently ensure that the audit process for contract years
2001-2005 provided information to assess the impact on beneficiaries.
After contract year 2003 audits were completed, CMS took steps to
determine such impact and identified about $34 million from those audits
that beneficiaries could have received in additional benefits. However, in
late May 2007, CMS officials told us they were planning to close out the
audits without pursuing financial recoveries because the agency does not
have the legal authority to do so. According to our assessment of the
statutes, CMS had the authority to pursue financial recoveries, but its
rights under contracts for 2001-2005 are limited because its implementing
regulations did not require that each contract include provisions to
inform organizations about the audits and about the steps that CMS would
take to address identified deficiencies, including pursuit of financial
recoveries.

CMS audited contract year 2006 bids for 80 organizations, and 18 had a
material finding that affected amounts in approved bids. CMS officials
said that they will use the audit results to help improve bids in
subsequent years but took limited action to follow-up on contract year
2006 findings. CMS will not pursue financial recoveries based on audit
results because it maintains that it does not have the legal authority to
do so. However, according to our assessment of the statutes, CMS has the
authority to include terms in bid contracts that would allow it to pursue
financial recoveries. CMS also has the authority to sanction organizations
but has not identified instances where sanctions are warranted. We also
noted that CMS did not document steps takento mitigate conflicts of
interest for the firms performing audits.

References

Visible links
  24. http://www.gao.gov/cgi-bin/getrpt?GAO-02-33
  25. http://www.gao.gov/cgi-bin/getrpt?GAO-02-33
  26. http://www.gao.gov/cgi-bin/getrpt?GAO-02-33
  27. http://www.gao.gov/cgi-bin/getrpt?GAO-02-33
  28. http://www.gao.gov/cgi-bin/getrpt?GAO-05-315R
  29. http://www.gao.gov/cgi-bin/getrpt?GAO-03-180
  30. http://www.gao.gov/cgi-bin/getrpt?GAO-02-202
  31. http://www.gao.gov/cgi-bin/getrpt?GAO-02-33
  32. http://www.gao.gov/cgi-bin/getrpt?GAO-01-1071
  33. http://www.gao.gov/cgi-bin/getrpt?GAO-01-176R
  34. http://www.gao.gov/archive/2000/he00183.pdf
  35. http://www.gao.gov/archive/2000/he00161.pdf
  36. http://www.gao.gov/
  37. http://www.gao.gov/
  38. http://www.gao.gov/fraudnet/fraudnet.htm
  39. mailto:[email protected]
  40. mailto:[email protected]
  41. mailto:[email protected]
  42. http://www.gao.gov/cgi-bin/getrpt?GAO-07-945
  43. http://www.gao.gov/cgi-bin/getrpt?GAO-07-945
*** End of document. ***