    Centers for Medicare and Medicaid Services: Internal Control
    Deficiencies Resulted in Millions of Dollars of Questionable
    Contract Payments (15-NOV-07, GAO-08-54).

    The Medicare Prescription Drug, Improvement, and Modernization
    Act of 2003 (MMA) established a voluntary outpatient prescription
    drug benefit, which is administered by the Centers for Medicare
    and Medicaid Services (CMS). CMS relies extensively on
    contractors to help it carry out its basic mission. Congress
    appropriated to CMS $1 billion for start-up administrative costs
    to implement provisions of MMA. Because CMS had discretion on how
    to use the appropriation, Congress asked GAO to determine (1) how
    CMS used the $1 billion MMA appropriation, (2) whether CMS's
    contracting practices and related internal controls were adequate
    to avoid waste and to prevent or detect improper payments, and
    (3) whether payments to contractors were properly supported as a
    valid use of government funds. To address objectives two and
    three above, our review extended beyond contract amounts paid
    with MMA funds.
    -------------------------Indexing Terms-------------------------
    REPORTNUM:   GAO-08-54
        ACCNO:   A78213
      TITLE:     Centers for Medicare and Medicaid Services: Internal
    Control Deficiencies Resulted in Millions of Dollars of
    Questionable Contract Payments
         DATE:   11/15/2007
      SUBJECT:   Appropriated funds
    	     Contract administration
    	     Contract oversight
    	     Contract performance
    	     Contractor payments
    	     Contractors
    	     Cost analysis
    	     Cost reimbursement contracts
    	     Erroneous payments
    	     Internal controls
    	     Medicare
    	     Noncompliance
    	     Payments
    	     Program management
    	     Risk assessment
    	     Risk management
    	     Waste, fraud, and abuse
    	     SBA 8(a) Program

    ******************************************************************
    ** This file contains an ASCII representation of the text of a  **
    ** GAO Product.                                                 **
    **                                                              **
    ** No attempt has been made to display graphic images, although **
    ** figure captions are reproduced.  Tables are included, but    **
    ** may not resemble those in the printed version.               **
    **                                                              **
    ** Please see the PDF (Portable Document Format) file, when     **
    ** available, for a complete electronic file of the printed     **
    ** document's contents.                                         **
    **                                                              **
    ******************************************************************
    GAO-08-54

    This is a work of the U.S. government and is not subject to copyright
    protection in the United States. It may be reproduced and distributed
    in its entirety without further permission from GAO. Because this work
    may contain copyrighted images or other material, permission from the
    copyright holder may be necessary if you wish to reproduce this
    material separately.

    Report to Congressional Requesters:

    United States Government Accountability Office:

    GAO:

    November 2007:

    Centers For Medicare And Medicaid Services:

    Internal Control Deficiencies Resulted in Millions of Dollars of
    Questionable Contract Payments:

    GAO-08-54:

    GAO Highlights:

    Highlights of GAO-08-54, a report to congressional requesters.

    Why GAO Did This Study:

    The Medicare Prescription Drug, Improvement, and Modernization Act of
    2003 (MMA) established a voluntary outpatient prescription drug
    benefit, which is administered by the Centers for Medicare and Medicaid
    Services (CMS). CMS relies extensively on contractors to help it carry
    out its basic mission. Congress appropriated to CMS $1 billion for
    start-up administrative costs to implement provisions of MMA. Because
    CMS had discretion on how to use the appropriation, Congress asked GAO
    to determine (1) how CMS used the $1 billion MMA appropriation, (2)
    whether CMS�s contracting practices and related internal controls were
    adequate to avoid waste and to prevent or detect improper payments, and
    (3) whether payments to contractors were properly supported as a valid
    use of government funds. To address objectives two and three above, our
    review extended beyond contract amounts paid with MMA funds.

    What GAO Found:

    CMS expended over 90 percent of the MMA appropriation by the end of
    December 2006. The majority, about $735 million, was paid to
    contractors and vendors for a variety of services. For example, because
    the volume of calls to the 1-800-MEDICARE help line significantly
    increased with the new outpatient prescription drug benefit, two
    contractors were paid about $234 million to support the help line. CMS
    also made payments to other federal agencies for services such as
    printing and mailing; to state agencies to fund educating the public;
    for CMS employee payroll and travel costs; and for purchase card
    transactions to acquire office supplies, equipment, and outreach
    materials.

    CMS management has not allocated sufficient resources, both staff and
    funding, to keep pace with recent increases in contract awards and
    adequately perform contract and contractor oversight. This operating
    environment created vulnerabilities in the contracting process.
    Specifically, CMS did not adequately fulfill critical contractor
    oversight, such as working with contractors to establish indirect cost
    rates. Further, certain contracting practices, such as the frequent use
    of cost reimbursement contracts, increased risks to CMS. After contract
    award, pervasive internal control deficiencies increased the risk of
    improper payments. Because CMS did not have clear invoice review
    guidance, invoice review procedures were often flawed or did not take
    place. CMS also had not taken steps to ensure contracts were closed
    within required deadlines and had a backlog of approximately 1,300
    contracts as of September 30, 2007.

    GAO identified numerous questionable payments totaling nearly $90
    million. These payments were for costs not compliant with contract
    terms, which could be potentially improper; costs for which we could
    not obtain adequate support to determine whether the costs were
    allowable; and potential waste caused by risks in CMS�s contracting
    practices. Importantly, in some cases, because we were not able to
    determine whether or to what extent the costs were allowable, some of
    the questioned amounts may relate to allowable costs that are not
    recoverable. The table below summarizes the questionable payments GAO
    identified.

    Summary of Questionable Payments (Dollars in millions):

    Type of questionable payment: Costs not compliant with contract terms
    and regulations;
    Amount: $25.5.

    Type of questionable payment: Unsupported contractor costs;
    Amount: $62.7.

    Type of questionable payment: Potential waste;
    Amount: $6.6.

    Type of questionable payment: Less overlapping amounts[A];
    Amount: ($5.0).

    Type of questionable payment: Total;
    Amount: $88.8.

    Source: GAO analysis of contractor invoices and data.

    [A] In certain instances, a portion of a questionable payment may fall
    into more than one category (i.e., a payment may be both potential
    waste and not compliant with contract terms). Therefore, to avoid
    double counting questionable payment amounts, we reduced the gross
    questionable payment amount by the overlapping amount ($5.0 million).

    [End of table]

    What GAO Recommends:

    GAO makes nine recommendations to improve internal control and
    accountability in the contracting process and related payments to
    contractors. In written comments on a draft of this report, CMS stated
    that it would take action on each of our recommendations and described
    some steps taken and others planned to address our recommendations. At
    the same time, CMS disagreed with some of our findings. We continue to
    believe that our findings fully support our nine recommendations.

    To view the full product, including the scope and methodology, click on
    [hyperlink, http://www.GAO-08-54]. For more information, contact
    Jeanette Franzel at (202) 512-9471 or franzelj@gao.gov.

    [End of section]

    Contents:

    Letter:

    Results in Brief:

    Background:

    CMS Paid Most of the $1 Billion of MMA Funds to Contractors:

    Internal Control Deficiencies over Contracting and Contract Payments
    Increased the Risk of Waste and Improper Payments:

    CMS Made Nearly $90 Million of Questionable Payments to Contractors:

    Conclusions:

    Recommendations for Executive Action:

    Agency Comments and Our Evaluation:

    Appendix I: Questionable Payments to Contractors:

    Appendix II: Scope and Methodology:

    Appendix III: Comments from the Centers for Medicare and Medicaid
    Services:

    Appendix IV: GAO Contact and Staff Acknowledgments:

    Tables:

    Table 1: Payments to Major Contractors and Vendors from January 2004
    through December 2006:

    Table 2: CMS's Cognizant Federal Agency Responsibilities:

    Table 3: Summary of Questionable Payments:

    Table 4: Questionable Payments by Contractor:

    Table 5: Contracts and Amounts Included in Our Review of CMS Payments:

    Figures:

    Figure 1: Recipients of CMS's Payments from MMA Funds from January 2004
    through December 2006:

    Figure 2: Activities Provided by Contractors and Vendors:

    Figure 3: CMS Contract Awards and Oversight Resources from Fiscal Years
    1997 through 2006:

    Abbreviations:

    BAH: Booz Allen Hamilton:

    CAS: Cost Accounting Standards:

    CMS: Centers for Medicare and Medicaid Services:

    DCAA: Defense Contract Audit Agency:

    DOD: Department of Defense:

    FAR: Federal Acquisition Regulation:

    FTE: full time equivalents:

    GSA: General Services Administration:

    HHS: Department of Health and Human Services:

    HHSAR: Health and Human Services Acquisition Regulations:

    IBM: International Business Machines:

    IFMC: Iowa Foundation for Medical Care:

    IR&D: independent research and development:

    IT: information technology:

    MMA: Medicare Prescription Drug, Improvement, and Modernization Act of
    2003:

    NIH: National Institutes of Health:

    OAGM: Office of Acquisition and Grants Management:

    OFM: Office of Financial Management:

    OIG: Office of Inspector General:

    SBA: Small Business Administration:

    T&M: time and materials:

    [End of section]

    United States Government Accountability Office:
    Washington, DC 20548:

    November 15, 2007:

    The Honorable Max Baucus:
    Chairman:
    The Honorable Charles E. Grassley:
    Ranking Member:
    Committee on Finance:
    United States Senate:

    In the most significant change to the Medicare program since its
    inception, the Medicare Prescription Drug, Improvement, and
    Modernization Act of 2003[Footnote 1] (MMA) established a voluntary
    outpatient prescription drug benefit, known as the Part D benefit. This
    benefit, which became available in January 2006, is intended to help
    seniors and persons with disabilities pay for outpatient prescription
    drugs. The Centers for Medicare and Medicaid Services (CMS) is the
    agency within the Department of Health and Human Services (HHS) that
    administers the Medicare program and Part D benefit. CMS relies
    extensively on contractors to carry out its basic mission. For example,
    the contractors that process and administer medical claims have played
    a critical role in serving both Medicare beneficiaries and health care
    providers. During fiscal year 2006, CMS awarded contracts valued at
    $3.8 billion.

    Congress appropriated to CMS $1 billion for start-up administrative
    costs to implement MMA provisions. These MMA funds were available for
    obligation[Footnote 2] through September 2006. Because CMS was granted
    broad discretion on how to use the appropriation, you asked us to
    determine (1) how CMS used the $1 billion MMA appropriation (2) whether
    CMS's contracting practices and related internal controls were adequate
    to avoid waste[Footnote 3] and to prevent or detect improper
    payments,[Footnote 4] and (3) whether payments to contractors were
    properly supported as a valid use of government funds.

    To address these objectives, we analyzed CMS obligation information and
    disbursement information from January 2004 through December 2006;
    discussed this information with CMS officials; and assessed contracts,
    interagency agreements, and related supporting documentation,
    including statements of work, vendor invoices, and contract files. We
    also interviewed CMS officials about their contractor oversight
    responsibilities and analyzed relevant CMS policies, procedures, and
    training. We used GAO's standards for internal control[Footnote 5] and
    Federal Acquisition Regulation (FAR)[Footnote 6] requirements as a
    basis to assess CMS's contracting practices and related internal
    controls. We selected contractors and contracts[Footnote 7] to test
    based on amounts paid with MMA funds and other risk factors. We
    performed data mining[Footnote 8] and forensic auditing[Footnote 9]
    techniques to select specific contract transactions for detailed
    testing. Specifically, for these selected transactions, we analyzed
    additional supporting documentation obtained from contractors and
    discussed billed amounts with contractor officials. While we identified
    instances of questionable payments,[Footnote 10] our work was not
    designed to identify all questionable payments or to estimate their
    extent. Because CMS funded some invoices with funding sources in
    addition to MMA, the questionable payments we identified may not be
    solely associated with the MMA appropriation.

    Appendix II provides additional details of our scope and methodology.
    We conducted this performance audit in accordance with generally
    accepted government auditing standards. Those standards require that we
    plan and perform the audit to obtain sufficient, appropriate evidence
    to provide a reasonable basis for our findings and conclusions based on
    our audit objectives. We believe that the evidence obtained provides a
    reasonable basis for our findings and conclusions based on our audit
    objectives. We conducted our audit work in Washington, D.C. and
    Baltimore, Maryland from March 2006 through September 2007.

    Results in Brief:

    Congress appropriated to CMS $1 billion for start-up administrative
    costs to implement MMA provisions. CMS obligated all of the funding
    made available by MMA and expended over 90 percent of it by the end of
    December 2006. The majority, about $735 million, was paid to
    contractors and vendors for a variety of services, including
    information technology (IT), support for the 1-800-MEDICARE help line,
    and outreach and education for the prescription drug benefit. CMS also
    made payments to other federal agencies for services such as printing
    and mailing; to state agencies to help fund educating the public about
    the new prescription drug benefit; for CMS employee payroll and travel
    costs; and for purchase card transactions to acquire office supplies,
    equipment, and outreach materials.

    CMS management has not allocated sufficient resources, both staff and
    funding, to keep pace with recent increases in contract awards and
    adequately perform contract and contractor oversight. This operating
    environment created vulnerabilities in the contracting process.
    Specifically, CMS did not fulfill critical contractor oversight
    responsibilities, such as reviewing contractors' indirect cost rate
    information and assessing the adequacy of the contractors' accounting
    systems, thereby increasing risks not only to CMS but to other federal
    agencies that may use the same contractors. Additionally, risks in
    CMS's contracting practices made CMS vulnerable to waste. For example,
    CMS did not always benefit from the effects of competition when
    awarding contracts. Further, CMS frequently used a contract type--cost
    reimbursement--under which the government assumes most of the cost
    risk. In some cases, this contract type was used contrary to FAR
    requirements. After contract award, pervasive internal control
    deficiencies in the contracting process increased the risk of improper
    payments. For example, CMS often used flawed procedures to review and
    approve invoices in part because policies, procedures, and training
    provided inadequate guidance to key staff. Meanwhile, other CMS
    procedures allowed for the payment of an invoice whether or not the
    invoice was reviewed and approved. Additionally, CMS had not taken
    steps to ensure contracts were closed within required deadlines and had
    a backlog of approximately 1,300 contracts needing closeout as of
    September 30, 2007.

    We identified numerous questionable payments totaling nearly $90
    million that represent potentially improper, unsubstantiated, or
    wasteful payments. For example, we found payments for costs that did
    not comply with the terms of the contract or applicable regulation,
    such as costs for unapproved labor categories, costs exceeding contract
    ceiling amounts, and travel costs in excess of allowable limits. In
    other cases, we were unable to obtain adequate documentation, such as
    vendor invoices or time sheets, to support costs billed. In addition,
    we identified payments for which risks in CMS's contracting practices
    resulted in potential waste. In some cases, due to the facts and
    circumstances involved, we were unable to determine whether or to what
    extent the costs were allowable, reasonable, and allocable. As a
    result, some portion of the total amount of questionable payments we
    identified ultimately may be determined by CMS to be allowable and
    therefore not recoverable from the contractor. Given CMS's poor control
    environment and the fact that our work was not designed to identify all
    questionable payments made by CMS or to estimate their extent, other
    questionable payments may have been made.

    To improve internal control and accountability in the contracting
    process and related contract payments, we are making nine
    recommendations to the Administrator of CMS to develop additional
    policies and procedures, training on the invoice review process, and a
    plan to reduce the backlog of contracts awaiting closeout.

    In written comments on a draft of this report, CMS stated that it would
    take action on each of our recommendations and described steps taken
    and others planned to address our recommendations. At the same time,
    CMS disagreed with some of our findings. Specifically, CMS disagreed
    with the questionable payments identified in our report. However, CMS
    also stated that it has not yet performed audits of the contracts in
    question. Our report clearly states that in some cases, due to the
    facts and circumstances involved, we were unable to determine whether
    or to what extent the costs we questioned were allowable, reasonable,
    and allocable. As a result, some portion of the total amount of
    questionable payments we identified ultimately may be determined by CMS
    to be allowable. However, we also state that given CMS's poor control
    environment and the fact that our work was not designed to identify all
    questionable payments made by CMS or to estimate their extent, other
    questionable payments may have been made. We continue to believe that
    our findings fully support the nine recommendations we make for
    improved control and accountability over the contracting process and
    related payments. However, we have considered CMS's comments and have
    incorporated, as appropriate, clarifying language in our report.

    Our responses to CMS's comments are provided in the agency comments
    section of this report and in appendix III, immediately following the
    reprinted CMS comments.

    Background:

    Contracts of federal executive agencies that use appropriated funds are
    administered in accordance with laws,[Footnote 11] FAR, agency-specific
    FAR supplements, the Cost Accounting Standards (CAS),[Footnote 12] and
    the terms of the contract. HHS' FAR supplement, the Health and Human
    Services Acquisition Regulations (HHSAR),[Footnote 13] contains
    additional requirements not found in the FAR, such as disallowing
    payments to contractors for independent research and development
    costs.[Footnote 14] The purpose of CAS is to help achieve uniformity
    and consistency in contractors' cost accounting practices and provide
    rules for estimating, accumulating, and reporting costs under
    government contracts and subcontracts. For example, CAS requires
    certain contractors to prepare a disclosure statement that describes
    their accounting practices and requires that similar costs be treated
    in the same manner. Contractor compliance with CAS is monitored by a
    contractor's cognizant federal agency.[Footnote 15]

    The cognizant federal agency is usually the agency with the largest
    dollar amount of negotiated contracts, including options, with the
    contractor. To help ensure continuity and ease of administration, FAR
    recommends that once an agency assumes cognizant federal agency
    responsibilities for a contractor, it generally retains cognizant
    status for at least 5 years. If, at the end of the 5-year period,
    another agency has the largest dollar amount of negotiated contracts
    including options, the two agencies coordinate and determine which one
    will assume the responsibilities. In addition to monitoring CAS
    compliance, the cognizant federal agency is responsible for determining
    if the contractor's billing and accounting systems are adequate to
    record and bill costs in accordance with FAR.[Footnote 16] The
    cognizant federal agency also establishes provisional indirect cost
    rates[Footnote 17] based on an audit of information provided by the
    contractors that contractors use to estimate indirect costs on their
    invoices. The cognizant federal agency also establishes final indirect
    cost rates based on an audit of actual costs of the contractor during
    the year. The final indirect cost rates are used to adjust contractor
    billings (based on provisional indirect cost rates) for actual costs
    and may result in an additional cost or savings to the government. The
    final indirect cost rates established by the cognizant federal agency
    are utilized by agencies dealing with the contractor. Because other
    agencies rely on this cost information and oversight, it is
    particularly important that the cognizant federal agency fulfills its
    responsibilities.

    MMA significantly changed Medicare law covering CMS's contracting for
    Medicare claims administration services. CMS refers to these changes,
    which are intended to improve service to beneficiaries and health care
    providers, as Medicare contracting reform. The implementation of
    contracting reform, which CMS is required to complete by October 2011,

    will fundamentally change Medicare claims administration contracting
    practices. Specifically, MMA requires CMS to use competitive procedures
    to select Medicare Administrative Contractors (formerly referred to as
    claims administration contractors) and to follow FAR except where
    specific MMA provisions differ. Prior to MMA, CMS was generally exempt
    from these requirements for its claims administration contractors.
    According to data provided by CMS's Office of Acquisition and Grants
    Management (OAGM), during fiscal year 2006 CMS awarded contracts valued
    at about $3.8 billion. Of that amount, about half represented Medicare
    claims administration contracts that were not previously subject to
    FAR. The other half was already covered by FAR and is the category of
    contract primarily covered by this report.[Footnote 18]

    Contract Life Cycle, Contract Types, and Contract Risks:

    The contract life cycle includes many acquisition and administrative
    activities. Prior to award, an agency identifies a need; develops a
    requirements package; determines the method of contracting; solicits
    and evaluates bids or proposals; and ultimately awards a contract.
    After contract award, the agency performs contract administration and
    contract closeout. Contract administration involves the agency
    monitoring the contractor's progress and processing payments to the
    contractor. The contract closeout process involves verification that
    the goods or services were provided and that administrative matters are
    completed. Also during contract closeout, a contract audit of costs
    billed to the government may be performed and the agency processes the
    final invoice with an adjustment for any over-or underpayments.

    Agencies may choose among different contract types to acquire goods and
    services. This choice is the principal means that agencies have for
    allocating risk between the government and the contractor. Contract
    types can be grouped into three broad categories: fixed price
    contracts, cost reimbursement contracts, and time and materials (T&M)
    contracts. As discussed below, these three types of contracts place
    different levels of risk on the government, which the government
    generally manages through oversight.

    * For fixed price contracts, the government agrees to pay a set price
    for goods or services regardless of the actual cost to the contractor.
    A fixed price contract is ordinarily in the government's interest when
    a sound basis for pricing exists as the contractor assumes the risk for
    cost overruns.

    * Under cost reimbursement contracts, the government agrees to pay
    those costs of the contractor that are allowable, reasonable, and
    allocable to the contract. The government assumes most of the cost risk
    because the contractor is only required to provide its best effort to
    meet contract objectives within the estimated cost. If this cannot be
    done, the government would provide additional funds to complete the
    effort, fail to provide additional funds, or terminate the contract.
    The FAR requires agencies to mitigate risks through adequate government
    surveillance (oversight) during the performance of the contract. In
    addition, the contractor must have adequate accounting systems to
    record and bill costs.

    * For T&M contracts, the government agrees to pay fixed per-hour labor
    rates and to reimburse other costs directly related to the contract,
    such as materials, equipment, or travel, based on cost. Like cost
    reimbursement contracts, the government assumes the cost risk because
    the contractor is only required to make a good faith effort to meet the
    government's needs within a ceiling price. In addition, since these
    contracts provide no positive profit incentive for the contractor to
    control costs or use labor efficiently, the government must conduct
    appropriate surveillance of contractor performance to ensure efficient
    methods and effective cost controls are being used.

    Roles in CMS Contracting Activities:

    At CMS, OAGM manages contracting activities and is responsible for,
    among other things, (1) developing policy and procedures for use by
    acquisition staff; (2) coordinating and conducting acquisition
    training; and (3) providing cost/price analyses and evaluations
    required for the review, negotiation, award, administration, and
    closeout of contracts. Multiple key players work together to monitor
    different aspects of contractor performance and execute preaward and
    postaward contract oversight. All but one of the players described
    below are centralized in OAGM. Project officers are assigned from CMS
    program offices.

    * Contracting officers are responsible for ensuring performance of all
    necessary actions for effective contracting, overseeing contractor
    compliance with the terms of the contract, and safeguarding the
    interests of the government in its contractual relationships. The
    contracting officer is authorized to enter into, modify, and terminate
    contracts.

    * Contracting specialists represent and assist the contracting officers
    with the contractor, but are generally not authorized to commit or bind
    the government. Additionally, the contracting specialist assists with
    the invoice review process.

    * The cost/price team serves as an in-house consultant to others
    involved in the contracting process at CMS. By request, the team, which
    consists of four contract auditors, provides support for contract
    administration including reviewing cost proposals, consultations about
    the allowability of costs billed on invoices, and assistance during
    contract closeout.

    * Project officers serve as the contracting officer's technical
    representative designated to monitor the contractor's progress,
    including the surveillance and assessment of performance and compliance
    with project objectives. The project officer also reviews invoices and
    conducts periodic analyses of contractor performance and cost data.

    Within HHS, its cognizant federal agency oversight responsibilities are
    divided between different agencies and offices. In 2002, HHS designated
    the National Institutes of Health (NIH) responsible for establishing
    provisional and final indirect cost rates when requested by other HHS
    agencies to perform such duties. Other responsibilities, such as
    monitoring a contractor's compliance with CAS, belonged to the
    individual HHS agency or office, such as CMS, that primarily works with
    the contractor. Because certain cognizant federal agency
    responsibilities at HHS were assigned to CMS, we refer to CMS as the
    cognizant federal agency. At CMS, the cost/price team was assigned
    these other cognizant federal agency responsibilities. CMS could also
    pay another agency to assist it with the necessary oversight. For
    example, within the Department of Defense (DOD), the Defense Contract
    Audit Agency (DCAA) performs contract audits, including those required
    to fulfill DOD's responsibilities as a cognizant federal agency. When
    requested and for a fee, DCAA will perform contract audits for other
    agencies.

    CMS Paid Most of the $1 Billion of MMA Funds to Contractors:

    Congress appropriated to CMS $1 billion to fund start-up administrative
    costs to implement MMA provisions. CMS received $975 million, and
    Congress transferred the remaining $25 million to the HHS Office of the
    Inspector General (OIG) for oversight of the Part D program, including
    detecting and preventing fraud and abuse and the design and maintenance
    of a drug pricing database.[Footnote 19] CMS's $975 million
    appropriation was available for obligation through September 2006.
    According to CMS financial data, CMS obligated $974.6 million and, from
    January 2004 through December 2006, expended over $908
    million,[Footnote 20] of which about $735 million or 81 percent was
    paid to contractors and vendors for a variety of services. Payments
    were also made for services provided by other federal and state
    agencies, for CMS employee-related expenses, and for purchase card
    transactions. Figure 1 summarizes the amounts CMS paid to various
    recipients.

    Figure 1: Recipients of CMS's Payments from MMA Funds from January 2004
    through December 2006:

    [See PDF for image]

    This figure is a pie-chart illustrating the amount and percentage of
    the total for recipients of CMS's payments from MMA funds from January
    2004 through December 2006. The following data is depicted:

    Contractors and vendors: 81.0% ($735.4 million);
    Federal agencies: 11.6% ($105.0 million);
    Employee-related expenses: 4.6% ($42.1 million);
    State agencies: 2.6% ($23.8 million);
    Purchase card payments: 0.2% ($2.0 million).

    Source: GAO analysis of CMS data.

    [End of figure]

    Payments to Contractors and Vendors:

    CMS paid $735.4 million to over 250 different contractors and vendors.
    Of this amount, CMS paid about $521.2 million to 16 major contractors,
    $26.7 million to several Medicare contractors serving as fiscal
    intermediaries[Footnote 21] and carriers[Footnote 22] that administer
    Medicare benefits on behalf of CMS, and an additional $187 million to
    over 200 other contractors and vendors. Our assessment of CMS's
    contracting practices and related internal controls was based primarily
    on specific controls over the contracts funded with MMA money for the
    16 major contractors listed in table 1.

    Table 1: Payments to Major Contractors and Vendors from January 2004
    through December 2006 (Dollars in millions):

    Contractors/vendors: NCS Pearson, Inc.;
    Amount: $153.9;
    Activity provided[A]: 1-800-Medicare help line.

    Contractors/vendors: Palmetto GBA;
    Amount: 81.0;
    Activity provided[A]: 1-800-Medicare help line[B].

    Contractors/vendors: Lockheed Martin Corporation;
    Amount: 54.3;
    Activity provided[A]: Information technology.

    Contractors/vendors: Ketchum, Inc.;
    Amount: 47.3;
    Activity provided[A]: Outreach/education.

    Contractors/vendors: CGI Federal;
    Amount: 25.7;
    Activity provided[A]: Information technology.

    Contractors/vendors: Computer Sciences Corporation;
    Amount: 24.8;
    Activity provided[A]: Information technology.

    Contractors/vendors: ViPS;
    Amount: 24.1;
    Activity provided[A]: Information technology.

    Contractors/vendors: Booz Allen Hamilton, Inc.;
    Amount: 19.4;
    Activity provided[A]: Information technology and program support[B].

    Contractors/vendors: Government Micro Resources, Inc.;
    Amount: 18.0;
    Activity provided[A]: Information technology.

    Northrop Grumman Corporation; Amount: 17.2; [Empty]; Activity
    provided[A]: Information technology.

    Contractors/vendors: Iowa Foundation for Medical Care;
    Amount: 13.7;
    Activity provided[A]: Information technology[B].

    Contractors/vendors: International Business Machines, Corp.;
    Amount: 10.2;
    Activity provided[A]: Information technology.

    Contractors/vendors: Z-Tech Corporation;
    Amount: 10.2;
    Activity provided[A]: Information technology.

    Contractors/vendors: TrailBlazer Health Enterprises, LLC;
    Amount: 7.4;
    Activity provided[A]: Information technology and outreach/education.

    Contractors/vendors: BearingPoint;
    Amount: 7.3;
    Activity provided[A]: Outreach/education and program support[B].

    Contractors/vendors: Maximus, Inc.;
    Amount: 6.7;
    Activity provided[A]: Information technology[B].

    Contractors/vendors: Medicare fiscal intermediaries and carriers[C];
    Amount: 26.7;
    Activity provided[A]: Outreach/education.

    Contractors/vendors: Other[D];
    Amount: 187.5;
    Activity provided[A]: Various goods and services.

    Contractors/vendors: Total;
    Amount: $735.4.

    Source: GAO analysis of CMS data.

    [A] We analyzed supporting documentation such as the statements of work
    for contracts that received at least $1 million of MMA funding. Based
    upon this information, we categorized CMS expenditures into various
    types of activities.

    [B] Because we did not categorize contracts or invoices receiving less
    than $1 million of MMA funds, this contractor may have performed other
    activities not specifically noted here.

    [C] These contractors, such as Blue Cross Blue Shield, administer
    Medicare benefits on behalf of CMS.

    [D] "Other" represents amounts paid to over 200 different contractors
    and vendors that were not included in our assessment of CMS's internal
    controls over contractor payments.

    [End of table]

    Based on our analysis of contracts and invoices paid with MMA funds,
    figure 2 summarizes the types of activities provided by contractors and
    vendors such as information technology, the 1-800-Medicare help line,
    outreach/education, program support, and program integrity.

    Figure 2: Activities Provided by Contractors and Vendors:

    [See PDF for image]

    This figure is a combination of a pie-chart and horizontal bar graph
    depicting activities provided by contractors and vendors. The pie-chart
    represents the same data presented in Figure 1 (Recipients of CMS's
    Payments from MMA Funds from January 2004 through December 2006). The
    bar graph provides a breakdown of the 81.0% ($735.4 million) paid to
    contractors and vendors as follows:

    Information technology: $244.0 million (33.2%);
    1-800-Medicare help line: $234.4 million (31.9%);
    Outreach/education: $98.9 million (13.4%);
    Program support: $61.4 million (8.4%);
    Program integrity[A]: $14.3 million (1.9%);
    Not categorized[B]: $82.4 million (11.2%).

    Source: GAO analysis of CMS data.

    Note: To categorize payments to contractors by activity, we analyzed
    supporting documentation such as the statements of work for contracts
    that received at least $1 million of MMA funding. Because we did not
    categorize contracts or invoices receiving less than $1 million of MMA
    funds, the amounts reported for each activity could be higher.

    [A] "Program integrity" represents amounts paid to contractors and
    vendors for activities such as antifraud and abuse efforts related to
    prescription drug benefits.

    [B] "Not categorized" represents amounts paid to over 200 contractors
    and vendors whose total disbursements per contract or invoice were less
    than $1 million or were not included in our detailed review of selected
    contractors.

    [End of figure]

    * Information technology: CMS paid $244.0 million for a variety of
    information technology services including new hardware and software,
    updates to existing systems, and the development of new systems. For
    example, CMS used MMA funds to modify its existing contract with CGI
    Federal (CGI) to update the system that handles Medicare claims appeals
    so that the system could also handle prescription drug claims. CMS also
    used MMA funds to modify its contract with Computer Sciences
    Corporation for the redesign of the beneficiary enrollment and payment
    system so that the system could also handle prescription drug
    beneficiaries. CMS also contracted with Iowa Foundation for Medical
    Care (IFMC) to develop a system to facilitate studies of chronic
    condition care, as specifically required by MMA.

    * 1-800-Medicare help line: CMS paid $234.4 million for the operation
    of the 1-800-Medicare help line, a CMS-administered help line used to
    answer beneficiaries' questions about Medicare eligibility,
    enrollment, and benefits.[Footnote 23] Because the help line's call
    volume significantly increased with the anticipation of the new
    prescription drug benefit,[Footnote 24] CMS used MMA funds to expand
    help line operations and fund a portion of help line costs. CMS
    contracted with both NCS Pearson (Pearson) and Palmetto GBA (Palmetto)
    for help line operations.

    * Outreach/education: CMS paid $98.9 million for a variety of outreach
    and education activities, including $67.3 million to inform
    beneficiaries and their caregivers about the changes to Medicare
    benefits and $31.6 million to meet the information and education needs
    of Medicare providers. For example, CMS paid Ketchum, a public
    relations and marketing firm, $47.3 million to provide outreach and
    education to the public. Ketchum assisted with a number of initiatives,
    including a nationwide bus tour, which traveled to targeted cities
    across America to promote key messages regarding Medicare prescription
    drug coverage. To further the television advertising campaign, Ketchum
    facilitated a number of media buys (the buying of advertising space)
    for commercials to inform the public about the new prescription drug
    benefit. CMS paid $31.6 million to Medicare contractors serving as
    fiscal intermediaries and carriers that administer Medicare benefits on
    behalf of CMS. These contractors, such as Blue Cross Blue Shield,
    assisted with provider customer service as required by MMA to meet the
    information and education needs of providers.

    * Program support: CMS paid $61.4 million for program support
    activities to assist with the implementation of the changes to the
    Medicare program. For example, CMS contracted with Booz Allen Hamilton
    (BAH) to perform an analysis of the prescription drug industry, review
    MMA legislative requirements, and develop application requirements for
    the prescription drug plans. CMS also contracted with BAH to support
    the development of the statements of work for the 1-800-MEDICARE help
    line contracts, including assisting CMS with monitoring and oversight
    of the contracts.

    * Program integrity: CMS paid $14.3 million for program integrity
    (antifraud and abuse) activities. For example, CMS paid one contractor
    $810,000 to assist CMS as one of the Medicare Drug Integrity
    Contractors. These contractors assist CMS in antifraud and abuse
    efforts related to the prescription drug benefits. Other examples of
    program integrity activities include oversight of the prescription drug
    card and coordination of benefit payments to prevent mistaken payment
    of Medicare claims.

    Payments to Other Recipients:

    In addition to the $735.4 million that CMS paid to contractors and
    vendors, based upon information in CMS's disbursement data and
    descriptions in interagency agreements and on invoices, we determined
    that CMS also made payments to other federal agencies, for employee-
    related costs, to state agencies, and for purchase card transactions.

    * Payments to federal agencies: CMS paid $105.0 million to other
    federal agencies. These payments included $27.5 million to the U.S.
    Postal Service for mailing services; $26.2 million to the Government
    Printing Office for printing services; $5.8 million to the Office of
    Personnel Management for various services, including the development of
    training courses; and about $19 million to other HHS divisions for
    human resources, legal, and other services. CMS also paid about $24
    million to the General Services Administration (GSA) for services
    including telephone and network services, building renovations, and
    renovating a leased facility to include a new training center and
    additional office space.

    * Payments for CMS employee-related costs: CMS paid $42.1 million for
    employee-related costs, including $38.2 million for payroll costs and
    $3.9 million for travel costs. The payroll costs covered about 500 new
    employees hired in response to MMA and did not include payroll costs
    for existing CMS employees working on MMA. While these new employees
    were hired to work in divisions throughout CMS and in various regions
    of the country, the largest group of employees, 174, was hired to work
    in CMS's Center for Beneficiary Choices, which is responsible for
    operations related to the prescription drug plans.

    * Payments to state agencies: CMS paid $23.8 million to state agencies
    as grants under the State Health Insurance Assistance Program. Under
    the program (which operates in all 50 states, the District of Columbia,
    the Virgin Islands, Puerto Rico, and Guam) the agencies provide
    advisory services to Medicare-eligible individuals and their
    caregivers. CMS relied on these state agencies to play a significant
    role in providing counseling and education services on the changes to
    Medicare, including the new prescription drug benefit.

    * Payments using purchase cards: CMS paid $2.0 million using purchase
    cards to acquire office supplies, outreach materials, and information
    technology equipment. An example of outreach materials was $148,391
    that CMS paid for 25,000 paperweights to be distributed at MMA outreach
    events, such as during the nationwide bus tour. CMS also made a number
    of audio and video equipment purchases for its television studio.
    Purchase cards were also used to pay for training such as training for
    MMA new hires, computer training, and preretirement training.

    Internal Control Deficiencies over Contracting and Contract Payments
    Increased the Risk of Waste and Improper Payments:

    The CMS operating environment created vulnerabilities in the
    contracting process and increased the risk of waste and improper
    payments. Over the past several years, resources allocated to contract
    oversight at CMS have not kept pace with the dramatic increase in
    contract awards. Additionally, CMS did not allocate adequate funding
    for contract audits and other contractor oversight activities essential
    to effectively fulfilling its critical cognizant federal agency
    responsibilities. Further, risks in CMS's contracting practices made
    CMS vulnerable to waste. For example, CMS did not always benefit from
    the effects of competition when awarding contracts. In addition, CMS
    frequently used a contract type--cost reimbursement--under which the
    government assumes most of the cost risk. In some cases, this contract
    type was used by CMS contrary to FAR requirements. In addition, CMS's
    approval of certain subcontractor agreements may have increased the
    costs to obtain services.

    CMS often applied flawed procedures to review and approve invoices. The
    flawed procedures were caused, in part, by pervasive internal control
    deficiencies, such as a lack of policies and procedures that provide
    sufficient guidance for reviewing invoices and that require adequate
    supporting documentation for invoices that would enable a review.
    Additionally, CMS did not sufficiently train its key staff in
    appropriate invoice review techniques, including identifying risks to
    the government based on contract type. Further, CMS's payment process,
    called negative certification, did not provide incentive for staff to
    review invoices, as payments would be made without a certification of
    review. Finally, CMS did not closeout contracts within time frames set
    by FAR. With only one OAGM contracting officer tasked with closing
    contracts, CMS has accumulated approximately 1,300 contracts with a
    total contract value of about $3 billion needing closeout as of
    September 30, 2007.

    CMS's Operating Environment Created Vulnerabilities in the Contracting
    Process:

    Over the past several years, CMS resources allocated to contract
    oversight have not kept pace with CMS's increase in contract awards.
    Additionally, CMS did not allocate sufficient funding for contract
    audits and other critical contractor oversight activities to fulfill
    its cognizant federal agency responsibilities. These contractor
    oversight responsibilities include establishing indirect cost rates
    with the contractor and verifying that the contractor has the necessary
    systems and processes in place to accurately bill the government.
    Moreover, risks in certain contracting practices related to
    noncompetitive contracts, cost reimbursement contracts, and
    subcontractor agreements made CMS vulnerable to waste.

    Emphasis on Contract Oversight Did Not Keep Pace with the Increase in
    Contract Awards:

    When an organization places sufficient emphasis on accountability or
    dedicates sufficient management attention to systemic problems, it
    reduces risk and potential vulnerabilities in operating activities. An
    organization's control environment, that is, management's overall
    approach toward oversight and accountability including a supportive
    attitude towards internal control, provides discipline and structure
    that influences the way the agency conducts its business. As stated in
    GAO's standards for internal control, a strong control environment is
    the foundation for all other elements of internal control. From fiscal
    year 1997 to 2006, as shown in figure 3, CMS contracting has
    dramatically increased; however, contract oversight resources have
    remained fairly constant. Specifically, contract awards have increased
    from about $1.9 billion in 1997 to about $3.8 billion in 2006, an
    increase of 103 percent, while oversight resources increased from 79
    full time equivalents (FTE) in 1997 to 88 in 2006, an increase of about
    11 percent. This trend presents a major challenge to contracting award
    and administration personnel who must deal with a significantly
    increased workload without additional support and resources.

    Figure 3: CMS Contract Awards and Oversight Resources from Fiscal Years
    1997 through 2006:

    [See PDF for image]

    This figure contains two line graphs depicting CMS Contract Awards and
    Oversight Resources from Fiscal Years 1997 through 2006.

    The first graph represents total dollars awarded. From fiscal year 1997
    through 2006, the total contract amount awarded increased from $1.9
    billion to $3.8 billion, reflecting a significant increase in the non-
    Medicare contract total. The vertical axis of the graph represents
    dollars in billions from 0 to 4.0. The horizontal axis of the graph
    represents fiscal years 1997 through 2006. Lines represent both
    Medicare contracts and non-Medicare contracts, with a combined total of
    $1.9 billion indicated for 1997 and a combined total of $3.8 billion
    indicated for 2006.

    The second graph represents percentage change in contract awards and
    oversight. Since fiscal year 1997, annual contract awards increased by
    103.0% by fiscal year 2006, while corresponding oversight FTE resources
    only increase 11.4% by fiscal year 2006. The vertical axis of the graph
    represents percentage change since 1997 from -20 to +120. The
    horizontal axis of the graph represents fiscal years 1997 through 2006.
    Lines represent contract awards and full time equivalents (FTEs), with
    contract awards indicated in 2006 as +103.0% and FTEs indicated in 2006
    as +11.4%.

    Source: GAO analysis of CMS data.

    [End of figure]

    Inadequate Fulfillment of Cognizant Federal Agency Responsibilities:

    As the cognizant federal agency, CMS was responsible for ensuring that
    certain critical contractor oversight was performed, including
    establishing provisional and final indirect cost rates,[Footnote 25]
    assessing the adequacy of accounting systems,[Footnote 26] and
    monitoring compliance with CAS.[Footnote 27] CMS did not have
    sufficient procedures in place to ensure its cognizant federal agency
    responsibilities were fulfilled, to readily know the contractors it was
    responsible for as the cognizant federal agency, or to readily know
    which contractors were subject to CAS, which would require additional
    oversight to be performed.

    We requested a listing of contractors for which CMS was the cognizant
    federal agency to determine whether the oversight activities were
    performed for the contractors in our review. However, because of
    missing and conflicting data in the information provided by CMS, we
    independently examined the contract files and spoke with contractors,
    NIH, DCAA, and CMS officials to determine that at the end of fiscal
    year 2006, CMS was the cognizant federal agency for 8 of the 16
    contractors[Footnote 28] in our review. The contracts in our review for
    these 8 contractors had a total value of nearly $1 billion as of August
    2007.[Footnote 29] As shown in table 2, we found that CMS did not
    ensure that critical cognizant federal agency duties were performed or
    that those duties were only partially or insufficiently performed.
    Table 2 also shows that CMS did not fully ensure that its cognizant
    federal agency duties were completely performed for any of the 8
    contractors.

    Table 2: CMS's Cognizant Federal Agency Responsibilities:

    Contractor: IFMC;
    Establish provisional indirect cost rates: Yes;
    Establish final indirect cost rates: No[B];
    Assess the adequacy of
    accounting system[A]: No;
    Monitor the adequacy of disclosure statement and/or CAS compliance:
    Yes.

    Contractor: Ketchum;
    Establish provisional indirect cost rates: No;
    Establish final indirect cost rates: No;
    Assess the adequacy of
    accounting system[A]: Insufficient[D];
    Monitor the adequacy of disclosure statement and/or CAS compliance: No.

    Contractor: Maximus;
    Establish provisional indirect cost rates: No;
    Establish final indirect cost rates: No;
    Assess the adequacy of
    accounting system[A]: Yes;
    Monitor the adequacy of disclosure statement and/or CAS compliance: No.

    Contractor: Pearson;
    Establish provisional indirect cost rates: Yes;
    Establish final indirect cost rates: No;
    Assess the adequacy of
    accounting system[A]: Insufficient[E];
    Monitor the adequacy of disclosure statement and/or CAS compliance:
    n/a[F].

    Contractor: Palmetto;
    Establish provisional indirect cost rates: No;
    Establish final indirect cost rates: No;
    Assess the adequacy of
    accounting system[A]: Insufficient[E];
    Monitor the adequacy of disclosure statement and/or CAS compliance:
    Insufficient[G].

    Contractor: TrailBlazer;
    Establish provisional indirect cost rates: No;
    Establish final indirect cost rates: No;
    Assess the adequacy of
    accounting system[A]: Insufficient[D];
    Monitor the adequacy of disclosure statement and/or CAS compliance: No.

    Contractor: ViPS;
    Establish provisional indirect cost rates: Yes;
    Establish final indirect cost rates: Partial;
    Assess the adequacy of
    accounting system[A]: Insufficient[D];
    Monitor the adequacy of disclosure statement and/or CAS compliance: No.

    Contractor: Z-Tech;
    Establish provisional indirect cost rates: Yes;
    Establish final indirect cost rates: No[C];
    Assess the adequacy of
    accounting system[A]: No;
    Monitor the adequacy of disclosure statement and/or CAS compliance:
    n/a[H].

    Source: GAO analysis of CMS, NIH, and DCAA rate letters and audit
    reports.

    Legend:

    Yes - Responsibilities were adequately performed.

    No - Responsibilities were not performed.

    Partial - Rates were established for at least 1 year between 2004 and
    2006, but not all the years necessary.

    Insufficient - Responsibilities were not sufficiently performed to
    fulfill cognizant federal agency oversight.

    [A] This responsibility was adequately performed if an assessment of
    the accounting system was performed and, if necessary a risk analysis
    was performed showing that a more thorough assessment was not
    necessary.

    [B] DCAA performed an audit of IFMC's indirect cost rates for 2004 and
    identified several questioned costs. Additionally, audits of 2005 and
    2006 indirect cost rates were recently completed. According to CMS, it
    has not settled the final indirect cost rates for these years. CMS was
    instructed by HHS OIG to not finalize indirect cost rates due to an OIG
    audit that was recently completed.

    [C] NIH issued negotiation agreements that included "final rates" for
    2004 and 2005. However, the documents do not indicate whether an audit
    of actual costs was performed.

    [D] A preaward survey of the accounting system was performed by DCAA.
    However, CMS did not provide documentation to show that a risk analysis
    was performed to determine whether a more thorough accounting system
    audit was necessary.

    [E] At the request of CMS, DCAA performed a preaward accounting system
    survey. However, despite the volume of contracting, a full accounting
    system audit was not done.

    [F] n/a = not applicable. At the request of another agency, DCAA
    performed an examination of Pearson's disclosure statement in 2005,
    prior to CMS becoming the cognizant federal agency.

    [G] At the request of CMS, DCAA performed an examination of the
    compliance with CAS. In its October 2006 report, DCAA stated that
    because of significant inadequacies, it was unable to complete its
    examination. We found no evidence of a follow-up examination.

    [H] n/a = not applicable. The contractor was not subject to CAS during
    the period of our review.

    [End of table]

    We found that the listings CMS provided of the contractors for which it
    was the cognizant federal agency and other contractors were not
    complete or accurate. CMS provided us with two listings, one prepared
    in 2005 and another prepared in 2007. The 2005 listing included data
    fields to record the applicable cognizant federal agency and the status
    of the cognizant federal agency responsibilities listed in table 2.
    However, this listing was missing key information for several
    contractors. For example, there was no information regarding the
    cognizant federal agency for Ketchum or the status of the cognizant
    federal agency responsibilities. The 2007 listing included a data field
    to record the applicable cognizant federal agency, but did not have
    data fields to record the status of cognizant federal agency
    responsibilities. In addition, the listings did not clearly or
    consistently identify whether CMS was the cognizant federal agency. For
    example, in the 2005 listing, CMS was identified as the cognizant
    federal agency for IFMC; however, IFMC was not included in the 2007
    listing. Subsequently, we verified with CMS officials that CMS was
    still the cognizant federal agency for IFMC but it was inadvertently
    excluded from the 2007 listing.

    The CAS states that agencies shall establish internal policies and
    procedures to govern how to monitor contractors' CAS compliance, with a
    particular emphasis on interagency coordination activities.[Footnote
    30] CMS did not have agency-specific policies and procedures in place
    to help ensure that its cognizant federal agency responsibilities were
    properly performed, including the monitoring of contractors' CAS
    compliance. Of the eight contractors in our review, for which CMS was
    the cognizant federal agency, seven were subject to CAS[Footnote 31] at
    the end of fiscal year 2006. Generally, CMS requested DCAA to perform
    audit work for some of its cognizant federal agency duties. Further,
    for HHS, NIH was the agency assigned responsibility for auditing
    provisional and final indirect rates. However, NIH would not know this
    work is needed, unless CMS makes a request. In January 2007, one
    contractor sent a letter to CMS indicating that while CMS had performed
    some of the cognizant federal agency functions "on an ad hoc basis over
    the past year," the contractor wanted "to have a more formal
    relationship in place." The contractor noted that until its indirect
    cost rates are audited and finalized, it will be "unable to submit
    final closeout invoices on [its] cost reimbursable work."

    Because other agencies rely on the work performed by cognizant federal
    agencies in their own contracting activities, CMS's failure to ensure
    its cognizant federal agency responsibilities were fulfilled not only
    increased risks to CMS, but also to other federal agencies that use the
    same contractors. For example, we noted that according to one
    contractor's audited financial statements, as of December 31, 2005, the
    contractor reported a liability of about $3.8 million for billing the
    government more than its actual costs, including about $2.8 million
    associated with CMS contracts and $1.0 million related to a DOD
    contract. At the time of our review, CMS, as the contractor's cognizant
    federal agency, had not established its final indirect cost rates for
    years after 2004, which would be necessary for CMS and DOD to collect
    the overbilled amounts.

    CMS officials and cost/price team members attributed their limited
    ability to request contract audits--those required by FAR to fulfill
    cognizant federal agency responsibilities and for the contract closeout
    process--to the lack of sufficient allocation of funds for these
    efforts. For example, OAGM provided us with documentation that it
    requested from CMS management about $1.2 million for fiscal year 2005
    and about $3.5 million for fiscal year 2006 to pay for proposal
    evaluations, accounting system reviews, and disclosure statement
    reviews to help CMS comply with FAR requirements. Despite these
    requests, OAGM was provided $30,000 in fiscal year 2005 and $18,320 in
    fiscal year 2006. Moreover, no funds were provided for this purpose in
    fiscal year 2007.[Footnote 32] Consistent with this, the cost/price
    team indicated that contract audits often "fall by the way-side" since
    its resources are limited. Not funding contract audits may limit CMS's
    ability to closeout contracts, as well as to detect and recover
    improper payments. Further, based on our review of payments to
    contractors, the contractors that we identified as having more
    questionable payments were contractors for which CMS was the cognizant
    federal agency.

    Risks in Contracting Practices:

    Contracting and procurement has been identified as an area that poses
    significant challenges across the federal government. Our work and that
    of agency inspectors general has found systemic weaknesses in key areas
    of acquisition that put agencies at risk for waste and
    mismanagement.[Footnote 33] At CMS we found risks resulting from CMS's
    failure to allocate sufficient resources for effective contract and
    contractor oversight, and we found that CMS engaged in certain
    contracting practices that made the agency more vulnerable to waste.
    For example, CMS did not always take advantage of the benefits of
    competition and frequently used a contract type--cost reimbursement--
    that by nature poses more risk to the government because the government
    assumes most of the cost risk. In addition, CMS approved some
    subcontractor agreements that may have unnecessarily increased the
    costs of obtaining those services. We also noted that, when awarding
    contracts, contracting officers did not always follow advice from
    others such as the cost/price team and HHS Office of General Counsel
    that could have mitigated some of these risks.

    Noncompetitive Contracts:

    CMS is generally required to obtain competition for the goods and
    services it procures.[Footnote 34] The FAR provides procedures for
    making price determinations[Footnote 35] and emphasizes the use of full
    and open competition in the acquisition process.[Footnote 36] Because a
    competitive environment generally provides more assurance of reasonable
    prices than a noncompetitive one, CMS is exposed to contracting
    vulnerabilities and potential waste due to practices that limit
    competition. About 45 percent of the contracts included in our review
    (representing about $499.1 million in total contract value) were
    awarded without the benefit of competition. According to CMS,
    noncompetitive procedures were used on the contracts in our review
    because (1) there was an unusual or compelling urgency for the work,
    (2), the award was made under the Small Business Administration (SBA)
    8(a) criteria,[Footnote 37] or (3) the contracted activities were
    considered to be a logical follow-on to prior work. While these are
    permissible reasons to limit competition, in the examples of the
    noncompetitive contracts described below, CMS's contracting practices
    may not have sufficiently protected the government's interest in
    obtaining the best value, in terms of fair and reasonable prices.

    * The FAR allows for noncompetitive procedures when there is an unusual
    and compelling urgency that the government would be seriously injured
    unless competition is limited. When this exemption is used, an agency
    prepares a written justification and requests offers from as many
    potential sources as is practicable.[Footnote 38] Prior to a
    noncompetitive award to Maximus ultimately valued at about $6.5
    million, the HHS Office of General Counsel reviewed CMS's justification
    for other than full and open competition and had concerns with the
    legal sufficiency of the justification. The Office found that CMS did
    not demonstrate how it had met the FAR requirement to obtain offers
    from as many sources as possible or how the agency would be seriously
    injured if the exemption is not used. Additionally, according to the
    Office of General Counsel, the urgent and compelling justification did
    not support procurements in excess of a "minimum amount of time," and
    suggested limiting the contract to a 5-month term and recompeting the
    contract during that time. Despite the advice of the Office of General
    Counsel, 2 days later CMS awarded the contract to Maximus for a 9-month
    period, never recompeted the contract, and eventually extended the
    period of performance another 17 months for a total of 26 months.

    * For multiple awards to Z-Tech, CMS justified the sole-source
    noncompetitive awards using SBA's 8(a) exceptions to competition
    subject to contract value thresholds. To use these exceptions,
    generally an agency obtains a written authorization from SBA, which
    places a limit on the dollar value of the contract. For one Z-Tech
    contract, CMS obtained authorization to award a contract for an amount
    up to $3.6 million. SBA also indicated that no other increases would be
    authorized under this contract and that further increases should be
    competed under a new contract. Nevertheless, CMS exceeded the SBA-
    authorized amounts and made awards to Z-Tech totaling about $4.4
    million. Further, we found an agency internal document in a contract
    file that expressed concern that contract awards to Z-Tech may have
    been divided to avoid the dollar threshold that would require
    competition for 8(a) procurements.

    The FAR allows for limiting competition on the issuance of task orders
    under multiple award contracts if doing so is in the interest of
    economy and efficiency because it is a logical follow-on to an earlier
    task order that had been subject to competition.[Footnote 39] However,
    the frequent use of the logical follow-on exemption to competition may
    hinder an agency's ability to obtain the best value for the taxpayer.
    About 24 percent of the contracts and task orders in our review, with a
    total value of nearly $390 million, were issued with no competition as
    a logical follow-on to a prior task order. Two of these logical follow-
    on task orders had total values of $234.6 million and $67.8 million.

    Cost Reimbursement Contracts:

    One role of the contracting officer is to select the contract type that
    is in the best interest of the government, places reasonable risk on
    the contractor, and provides the contractor with the greatest incentive
    for efficient and economical performance. Cost reimbursement contracts
    are suitable for use only when uncertainties involved in contract
    performance do not permit costs to be estimated with sufficient
    accuracy to use any type of fixed-price contract. We found that about
    78 percent of the contracts we reviewed were cost reimbursement
    contracts. These cost reimbursement contracts had a total contract
    value of $1.2 billion. Some CMS officials told us that CMS was a "cost-
    type shop," meaning that at CMS they prefer cost reimbursement
    contracts. When cost reimbursement contracts are utilized, FAR requires
    additional procedures to mitigate the increased risk such as adequate
    government surveillance.[Footnote 40] However, as discussed later in
    this report, CMS did not implement sufficient oversight required for
    cost reimbursement contracts. In addition, before awarding a cost
    reimbursement contract, the contracting officer is required by FAR to
    verify that the contractor has an adequate accounting system for
    determining costs applicable to the contract,[Footnote 41] which helps
    provide the government assurance that the contractor has systems in
    place to accurately and consistently record and bill costs in
    accordance with FAR. During our review of CMS's contract files, we
    found that contracting officers did not always proactively ensure the
    adequacy of contractors' accounting systems prior to award of the cost
    reimbursement contracts.

    We also noted instances when CMS knowingly awarded cost reimbursement
    contracts to a contractor with a deficient accounting system, contrary
    to the FAR requirement. Specifically, the CMS cost/price team noted
    numerous significant deficiencies in how Palmetto accounted for costs
    and determined that Palmetto's accounting system could not adequately
    account for its direct labor and indirect costs. The cost/price team
    notified the contracting specialist of the accounting system
    deficiencies and also stated that "corrections to [Palmetto's] system
    cannot be completed by the time this contract is awarded." Despite this
    determination by the cost/price team, the contracting officer awarded
    two cost reimbursement contracts included in our review to Palmetto
    with a total contract value of $157.3 million. Further, the contracting
    officer awarded a third contract valued at $3.3 million to Palmetto
    without verifying whether or not Palmetto's accounting system
    deficiencies were resolved.

    CMS also encouraged a contractor to use a cost reimbursement contract,
    even though the cost/price team raised concerns regarding the
    contractor's proposal of certain costs as direct costs and the
    contractor's ability to accumulate and record direct and indirect
    costs. Despite these concerns, CMS did not inquire with DCAA about
    whether or not an accounting system audit had been performed until
    after the contract was awarded. CMS eventually requested an accounting
    system audit about a year and a half after contract award. Further, the
    contractor expressed concerns regarding the cost reimbursement contract
    type requested by CMS because it did not have prior experience with the
    contract type. CMS documented in the contract file that "after much
    deliberation, the contractor realized it was in [its] best interest to
    accept a [cost reimbursement] contract." In some instances,
    contractors' inadequate accounting systems inhibited our ability to
    audit costs billed to the government because the contractors were
    unable to substantiate the costs billed.

    Subcontractor Agreements:

    While it is not inappropriate for a prime contractor to use
    subcontractors to achieve the contract's objectives, CMS's approval of
    some subcontractor agreements may have increased the cost to obtain the
    services through additional indirect costs and fees. For the contracts
    we reviewed, several of the prime contractors subcontracted for
    significant volumes of work. For example, on one task order between
    February 2004 and February 2005, Ketchum billed about $34.7 million of
    which about $33.8 million, or 97 percent, was for subcontractor costs.
    Furthermore, about $32.3 million of these costs were related to a
    single subcontractor. During this same period Ketchum billed only
    $59,509 for direct labor (which would include Ketchum's oversight of
    the subcontractors) yet received about $694,000 in fees, or over 10
    times more than the direct labor Ketchum provided under the contract.

    The contracts for the operation of the 1-800-MEDICARE help line are
    another example of cost increases caused by subcontractor agreements.
    CMS hired two contractors to operate the help line--Pearson and
    Palmetto. While each contractor had its own contract with CMS that
    required them to provide similar services, Pearson and Palmetto
    subsequently subcontracted with each other, again for the same
    services. Consequently, the costs to operate the help line were
    increased through additional indirect costs and fees. Specifically, CMS
    paid Palmetto an additional $3.6 million (for indirect costs and fees
    applied to the Pearson services included with Palmetto's invoices) that
    may not have been paid absent the subcontract agreement, such as if
    Pearson provided the services under its own prime contract. In
    addition, CMS paid Pearson an additional $630,000 in fees that may not
    have been paid absent the subcontract agreement.[Footnote 42]

    Pervasive Internal Control Deficiencies Increased the Risk of Improper
    Payments:

    In addition to increased risks associated with CMS's operating
    environment and certain contracting practices, pervasive internal
    control deficiencies in its invoice review and approval process
    increased the risk of improper payments. These deficiencies were caused
    in part by inadequate policies and procedures for invoice review and
    insufficient training of key personnel. CMS also did not perform timely
    contract closeout procedures, including contract audits to determine
    the allowability of billed amounts.

    Inadequate Invoice Review and Approval Process:

    GAO's standards for internal control state that control activities are
    the policies, procedures, and mechanisms that address risk and are an
    integral part of an organization's stewardship of government resources.
    Effective controls are even more important given CMS's risks and
    vulnerabilities in the contracting process caused by its operating
    environment. Effective policies and procedures for reviewing and
    approving contractor invoices help to ensure that goods and services
    were actually received and amounts billed represent allowable costs,
    and are comprised of numerous control activities. At CMS, the project
    officer's role is to review the invoices for technical compliance and
    accuracy of quantities billed whereas the contracting specialists' role
    is to determine if the amounts billed comply with contract terms such
    as indirect cost rates or ceiling amounts.

    We found that CMS often used flawed procedures to review and approve
    contractor invoices. These flawed procedures were caused, in part, by a
    lack of specific guidance and procedures for the contracting officials
    to follow as well as insufficient training.

    * Inadequate policies and procedures over invoice review: CMS's
    policies and procedures did not provide adequate details on how to
    review invoice cost elements. For example, CMS's acquisition policy for
    invoice payment procedures[Footnote 43] simply states that "the project
    officer shall certify whether or not the invoice is approved for
    payment" and "the contracting specialist will review the invoice and
    (the project officer's certification)." The policy did not give
    specific instructions or guidance on how to review an invoice or which
    invoice elements receive the most review given the nature of the
    services provided or the contract type.

    * Lack of requirements for invoice detail: CMS did not have
    requirements for contracting officers to ensure that contractors
    provide a certain level of detail supporting their invoices to allow
    responsible CMS personnel to sufficiently review key elements. As a
    result, CMS often did not require contractors to provide adequate
    detail in invoices to review billed costs, such as labor charges or
    travel. For example, some contractors included only lump sum amounts
    showing the number of hours worked and the associated dollar amount for
    labor costs but did not provide a list of hours worked by employee or
    respective labor rates. Without this information, it was not possible
    for CMS to verify whether the amounts billed corresponded to employees
    who actually worked on the project. One contractor stated that CMS
    requested only lump sum amounts for travel with no detailed information
    or travel receipts. Without this information, CMS could not verify that
    travel costs were related to the contract or were in accordance with
    FAR requirements.

    * Insufficient training: CMS did not sufficiently train staff on how to
    adequately review invoices, such as identification of risks to the
    government based on contract type and how to verify labor rates or
    hours worked. As a result, project officers and contracting specialists
    were not always aware of their invoice review responsibilities. Some
    project officers told us that they had only received training "on-the-
    job." Further, several staff we interviewed referred to the Project
    Officer Handbook as a source for guidance on the project officer's
    responsibilities. We reviewed this handbook and found that it did not
    provide any practical guidance on how to review invoices and focused
    more on the acquisition process (i.e., developing statements of work
    and preparing acquisition planning documents). In addition, two
    contracting officers said they attended a 2-hour training sponsored by
    CMS's Office of Financial Management (OFM) and that it was helpful in
    providing guidance on how to review invoices. We also reviewed this
    training material and found that the training did not sufficiently
    cover invoice review procedures. The training materials included one
    slide that indicated that it was the project officers' responsibility
    to review invoices, but it did not provide specific examples of invoice
    review procedures. An OFM official told us that the training was
    intended to provide detailed guidance on budgeting and appropriation
    procedures and not invoice review.

    * Lack of incentive to review invoices: CMS uses a payment process--
    negative certification--whereby OFM paid contractor and vendor invoices
    without knowing whether or not such invoices were reviewed and
    certified. Negative certification is used, in part, to help the agency
    meet Prompt Payment Act requirements.[Footnote 44] However, this
    process is the default for all invoice payments regardless of factors
    that may increase risk to the agency, including contract type or prior
    billing problems with the contractor. By contrast, DOD allows for
    contractors to participate in direct billing, a process similar to
    negative certification, only if the contractors meet certain criteria
    such as adequate accounting systems, billing rates established based
    upon recent reviews, and timely submissions of cost information as
    required by FAR. CMS's negative certification process provides little
    incentive for personnel to perform timely reviews of invoices or for
    reviews to even take place. In our review of contract files, we found
    that certificates of review by the project officer were not always
    included in the contract files, and when the certificates were included
    in the file, they generally did not include evidence to document the
    review, such as tickmarks or notes, and they were not always signed.

    Without sufficient policies and procedures, training, and incentives to
    review invoices, we found that key staff often used flawed procedures.
    Contracting officers, specialists, and project officers told us they
    reviewed invoice costs, such as labor rates for cost reimbursement
    contracts, based on amounts proposed by the contractor prior to award.
    However, this practice has little value for cost reimbursement
    contracts because FAR calls for the payment of actual allowable
    costs,[Footnote 45] rather than costs proposed prior to performance of
    the contract.

    Contracting specialists and project officers also told us they reviewed
    invoices by comparing current invoices to prior months and to burn
    rates (the rate at which CMS is expending dollars that are obligated to
    the contract). This procedure provides no assurance that the amounts
    billed are allowable. Additionally, several project officers told us
    that they compared invoices to monthly reports prepared by the
    contractors. This procedure has limited value because it does not
    involve verifying amounts billed to source documents, such as time
    sheets, payroll registers, or vendor invoices. Also, when we reviewed
    the monthly reports, we noted that the reports were not always
    reconcilable to the invoices, which would hinder the project officer's
    ability to use the monthly reports in determining the validity of the
    billed amounts. As described later in this report, we found payments
    for potentially unallowable costs that could have been identified had
    proper invoice review procedures been in place.

    Further, contracting and project officers did not call for additional
    oversight procedures when they approved complex subcontractor
    arrangements such as when a contractor provides the same services as
    both a prime contractor and as a subcontractor to another contractor.
    When these types of relationships exist, improper payments or double-
    billings may go undetected if a contractor bills the same services on
    both its prime contract invoices (which are reviewed by the government)
    and its subcontract invoices (which are reviewed by the other prime
    contractor). Further, some officials indicated that they relied on
    contract audits rather than invoice review procedures to catch improper
    payments. One contracting officer stated that it was not the
    contracting officer's or specialist's responsibility to review invoices
    for fraudulent billings, such as double-billings, because such billings
    would only be found during a closeout audit. While an audit during the
    closeout process may provide a detective control to identify improper
    payments after they were made, timely invoice review procedures provide
    the necessary preventive controls to help ensure that improper payments
    are not made and would allow CMS to take corrective actions, if
    necessary. For example, it would be more effective to review the
    accuracy of labor billings while the contractor is still performing
    services rather than after the fact during the closeout process, which
    may be several years later.

    Untimely Contract Closeout:

    CMS did not perform its contract closeout procedures in accordance with
    FAR time frames, and until recently, did not have contract closeout
    policies. The FAR requires agencies to closeout a contract after the
    work is physically completed (i.e., goods or services are
    provided).[Footnote 46] The closeout process is an important internal
    control, in part, because it is generally the last opportunity for the
    government to detect and recover any improper payments. The closeout
    process includes verifying that administrative matters are completed,
    adjusting provisional indirect cost rates for actual final indirect
    cost rates, performing a contract audit of costs billed to the
    government, and making final payments. The complexity and length of the
    process can vary with the extent of oversight performed by the agency
    and the contract type. The FAR generally calls for fixed price
    contracts to be closed within 6 months; contracts requiring the
    settlement of indirect costs rates, such as cost reimbursement
    contracts, to be closed within 36 months; and all other contracts to be
    closed within 20 months.[Footnote 47] These time frames begin in the
    month in which the contracting official receives evidence of physical
    completion of the contract.

    According to information provided by OAGM management, as of September
    30, 2007, CMS's contract closeout backlog was approximately 1,300
    contracts with a total contract value of approximately $3 billion. The
    backlog report indicated that 407 contract closeouts were overdue
    according to FAR timing requirements. Currently, CMS has only one
    contracting officer responsible for the closeout process. Several of
    the contracts on the backlog list completed contract performance as far
    back as 1999. CMS established agency-specific contract closeout
    policies in February 2007. One CMS official stated that prior to the
    closeout policies, some contracting officials and specialists often
    passed on contract files to the closeout staff before compiling all
    required documentation. Because of this, the sole staff member
    responsible for CMS's contract closeout procedures has to spend time
    tracking down required documents rather than performing actual closeout
    procedures.

    A key element of the closeout process is the contract audit of costs
    billed to the government. This audit is used to verify that the
    contractor's billed costs were allowable, reasonable, and allocable,
    which is critical for a cost reimbursement contract. This audit is even
    more important at CMS because of CMS's dependence on cost reimbursement
    contracts and the reliance placed on the contract audits instead of
    invoice review procedures. As previously mentioned, CMS has not
    allocated sufficient resources to ensure contract audits take place. As
    a result, CMS has limited its ability to detect and recover improper
    payments from contractors.

    CMS Made Nearly $90 Million of Questionable Payments to Contractors:

    Because of the risks in CMS's contracting practices and pervasive
    internal control deficiencies, CMS was highly vulnerable to waste and
    improper payments. Due to this increased risk, we selected contractor
    transactions to test and found nearly $90 million of payments to
    contractors that we questioned because the payments were potentially
    improper, unsubstantiated, or wasteful. Potentially improper payments
    include payments for costs that did not comply with the terms of the
    contract or applicable regulation. Unsubstantiated payments are related
    to costs that were not adequately supported. Wasteful payments are
    those for which risks in CMS's contracting practices may have resulted
    in CMS not obtaining the best value. In some cases, a portion of the
    questionable payment most likely relates to allowable costs, but due to
    the facts and circumstances involved, we were unable to determine
    whether or to what extent the costs were allowable, reasonable, and
    allocable. As a result, some portion of the total amount of
    questionable payments we identified ultimately may be determined by CMS
    to be allowable and therefore not recoverable from the contractor.
    Table 3 summarizes the questionable payments we identified. Appendix I
    provides a summary by contractor of the questionable payments we
    identified.

    Table 3: Summary of Questionable Payments (Dollars in millions):

    Type of questionable payment: Costs not compliant with contract terms
    or regulations;
    Amount: $24.5.

    Type of questionable payment: Unsupported contractor costs;
    Amount: 62.7.

    Type of questionable payment: Potential waste;
    Amount: 6.6.

    Type of questionable payment: Less overlapping amounts[A];
    Amount: (5.0).

    Type of questionable payment: Total;
    Amount: $88.8.

    Source: GAO analysis of contractor invoices and data.

    [A] In certain instances, a portion of a questionable payment may fall
    into more than one category (i.e., a payment may be both potential
    waste and not compliant with contract terms). Therefore, to avoid
    double counting questionable payment amounts, we reduced the gross
    questionable payment amount by the overlapping amount ($5.0 million).

    [End of table]

    Because CMS sometimes used other funding sources in addition to MMA to
    pay invoices for one contract, we were not always able to identify
    specific costs that were paid with MMA funds. As a result, the scope of
    our review extended beyond payments made with MMA funds for some
    contracts and the amount of questionable payments we identified may not
    have been paid solely with MMA funds. Given CMS's poor control
    environment and the fact that our work was not designed to identify all
    questionable payments made by CMS or to estimate their extent, CMS may
    have made other questionable payments. Appendix II provides details on
    the amounts by contractor that we reviewed and the amounts paid with
    MMA funds.

    Questionable Payments for Costs Not Compliant with Contract Terms or
    Regulations:

    Contracts contain the terms and provisions that set the parameters for
    allowable costs and the necessary documentation required to support the
    contractor's billings. For example, contracts may set ceiling limits on
    the amount of indirect costs a contractor may bill or the amount a
    contractor may bill for subcontractor costs. Additionally, contracts
    also incorporate numerous FAR provisions that the contracting officer
    determines to be applicable to the contract that may require the
    contractor to follow CAS or may restrict the contractor's travel costs.
    The contractor is required to bill the government in accordance with
    the terms of the contract and, as part of its invoice review and
    approval process, the government's responsibility is to ensure that
    billings comply with those terms. We identified numerous questionable
    payments totaling about $24.5 million that represent potentially
    improper payments for contractor costs not compliant with the terms of
    the contract or applicable regulation.

    * Labor categories outside the terms of the contract - $1.7 million:
    CMS paid CGI, BAH, International Business Machines (IBM), and IFMC for
    labor categories which were not specifically listed in the terms of the
    task orders. For example, CGI's task order specified "should the
    contractor wish to utilize additional GSA IT labor categories�prior CMS
    approval must be obtained." CGI did not seek and CMS did not give
    approval for the use of four labor categories, totaling about $1.3
    million. Also, CMS paid BAH about $208,000 for labor categories that
    were not specifically listed in the terms of the task order. BAH told
    us that in its proposal for a modification to the task order, it
    proposed using the additional labor categories. However, according to
    the task order, the modification, and other CMS internal contract
    documents, no additional labor categories were added to the contract.
    During our review, we also identified payments to IBM and IFMC of about
    $231,000 and $3,000, respectively for labor categories that were not
    specifically listed in the terms of the task orders. In these four
    instances, CMS made questionable payments of over $1.7 million.

    * Indirect cost rates exceeded contract ceiling rates - $17.6 million:
    CMS paid Palmetto, TrailBlazer, and Maximus for indirect costs that
    exceeded amounts allowed under indirect cost rate ceilings established
    in the respective contracts. The contract between CMS and Palmetto
    included acceptable indirect cost rates, based upon the indirect costs
    proposed by Palmetto, and applicable ceiling rates. Overhead was not
    included in the contract as an accepted indirect cost. Nevertheless,
    Palmetto billed, and CMS paid, at least $16.2 million of overhead
    costs. CMS told us that the contract was not modified to include
    overhead and that "for the government to continue business with
    [Palmetto] in good faith...[CMS] had to work with Palmetto as it
    transitioned to becoming CAS and FAR compliant." Palmetto notified CMS
    that an overhead rate was added to its billing structure, yet CMS did
    not modify the contract to include the overhead rate. In addition,
    TrailBlazer billed nearly twice as much as the contract allowed for
    overhead. During 2006, CMS paid TrailBlazer $1.4 million for G&A and
    overhead costs greater than the amount allowed by rate ceilings in the
    contract between CMS and TrailBlazer. TrailBlazer told us that the
    indirect cost rate ceilings incorporated into its contract at the time
    of award were based on its accounting system that, at the time, was not
    compliant with CAS. Subsequently, in January 2006, when TrailBlazer
    changed its accounting system to be CAS compliant, the rate ceilings
    were no longer reflective of its billing structure. In June 2007,
    TrailBlazer submitted to CMS, its cognizant federal agency, a cost
    report supporting an increase to its indirect cost rates for 2006.
    However, CMS did not issue a modification to amend the contract and
    increase the indirect cost rate ceilings. CMS also paid Maximus $16,000
    in excess of its G&A rate ceiling. In these three instances, CMS made
    questionable payments of over $17.6 million.

    * Subcontractor costs exceeded approved amount -$489,000: CMS paid CGI
    about $489,000 for subcontractor costs above the not-to-exceed amount
    established when CMS approved CGI's use of subcontractors.

    * Improper use of contract type - $4.5 million: In February 2005, CMS
    issued a sole-source, T&M task order to IBM under a commercial Army
    contract to procure commercial services. Because the FAR prohibited the
    use of other than fixed-price contracts to procure commercial services
    at the time the task order was awarded,[Footnote 48] we questioned the
    payments to IBM under this task order totaling approximately $4.5
    million.

    * Travel costs exceeding limits - $11,000: CMS paid ViPS and CGI for
    travel costs that exceeded FAR limits incorporated in their contracts.
    The FAR prohibits contractors from billing for other-than-coach
    transportation or above set limits for hotels, meals and incidentals,
    and mileage reimbursement. In several instances, ViPS billed the
    government $299 or more a night, in one case as high as $799 a night,
    excluding taxes, for hotel stays in Manhattan. During the applicable
    period, the federal hotel per diem limit for Manhattan was at most $200
    a night. Additionally, the contractor billed the government for
    business class train travel and amounts that exceeded the meals and
    incidentals per diem. Each of the 14 ViPS travel vouchers we tested
    included costs that exceeded allowed amounts. In total, we identified
    questionable payments of nearly $10,000 for ViPS travel. CMS also
    reimbursed CGI about $1,000 for travel costs in excess of allowed per
    diem limits.

    * Inappropriate calculation of labor - $9,000: CMS paid Ketchum for
    labor costs that exceeded Ketchum's actual costs for those services on
    a cost reimbursement contract. Ketchum did not adjust its hourly labor
    rates to bill for actual labor costs when exempt salaried employees
    (employees not eligible for overtime compensation) worked more than the
    standard hours in a pay period. By not adjusting (decreasing) the
    hourly labor rate to reflect the number of hours actually worked when
    an employee worked more than the standard hours, Ketchum charged the
    government more than its cost--the employee's salary. For example, if
    an exempt employee earns $4,000 for working a 40-hour week, the
    employee's hourly rate would be $100 ($4,000/40 hours). If that
    employee worked 50 hours in a week, the employee still earns $4,000 and
    the hourly rate would be adjusted to $80 ($4,000/50 hours). In this
    scenario, if the hourly rate were not adjusted, the contractor would
    have billed $5,000 ($100 * 50 hours) when its actual costs were only
    $4,000. Based on the labor transactions we selected for review totaling
    about $214,000, we estimated that CMS made about $9,000 of questionable
    payments as a result of Ketchum not adjusting its hourly labor rates.

    * Labor costs inappropriately billed - $20,000: CMS paid nearly $20,000
    to IFMC for vacation and sick leave that IFMC billed directly to the
    government. The FAR defines a direct cost as a cost that benefits a
    single cost objective (e.g., a contract) and an indirect cost as a cost
    that benefits more than one cost objective.[Footnote 49] Costs such as
    employees' fringe benefits, vacation and sick leave, and other
    headquarters costs are common indirect costs. IFMC billed vacation and
    sick leave directly to contracts that an employee worked on only at the
    time the leave was taken. By billing vacation and sick leave as direct
    costs, IFMC may have billed more than CMS's portion of the costs to
    CMS. For example, if an employee worked on one contract for 11 months
    and a new contract in the twelfth month and also took leave in the
    twelfth month, only the contract that the employee worked on in the
    twelfth month would bear the entire cost of the leave. Had IFMC
    included its costs associated with vacation and sick leave in its
    indirect cost rates, these costs would have been proportionally
    allocated to all of IFMC's contracts. Therefore, some of the nearly
    $20,000 of questionable payments would likely be offset by an increase
    in the indirect cost rates; however, we could not determine what that
    amount would be. In total, IFMC billed CMS about $4.3 million for
    direct labor from June 2005 through January 2006. Because we only
    reviewed $152,000 of labor charges, the total labor billed by IFMC may
    include additional costs associated with vacation and sick leave.

    * Labor rates in excess of contract terms - $31,000: CMS paid CGI for
    one labor category at rates higher than the rates allowed in its T&M
    contract, resulting in additional costs of about $31,000. According to
    CGI, it intends to issue a credit to CMS for the overbilling.

    * Duplicate billing - $95,000: CMS paid about $95,000 for equipment
    that CGI billed twice. CGI discovered the double billing for equipment
    as a result of our audit and subsequently issued a credit to CMS for
    the double billing.

    Questionable Payments for Unsupported Contractor Costs:

    Under a cost reimbursement contract, in which a contractor bills the
    government for allowable costs to achieve the contract objectives, the
    FAR requires the contractor to maintain adequate accounting systems and
    other documentation to support the amounts the contractor bills. For
    example, the FAR requires contractors to maintain documentation, such
    as time sheets, pay information, or vendor invoices. Additionally, FAR
    stipulates that supporting documentation must be maintained for 3 years
    after the final payment.[Footnote 50] We identified about $62.7 million
    of questionable payments for unsubstantiated contractor costs that were
    not adequately supported. For each of the questionable payments
    described below, a portion of the questionable payment most likely
    relates to allowable costs, but due to the different facts and
    circumstances involved, we were unable to determine whether or to what
    extent the costs were allowable, reasonable, and allocable. As a
    result, some portion of the total amount of questionable payments we
    identified ultimately may be determined by CMS to be allowable and
    therefore not recoverable from the contractor.

    * Unsupported contractor costs - $50.8 million: CMS paid $40.6 million
    to Palmetto for costs that were not adequately supported and $10.2
    million to Pearson for subcontractor costs related to Palmetto that
    were also not adequately supported.

    CMS's cost/price team's review of Palmetto's proposal identified
    numerous concerns about Palmetto's ability to record and bill costs.
    Specifically, the cost/price team noted that Palmetto's accounting
    practices were not compliant with several CAS requirements, its labor
    system did not distinguish between direct labor and vacation time, and
    its accounting system did not use indirect cost rates. The cost/price
    team also indicated that Palmetto was working on addressing these
    issues, but that it would probably be a lengthy process because of the
    numerous deficiencies. Despite the concerns about Palmetto's ability to
    record and bill costs, CMS awarded Palmetto three cost reimbursement
    contracts, contrary to the FAR requirement[Footnote 51] that the
    contractor must have an adequate accounting system for recording and
    billing costs. In this instance, CMS's decision to award cost
    reimbursement contracts to a contractor with accounting system
    deficiencies and CMS's failure to establish Palmetto's indirect cost
    rates inhibited our ability to audit the costs billed to CMS.

    In response to our request for transaction-level detailed reports of
    costs billed to CMS, Palmetto officials told us that its accounting
    systems[Footnote 52] could not generate a report that summarized the
    costs billed to CMS and that invoices were created manually by
    allocating costs (direct and indirect) from its cost centers. In
    addition, we were told that prior to June 2005, Palmetto did not
    require its salaried employees to use time sheets.

    Even though Palmetto told us its salaried employees were not required
    to use time sheets, Palmetto was able to provide many time sheets to
    support labor costs it billed. To gain an understanding of the type of
    information available that Palmetto could provide to support its other
    direct costs billed, we asked Palmetto to support the costs billed on
    four invoices. In response, Palmetto provided travel vouchers,
    subcontractor invoices, and numerous cost center reports and
    spreadsheets. The travel vouchers and subcontractor invoices supported
    the amounts billed to CMS. The cost center information represented
    costs that were directly allocated to the CMS contract. However,
    Palmetto did not support how it determined the percentages it used to
    allocate the costs to the CMS contract. Further, when we analyzed the
    cost center information, we noted several unusual transactions,
    including depreciation for office and cafeteria furniture, computer
    equipment, and basketball goals; building and lawn maintenance; and
    janitorial, security, and recycling services. Because these costs could
    reasonably benefit more than one cost objective or contract, these
    types of costs are generally included in a contractor's indirect cost
    rates rather than billed directly to a contract. Essentially, to audit
    these costs, all of Palmetto's operations--not just the costs allocated
    to the three CMS contracts included in our review--would need to be
    audited to determine whether the costs were allowable. This type of
    contractor oversight is normally performed by the cognizant federal
    agency, which for Palmetto is CMS.

    Because of the uncertainties associated with Palmetto's other direct
    costs (which based on the cost center reports seem to include
    significant allocations of indirect costs) we concluded that we were
    unable to audit the other direct costs (excluding travel and
    subcontractor costs) totaling $6.1 million billed to CMS prior to June
    2005 when Palmetto changed its accounting system to be compliant with
    CAS.

    In addition, we could not verify the allowability and reasonableness of
    $34.5 million of indirect costs billed to CMS on the three Palmetto
    contracts covering 2004 through 2006.[Footnote 53] On a cost
    reimbursement contract, indirect costs can be a substantial portion of
    the total contract cost. FAR requires that 6 months after the close of
    a year, contractors with cost reimbursement contracts must submit a
    report of their final costs to their cognizant federal agency.[Footnote
    54] On October 2, 2006, Palmetto submitted to its CMS contracting
    officer a report of its 2005 final costs. However, CMS may not have
    realized that Palmetto submitted this report because, according to a
    letter from CMS's cost/price team to Palmetto dated June 4, 2007, CMS
    notified Palmetto that its 2004 and 2005 final cost reports were
    delinquent according to FAR. Further, as of October 2007, Palmetto had
    not provided to CMS its final cost report for 2006, which is delinquent
    according to the FAR. Because Palmetto's final cost reports for 2004,
    2005, and 2006 have not been audited by CMS its cognizant agency,
    Palmetto's final indirect cost rates have not been established.
    Further, provisional indirect cost rates have not been established.
    Therefore, we did not have support to verify the allowability and
    reasonableness of the indirect costs that were billed. Moreover, as
    discussed above, it appeared that indirect costs from Palmetto's cost
    centers were directly allocated to the CMS contract. As a result, there
    is considerable risk that CMS may have been billed twice for Palmetto's
    indirect costs--once as an allocated direct cost and again as an
    indirect cost.

    The issues described above related to Palmetto's other direct costs and
    indirect costs also affected the amounts CMS paid to Pearson for
    Palmetto as a subcontractor. As a result, additional payments totaling
    $10.2 million were unsupported.

    Because of these numerous concerns described above and lack of
    documentation to verify amounts billed, CMS made questionable payments
    totaling $50.8 million ($6.1 million, $34.5 million, and $10.2
    million), which represents the direct and indirect costs that were not
    adequately supported during our review.

    * Unsupported contractor costs - $9.7 million: CMS paid about $9.7
    million to TrailBlazer for costs that TrailBlazer did not adequately
    support related to a cost reimbursement contract ($4.8 million)
    [Footnote 55] and a portion of its Medicare contract ($4.9 million)
    paid with MMA funds.[Footnote 56] After numerous requests spanning over
    7 months, TrailBlazer did not provide us with adequate documentation
    supporting the amounts billed to CMS for these contracts. For the cost
    reimbursement contract, the $4.8 million that TrailBlazer did not
    adequately support included $2.4 million of labor costs, $654,000 of
    other direct costs, and $1.8 million of indirect costs. For the labor
    costs, TrailBlazer told us that only its parent company could provide
    transaction information, which was never provided. Instead, TrailBlazer
    provided several reports summarizing labor and other direct costs;
    however, we could not use these reports because they did not reconcile
    to the amounts billed to CMS and often included only summary level
    information. For the indirect costs, generally these costs are
    supported with provisional or final indirect cost rates that have been
    audited by a contractor's cognizant federal agency. However, as of
    October 2007, CMS, TrailBlazer's cognizant federal agency, has not
    ensured that TrailBlazer's indirect cost rates were audited.
    TrailBlazer submitted a cost report of its indirect costs for 2006 to
    CMS in June 2007.

    For the $4.9 related to the Medicare contract, TrailBlazer provided a
    one-page document that summarized the total amount by types of costs,
    such as salaries, equipment, and fringe benefits. This was not
    sufficient for us to review the costs.

    * Unsupported indirect costs - $1.2 million: CMS paid at least $1.2
    million to Ketchum for indirect costs that were not adequately
    supported with recently audited provisional or final indirect cost rate
    information. From May 2004 through October 2006, CMS paid Ketchum for
    indirect costs based on indirect cost information from 1999. Because
    FAR calls for indirect cost rates to be based on recent information and
    established annually, rates based on information from 1999 did not
    adequately support costs billed in 2004 through 2006. Further, in our
    review of the contract file, we noted documentation from 2004 that
    alerted CMS to potential issues with Ketchum's indirect cost rates--
    namely, that the rates were too high. In September 2006, Ketchum
    submitted cost reports for its 2001 through 2005 actual indirect costs.
    According to Ketchum officials, CMS, as the cognizant federal agency,
    has recently initiated an audit of this indirect cost rate information
    to establish final rates for these years.

    * Unsupported labor costs - $383,000: Based on the task orders in our
    review, we estimated that $383,000 of BearingPoint's billings for labor
    and fringe benefits costs were not adequately supported. BearingPoint
    was unable to provide us with support for certain key elements of the
    labor and fringe benefits costs it billed on the five task orders in
    our review.

    * Unsupported transactions - $463,000: During our audit, contractors
    could not adequately support several miscellaneous transactions
    totaling $463,000.

    - Palmetto billed CMS for about $79,000 of labor and about $323,000 of
    Kelly Services costs which it did not support with documentation such
    as time sheets or vendor invoices. Therefore, we were unable to verify
    the amounts billed.

    - IFMC billed CMS for about $49,000 of other direct costs such as
    referral bonuses and placement fees that IFMC did not adequately
    support. In some cases, IFMC provided invoices for the costs but did
    not provide support that would enable us to verify that these costs
    solely benefited and were directly allocable to the CMS contract.

    - BearingPoint billed CMS for about $5,000 of other direct costs which
    it did not support with vendor invoices. Therefore, we could not verify
    the amounts billed.

    - CGI billed CMS for about $5,000 of other direct costs which it did
    not support with vendor invoices. Therefore, we could not verify the
    amounts billed.

    - Maximus billed CMS for about $2,000 of other direct costs which it
    did not support with documentation that would allow us to verify that
    these costs were directly allocable to the CMS contract.

    * Unsupported contractor costs - $60,000: CMS paid BAH more than
    $60,000 for intercompany labor costs billed on a cost reimbursement
    contract that the contractor did not adequately support the rates
    billed to CMS. For example, on one task order, the intercompany hourly
    rates, on average, were nearly 14 times higher than the average hourly
    rate for other BAH employees and almost 6 times higher than the next
    highest BAH employee. We noted that in a proposal review, CMS's cost/
    price team raised a concern that BAH's proposed intercompany hourly
    rates were "excessive and unreasonable" and requested BAH to provide
    support for the proposed rates. Even though BAH refused to provide the
    support to CMS, CMS awarded the contract. We noted that some of the
    rates BAH charged for intercompany labor exceeded the proposed rates
    that were questioned by CMS by, on average, 65 percent. BAH did not
    provide us support for the rates, but stated that the rates were
    commercial billing rates priced based on the private sector market.

    * Unsupported labor costs - $90,000: CMS paid Ketchum for labor costs
    that Ketchum could not support were appropriately allocated to the CMS
    contract. For cost reimbursement contracts, contractors generally
    calculate an employee's hourly labor rate by dividing the employee's
    annual salary by 2,080 hours (the standard number of work hours in a
    year). Ketchum calculated standard hourly labor rates based on 1,880
    hours, which increased the hourly rates to account for employees' leave
    time. However, this calculation method assigned costs for leave time
    regardless of whether the leave was taken (when the actual cost
    occurs). Generally, contractors include the costs of leave time in
    indirect cost rates, which allocate costs proportionally to all
    contracts, and when the indirect cost rates are finalized, billed costs
    are adjusted based on actual costs. Because Ketchum incorporated
    expected leave time in its hourly labor rates, its billings to CMS
    would not be adjusted based on its actual costs. Since we were not able
    to verify that the cost of the leave was appropriately allocated to the
    CMS contracts, we estimated that CMS made almost $90,000 of
    questionable payments as a result of Ketchum using 1,880 hours instead
    of 2,080 to calculate hourly rates. A portion of the $90,000 would
    likely be offset by an increase in indirect costs if Ketchum had
    allocated its leave time to its indirect cost rates.

    Questionable Payments Related to Potential Waste:

    During our review, we identified certain contracting practices that
    increased the risk that CMS did not obtain the best value, thus leading
    to potential waste. Therefore, we question whether certain contract
    costs were an efficient use of government resources or might have been
    avoided. Waste involves the taxpayers in the aggregate not receiving
    reasonable value for money. Importantly, waste involves a transgression
    that is less than fraud and abuse. Most waste does not involve a
    violation of law or regulation but rather relates to mismanagement or
    inadequate oversight. We identified $6.6 million of questionable
    payments for which CMS may not have received the best value. Because
    waste is generally caused by mismanagement or inadequate oversight, the
    total amount of questionable payments we identified may not be
    recoverable from the contractor.

    * Excess subcontractor costs - $1.4 million: CMS missed opportunities
    to save about $1.4 million associated with costs Z-Tech, IBM, and CGI
    billed for subcontractors under T&M contracts. According to DCAA, the
    "T&M payments clause,"[Footnote 57] generally included in T&M
    contracts, required that contractors bill the government for
    subcontractor labor hours at cost. GSA took the position that prime
    contractors should bill for subcontracted labor at the prime
    contractor's own labor rates (regardless of the contractor's cost).
    DCAA stated that such a practice places the government at a greater
    risk of paying costs higher than what prime contractors actually pay
    without receiving any additional benefits. Further, DCAA noted that the
    practice incentivizes contractors to maximize profits by subcontracting
    more work and forces the government to expend additional resources to
    monitor the subcontracted labor.[Footnote 58]

    We noted three instances where CMS allowed prime contractors to bill
    subcontractor labor hours at their own labor rates rather than the
    lower actual cost. For example, IBM paid about $1.1 million for its
    subcontractor labor but billed CMS about $2.0 million, representing an
    increase of about $900,000 or over 80 percent. Likewise, CGI billed CMS
    about $420,000, or about 60 percent, more than the amount CGI paid for
    subcontractor labor and Z-Tech billed CMS about $91,000, or nearly 35
    percent, more than the amount Z-Tech paid for subcontractor labor.
    According to Z-Tech and CGI, they both notified CMS of their plans to
    bill subcontractor labor hours under their own labor rates (rather than
    actual cost) in their contract proposals, which were accepted by CMS.
    Further, because CMS inappropriately issued IBM's T&M contract off a
    commercial contract, as previously discussed, the commercial contract
    did not contain the T&M payments clause. Because CMS did not
    proactively limit the contractor's billings for subcontractor services
    to cost, CMS missed an opportunity to save, in total, about $1.4
    million.

    * Additional costs billed by prime contractors - $4.2 million: CMS paid
    Palmetto and Pearson additional costs due to subcontracting
    arrangements that may have been avoided. As previously mentioned,
    Palmetto and Pearson each had a prime contract with CMS and
    subcontracted with each other for similar services. For Palmetto's
    prime cost reimbursement contract with CMS, Palmetto applied indirect
    costs and fees to the amounts it billed CMS for the subcontracted work
    provided by Pearson, which already included Pearson's indirect costs
    and fees. As a result, two layers of indirect costs and fees were
    applied to the same services. If CMS had not permitted this
    subcontracting relationship, the additional layer of indirect costs and
    fees applicable to Palmetto's billings, totaling $3.6 million,[Footnote
    59] may have been avoided. Likewise, CMS paid Pearson an additional
    $630,000 in fees that may not have been paid absent the subcontract
    agreement.

    * Unallowable costs included in indirect cost rates - $953,000: Prior
    to September 2005, CMS did not require CGI to exclude independent
    research and development (IR&D) costs from its indirect cost rates. The
    HHSAR states that IR&D costs are unallowable;[Footnote 60] however,
    according to CGI, CMS did not incorporate the HHSAR clause into CGI's
    contract. CGI agreed to prospectively revise its indirect cost rates to
    exclude IR&D once they were made aware of the clause. For fiscal year
    2005, CMS paid CGI about $953,000 for IR&D costs that were included in
    CGI's indirect cost rates. We were unable to calculate the financial
    impact prior to fiscal year 2005 because CGI did not separately
    quantify the IR&D component of its indirect rates prior to this point.
    If CMS failed to include this HHSAR clause in other contracts with CGI
    or other contractors, this could result in additional waste.

    Conclusions:

    CMS management has not allocated sufficient resources, both staff and
    funding, to keep pace with recent increases in contract awards and
    adequately perform contract and contractor oversight. This poor
    operating environment created vulnerabilities in the contracting
    process. CMS's preaward contracting practices were driven by expediency
    rather than obtaining the best value and minimizing the risk to the
    government. Likewise, CMS was not proactive in fulfilling its cognizant
    federal agency responsibilities, which not only increased its own risk
    but the risk of other agencies that use the same contractors. Further,
    significant deficiencies in internal controls over contractor payments,
    such as inadequate policies, procedures, and training to guide its
    invoice review process, increased the agency's risk of improper
    payments. By not timely performing contract closeout audits, CMS may
    have missed opportunities to detect and recover improper payments.
    Without immediate corrective actions and appropriate high-level
    management accountability to fix systemic issues, CMS will continue to
    be highly vulnerable to waste and improper payments. Moreover, if these
    issues are not promptly corrected, the Medicare claims administration
    contracting reform called for in MMA will result in billions of
    additional dollars of contracting activities being subject to these
    same deficient contracting practices and internal controls, and
    exacerbate the potential waste and improper payments.

    Recommendations for Executive Action:

    We are making the following nine recommendations to the Administrator
    of CMS to improve internal control and accountability in the
    contracting process and related payments to contractors. We recommend
    that the Administrator take the following actions:

    * Develop policies and criteria for preaward contracting activities
    including (1) appropriate use of competition exemptions such as logical
    follow-on agreements, unusual and compelling urgency, and SBA's 8(a)
    program; (2) analysis to justify contract type selected, as well as, if
    applicable, verification of the adequacy of the contractor's accounting
    system prior to the award of a cost reimbursement contract; and (3)
    consideration of the extent to which work will be subcontracted.

    * Develop policies and procedures to help ensure that cognizant federal
    agency responsibilities are performed, including (1) monitoring CAS
    compliance, (2) a mechanism to track contractors for which CMS is the
    cognizant federal agency, and (3) coordination efforts with other
    agencies.

    * Develop agency-specific policies and procedures for the review of
    contractor invoices so that key players are aware of their roles and
    responsibilities, including (1) specific guidance on how to review key
    invoice elements; (2) methods to document review procedures performed;
    and (3) consideration to circumstances that may increase risk, such as
    contract type or complex subcontractor agreements.

    * Prepare guidelines to contracting officers on what constitutes
    sufficient detail to support amounts billed on contractor invoices to
    facilitate the review process.

    * Establish criteria for the use of negative certification in the
    payment of a contractor's invoices to consider potential risk factors,
    such as contract type, the adequacy of the contractor's accounting and
    billing systems, and prior history with the contractor.

    * Provide training on the invoice review policies and procedures to key
    personnel responsible executing the invoice review process.

    * Create a centralized tracking mechanism that records the training
    taken by personnel assigned to contract oversight activities.

    * Develop a plan to reduce the backlog of contracts awaiting closeout.

    * Review the questionable payments identified in this report to
    determine whether CMS should seek reimbursement from contractors.

    Agency Comments and Our Evaluation:

    In written comments on a draft of this report (reprinted in their
    entirety in appendix III), CMS stated that it would take action on each
    of our recommendations and described steps taken and others planned to
    address our recommendations. At the same time, CMS disagreed with some
    of our findings. Where appropriate, we incorporated changes to our
    report to provide additional clarification.

    In its comments, CMS stated that the contract actions we reviewed were
    not representative of CMS's normal contracting procedures and stated
    that the unique circumstances of the implementation of MMA, including
    the unusually short implementation period, required it to complete an
    unusually large number of contract actions on the basis of other than
    full and open competition. We acknowledge that the time frames for
    implementing MMA added schedule pressures for CMS. At the same time,
    the compressed time frames and the resulting contracting practices
    added risk to the contracting process. Many of the findings in our
    report are a result of the increased risk together with inadequate
    compensating controls to mitigate risk.

    Further, in its comments, CMS disagreed with our finding that it made
    nearly $90 million in questionable payments. CMS also stated its belief
    that it was appropriate for contracting officers to approve invoices
    for payment based on the information provided with the invoices, and
    that the payments were interim payments that would be audited at a
    later date. CMS also stated that the questionable payments we
    identified were based on our review of the contractors' books and
    records rather than the invoice amounts. CMS stated that it is
    premature to conclude that questionable payments exist because it has
    not conducted a detailed audit of the invoices for the contracts in
    question.

    We disagree. We found amounts that were clearly questionable. Our
    report also clearly states that in some cases, due to the facts and
    circumstances involved, we were unable to determine whether or to what
    extent the costs we questioned were allowable, reasonable, and
    allocable. As a result, some portion of the total amount of
    questionable payments we identified ultimately may be determined by CMS
    to be allowable. However, we also state that given CMS's poor control
    environment and the fact that our work was not designed to identify all
    questionable payments made by CMS or to estimate their extent, other
    questionable payments may have been made.

    Further, CMS did not always ensure that contractors provided adequate
    detail supporting the invoices to allow responsible CMS personnel to
    sufficiently review and approve invoices. Regarding contract audits,
    CMS had not demonstrated a willingness to allocate the necessary
    funding; thus audits have not taken place in a timely manner. In
    addition, while we agree that an audit of contract costs can provide a
    detective control to help determine whether contractor costs were
    proper, CMS's reliance on an after-the-fact audit is not an acceptable
    substitute for the real-time monitoring and oversight of contractor
    costs--preventative controls--that we recommend in this report.
    Effective internal control calls for a sound, ongoing invoice review
    process as the first line of defense in preventing unallowable costs
    and improper payments. Finally, many of the questionable payments we
    identified were based on our review of invoices and documentation
    received by CMS at the time of payment and did not require additional
    detail from the contractors' books and records. For example, our
    findings regarding indirect costs, labor categories, and unallowable
    travel costs could have been identified by CMS with an adequate review
    of the invoices and information they received from the contractors.

    In response to our recommendations to improve controls over its
    contracting process and related payments, CMS stated in its comments
    that it has taken or will take the following actions:

    * continue to evaluate and update its policies and procedures to make
    appropriate changes,

    * review its policies and criteria for the use of cost reimbursement
    contracts and the need for approved accounting systems,

    * review and update policies and procedures as appropriate and provide
    training regarding subcontracting,

    * develop appropriate procedures to support HHS in its cognizant
    federal agency functions,

    * update its invoice review and payment policies and procedures as
    necessary,

    * develop comprehensive training on the invoice review and approval
    process,

    * require the use of a governmentwide system to track the training
    taken by personnel assigned to contract oversight,

    * continue to reduce its backlog of contracts awaiting closeout, and:

    * obtain contract audits related to our identified questionable
    payments and seek reimbursement for any costs found to be unallowable.

    In addition, our responses to a number of specific CMS comments are
    annotated and included at the end of appendix III.

    As agreed with your offices, unless you publicly announce its contents
    earlier, we plan no further distribution of this report until 30 days
    from its date. At that time, we will send copies to the Secretary of
    Health and Human Services, Administrator of the Centers for Medicare
    and Medicaid Services, and interested congressional committees. Copies
    will also be available to others upon request. In addition, the report
    will be available at no charge on the GAO Web site at [hyperlink,
    http://www.gao.gov].

    If you or your staffs have any questions about this report, please
    contact me at (202) 512-9471 or franzelj@gao.gov. Contact points for
    our Offices of Congressional Relations and Public Affairs may be found
    on the last page of this report. Major contributors to this report are
    acknowledged in appendix IV.

    Signed by:

    Jeanette M. Franzel:
    Director:
    Financial Management and Assurance:

    [End of section]

    Appendix I: Questionable Payments to Contractors:

    As shown in table 4, we identified numerous questionable payments
    totaling nearly $90 million that represent potentially improper,
    unsubstantiated, or wasteful payments. In some cases, due to the facts
    and circumstances involved, we were unable to determine whether or to
    what extent the costs were allowable, reasonable, and allocable. As a
    result, some portion of the total amount of questionable payments we
    identified ultimately may be determined by the Centers for Medicare and
    Medicaid Services (CMS) to be allowable and therefore not recoverable
    from the contractor. Given CMS's poor control environment and the fact
    that our work was not designed to identify all questionable payments
    made by CMS or to estimate their extent, other questionable payments
    may have been made.

    Table 4: Questionable Payments by Contractor (Dollars in thousands):

    Contractor: BearingPoint;
    Costs not compliant with contract terms: [Empty];
    Unsupported contractor costs: $388;
    Potential waste: [Empty];
    Less overlapping amounts[A]: [Empty];
    Total: $388.

    Contractor: Booz Allen Hamilton, Inc.;
    Costs not compliant with contract terms: $208;
    Unsupported contractor costs: 60;
    Potential waste: [Empty];
    Less overlapping amounts[A]: [Empty];
    Total: 268.

    Contractor: CGI Federal;
    Costs not compliant with contract terms: 1,894;
    Unsupported contractor costs: 5;
    Potential waste: $1,373;
    Less overlapping amounts[A]: $(631);
    Total: 2,641.

    Contractor: International Business Machines, Corp.;
    Costs not compliant with contract terms: 4,720;
    Unsupported contractor costs: [Empty];
    Potential waste: 909;
    Less overlapping amounts[A]: (1,140);
    Total: 4,489.

    Contractor: Iowa Foundation for Medical Care;
    Costs not compliant with contract terms: 23;
    Unsupported contractor costs: 49;
    Potential waste: [Empty];
    Less overlapping amounts[A]: [Empty];
    Total: 72.

    Contractor: Ketchum, Inc.;
    Costs not compliant with contract terms: 9;
    Unsupported contractor costs: 1,324;
    Potential waste: [Empty];
    Less overlapping amounts[A]: (5);
    Total: 1,328.

    Contractor: Maximus, Inc.;
    Costs not compliant with contract terms: 16;
    Unsupported contractor costs: 2;
    Potential waste: [Empty];
    Less overlapping amounts[A]: [Empty];
    Total: 18.

    Contractor: NCS Pearson, Inc;
    Costs not compliant with contract terms: [Empty];
    Unsupported contractor costs: [Empty];
    Potential waste: 630;
    Less overlapping amounts[A]: [Empty];
    Total: 630.

    Contractor: Palmetto GBA;
    Costs not compliant with contract terms: 16,184;
    Unsupported contractor costs: 51,181[B];
    Potential waste: 3,622;
    Less overlapping amounts[A]: (3,304);
    Total: 67,683.

    Contractor: TrailBlazer Health Enterprises, LLC;
    Costs not compliant with contract terms: 1,441;
    Unsupported contractor costs: 9,697;
    Potential waste: [Empty];
    Less overlapping amounts[A]: [Empty];
    Total: 11,138.

    Contractor: ViPS;
    Costs not compliant with contract terms: 10;
    Unsupported contractor costs: [Empty];
    Potential waste: [Empty];
    Less overlapping amounts[A]: [Empty];
    Total: 10.

    Contractor: Z-Tech Corporation;
    Costs not compliant with contract terms: [Empty];
    Unsupported contractor costs: [Empty];
    Potential waste: 91;
    Less overlapping amounts[A]: [Empty];
    Total: 91.

    Contractor: Total;
    Costs not compliant with contract terms: $24,505;
    Unsupported contractor costs: $62,706;
    Potential waste: $6,625;
    Less overlapping amounts[A]: $(5,080);
    Total: $88,756.

    Source: GAO analysis of contractor invoices and data.

    [A] In certain instances, a portion of a questionable payment may fall
    into more than one category (i.e., a payment may be both potential
    waste and not compliant with contract terms). Therefore, to avoid
    double counting questionable payment amounts, we reduced the gross
    questionable payment amount by the overlapping amount ($5.08 million).

    [B] This amount includes $10.2 million of costs that Palmetto could not
    adequately support under its subcontract with NCS Pearson.

    [End of table]

    Because CMS sometimes used other funding sources in addition to
    Medicare Prescription Drug, Improvement, and Modernization Act of 2003
    (MMA) funds to pay invoices for one contract, we were not always able
    to identify specific costs that were paid with MMA funds. As a result,
    the scope of our review extended beyond payments made with MMA funds
    for some contracts and the questionable payments we identified may not
    have been paid solely with MMA funds.

    [End of section]

    Appendix II: Scope and Methodology:

    To determine how the Centers for Medicaid and Medicare Services (CMS)
    used the $1 billion Medicare Prescription Drug, Improvement, and
    Modernization Act of 2003 (MMA) appropriation, we obtained obligation
    and disbursement transactions from CMS's financial systems from the
    period January 2004 through December 2006 that CMS charged against the
    MMA appropriation. We scanned these data files for obvious omissions or
    errors in key data fields. To verify the completeness of the files, we
    reconciled the total obligated amount to the MMA appropriation and
    reconciled the liquidated obligation amount (a field within the
    obligation data file) to the disbursement data totals. To determine the
    recipients of the MMA appropriation, we categorized disbursement data
    by payee category (contractors, government agencies, state government
    agencies, etc.) based upon the vendor name in the file. Because CMS
    recorded about $536 million of its disbursement to one budget object
    code, "other services," we were unable to use CMS's budget object codes
    to determine the services provided by contractors and vendors.
    Therefore, to categorize expenditures to contractors and vendors by
    activity (information technology, 1-800-MEDICARE help line, etc.), we
    reviewed the project titles in CMS's contracts database for all
    contracts[Footnote 61] with total disbursements greater than $1
    million; if the contract title was unclear, we reviewed the statement
    of work in the contract file. We also categorized some additional
    contracts based on our detailed review of selected contractors.

    To identify additional details on the services obtained with MMA funds,
    we (1) analyzed contract files including statements of work, (2)
    analyzed interagency agreements, (3) discussed employee-related costs
    with CMS officials, (4) discussed payments to state agencies with CMS
    officials overseeing the State Health Insurance Assistance Program as
    well as certain state agency officials, and (5) analyzed purchase card
    transaction statements and supporting receipts and discussed these
    purchases with applicable CMS officials.

    To determine whether CMS's contracting practices and related internal
    controls are adequate to avoid waste and to prevent or detect improper
    payments, we interviewed CMS officials including contracting officers,
    contracting specialists, project officers, cost/price team members,
    financial management officials, and Office of Acquisition and Grants
    Management (OAGM) management about oversight responsibilities;
    analyzed contract files and invoices; and assessed the sufficiency of
    CMS policies, procedures, and training. As criteria, we used our
    Standards for Internal Control in the Federal Government[Footnote 62]
    and the Federal Acquisition Regulation (FAR). We focused our internal
    control work on the contractors that received the most MMA funding,
    based on the CMS disbursement data. We also selected contractors with
    other risk factors such as billing or accounting system problems for
    review. Our approach resulted in the selection of 16 contractors. For
    these 16 contractors, we then selected contracts to use for our work
    based on contracts that were funded with at least $1.5 million of the
    MMA appropriation.[Footnote 63] As a result, we nonstatistically
    selected 16 contractors and 67 contracts with a total contract value of
    $1.6 billion. One contract selected was a Medicare contract. Because
    Medicare contracts were not subject to FAR, we did not include this
    contract in our internal control review. Therefore we evaluated CMS
    contracting practices and related internal controls for 66 contracts.
    Additionally, we obtained from CMS information related to oversight
    resources from fiscal year 1997 through 2006, the closeout backlog, and
    its cognizant federal agency duties. We discussed cognizant federal
    agency oversight activities with and obtained documentation such as
    indirect cost rate agreements or audit reports from the National
    Institutes of Health and the Defense Contract Audit Agency.

    To determine whether payments to contractors were properly supported as
    a valid use of government funds, we started with the same 67 contracts
    we had nonstatistically selected. We further refined the list of 67
    contracts based on individual contract values and other risk factors
    such as contract type to arrive at a selection of 47 contracts for
    which we reviewed CMS payments to contractors. Because CMS sometimes
    used other funding sources in addition to MMA to pay invoices for one
    contract, we were not always able to identify specific costs that were
    paid with MMA funds. As a result, the scope of our review extended
    beyond payments made with MMA funds. This nonstatistical selection
    methodology resulted in a selection of CMS payments to contractors
    totaling $595.4 million, of which $355.5 million was paid with MMA
    funds. The following table summarizes the number of contracts and
    amounts of CMS payments to contractors included in our review, as well
    as the amount paid with MMA funds.

    Table 5: Contracts and Amounts Included in Our Review of CMS Payments
    (Dollars in thousands):

    Contractor: BearingPoint;
    Number of contracts reviewed: 5;
    Contract payment amounts: $4,678;
    Amount paid with MMA funds: $4,106.

    Contractor: Booz Allen Hamilton;
    Number of contracts reviewed: 4;
    Contract payment amounts: 7,532;
    Amount paid with MMA funds: 8,185.

    Contractor: CGI;
    Number of contracts reviewed: 6;
    Contract payment amounts: 43,160;
    Amount paid with MMA funds: 25,742.

    Contractor: Computer Sciences Corporation;
    Number of contracts reviewed: 2;
    Contract payment amounts: 23,992;
    Amount paid with MMA funds: 18,877.

    Contractor: IBM;
    Number of contracts reviewed: 2;
    Contract payment amounts: 7,042;
    Amount paid with MMA funds: 9,678.

    Contractor: Iowa Foundation for Medical Care;
    Number of contracts reviewed: 2;
    Contract payment amounts: 19,795;
    Amount paid with MMA funds: 13,544.

    Contractor: Ketchum;
    Number of contracts reviewed: 9;
    Contract payment amounts: 54,442;
    Amount paid with MMA funds: 47,285.

    Contractor: Maximus;
    Number of contracts reviewed: 1;
    Contract payment amounts: 6,317;
    Amount paid with MMA funds: 6,301.

    Contractor: Northrop Grumman;
    Number of contracts reviewed: 4;
    Contract payment amounts: 24,373;
    Amount paid with MMA funds: 16,927.

    Contractor: Palmetto;
    Number of contracts reviewed: 3;
    Contract payment amounts: 182,526;
    Amount paid with MMA funds: 80,158.

    Contractor: Pearson;
    Number of contracts reviewed: 1;
    Contract payment amounts: 180,011;
    Amount paid with MMA funds: 89,893.

    Contractor: Trailblazer;
    Number of contracts reviewed: 2;
    Contract payment amounts: 12,564;
    Amount paid with MMA funds: 7,393.

    Contractor: ViPS;
    Number of contracts reviewed: 2;
    Contract payment amounts: 19,305;
    Amount paid with MMA funds: 18,172.

    Contractor: Z-Tech;
    Number of contracts reviewed: 4;
    Contract payment amounts: 9,634;
    Amount paid with MMA funds: 9,247.

    Contractor: Total;
    Number of contracts reviewed: 47;
    Contract payment amounts: $595,371;
    Amount paid with MMA funds: $355,508.

    Source: GAO analysis of contractor invoices and data.

    [End of table]

    For the 47 contracts, we performed forensic auditing techniques, data
    mining, and document analyses to select contractor costs billed to CMS
    to test. Because we selected individual or groups of transactions for
    detailed testing to determine whether costs were allowable, the amount
    of contract payments we tested was lower than the amount of payments
    included in our review shown in table 5. Following is a description of
    the types of procedures we used to test transactions.

    * Labor costs: We obtained from contractors their databases of hours
    charged to CMS that included detailed information such as employee
    name, hours worked per pay period, and pay rate information. Using this
    information, we selected labor transactions for testing based on
    quantitative factors such as (1) number of hours worked, (2) dollar
    amount billed, (3) labor rates, or (4) anomalies in the data. For these
    nonstatistical selections, we compared the information to supporting
    documentation obtained from the contractor, including time sheets and
    payroll registers and discussed billed amounts with contractor
    officials.

    * Subcontractor, travel, and other direct costs: When contractor
    invoices did not provide sufficient information, we obtained additional
    information from the contractor, such as databases of transaction-level
    detail, to select specific transactions based on criteria such as
    amount billed, vendor names, and potential duplicate payments. We
    compared our nonstatistical selections to applicable supporting
    documentation such as vendor invoices, travel vouchers and receipts,
    and subcontract agreements provided by the contractor.

    * Indirect costs: We verified the appropriateness of indirect costs
    billed by recalculating the amounts and comparing the rates billed to
    provisional and final indirect cost rates and contract ceilings.

    * Analytical procedures: We performed a variety of analytical
    procedures including recalculating invoice line items for mathematical
    accuracy and reviewing invoice amounts for trends and anomalies.

    We questioned payments for costs that were potentially improper by
    assessing whether the costs did not comply with the terms of the
    contract or applicable regulation (FAR, the Health and Human Services
    Acquisition Regulation, and Federal Travel Regulation) or that were
    unsubstantiated because the contractor did not provide adequate support
    for us to determine whether the costs were allowable. In addition, we
    questioned payments for which we had concerns that risks in CMS's
    contracting practices may have resulted in waste. When calculating our
    questionable payment amounts, where applicable for costs not compliant
    with contract terms and regulations we added the respective indirect
    costs that the contractor charged on the item in question. For some of
    the questionable payments we identified, a portion of the cost is most
    likely appropriate; however, because of certain facts and circumstances
    involved, we were unable to determine whether or to what extent the
    costs were allowable, reasonable, and allocable. Therefore, we
    questioned the entire amount associated with the uncertainties.

    Because CMS sometimes used other funding sources in addition to MMA to
    pay invoices, the scope of our review extended beyond the payments made
    with MMA funds. Therefore, questionable payment amounts do not relate
    exclusively to MMA funds. While we identified some payments as
    questionable, our work was not designed to identify all questionable
    payments or to estimate their extent.

    We provided CMS a draft of this report for review and comment. CMS
    provided written comments, which are reprinted in appendix III of this
    report. We also discussed with CMS contractors any findings that
    related to them. We conducted this performance audit in accordance with
    generally accepted government auditing standards. Those standards
    require that we plan and perform the audit to obtain sufficient,
    appropriate evidence to provide a reasonable basis for our findings and
    conclusions based on our audit objectives. We believe that the evidence
    obtained provides a reasonable basis for our findings and conclusions
    based on our audit objectives. We conducted our audit work in
    Washington D.C. and Baltimore, Maryland from March 2006 through
    September 2007.

    [End of section]

    Appendix III: Comments from the Centers for Medicare and Medicaid
    Services:

    [Note: GAO comments supplementing those in the report text appear at the
    end of this appendix]

    Department Of Health & Human Services:
    Centers for medicare & Medicaid Services:
    Office of the Administrator:
    Washington, DC 20201:

    Date: November 6, 2007:

    TO: Jeanette Franzel:
    Director:
    Financial Management and Assurance:
    Government Accountability Office:

    From: Kerry Weems: [signature included]
    Acting Administrator:

    Subject: Government Accountability Office Draft Report: "Internal
    Control Deficiencies Resulted in Millions of Dollars of Questionable
    Contract Payments," (GAO-08-54):

    Thank you for the opportunity to review and comment on the draft
    Government Accountability Office (GAO) report. The Centers for Medicare
    & Medicaid Services (CMS) appreciates the insights GAO provides
    regarding CMS' contracting processes and procedures.

    The CMS awards and administers contracts in full compliance with
    applicable statutes and regulations. We further conduct our contracting
    operations with the highest degree of integrity.

    While our agency will take action on each of the nine GAO
    recommendations, we assert that the contract actions reviewed by GAO
    are not, in fact, representative of CMS' normal contracting procedures.
    The unique circumstances of the implementation of the MMA dictated
    approaches that are not part of our current contracting procedures.
    Recognizing the unusually short implementation period, Congress gave
    CMS the authority to deviate from our usual practices. In fact, 2007
    CMS has been exemplary in its use of competitive contracts. [See
    comment 1 and 2]

    Moreover, we disagree with GAO's conclusion that $90 million in
    questionable payments were made to contractors. As we will discuss, CMS
    has not performed incurred cost audits of the contracts in question nor
    made a final determination as to the amount of payments owed to the
    contractors. [See comment 1]

    In conducting its review, GAO examined a very small sample of CMS'
    contract actions required to meet the mandates of the Medicare
    Prescription Drug, Improvement, and Modernization Act of 2003 (MMA),
    Pub. L. No. 108-173 (Dec. 8, 2003). There were many unique factors that
    affected MMA contracting actions during calendar years 2004 and 2005,
    when the Agency was establishing the prescription drug program and
    implementing other requirements of the MMA. [See comment 3]

    In the "Conclusion" section of the report, GAO suggests that if the
    problems noted in its report are not promptly corrected, there may be
    issues with the Medicare claims administration contracting reform
    called for in the MMA. The Medicare Administrative Contracts (MAC),
    which are being awarded on the basis of full and open competition in
    accordance with the requirements of section 911 of the MMA, fully
    comply with all applicable statutes and regulations. Safeguards have
    been put into place to assure that payments to the MACs are
    appropriate, and that these contracts are administered in strict
    accordance with applicable contracting requirements.

    With respect to the recommendations contained in GAO's draft report, we
    are providing the following responses:

    GAO Recommendation Number 1:

    Develop policies and criteria for pre-award contracting activities
    including (1) appropriate use of competition exemptions such as logical
    follow-on agreements, unusual and compelling urgency, and SBA's 8(a)
    program; (2) analysis to justify contract type selected, as well as, if
    applicable, verification of the adequacy of the contractor's accounting
    system prior to the award of a cost reimbursement contract; and (3)
    consideration of the extent to which work will be subcontracted.

    CMS Response:

    (1) The first recommendation, regarding the appropriate use of
    competition exemptions, stems from GAO's finding that a large
    percentage of contract actions necessary to implement the MMA were
    awarded on a noncompetitive basis. Admittedly, CMS was required to
    complete an unusually large number of contract actions, necessary to
    meet MMA requirements, on the basis of other than full and open
    competition. Many of these contract actions were required to implement
    the prescription drug program. This is an extremely large and complex
    program. Congressionally mandated dates for the implementation of MMA
    requirements did not afford CMS sufficient time to compete contracts. A
    prime example is when CMS had to develop new applications to meet
    information technology needs. There simply was not sufficient time to
    develop entirely new systems and applications. Therefore, CMS found it
    necessary to modify existing systems and applications in order to
    develop the information technology infrastructure required for the
    prescription drug program.

    Congress recognized the extraordinary circumstances under which CMS
    would have to award the contracts necessary to implement the programs
    established in the MMA. Therefore, Congress specifically provided, in
    section 1857(c)(5) that: [See comment 2]

    Contracting Authority � The authority vested in the Secretary by this
    part may be performed without regard to such provisions of law or
    regulations relating to the making, performance, amendment, or
    modification of contracts of the United States as the Secretary may
    determine to be inconsistent with the furtherance of this title.

    The CMS developed a policy for the use of the authority in section
    1857(c) to enter into a Medicare Advantage Contract on the basis of
    other than full and open competition. That policy provided that CMS
    would only rely upon section 1857(c) 5) if no exceptions to competition
    under the Federal Acquisition Regulations (FAR) supported a
    noncompetitive contract award. CMS did not find it necessary to award
    any Medicare Advantage Contracts pursuant to the authority of section
    1857(c)(5) because the FAR provided authority for the noncompetitive
    contract actions required to implement the MMA.

    On page 23 of the draft report, GAO states "that about 45 percent of
    the contracts included in our review (representing about $499.1 M in
    total contract value) were awarded without the benefit of competition."
    In fiscal year (FY) 2007, CMS executed 2,489 contract actions resulting
    in the obligation of $1.943 billion. Twenty-one of these contracts were
    awarded on a non-competitive basis under FAR Part 6 in the total amount
    of $255 million. Hence, less than 1 percent of CMS' contract actions
    and approximately 13 percent of the contracted dollars, were awarded on
    a noncompetitive basis, under FAR Part 6 in FY 2007. For FY 2008, the
    Department has established a goal that at least 75 percent of awarded
    dollars, or 60 percent of contract actions, be processed on the basis
    of competition. CMS substantially exceeds these goals. Indeed, CMS has
    an exceptional record for awarding contracts on the basis of full and
    open competition. [See comment 4]

    On page 25 of the draft report, GAO also states, "About 24 percent of
    the contracts and task orders in our review, with a total value of
    nearly $390 million, were issued with no competition as a logical
    follow-on to a prior task order." In FY 2007, CMS only awarded 10 task
    orders as a logical follow-on, which is .004 percent of all contract
    actions, in the total amount of $2.3 million, or approximately 1
    percent of the total dollars obligated. The extent of use of logical
    follow-on task orders to implement the MMA in the contracts sampled is
    not indicative of CMS' award of logical follow-on task orders in
    general. [See comment 4]

    In addition, GAO recommends that CMS develop policies and criteria for
    the award of contracts pursuant to the Small Business Administration's
    8(a) program. CMS is required to utilize small disadvantaged businesses
    in the 8(a) program to the maximum extent possible. The Department of
    Health and Human Services (DHHS) has established a goal that CMS award
    5.5 percent of its total contract dollars to 8(a) firms, and there is
    an expectation that CMS will significantly exceed that goal. The 8(a)
    program is the cornerstone of the Government's initiatives for
    increasing small business participation in Government contracting.
    Thus, pursuant to the authority of the 8(a) program, we are required to
    award contracts to small and disadvantaged businesses to the maximum
    possible extent.

    The fundamental procedures for the award of non-competitive contracts
    are contained in the FAR and the Department of Health and Human
    Services Acquisition Regulation (HHSAR). We also have in place CMS-
    specific procedures for use of competition exemptions. For example,
    Justifications for Other Than Full and Open Competition (JOFOC), which
    are based upon unusual and compelling circumstances, must be reviewed
    by the Office of the General Counsel to ensure they are legally
    sufficient. In addition, CMS' Competition Advocate reviews and approves
    all JOFOCs over $500,000. These measures provide added safeguards to
    assure that CMS awards contracts on the basis of competition to the
    maximum possible extent.

    We agree with GAO that the award of contracts on a competitive basis is
    essential to assuring the integrity of the contracting process.
    Therefore, we will continue to evaluate and update our policies and
    procedures and make appropriate changes. We will also address
    competitive contracting requirements in our training to assure that
    CMS' acquisition workforce is fully aware of the requirements for the
    competitive award of contracts.

    (2) On page 25 of the draft report GAO states: "We found that about 78
    percent of the contracts we reviewed were cost reimbursement contracts.
    These cost reimbursement contracts had a total contract value of $1.2
    billion." However, for the contracts in question, CMS had to utilize
    cost-reimbursement contracts. [See comment 5]

    The FAR section 16.202 states that a firm-fixed-price contract is
    appropriate for supplies or services which are to be acquired on the
    basis of "reasonably definite functional or detailed specifications."
    The prescription drug program was an entirely new initiative. CMS had
    no prior experience with this program. CMS did not have extensive
    expertise among its staff for implementing the prescription drug
    program. CMS could not develop statements of work for MMA requirements
    that were definite enough to allow for a fixed-price contract. In FY
    2007, approximately 30 percent of CMS contract actions, accounting for
    just over 50 percent of the total dollars awarded, were for cost-
    reimbursement type contracts. Given the constant changes associated
    with the Medicare program, and the difficulty in precisely defining the
    Agency's needs, we believe these figures show that CMS employs cost-
    reimbursement type contracts to an appropriate extent.

    On page 26 of the draft report, GAO notes instances where it believes
    CMS awarded contracts to entities that did not have an acceptable
    accounting system. In fact, based upon past audits by the Defense
    Contract Audit Agency (DCAA), CMS believes that the contractors in
    question, including Palmetto, IFMC, Ketchum, NCS Pearson, Trailblazer,
    and ViPS, did have acceptable accounting systems. Hence, the
    information in the chart on page 20, to the effect that these
    contractors did not have approved accounting systems, is not accurate.
    CMS Contracting Officers are sensitive to the requirement that a
    contractor have an acceptable accounting system prior to being awarded
    a cost reimbursement contract. [See comment 6]

    The use of the correct contract type is critical to the award of a
    contract, as is assuring that a contractor has an approved accounting
    system. Therefore, in response to GAO's recommendations, we intend to
    review our policies and criteria for the use of cost reimbursement
    contracts and the need for approved accounting systems and will update
    those polices as necessary. We will also provide appropriate training
    to CMS staff.

    (3) With respect to subcontracted work, CMS awarded contracts that
    resulted in extensive subcontracting efforts because the skills
    required to perform the work were not readily available from a single
    contractor. GAO questioned the utilization of subcontractors under
    certain CMS contracts. For example, on page 27 of the draft report, GAO
    indicates that under a task order with Ketchum, 97 percent of the total
    costs went to subcontractors. The report further questions the level of
    profit paid to Ketchum.

    However, a principal purpose of the task order was to secure television
    advertising time for the Medicare education campaign. Hence, this work
    had to be subcontracted. Television advertising requires upfront
    payments. Ketchum financed millions of dollars to make certain that
    CMS' advertisements ran on network and cable television. Ketchum,
    therefore, assumed an inordinate amount of costs in disbursing funds
    for television advertising on the Government's behalf, as well as risk
    in performing this work. The fact that Ketchum financed these millions
    of dollars and oversaw the process of getting the ads to the airwaves
    was the rationale for determining that a 2 percent profit factor for
    subcontracted work was fair and reasonable.

    The GAO also questioned subcontracting arrangements between Pearson and
    Palmetto for the operation of the Medicare call center. However, the
    volume of calls received from beneficiaries increased exponentially as
    a result of the implementation of the prescription drug and Medicare
    Advantage programs. It was necessary for Pearson and Palmetto to work
    in tandem and to balance calls between their respective operations in
    order to provide acceptable service to the public.

    We appreciate the importance of assuring that contract work is
    performed appropriately and that profits are not excessive. We will
    therefore review and update our policies and procedures regarding the
    review and approval of subcontracts as appropriate. We will also
    provide training to staff on subcontracting requirements.

    GAO Recommendation Number 2:

    Develop policies and procedures to govern CMS' cognizant federal agency
    responsibilities, including (1) monitoring CAS compliance, (2)
    mechanism to track contractors for which CMS is the cognizant federal
    agency, and (3) coordination efforts with other agencies.

    CMS Response:

    We agree that processes and procedures for performance of cognizant
    Federal agency responsibilities need to be strengthened. We have had
    ongoing discussions with DHHS regarding audit cognizance. Section
    42.003 of the FAR provides that "the cognizant Federal agency normally
    will be the agency with the largest dollar amount of negotiated
    contracts." Based upon discussions with DHHS, we understand that DHHS
    is the "cognizant Federal agency." CMS is an Operating Division of DHHS
    and is not a "Federal agency." Hence, CMS cannot independently perform
    cognizant Federal agency contracting functions. [See comment 7]

    Part of the confusion surrounding audit cognizance stems from section
    342.705 of the HHSAR, which provides that "The Division of Financial
    Advisory Services of the National Institutes of Health has the
    authority to establish indirect cost rates, fringe benefit rates, etc.,
    for use in contracts and grants awarded to commercial organizations."
    To date, NIH generally has not been able to perform this function.

    Therefore, we recognize the need to work with DHHS to establish
    policies and procedures for the performance of cognizant Federal agency
    functions. To the extent that CMS is designated to perform functions in
    supporting DHHS as the cognizant Federal agency, we will develop
    appropriate procedures for monitoring Cost Accounting Standard (CAS)
    compliance and for coordinating efforts with other agencies.

    GAO Recommendation Number 3:

    Develop agency-specific policies and procedures for the review of
    contractor invoices so that key players are aware of their roles and
    responsibilities, including (1) specific guidance on how to review key
    invoice elements; (2) methods to document review procedures performed;
    and (3) consideration to circumstances that may increase risk, such as
    contract type or complex subcontractor agreements.

    CMS Response:

    The CMS Acquisition Policy Number 16, entitled "Invoice Payment
    Procedures," was issued in August 2005. The purpose of this Acquisition
    Policy was to promulgate specific policies and procedures for invoice
    review and payment. CMS will review Acquisition Policy Number 16 and
    will amend its policies and procedures as necessary to assure that key
    players understand their roles and responsibilities. Also, CMS is
    coordinating with the Department in the sharing of "best practices"
    which may lead to the development of Department-wide standardized
    policies and procedures for invoice review and payment. We recently
    provided comprehensive training to CMS Project Officers regarding
    invoice review and will continue our efforts to train both Project
    Officers and Office of Acquisition and Grants Management contracting
    staff. [See comment 8]

    It should be noted, however, that with respect to our most significant
    contracts, such as contracts with the MACs, Program Safeguard
    Contractors, Quality Improvement Organizations, and Qualified
    Independent Contractors, as well as the Health Insurance General Ledger
    Accounting System, the contact center and significant IT contracts, we
    have established very comprehensive processes and procedures for the
    review and approval of invoices. We have gone so far as to develop
    software that is used to analyze the invoices under most of these
    contracts. A preponderance of the funds that CMS obligates to contracts
    is expended under these major contracting efforts.

    GAO Recommendation Number 4:

    Prepare guidelines to contracting officers on what constitutes
    sufficient detail to support amounts billed on contractor invoices to
    facilitate the review process.

    CMS Response:

    As stated above, CMS will review its current invoice review policies
    and procedures and will make appropriate revisions. Moreover, CMS
    intends to develop a guide for both Project Officers and Contracting
    Officers for the review and approval of contractor invoices. This will
    provide for more consistency in the review of invoices.

    GAO Recommendation Number 5:

    Establish criteria for the use of negative certification in the payment
    of contractor's invoices to consider potential risk factors, such as
    contract type, the adequacy of the contractor's accounting and billing
    systems, and prior history with the contractor.

    CMS Response:

    The negative certification process was established to assure that CMS
    would meet the requirements of the Prompt Payment Act. Under this
    process, Project Officers and Contracting Officers were nonetheless
    required to thoroughly review invoices. We are constantly providing
    training and direction to Project Officers and Contracting Officers
    assure that they review invoices appropriately. We recognize, however,
    that absent documentation supporting the approval of invoices, there is
    no evidence to support the extent and appropriateness of invoice review
    and approval. Therefore, we intend to revise our procedures to develop
    a documentation trail that will support that an invoice was
    appropriately reviewed and may properly be paid.

    GAO Recommendation Number 6:

    Provide training on the invoice review policies and procedures to key
    personnel responsible for executing the invoice review process.

    CMS Response:

    As previously mentioned, we intend to develop comprehensive training
    for Project Officers and Contracting Officers on invoice review
    policies and procedures. A training session was held recently on
    October 16, 2007, which was attended by approximately 300 Project
    Officers. The training addressed the review and approval of invoices.

    GAO Recommendation Number 7:

    Create a centralized tracking mechanism that records the training taken
    by personnel assigned to contract oversight activities.

    CMS Response:

    A Government-wide system was recently established for tracking the
    training taken by personnel assigned to contract oversight activities.
    The Acquisition Career Management Information System (ACMIS) is a
    centralized tracking mechanism used by all Federal agencies for
    maintaining the training records of personnel assigned to contract
    oversight activities. ACMIS provides a database on the training,
    education, certification, and other information on an agency's
    acquisition workforce including both Project Officers and Contracting
    Officers. Use of ACMIS is mandatory for all CMS Project Officers and
    contracting staff.

    GAO Recommendation Number 8:

    Develop a plan to reduce the backlog of contracts awaiting closeout.

    CMS Response:

    The CMS developed a plan for reducing the backlog of contracts awaiting
    closeout and successfully implemented the plan in FY 2007. It proved to
    be a very effective strategy for reducing CMS' backlog of contracts
    awaiting closeout. At the beginning of FY 2007, CMS had 590 contracts
    that were overdue for closeout. By the end of FY 2007, CMS had reduced
    the number of contracts overdue for closeout to 407. This was a 30
    percent reduction in contracts that were overdue for closeout. In FY
    2008, CMS fully expects to continue this trend and further reduce the
    backlog.

    GAO Recommendation Number 9:

    Review the questionable payments identified in this report to determine
    whether CMS should seek reimbursement from contractors.

    CMS Response:

    This recommendation stems from GAO's finding that CMS made nearly $90
    million in questionable payments to contractors. We disagree with this
    finding. The contracts in question were cost-reimbursement contracts.
    The payments to the contractors were interim payments under those
    contracts. The payments were made strictly on the basis of the
    contractor invoices and the documentation provided in connection with
    those invoices. Based upon the information the contractors provided in
    support of the payments, it was entirely appropriate for the
    Contracting Officers to approve the invoices for payment. [See comment
    1]

    GAO found that the payments were questionable not based upon its review
    of the invoices, which served as the Contracting Officers' basis for
    the approval of the interim payments, but instead based its review upon
    the contractors books and records. CMS will obtain audits of all costs
    claimed for reimbursement under these contracts and will obtain the
    repayment of any costs that are found to be unallowable. It is
    premature to conclude that CMS has made any questionable payments, as
    there has not yet been a determination of the proper amount of
    reimbursement under these contracts. [See comment 1]

    In fact, it is entirely likely that most of the contractors invoiced
    costs will be found to be allowable. Specifically, on page 36 of the
    draft report, GAO questioned $16.2 million in indirect costs paid to
    Palmetto on the basis that the costs exceeded the contract ceiling
    rates. On pages 39-40 of the draft report, GAO questioned $40.6 million
    that was paid to Palmetto but GAO found that there were issues with
    Palmetto's ability to record and bill costs. These two cost elements
    comprise more than over 60 percent of the costs which GAO questioned.

    The questioned costs were incurred in the performance of Palmetto's
    call center contract. This contract was critical to the successful
    implementation of MMA. Palmetto served as one of the main sources of
    information for Medicare beneficiaries regarding the prescription drug
    benefit and the Medicare Advantage program. The Contracting Officer had
    documentation from DCAA finding Palmetto's accounting system to be
    adequate for the award of a cost-reimbursement contract. In performing
    this contract, Palmetto was in the process of converting from the
    accounting practices under its Medicare intermediary and carrier
    contracts to an accounting system that complied with the Cost
    Accounting Standards (CAS). In making the conversion to a CAS compliant
    system, costs that were previously charged directly under the
    intermediary and carrier contracts were moved into indirect cost pools,
    and other changes were made to Palmetto's methodologies for
    accumulating and reporting costs.

    The Contracting Officer was aware of the transition that Palmetto was
    undergoing in becoming CAS compliant and was working in good faith to
    assist Palmetto in making the conversion to CAS. The Contracting
    Officer reviewed the invoices, in concert with program staff, and
    approved the payments based upon the information presented in the
    invoice. The conversion to a CAS compliant system does not mean that
    the charges to the contract were inappropriate. CMS will audit the
    costs incurred by Palmetto and will finalize indirect cost rates for
    the periods in question for both contractors, and will recoup any costs
    that are determined to be unallowable.

    On page 42 of the draft report, GAO indicates that Trailblazers did not
    provide adequate documentation to support $10.3 million of invoiced
    costs. However, the Contracting Officer has been addressing this issue
    with Trailblazers, and believes that, in fact, Trailblazers does have
    documentation in support of these costs. Hence, we do not believe that
    these costs are questionable.

    In other instances where CMS was aware that a contractor had billed
    inappropriate amounts to its contracts, CMS took action to recover
    amounts erroneously billed. For example, when CMS became aware of a
    MAXIMUS' billing in excess of the indirect ceiling rates specified in
    the contract as is discussed on page 36 of the draft report, CMS
    immediately issued a demand letter to MAXIMUS requesting reimbursement
    of the inappropriately charged amount. [See comment 9]

    In sum, we intend to review all of the contractor costs that have been
    questioned in the report in the course of our audits of the
    contractors, and to seek reimbursement as appropriate. However, CMS
    appropriately approved the interim payments under the contracts in
    question.

    Thank you again for your review of CMS' MMA-related contract actions.
    In response to GAO's recommendations, we will review and amend our
    processes and procedures, as appropriate. We will further assure that
    CMS contracting staff receives appropriate training on such policies
    and procedures.

    [End of Comments from CMS]

    GAO Comments:

    1. See "Agency Comments and Our Evaluation" section.

    2. The contracting authority CMS referred to (Section 1857(c)(5))
    applies specifically to Medicare Advantage contracts (formerly referred
    to as Medicare+Choice contracts) and prescription drug plan contracts
    and does not apply to the types of contracts included in our review.

    3. As stated in our report, CMS paid $735.4 million of its MMA funds
    for start-up administrative costs to contractors and vendors. Our
    review included 67 contracts with a total contract value of $1.6
    billion, of which $508.4 million was paid with MMA funds. Our sample
    covered about 69 percent of the MMA funds paid to contractors and
    vendors.

    4. CMS compared the percentages of noncompetitively awarded and logical
    follow-on task orders that were included in our review to statistics it
    calculated for its 2007 contracting actions. The percentages related to
    our review are not comparable to the statistics CMS presented primarily
    because the percentages were calculated differently. Our percentages
    were based solely on the number of contracts in our review and included
    several years. Our calculation showed that 45 percent of contracts in
    our review were awarded without the benefit of competition. CMS used
    fiscal year 2007 contracts, which were outside the scope of our review,
    to arrive at a total of $255 million awarded on a noncompetitive basis
    for that fiscal year. Furthermore, CMS calculated the percentage of
    noncompetitive awards for fiscal year 2007 by comparing the number of
    noncompetitive contracts to the total number of contract actions.
    Contract actions likely include contract modifications, and one
    contract could have several modifications. For example, one of the
    large information technology contracts in our review had over one
    hundred modifications (contract actions).

    5. CMS stated that it had to use cost reimbursement contracts because
    MMA was an entirely new initiative. We present the statistics about
    cost reimbursement contracts to add perspective due to the increased
    risk associated with these types of contracts.

    6. As stated in our report, CMS awarded cost reimbursement contracts to
    Palmetto despite CMS's own cost/price team's determination that the
    contractor had numerous accounting system deficiencies. The chart CMS
    referred to is our summary of CMS's fulfillment of its cognizant
    federal agency responsibilities. The chart illustrates instances in
    which CMS did not sufficiently assess the adequacy of the contractor's
    accounting system. The chart is not intended to present a conclusion
    about the adequacy of the contractors' accounting systems.

    7. Because certain cognizant federal agency oversight responsibilities
    at HHS were assigned to CMS, as discussed in our report, we believe it
    is CMS's obligation to ensure that those responsibilities are
    performed. In addition, we added wording to our report to clarify that
    we refer to CMS as the cognizant federal agency in this report because
    HHS delegated cognizant federal agency responsibilities to CMS.

    8. We modified our report to clarify that we reviewed CMS's Acquisition
    Policy - 16 Subject: Invoice Payment Procedures, August 2005.

    9. CMS issued the demand letter to Maximus as a result of our
    preliminary audit findings.

    [End of section]

    Appendix IV: GAO Contact and Staff Acknowledgments:

    GAO Contact:

    Jeanette Franzel, (202) 512-9471, or franzelj@gao.gov:

    Acknowledgments:

    Staff members who made key contributions to this report include: Marcia
    Carlsen (Assistant Director), Richard Cambosos, Timothy DiNapoli, Abe
    Dymond, Janice Friedeborn, Leslie Jones, Jason Kelly, Steven Koons,
    John Lopez, Meg Mills, Kara Patton, Ronald Schwenn, Omar Torres, Ruth
    Walk, and Doris Yanger.

    [End of section]

    Footnotes:

    [1] Pub. L. No. 108-173, 117 Stat 2066 (Dec. 8, 2003).

    [2] An obligation is a definite commitment that creates a legal
    liability of the government for the payment of goods and services
    ordered or received. Payment may be made immediately or in the future.

    [3] Waste involves the taxpayers in the aggregate not receiving
    reasonable value for money. Importantly, waste involves a transgression
    that is less than fraud and abuse. Most waste does not involve a
    violation of law or regulation but rather relates to mismanagement or
    inadequate oversight.

    [4] Improper payments include duplicate payments and miscalculations;
    payments for goods or services not rendered; payments resulting from
    fraud or abuse; or payments for unallowable costs (contractor costs
    that are not allowed under a term or condition of the contract or
    pursuant to applicable regulation).

    [5] GAO, Standards for Internal Control in the Federal Government, GAO/
    AIMD-00-21.3.1 (Washington, D.C.: November 1999).

    [6] 48 C.F.R. ch. 1.

    [7] For the purposes of this report, the term "contract" is generally
    used to refer to both contracts and task orders issued under contracts.
    We use the term "task order" when we discuss an issue or a requirement
    that applies just to a task order and not to the underlying contract.

    [8] Data mining applies a search process to a data set, analyzing for
    trends, relationships, and associations. For instance, it can be used
    to efficiently query transaction data for characteristics that may
    indicate potentially improper activity.

    [9] Forensic auditing refers to techniques used to apply increased
    scrutiny to the facts and circumstances (including judgments made and
    actions taken by individuals party to the transaction) surrounding
    potentially fraudulent, improper, and abusive transactions.

    [10] Questionable payments include payments for costs that we
    determined to be potentially unallowable or lack the support necessary
    to determine whether they are allowable under applicable laws,
    regulations, and the terms and conditions of the contract. Questionable
    payments also include payments for which we had concerns that risks in
    CMS's contracting practices resulted in potential waste.

    [11] Subch. IV of ch. 4 of title 41, United States Code.

    [12] 48 C.F.R. ch. 99. These standards are mandatory for use by all
    executive agencies and by contractors and subcontractors in estimating,
    accumulating, and reporting costs in connection with pricing and
    administration of, and settlement of disputes concerning, all
    negotiated prime contract and subcontract procurements with the U.S.
    government in excess of $500,000. Certain contracts or subcontracts are
    exempt from CAS, such as those that are fixed price or those with a
    small business. Additionally, contractors that received less than $50
    million in net awards in the prior accounting period are subject to
    only certain CAS standards, known as modified coverage.

    [13] 48 C.F.R. ch. 3.

    [14] 48 C.F.R. 352.216-72(b)(3).

    [15] 48 C.F.R. 2.101.

    [16] 48 C.F.R. 2.101, 30.202-7, 42.003, 42.101(a)(2), and 9903.202-6.

    [17] 48 C.F.R. 2.101. An indirect cost rate is the percentage or dollar
    factor that is used to allocate costs not directly identified with a
    single final cost objective, such as a contract. Employee fringe
    benefits, general and administrative costs, and overhead are examples
    of indirect cost rates.

    [18] One contract included in our review of payments to contractors was
    a Medicare claims administration contract. For this contract, we
    focused only on the portion of the contract funded by MMA, which
    related to provider customer service activities that were required by
    MMA.

    [19] Because this amount only represented 2.5 percent of the total MMA
    appropriation, we did not include this $25 million in our review.

    [20] The $67 million that was not expended as of December 2006
    primarily represents amounts obligated to contracts, but not yet paid.

    [21] Fiscal intermediaries administer Medicare claims paid to hospitals
    and other institutions, such as home health agencies.

    [22] Carriers administer the majority of Medicare claims for the
    services of physicians and other healthcare providers.

    [23] In December 2004, we reported on the information being provided to
    beneficiaries through the Medicare help line on eligibility,
    enrollment, and benefits. See GAO, Medicare: Accuracy of Responses from
    the 1-800-MEDICARE Help Line Should be Improved, GAO-05-130
    (Washington, D.C.: Dec. 8, 2004).

    [24] In May 2006, we reported on the quality of CMS's communications on
    the Part D benefit, including communication through the 1-800-MEDICARE
    help line. See GAO, Medicare: Communications to Beneficiaries on the
    Prescription Drug Benefit Could be Improved, GAO-06-654 (Washington,
    D.C.: May 3, 2006).

    [25] 48 C.F.R. 42.703-1 and 42.704(a).

    [26] 48 C.F.R. 2.101, 30.202-7, 42.003, 42.101(a)(2), and 9903.202-6.

    [27] 48 C.F.R. 9903.201-7.

    [28] These eight contractors were IFMC; Ketchum, Inc.; Maximus;
    Pearson; Palmetto; TrailBlazer Health Enterprises, LLC (TrailBlazer);
    ViPS; and Z-Tech. CMS became the cognizant federal agency for Maximus
    in 2005 and Pearson in 2006.

    [29] This total dollar amount reflects only the value of the contracts
    included in our review. The total contract value for which CMS is the
    cognizant federal agency is substantially higher and would include
    other contracts at CMS not included in our review as well as contracts
    at other agencies.

    [30] 48 C.F.R. 9903.201-7 (b).

    [31] The seven contractors subject to CAS were IFMC; Ketchum; Maximus;
    Pearson; Palmetto; TrailBlazer, and ViPS. According to IFMC, Ketchum,
    and TrailBlazer, they were subject to modified CAS.

    [32] In addition to these allocated resources, OAGM management told us
    that it can obtain additional funds from CMS program offices to fund
    specific audits. For fiscal years 2005 through 2007, program offices
    provided about $2.3 million, of which $1.1 million was related to
    contracting reform activities in fiscal year 2007. CMS also obtained
    about $735,000 for fiscal years 2006 and 2007 from the HHS Office of
    Inspector General for audits that may impact more than one HHS agency.

    [33] Contract management at the Departments of Defense and Energy and
    the National Aeronautics and Space Administration is on GAO's high-risk
    list, which identifies areas in the federal government with greater
    vulnerability to fraud, waste, abuse, and mismanagement. See GAO, High-
    Risk Series: An Update, GAO-07-310 (Washington, D.C.: January 2007) and
    GAO, Federal Acquisition and Contracting: Systemic Challenges Need
    Attention, GAO-07-1098T (Washington, D.C.: July 17, 2007).

    [34] 48 C.F.R. Part 6.

    [35] 48 C.F.R. Subpart 15.4.

    [36] 48 C.F.R. Part 6.

    [37] SBA's 8(a) program is a program for developing small businesses
    owned by socially and economically disadvantaged individuals.
    Contracting officers can award contracts below certain dollar
    thresholds to 8(a) firms without competition.

    [38] 48 C.F.R. 6.302-2(c).

    [39] 48 C.F.R. 16.505(b)(2)(iii).

    [40] 48 C.F.R. 16.301-3(a)(2).

    [41] 48 C.F.R. 16.104(h) and 16.301-3(a)(1).

    [42] Based on Pearson's invoices, Pearson did not apply indirect costs
    to the Palmetto services included in its invoices.

    [43] Acquisition Policy - 16 Subject: Invoice Payment Procedures,
    August 2005.

    [44] Under the Prompt Payment Act and its implementing regulations, an
    agency's payment due date for paying an invoice without incurring an
    interest penalty is generally 30 days after the agency's receipt of a
    proper invoice (5 C.F.R. �1315.4(f), (g)).

    [45] 48 C.F.R. 16.

    [46] 48 C.F.R. 4.804.

    [47] 48 C.F.R. 4.804-1(2), (3), and (4).

    [48] 48 C.F.R. 12.207 (2006).

    [49] 48 C.F.R. 2.101.

    [50] 48 C.F.R. 4.703.

    [51] 48 C.F.R. 16.104(h) and 16.301-3(a)(1).

    [52] According to Palmetto's Chief Financial Officer, in June 2005
    Palmetto changed its accounting structure in response to MMA (meaning
    the requirement for Medicare claims administration contractors to
    adhere to FAR requirements) and the need to be CAS compliant.

    [53] This $34.5 million of questionable payments related to unsupported
    indirect costs does not include amounts related to overhead that were
    questioned as costs not compliant with the terms of the contract.

    [54] 48 C.F.R. 42.705-1(b).

    [55] This $4.8 million of questionable payments related to unsupported
    costs does not include amounts related to indirect costs that were
    questioned as costs not compliant with the terms of the contract.

    [56] TrailBlazer, a Medicare contractor that administers claims on
    behalf of CMS, received a portion of the MMA funds to assist with
    provider customer service as required by MMA. Medicare contractors,
    including TrailBlazer, receive advance funding based on budgeted
    amounts. Three months after the end of a fiscal year, a cost report is
    submitted to CMS that summarizes actual costs and serves as the basis
    for final determination of allowable costs.

    [57] 48 C.F.R. 52.232-7.

    [58] The FAR was revised in February 2007 to allow contractors, in
    certain circumstances such as when the contract was fully competed or
    was for commercial services, to bill subcontractor labor hours at the
    contractor's own labor rates. See GAO, Defense Contracting: Improved
    Insight and Controls Needed over DOD's Time-and-Materials Contracts,
    GAO-07-273 (Washington, D.C.: June 29, 2007), pp. 34-36.

    [59] Palmetto billed CMS a total of $3.6 million in additional indirect
    costs ($3.3 million) and fees ($318,000) associated with its
    subcontract with Pearson. The amount related to indirect costs is
    included in questionable payments for cost not compliant with contract
    terms ($16.2 million) and unsupported contractor costs billed by
    Palmetto ($50.8 million).

    [60] 48 C.F.R. 352.216-72(b)(3).

    [61] For the purposes of this report, the term "contract" is generally
    used to refer to both contracts and task orders issued under contracts.
    We use the term "task order" when we discuss an issue or a requirement
    that applies just to a task order and not to the underlying contract.

    [62] GAO/AIMD-00-21.3.1 (Washington, D.C.: November 1999).

    [63] Additionally, if a base contract had multiple task orders--some
    task orders meeting the $1.5 million threshold and others not meeting
    the threshold--we selected all task orders.

    [End of section]

    GAO's Mission:

    The Government Accountability Office, the audit, evaluation and
    investigative arm of Congress, exists to support Congress in meeting
    its constitutional responsibilities and to help improve the performance
    and accountability of the federal government for the American people.
    GAO examines the use of public funds; evaluates federal programs and
    policies; and provides analyses, recommendations, and other assistance
    to help Congress make informed oversight, policy, and funding
    decisions. GAO's commitment to good government is reflected in its core
    values of accountability, integrity, and reliability.

    Obtaining Copies of GAO Reports and Testimony:

    The fastest and easiest way to obtain copies of GAO documents at no
    cost is through GAO's Web site [hyperlink, http://www.gao.gov]. Each
    weekday, GAO posts newly released reports, testimony, and
    correspondence on its Web site. To have GAO e-mail you a list of newly
    posted products every afternoon, go to [hyperlink, http://www.gao.gov]
    and select "Subscribe to Updates."

    Order by Mail or Phone:

    The first copy of each printed report is free. Additional copies are $2
    each. A check or money order should be made out to the Superintendent
    of Documents. GAO also accepts VISA and Mastercard. Orders for 100 or
    more copies mailed to a single address are discounted 25 percent.
    Orders should be sent to:

    U.S. Government Accountability Office:
    441 G Street NW, Room LM:
    Washington, D.C. 20548:

    To order by Phone:
    Voice: (202) 512-6000:
    TDD: (202) 512-2537:
    Fax: (202) 512-6061:

    To Report Fraud, Waste, and Abuse in Federal Programs:

    Contact:

    Web site: [hyperlink, http://www.gao.gov/fraudnet/fraudnet.htm]:
    E-mail: fraudnet@gao.gov:
    Automated answering system: (800) 424-5454 or (202) 512-7470:

    Congressional Relations:

    Gloria Jarmon, Managing Director, JarmonG@gao.gov:
    (202) 512-4400:
    U.S. Government Accountability Office:
    441 G Street NW, Room 7125:
    Washington, D.C. 20548:

    Public Affairs:

    Chuck Young, Managing Director, youngc1@gao.gov:
    (202) 512-4800:
    U.S. Government Accountability Office:
    441 G Street NW, Room 7149:
    Washington, D.C. 20548:

    *** End of document. ***