This is the accessible text file for GAO report number GAO-08-154T entitled 'Medicare Advantage: Required Audits of Limited Value' which was released on October 17, 2007. This text file was formatted by the U.S. Government Accountability Office (GAO) to be accessible to users with visual impairments, as part of a longer term project to improve GAO products' accessibility. Every attempt has been made to maintain the structural and data integrity of the original printed product. Accessibility features, such as text descriptions of tables, consecutively numbered footnotes placed at the end of the file, and the text of agency comment letters, are provided but may not exactly duplicate the presentation or format of the printed version. The portable document format (PDF) file is an exact electronic replica of the printed version. We welcome your feedback. Please E-mail your comments regarding the contents or accessibility features of this document to Webmaster@gao.gov. This is a work of the U.S. government and is not subject to copyright protection in the United States. It may be reproduced and distributed in its entirety without further permission from GAO. Because this work may contain copyrighted images or other material, permission from the copyright holder may be necessary if you wish to reproduce this material separately. Testimony: Before the Subcommittees on Health and Oversight, Committee on Ways and Means, House of Representatives: United States Government Accountability Office: GAO: For Release on Delivery Expected at 10:00 a.m. EST: Tuesday, October 16, 2007: medicare advantage: Required Audits of Limited Value: Statement of: Jeffrey C. Steinhoff, Managing Director, Financial Management and Assurance: and: James Cosgrove, Acting Director, Health Care: Accompanied by: Kimberly Brooks, Assistant Director, Financial Management and Assurance: GAO-08-154T: GAO Highlights: Highlights of GAO-08-154T, a testimony before the Subcommittees on Health and Oversight, Committee on Ways and Means, House of Representatives. Why GAO Did This Study: In fiscal year 2006, the Centers for Medicare & Medicaid Services (CMS) estimated it spent over $51 billion on the Medicare Advantage program, which serves as an alternative to the traditional fee for- service program. Under the Medicare Advantage program, CMS approves private companies to offer health plan options to Medicare enrollees that include all Medicare-covered services. Many plans also provide supplemental benefits. The Balanced Budget Act (BBA) of 1997 requires CMS to annually audit the financial records supporting the submissions (i.e., adjusted community rate proposals (ACRP) or bids) of at least one-third of participating organizations. BBA also requires that GAO monitor the audits. This testimony provides information on (1) the ACRP and bid process and related audit requirement, (2) CMS’ efforts related to complying with the audit requirement, and (3) factors that cause CMS’ audit process to be of limited value. What GAO Found: Before 2006, companies choosing to participate in the Medicare Advantage program were annually required to submit an ACRP to CMS for review and approval. In 2006, a bid submission process replaced the ACRP process. The ACRPs and bids identify the health services the company will provide to Medicare members and the estimated cost for providing those services. CMS contracted with accounting and actuarial firms to perform the required audits. According to our analysis, CMS did not meet the requirement for auditing the financial records of at least one-third of the participating Medicare Advantage organizations for contract years 2001-2005. CMS is planning to conduct other financial reviews of organizations to meet the audit requirement for contract year 2006. However, CMS does not plan to complete the financial reviews until almost 3 years after the bid submission date each contract year, which will affect its ability to address any identified deficiencies in a timely manner. Figure: Number of Organizations audited (Percent): [See PDF for image] Source: GAO analysis of CMS data. [End of figure] CMS did not consistently ensure that the audit process for contract years 2001-2005 provided information to assess the impact on beneficiaries. After contract year 2003 audits were completed, CMS took steps to determine such impact and identified an impact on beneficiaries of about $35 million. CMS audited contract year 2006 bids for 80 organizations, and 18 had a material finding that affected amounts in approved bids. CMS officials took limited action to follow up on contract year 2006 findings. CMS officials told us they do not plan to sanction or pursue financial recoveries based on these audits because the agency does not have the legal authority to do so. According to our assessment of the statutes, CMS had the authority to pursue financial recoveries, but its rights under contracts for 2001–2005 were limited because its implementing regulations did not require that each contract include provisions to inform organizations about the audits and about the steps that CMS would take to address identified deficiencies. Further, our assessment of the statute is that CMS has the authority to include terms in bid contracts that would allow it to pursue financial recoveries. Without changes in its procedures, CMS will continue to invest resources in audits that will likely provide limited value. What GAO Recommends: In past work, GAO made five recommendations to CMS for meeting the one- third audit requirement, enhancing its audit follow-up, and improving the bid audit process. CMS concurred with our recommendations. To view the full product, including the scope and methodology, click on [hyperlink, http://www/GAO-08-154T]. For more information, contact Jeanette Franzel at 202-512-9471 or franzelj@gao.gov. [End of section] Mr. Chairmen and Members of the Subcommittees: We are pleased to be here today to testify on the results of our review of the Centers for Medicare & Medicaid Services' (CMS) audit activities related to Medicare Advantage (MA) organizations that was mandated by the Balanced Budget Act (BBA) of 1997.[Footnote 1] Our results are documented in our July report, Medicare Advantage: Required Audits of Limited Value.[Footnote 2] BBA requires CMS to annually audit the financial records (including data relating to Medicare utilization and costs) of at least one-third of the organizations participating in the Medicare Advantage program. BBA also requires us to monitor CMS' audit activities. In fiscal year 2006, CMS estimated it spent over $51 billion on the Medicare Advantage program,[Footnote 3] which serves as an alternative to Medicare's traditional fee-for-service program. Under Medicare Advantage, CMS approves private companies to offer health plan options that include all Medicare-covered services. In addition, many plans provide supplemental benefits, such as a reduction in the enrollee's required cost sharing (e.g., beneficiaries' Part B premiums)[Footnote 4] or coverage for items and services not included under the traditional fee-for-service program, such as dental care. According to CMS, in fiscal year 2006, over 16 percent of Medicare beneficiaries--or about 7 million of the approximately 43 million--were enrolled in a Medicare Advantage plan. Our review covered CMS audits for contract years 2001 through 2006. In summary, we found that the required audits were of limited value, which is similar to what we reported on audits for contract year 2000 in October 2001, when we last reviewed CMS' audit activities under BBA.[Footnote 5] The findings in our latest review cause us continuing concern about the audit process. CMS did not document its process to determine whether it met the requirement to audit the financial records of at least one-third of the participating organizations for contract years 2001 through 2006, and based on our analysis of available CMS data, CMS did not meet that requirement. For those audits that CMS completed, it did not consistently ensure that the audit process provided information needed for assessing the potential impact on beneficiaries, and CMS took limited action to follow-up on the audit findings. Today, we will discuss the findings in our recent report. Specifically, we will tell you about: * the adjusted community rate proposal (ACRP) and bid process and the related audit requirement for organizations that participate in the Medicare Advantage program, * CMS' efforts to comply with the audit requirement for organizations' ACRP and bid submissions, and: * factors that cause CMS' audit process to be of limited value. Our prior work on which this testimony is based was performed in accordance with generally accepted government auditing standards. Medicare Advantage ACRP and Bid Process and Related Audit Requirements: Before 2006, companies choosing to participate in the Medicare Advantage program were required to annually submit an ACRP to CMS for review and approval for each plan they intended to offer.[Footnote 6] The ACRP consisted of two parts--a plan benefit package and the adjusted community rate (ACR). The plan benefit package contained a detailed description of the benefits offered, and the ACR contained a detailed description of the estimated costs to provide the package of benefits to an enrolled Medicare beneficiary. These costs were to be calculated based on how much a plan would charge a commercial customer to provide the same benefit package if its members had the same expected use of services as Medicare beneficiaries. CMS made payments to the companies monthly in advance of rendering services. In 2003, Congress enacted the Medicare Prescription Drug, Improvement and Modernization Act of 2003 (MMA).[Footnote 7] MMA included provisions that established a bid submission process to replace the ACRP submission process, as well as a new prescription drug benefit, both effective for 2006. Under the bid process, an organization choosing to participate in Medicare Advantage is required to annually submit a bid for review and approval for each plan they intend to offer. The bid submission includes the organization's estimate of the cost of delivering services (submitted on a bid form) to an enrolled Medicare beneficiary and a plan benefit package that provides a detailed description of the benefits offered. In addition, each MA organization and prescription drug plan that offers prescription drug benefits under Part D[Footnote 8] is required to submit a separate prescription drug bid form, a formulary,[Footnote 9] and a plan benefit package to CMS for its review and approval. On the bid forms, MA organizations include an estimate of the per-person cost of providing Medicare-covered services. BBA requires CMS to annually audit the submissions of one-third of MA organizations. In defining what constituted an organization for the purpose of selecting one-third for audit, CMS officials explained that they determined the number of participating organizations based on the number of contracts they awarded. Under each contract, an organization can offer multiple plans. Further, an organization like Humana Inc. can have multiple contracts. CMS contracts with accounting and actuarial firms to perform these audits. For audits of the contract year 2006 bid forms, CMS contracted in September 2005 with six firms. CMS gave the auditors guidance. It is important to note that the audit guidance includes procedures to verify information used in the projection or estimation of costs submitted in the bids, not actual results or costs each year, as the bids do not report actual costs. GAO Analysis Shows CMS Did Not Meet the Audit Requirement: According to our analysis of available CMS data, CMS did not meet the statutory requirement to audit the financial records of at least one- third of the participating MA organizations for contract years 2001 through 2005, nor has it done so yet for the 2006 bid submissions. We performed an analysis to determine whether CMS had met the requirement because CMS could not provide documentation to support the method it used to select the ACRs and bids for audit, nor did CMS document whether or how it met the one-third requirement for contract years 2001 through 2006. Our analysis shows that between 18.6 and 23.6 percent, or fewer than one-third, of the MA organizations (as defined by the number of contracts each year) for contract years 2001 through 2005 were audited each year. Similarly, we determined that only 13.9 percent of the MA organizations and prescription drug plans with approved bids for 2006 were audited, as of the end of our review.[Footnote 10] Table 1 summarizes our results. Table 1: Summary of MA Organizations Audited as a Percentage of Total MA Organizations and Audit Costs: Contract year: 2001; Type of audit: ACRP; Number of organizations audited[A]: 50; Number of organizations: 212; Percentage of organizations audited: 23.6; Audit costs[B] (dollars in millions): $2.8. Contract year: 2002; Type of audit: ACRP; Number of organizations audited[A]: 40; Number of organizations: 183; Percentage of organizations audited: 21.9; Audit costs[B] (dollars in millions): $2.6. Contract year: 2003; Type of audit: ACRP; Number of organizations audited[A]: 49; Number of organizations: 220; Percentage of organizations audited: 22.3; Audit costs[B] (dollars in millions): $3.8. Contract year: 2004; Type of audit: ACRP; Number of organizations audited[A]: 47; Number of organizations: 228; Percentage of organizations audited: 20.6; Audit costs[B] (dollars in millions): $3.4. Contract year: 2005; Type of audit: ACRP; Number of organizations audited[A]: 59; Number of organizations: 318; Percentage of organizations audited: 18.6; Audit costs[B] (dollars in millions): $2.6. Contract year: 2006; Type of audit: Bid; Number of organizations audited[A]: 80; Number of organizations: 577; Percentage of organizations audited: 13.9; Audit costs[B] (dollars in millions): $3.3. Source: GAO analysis of CMS data and ACRP and bid audit reports. [A] In determining what constituted an organization for audit purposes, CMS determined the number of organizations based on the contract level. Several plans may be offered under one contract. [B] Audit costs include only amounts awarded to audit contractors and do not include CMS staff costs. [End of table] As stated earlier, CMS selects organizations to meet the one-third audit requirement based on the number of contracts awarded and not the total number of plans offered under each contract. However, to present additional perspective, we also analyzed the percentage of plans audited of the total number of plans offered by each audited organization. Our analysis shows that with the exception of contract year 2002, the level of audit coverage achieved by CMS audits has progressively decreased in terms of the percentage of plans audited for those organizations that were audited. Audit coverage has also decreased in terms of the percentage of plans audited of all plans offered by participating organizations each contract year. In contract year 2006, a large increase in the number of bid submissions meant that the 159 plans audited reflected only 3.2 percent of all the plans offered. Table 2 summarizes our analysis. Table 2: Summary of Audited Plans as a Percentage of Those Offered by Audited Organizations and All Participating Organizations: Contract year: 2001; Type of audit: ACRP; Number of plans audited for audited organizations: 165; Number of plans offered by audited organizations: 216; Percentage of plans audited of all plans offered by audited organizations: 76.4; Number of plans offered by all participating organizations: 743; Percentage of plans audited of all plans offered by participating organizations: 22.2. Contract year: 2002; Type of audit: ACRP; Number of plans audited for audited organizations: 84; Number of plans offered by audited organizations: 93; Percentage of plans audited of all plans offered by audited organizations: 90.3; Number of plans offered by all participating organizations: 554; Percentage of plans audited of all plans offered by participating organizations: 15.2. Contract year: 2003; Type of audit: ACRP; Number of plans audited for audited organizations: 137; Number of plans offered by audited organizations: 254; Percentage of plans audited of all plans offered by audited organizations: 53.9; Number of plans offered by all participating organizations: 770; Percentage of plans audited of all plans offered by participating organizations: 17.8. Contract year: 2004; Type of audit: ACRP; Number of plans audited for audited organizations: 124; Number of plans offered by audited organizations: 257; Percentage of plans audited of all plans offered by audited organizations: 48.2; Number of plans offered by all participating organizations: 967; Percentage of plans audited of all plans offered by participating organizations: 12.8. Contract year: 2005; Type of audit: ACRP; Number of plans audited for audited organizations: 100; Number of plans offered by audited organizations: 476; Percentage of plans audited of all plans offered by audited organizations: 21.0; Number of plans offered by all participating organizations: 1,865; Percentage of plans audited of all plans offered by participating organizations: 5.3. Contract year: 2006; Type of audit: Bid; Number of plans audited for audited organizations: 159; Number of plans offered by audited organizations: 1,194; Percentage of plans audited of all plans offered by audited organizations: 13.3; Number of plans offered by all participating organizations: 4,920; Percentage of plans audited of all plans offered by participating organizations: 3.2. [End of table] Source: GAO analysis of CMS data and ACRP and bid audit reports. Regarding contract years 2001 through 2004, CMS officials told us that they did not know how the MA organizations were selected for audit, and the documentation supporting the selections was either not created or not retained. For contract year 2005 audits, CMS officials told us that the selection criteria included several factors. They said that the criteria considered included whether the MA organization had been audited previously and whether it had significant issues. With respect to contract year 2006, CMS officials acknowledged the one- third requirement, but they stated that they did not intend for the audits of the 2006 bid submissions to meet the one-third audit requirement. They explained that they plan to conduct other reviews of the financial records of MA organizations and prescription drug plans to meet the requirement for 2006. In September 2006, CMS hired a contractor to develop the agency's overall approach to conducting reviews to meet the one-third requirement. Draft audit procedures prepared by the contractor in May 2007, indicate that CMS plans to review solvency, risk scores, related parties, direct medical and administrative costs, and, where relevant, regional preferred provider organizations' (RPPO) cost reconciliation reports for MA bids. For Part D bids, CMS indicated it also plans to review other areas, including beneficiaries' true out-of-pocket costs.[Footnote 11] However, when our review ended, CMS had not yet clearly laid out how these reviews will be conducted to meet the one-third requirement. Further, CMS is not likely to complete these other financial reviews until almost 3 years after the bid submission date (see figure 1) for each contract year, in part because it must first reconcile payment data that prescription drug plans are not required to submit to CMS until 6 months after the contract year is over. Such an extended cycle for conducting these reviews greatly limits their usefulness to CMS and hinders CMS' ability to recommend and implement timely actions to address identified deficiencies in the MA organizations' and prescription drug plans' bid processes. Figure 1: Time Elapsed from Contract Year 2006 Bid Submissions to Reviews to Meet Audit Requirement: [See PDF for image] Source: GAO. [End of figure] CMS' Audit Process Was of Limited Value: In its audits for contract years 2001-2005, CMS did not consistently ensure that the audit process provided information needed for assessing the potential impact of errors on beneficiaries' benefits or payments to the MA organizations. The auditors reported findings ranging from lack of supporting documentation to overstating or understating certain costs, but did not identify how the errors affected beneficiary benefits, copayments, or premiums. In addition, although the auditors categorized their results as findings and observations, with findings being more significant, depending on their materiality to the average payment rate reported in the ACR, the distinction between findings and observations, was based on judgment, and therefore varied among the different auditors. In our 2001 report, we reported that CMS planned to require auditors, where applicable, to quantify in their audit reports the overall impact of errors.[Footnote 12] Further, during the work for the 2001 report, CMS officials stated that they were in the process of determining the impact on beneficiaries and crafting a strategy for audit follow-up and resolution. CMS did not initiate any actions to attempt to determine such impact until after the contract year 2003 audits were completed. CMS took steps to determine such impact and identified a net of about $35 million from the contract year 2003 audits that beneficiaries could have received in additional benefits.[Footnote 13] The only audit follow-up action that CMS has taken regarding the ACR audits was to provide copies of the audit reports to the MA organizations and instruct them to take action in subsequent ACR filings. In CMS' audits of the 2006 bid submissions, 18 (or about 23 percent) of the 80 organizations audited had material findings that have an impact on beneficiaries or plan payments approved in bids. CMS defined material findings as those that would result in changes in the total bid amount of 1 percent or more or in the estimate for the costs per member per month of 10 percent or more for any bid element.[Footnote 14] CMS officials told us that they will use the results of the bid audits to help organizations improve their methods in preparing bids in subsequent years and to help improve the overall bid process. Specifically, they told us they could improve the bid forms, bid instructions, training, and bid review process. CMS' audit follow-up process has not involved pursuing financial recoveries from Medicare Advantage organizations based on audit results even when information was available on deficiencies or errors that could impact beneficiaries. CMS officials told us they do not plan to pursue financial recoveries from MA organizations based on the results of ACR or bid audits because the agency does not have the legal authority to do so. According to our assessment of the statutes, CMS has the authority to pursue financial recoveries, but its rights under contracts for 2001 through 2005 are limited because its implementing regulations did not require that each contract include provisions to inform organizations about the audits and about the steps that CMS would take to address identified deficiencies, including pursuit of financial recoveries. Regarding the bid process that began in 2006, our assessment of the statutes is that CMS has the authority to include terms in bid contracts that would allow it to pursue financial recoveries based on bid audit results.[Footnote 15] CMS also has the authority to sanction organizations, but it has not. CMS officials believe the bid audits provide a "sentinel or deterrent effect" for organizations to properly prepare their bids because they do not know when the bids may be selected for a detailed audit. Given the current audit coverage, CMS is unlikely to achieve significant deterrent effect, however, because only 13.9 percent of participating organizations for contract 2006 have been audited. Concluding Remarks: Appropriate oversight and accountability mechanisms are key to protecting the federal government's interests in using taxpayer resources prudently. When CMS falls short in meeting the statutory audit requirements and in a timely manner resolving the findings arising from those audits, the intended oversight is not achieved and opportunities are lost to determine whether organizations have reasonably estimated the costs to provide benefits to Medicare enrollees. Inaction or untimely audit resolution also undermines the presumed deterrent effect of audit efforts. While the statutory audit requirement does not expressly state the objective of the audits or how CMS should address the results of the audits, the statute does not preclude CMS from including terms in its contracts that allow it to pursue financial recoveries based on audit results. If CMS maintains the view that statute does not allow it to take certain actions, the utility of CMS' efforts is of limited value. In our recent report, we made several recommendations to the CMS Administrator to improve processes and procedures related to its meeting the one-third audit requirement and audit follow-up. We also recommended that CMS amend its implementing regulations for the Medicare Advantage Program and Prescription Drug Program to provide that all contracts CMS enters into with MA organizations and prescription drug plan sponsors include terms that inform these organizations of the audits and give CMS authority to address identified deficiencies, including pursuit of financial recoveries. We further recommended that if CMS does not believe it has the authority to amend its implementing regulations for these purposes, it should ask Congress for express authority to do so. In response to our report, CMS concurred with our recommendations and stated it is in the process of implementing some of our recommendations. Contacts and Acknowledgments: For information about this statement, please contact Jeanette Franzel, Director, Financial Management and Assurance, at (202) 512-9471 or franzelj@gao.gov or James Cosgrove, Acting Director, Health Care, at (202) 512-7029 or cosgrovej@gao.gov. Individuals who made key contributions to this testimony include Kimberly Brooks (Assistant Director), Christine Brudevold, Paul Caban, Abe Dymond, Jason Kirwan, and Diane Morris. Footnotes: [1] Pub. L. No. 105-33, tit. IV, § 4001, 111 Stat. 251, 320 (Aug. 5, 1997) (codified at 42 U.S.C. § 1395w-27(d)(1)). [2] GAO, Medicare Advantage: Required Audits of Limited Value, GAO-07- 945 (Washington, D.C.: July 30, 2007). [3] Total Medicare outlays in fiscal year 2006 were $381.9 billion. [4] Medicare Part B provides coverage for certain physician, outpatient hospital, laboratory, and other services to beneficiaries who pay monthly premiums. [5] GAO, Medicare+Choice Audits: Lack of Audit Follow-up Limits Usefulness, GAO-02-33 (Washington, D.C.: October 9, 2001). [6] Participating companies or sponsors can offer multiple plans. The term "plan" refers to a specific package of benefits offered. [7] Pub. L. No. 108-173, 117 Stat. 2066 (Dec. 8, 2003). [8] Part D is the optional outpatient prescription drug benefit for Medicare established by MMA. [9] The formulary is a listing of prescription medications that are approved for use or coverage by the plan and that will be dispensed through participating pharmacies to covered enrollees. [10] The 80 organizations audited for contract year 2006 included 60 MA organizations with prescription drug plans and 20 prescription drug plans. [11] True out-of-pocket costs are amounts paid by the enrollee or on behalf of the enrollee for covered Part D drugs that count toward the out-of-pocket limit that must be reached before the catastrophic benefit becomes available. [12] GAO-02-33, p. 20. [13] Information on the impact of errors identified in contract year 2004 and contract year 2005 audits was not completed or not available at the time we completed our recent review. [14] Findings also include any serious failure to follow applicable Actuarial Standards of Practice. Materiality for identifying observations included all other errors or deviations from the instructions or best actuarial practices that did not meet the criteria for being classified as findings. [15] 42 U.S.C. § 1395w-27(e)(1); 42 C.F.R. § 422.504(j). This provision also applies to prescription drug plans under Part D. 42 U.S.C. § 1395w- 112(b)(3)(D). GAO's Mission: The Government Accountability Office, the audit, evaluation, and investigative arm of Congress, exists to support Congress in meeting its constitutional responsibilities and to help improve the performance and accountability of the federal government for the American people. GAO examines the use of public funds; evaluates federal programs and policies; and provides analyses, recommendations, and other assistance to help Congress make informed oversight, policy, and funding decisions. GAO's commitment to good government is reflected in its core values of accountability, integrity, and reliability. Obtaining Copies of GAO Reports and Testimony: The fastest and easiest way to obtain copies of GAO documents at no cost is through GAO's Web site [hyperlink, http://www.gao.gov]. Each weekday, GAO posts newly released reports, testimony, and correspondence on its Web site. To have GAO e-mail you a list of newly posted products every afternoon, go to [hyperlink, http://www.gao.gov] and select "E-mail Updates." Order by Mail or Phone: The first copy of each printed report is free. Additional copies are $2 each. A check or money order should be made out to the Superintendent of Documents. GAO also accepts VISA and Mastercard. Orders for 100 or more copies mailed to a single address are discounted 25 percent. Orders should be sent to: U.S. Government Accountability Office 441 G Street NW, Room LM Washington, DC 20548: To order by Phone: Voice: (202) 512-6000: TDD: (202) 512-2537: Fax: (202) 512-6061: To Report Fraud, Waste, and Abuse in Federal Programs: Contact: Web site: [hyperlink, http://www.gao.gov/fraudnet/fraudnet.htm]: E-mail: fraudnet@gao.gov: Automated answering system: (800) 424-5454 or (202) 512-7470: Congressional Relations: Gloria Jarmon, Managing Director, JarmonG@gao.gov, (202) 512-4400: U.S. Government Accountability Office: 441 G Street NW, Room 7125: Washington, DC 20548: Public Affairs: Susan Becker, Acting Manager, BeckerS@gao.gov: (202) 512-4800: U.S. Government Accountability Office: 441 G Street NW, Room 7149: Washington, DC 20548: