Centers for Medicare and Medicaid Services:

Deficiencies in Contract Management Internal Control Are Pervasive

GAO-10-60: Published: Oct 23, 2009. Publicly Released: Nov 24, 2009.

Additional Materials:

Contact:

Kay L. Daly
(202) 512-9312
contact@gao.gov

 

Office of Public Affairs
(202) 512-4800
youngc1@gao.gov

As a result of internal control deficiencies discussed in GAO's 2007 report on certain contracts at the Centers for Medicare and Medicaid Services (CMS), GAO was asked to identify the extent to which CMS (1) implemented effective control procedures over contract actions, and (2) established a strong control environment for contract management. GAO used a statistical random sample of 2008 CMS contract actions (including contract awards and modifications) to assess CMS internal control procedures. The results were projected to the population of 2008 CMS contract actions. GAO also determined the extent to which CMS implemented recommendations GAO made in 2007 to improve internal control over contracting and payments to contractors. GAO reviewed contract file documentation and interviewed senior acquisition management officials.

Pervasive deficiencies in CMS contract management internal controlincrease the risk of improper payments or waste. Specifically, based on our statistical random sample of 2008 CMS contract actions, GAO estimates that at least 84.3 percent of fiscal year 2008 contract actions contained at least one instance where a key control was not adequately implemented. GAO also estimates that at least 37.2 percent of fiscal year 2008 contract actions had three or more instances in which a key control was not adequately implemented. The contract actions GAO evaluated were generally subject to the Federal Acquisition Regulation. For example, CMS used cost reimbursement contracts without first ensuring that the contractor had an adequate accounting system. Also, project officers did not always certify invoices for payment. These deficiencies were due in part to a lack of agency-specific policies and procedures to help ensure proper contracting expenditures. These control deficiencies also stem from a weak overall control environment as characterized primarily by inadequate strategic planning for staffing and funding resources. CMS also did not accurately capture data on the nature and extent of its contracting, which hinders CMS's ability to manage its acquisition function by identifying areas of risk, due to a lack of quality assurance procedures over data entry. CMS also has not substantially addressed seven of the nine recommendations made by GAO in 2007 to improve internal control over contracting and payments to contractors. For example, CMS has not made progress in clarifying the roles and responsibilities for implementing certain contractor oversight responsibilities and, as of July 2009, CMS still had a backlog of contacts that were overdue for closeout, putting CMS at increased risk of not identifying or recovering improper payments or waste. The continuing weaknesses in contracting activities and limited progress in addressing known deficiencies will continue to put billions of taxpayer dollars at risk of improper payments or waste.

Status Legend:

More Info
  • Review Pending-GAO has not yet assessed implementation status.
  • Open-Actions to satisfy the intent of the recommendation have not been taken or are being planned, or actions that partially satisfy the intent of the recommendation have been taken.
  • Closed-implemented-Actions that satisfy the intent of the recommendation have been taken.
  • Closed-not implemented-While the intent of the recommendation has not been satisfied, time or circumstances have rendered the recommendation invalid.
    • Review Pending
    • Open
    • Closed - implemented
    • Closed - not implemented

    Recommendations for Executive Action

    Recommendation: The Administrator of CMS should develop and implement policies and procedures to ensure that federal acquisition requirements (FAR) requirements and other control objectives are met. Policies and procedures should document compliance with FAR requirements for different contract types. At a minimum, enhance current documentation, such as the contract checklist, to ensure the contract file documents authorizations for letter contracts, adequacy of the contractors accounting systems, and determination and findings for time and materials contracts, when applicable.

    Agency Affected: Department of Health and Human Services: Centers for Medicare and Medicaid Services

    Status: Open

    Comments: When we confirm what actions the agency has taken in response to this recommendation, we will provide updated information.

    Recommendation: The Administrator of CMS should develop and implement policies and procedures to ensure that FAR requirements and other control objectives are met. Policies and procedures should document in the contract file provisional indirect cost rates used as a basis for reviewing the reasonableness of the indirect costs billed on the contractor invoices.

    Agency Affected: Department of Health and Human Services: Centers for Medicare and Medicaid Services

    Status: Open

    Comments: When we confirm what actions the agency has taken in response to this recommendation, we will provide updated information.

    Recommendation: The Administrator of CMS should develop and implement policies and procedures to ensure that FAR requirements and other control objectives are met. Policies and procedures should specify what constitutes timely performance of (or request for) audits of contractors' statements of incurred cost for cost reimbursement and time and materials (T&M) contracts, including circumstances when Office of Acqusition and Grants Management (OAGM) should perform the audit itself or request another organization to perform the service.

    Agency Affected: Department of Health and Human Services: Centers for Medicare and Medicaid Services

    Status: Open

    Comments: When we confirm what actions the agency has taken in response to this recommendation, we will provide updated information.

    Recommendation: The Administrator of CMS should develop and implement policies and procedures to ensure that FAR requirements and other control objectives are met. Policies and procedures should specify circumstances under which negotiation memorandums should be used and the content of such, and any required secondary reviews, in light of Health and Human Services Acquisition Regulations (HHSAR) requirements and current OAGM practice.

    Agency Affected: Department of Health and Human Services: Centers for Medicare and Medicaid Services

    Status: Open

    Comments: When we confirm what actions the agency has taken in response to this recommendation, we will provide updated information.

    Recommendation: The Administrator of CMS should develop and implement policies and procedures to ensure that FAR requirements and other control objectives are met. Policies and procedures should specify Contract Review Board review documentation to include, at a minimum, documentation of the number of contracts reviewed each year, the issues identified by the Contract Review Board (CRB) reviewer(s), and resolution of issues identified during the CRB reviews.

    Agency Affected: Department of Health and Human Services: Centers for Medicare and Medicaid Services

    Status: Open

    Comments: When we confirm what actions the agency has taken in response to this recommendation, we will provide updated information.

    Recommendation: The Administrator of CMS should develop and implement policies and procedures to ensure that FAR requirements and other control objectives are met. Policies and procedures should require Division Directors to periodically assess, document, and report to senior management on the results of their review of whether the contract files contain documentation that invoices were properly reviewed by both the project officer and contracting officer or specialist.

    Agency Affected: Department of Health and Human Services: Centers for Medicare and Medicaid Services

    Status: Open

    Comments: When we confirm what actions the agency has taken in response to this recommendation, we will provide updated information.

    Recommendation: To strengthen the control environment, the Office of Acquisition Grants Management (OAGM) management should develop and implement a comprehensive strategic acquisition workforce plan. The plan should include, at a minimum, elements such as performance goals, time frames, implementation actions, and resource requirements, and address issues such as OAGM workload, full time equivalents needed, and a workforce skills analysis, as well as an estimate of the amount of resources OAGM needs to fulfill the audit and other FAR requirements for comprehensive oversight, including those required of a cognizant federal agency (CFA).

    Agency Affected: Department of Health and Human Services: Centers for Medicare and Medicaid Services: Office of Acquisition and Grants Management

    Status: Open

    Comments: When we confirm what actions the agency has taken in response to this recommendation, we will provide updated information.

    Recommendation: To strengthen the control environment, the Office of Acquisition Grants Management (OAGM) management should revise the Verification and Validation Plan for Departmental Contracts Information System (DCIS) Accuracy and Improvements policy to require all relevant errors be corrected and their resolution documented.

    Agency Affected: Department of Health and Human Services: Centers for Medicare and Medicaid Services: Office of Acquisition and Grants Management

    Status: Open

    Comments: When we confirm what actions the agency has taken in response to this recommendation, we will provide updated information.

    Recommendation: To strengthen the control environment, the Office of Acquisition Grants Management (OAGM) management should develop and implement policies and procedures for tracking contract audit requests, monitoring the results of contract audits and evaluations, and resolving the audit findings, to include roles and responsibilities of the contracting officer, specialist, and members of the cost/price team.

    Agency Affected: Department of Health and Human Services: Centers for Medicare and Medicaid Services: Office of Acquisition and Grants Management

    Status: Open

    Comments: When we confirm what actions the agency has taken in response to this recommendation, we will provide updated information.

    Recommendation: To improve the department's fulfillment of CFA duties as described in FAR, the Secretary of HHS should develop policies and procedures that clearly assign roles and responsibilities for the timely fulfillment of CFA duties, and that include the preparation of and periodic update of a list of contractors for which the department is the CFA.

    Agency Affected: Department of Health and Human Services

    Status: Open

    Comments: When we confirm what actions the agency has taken in response to this recommendation, we will provide updated information.

    Apr 10, 2014

    Apr 8, 2014

    Apr 3, 2014

    Mar 31, 2014

    Mar 26, 2014

    Mar 25, 2014

    Looking for more? Browse all our products here