GAO says CMS falls short on contracting controls

The Centers for Medicare and Medicaid Services (CMS) experienced significant gaps in its oversight of $3.6 billion worth of contracts in fiscal 2008, according to a new report from the Government Accountability Office.

In 84 percent of its contract actions that year, CMS failed to implement at least one key control, GAO said in a report issued Nov. 24. In 37 percent of those transactions, there were failures in implementing three or more key controls, the report said.

“Pervasive deficiencies in CMS contract management of internal controls increase the risk of improper payments or waste,” GAO warned.

The watchdog agency found instances in which CMS used cost reimbursement contracts without first ensuring that the contractor had an adequate accounting system. Also, project officers did not always certify invoices for payment.

The deficiencies stem from a lack of agency-specific policies and procedures and from a weak overall control environment with inadequate strategic planning to manage funding and staffing needs, GAO said.

The agency made 10 recommendations for improvement, and CMS officials agreed with those recommendations. The officials also said they were encouraged that the GAO’s analysis showed only “perceived documentation deficiencies” rather than substantive violations of the Federal Acquisition Regulation.

The report said several of the shortcomings were longstanding, including CMS’ lack of progress in clarifying roles and responsibilities for implementing certain contractor oversight duties. GAO also contended that CMS has not yet fully implemented seven of the nine recommendations to improve internal controls GAO made in 2007.

However, CMS officials disagreed with that assessment of how well it performed on the two-year-old recommendations.

“CMS did, in fact, substantially implement the recommendations contained in the GAO’s 2007 report,” wrote Charlene Frizzara, acting administrator of CMS, in a response to a draft of the GAO report.

The CMS, which manages Medicare and Medicaid, relies on contractors for program administration, management and oversight. It awards contracts for administration, oversight, auditing of claims, information technology, program management, consulting and operation of the Medicare help line.

Under the economic stimulus law, CMS will be distributing $19 billion in one-time incentive payments to doctors and hospitals who buy and meaningfully use certified electronic health records systems. The CMS also is planning to track those payments with upgraded IT systems.