Medicaid: CMS Needs to Better Target Risks to Improve Oversight of Expenditures

Medicaid has grown by over 50 percent over the last decade, with about $370 billion in federal spending in fiscal year 2017. CMS is responsible for assuring that expenditures—reported quarterly by states—are consistent with Medicaid requirements and matched with the correct amount of federal funds. CMS's review of reported expenditures has become increasingly complex due to variation in states' Medicaid programs and an increasing number of different matching rates.

GAO was asked to examine CMS's oversight of state-reported Medicaid expenditures. In this report, GAO examined how CMS assures that (1) expenditures are supported and consistent with requirements; and (2) the correct federal matching rates were applied to expenditures subject to a higher match. GAO also examined the financial impact of resolved errors. GAO reviewed documentation for the most recently completed quarterly reviews by 3 of CMS's 10 regional offices for six states that varied by Medicaid program expenditures and design. GAO also reviewed policies, procedures, and data on resolved errors; and interviewed CMS and state officials. GAO assessed CMS's oversight processes against federal standards for internal control.

The Centers for Medicare & Medicaid Services (CMS), which oversees Medicaid, has various review processes in place to assure that expenditures reported by states are supported and consistent with Medicaid requirements. The agency also has processes to review that the correct federal matching rates were applied to expenditures receiving a higher than standard federal matching rate, which can include certain types of services and populations. These processes collectively have had a considerable federal financial benefit, with CMS resolving errors that reduced federal spending by over $5.1 billion in fiscal years 2014 through 2017.

However, GAO identified weaknesses in how CMS targets its resources to address risks when reviewing whether expenditures are supported and consistent with requirements.

CMS devotes similar levels of staff resources to review expenditures despite differing levels of risk across states. For example, the number of staff reviewing California's expenditures—which represent 15 percent of federal Medicaid spending—is similar to the number reviewing Arkansas' expenditures, which represents 1 percent of federal Medicaid spending.

CMS cancelled in-depth financial management reviews in 17 out of 51 instances over the last 5 years. These reviews target expenditures considered by CMS to be at risk of not meeting program requirements.

CMS told GAO that resource constraints contributed to both weaknesses. However, the agency has not completed a comprehensive assessment of risk to (1) determine whether oversight resources are adequate and (2) focus on the most significant areas of risk. Absent such an assessment, CMS is missing an opportunity to identify errors in reported expenditures that could result in substantial savings to the Medicaid program.

GAO also found limitations in CMS's processes for reviewing expenditures that receive a higher federal matching rate.

Internal guidance for examining variances in these expenditures was unclear, and not all reviewers in the three CMS regional offices GAO reviewed were investigating significant variances in quarter-to-quarter expenditures.

Review procedures for expenditures for individuals newly eligible for Medicaid under the Patient Protection and Affordable Care Act were not tailored to different risk levels among states. For example, in its reviews of a sample of claims for this population, CMS reviewed claims for the same number of enrollees—30—in California as for Arkansas, even though California had 10 times the number of newly eligible enrollees as Arkansas.

Without clear internal guidance and better targeting of risks in its review procedures for expenditures receiving higher matching rates, CMS may overpay states.

GAO is making three recommendations, including that CMS improve its risk-based targeting of oversight efforts and resources, and clarify related internal guidance. The Department of Health and Human Services concurred with these recommendations.

Over the last decade, Medicaid—a joint, federal-state program that  finances health care coverage for low-income and medically needy  populations—has increased by over 50 percent, both in terms of  enrollment and cost. In fiscal year 2017, Medicaid covered an estimated  73.5 million individuals at an estimated cost of $596 billion, including  about $369 billion in federal spending. Federal projections indicate that  those costs will continue to grow.

The Centers for Medicare & Medicaid Services (CMS), the agency within  the Department of Health and Human Services (HHS) that oversees  Medicaid, is responsible for providing federal funds on the basis of state  estimates of expenditures. CMS subsequently reconciles states’ actual  expenditures against those estimates. Thus, a key part of CMS’s  oversight responsibility is to review state-reported expenditures to assure  that they are supported and consistent with Medicaid requirements. Each  quarter, states report their expenditures to CMS through its CMS-64 form.  CMS regional offices are responsible for reviewing these reported  expenditures and working with states to resolve any questionable  expenditures. If CMS identifies errors—which can include (1) errors in the  amounts reported or (2) reported expenditures that are not allowable—the  agency can require states to reduce reported expenditures or return  federal funds. Because Medicaid requirements include higher than  standard federal matching rates for certain types of services and for  certain populations of enrollees, part of CMS’s review process is to  assure that expenditures are being matched at the correct rate. For  example, states receive higher matching rates for services provided in  Indian Health Service (IHS) facilities and for family planning services.  They also receive higher matching rates for individuals newly eligible  under the Patient Protection and Affordable Care Act (PPACA), referred  to in this report as Medicaid expansion enrollees.

While there is a common reporting form, state expenditure reporting  varies depending upon the populations and services states cover and  how they deliver and finance care. These variations reflect the diversity of  the design of states’ Medicaid programs; however, the task of reviewing  reported expenditures has grown increasingly complex due to this  variation, and is further complicated by the growing number of different  federal matching rates for expenditures. When reporting errors or  inappropriate expenditures go undetected, it can result in overpayment by  the federal government.

Given the significance of federal Medicaid expenditures and past  concerns about the challenges CMS has faced in ensuring that  expenditures are being matched at the correct rate, you asked us to  examine CMS oversight of state-reported expenditures. This report  examines the following:  1.  CMS’s policies and procedures for assuring that state-reported  Medicaid expenditures are supported and consistent with Medicaid  requirements.  2.  How CMS assures that correct federal matching rates are applied to  expenditures subject to a higher than standard matching rate.  3.  The financial impact of CMS’s efforts to resolve errors in reported  expenditures.

To examine CMS’s policies and procedures for assuring that state- reported Medicaid expenditures are supported and consistent with  Medicaid requirements, we reviewed CMS’s internal guidance to regional  offices on conducting quarterly reviews of reported expenditures. We also  reviewed CMS’s guidance to states on reporting expenditures, including  the reporting forms. To examine how CMS’s regional offices implemented  this guidance, we selected 3 of 10 regional offices to achieve geographic  variation. We selected regional offices 3, 6, and 9, which cover states in  the East, South, and West of the United States. Within our three regional  offices, we selected six states to review CMS’s oversight: Arkansas,  California, Maryland, Nevada, Pennsylvania, and Texas. We selected  these states to achieve variation in program expenditures, enrollment,  and program features, including whether they expanded Medicaid  eligibility under PPACA. Together these six states account for  approximately 30 percent of total federal Medicaid expenditures in fiscal  year 2015. We visited our selected regional offices to conduct a  walkthrough of their review of expenditures for our selected states for the  most recently completed quarter at the time we planned our site visits,  generally the first quarter of fiscal year 2017.

We obtained and examined copies of reviewers’ documentation of the  steps taken to complete their quarterly reviews in the six selected states,  including the completed review guides, summary memos, and  correspondence with state officials. We also reviewed CMS’s internal  guidance for conducting financial management reviews, and obtained and  examined documentation of reviews conducted from 2014 through 2017  (the first 4 years of expansion under PPACA), and resources assigned to  review functions. In reviewing documentation of the quarterly reviews and  the financial management reviews, we determined whether current  procedures were resulting in reviewers identifying errors, but did not  assess the magnitude of the errors identified. We interviewed officials  from CMS’s central office and our three selected regional offices about  their review policies, processes, and resources. We also interviewed  Medicaid officials from our six selected states about their experiences  submitting data and undergoing CMS’s review processes. In evaluating  this information, we compared policies and procedures against the  Standards for Internal Control in the Federal Government.

To examine how CMS assures that correct matching rates are applied to  expenditures, we reviewed CMS policies and procedures for reviewing  expenditures subject to a higher than standard federal matching rate,  including the quarterly review guide. In addition, we examined the extent  to which these were consistently applied by reviewing the quarterly review  documentation for our three selected regional offices. Specifically, we  examined how they reviewed expenditure reporting for four types of  expenditures for which states receive a higher federal matching rate: IHS,  services for certain women with breast or cervical cancer, family planning,  and Medicaid expansion. We selected these four expenditure types  because they cover a variety of services and populations, and under  CMS’s quarterly review guidance, they are subject to specific review  procedures. We also tested CMS’s reviews by completing our own  reviews of reported expenditures in the six states. Specifically, we  calculated the variance in expenditures from the quarter under review to  the previous quarter, which is in line with CMS’s review guidance. We  also interviewed CMS officials, including officials in our selected regional  offices about their review process. In evaluating the measures CMS has  taken to assure that correct matching rates are applied to different  expenditures, we compared policies and procedures against the  Standards for Internal Control in the Federal Government.

To examine the financial impact of errors resolved by CMS, we reviewed  data on errors resolved in fiscal years 2014 through 2017, the four most  recent years of available data. Specifically, we reviewed data on the  magnitude of errors resolved through states reducing reported  expenditures and on errors resolved by CMS issuing a disallowance,  which requires a state to return federal funds. We also reviewed data on  deferrals of federal funds (i.e., CMS defers payment until issues are  resolved) as of the end of fiscal year 2017. We asked CMS officials  responsible for overseeing data on errors to describe the reliability of the  data, including any limitations. For the data on disallowances, deferrals,  and errors resolved by states reducing reported expenditures, we  reviewed relevant documentation; examined the data for obvious errors,  such as missing values; and compared the results to other supporting  documentation to ensure accuracy, when possible. We determined that  all data were sufficiently reliable for the purposes of our reporting  objectives. We also reviewed the documentation from the three selected  regional offices’ quarterly expenditure reviews for examples of errors  resolved in our six selected states. Using the data on disallowances, and  documentation from the quarterly expenditure reviews, we analyzed the  range in types of errors and the range in the financial impact of errors  resolved by CMS. We also interviewed CMS officials from the regional  offices and CMS’s central office about the errors resolved and their  procedures for issuing deferrals and disallowances.

We conducted this performance audit from April 2017 to August 2018 in  accordance with generally accepted government auditing standards.  Those standards require that we plan and perform the audit to obtain  sufficient, appropriate evidence to provide a reasonable basis for our  findings and conclusions based on our audit objectives. We believe that  the evidence obtained provides a reasonable basis for our findings and  conclusions based on our audit objectives.

In order to receive federal matching funds, states report expenditures  quarterly to CMS on the CMS-64. States are required to report their  expenditures to CMS within 30 days of the end of each quarter, but may  adjust their past reporting for up to 2 years after the expenditure was  made, referred to as the 2-year filing limit. Adjustments can reflect  resolved disputes or reclassifications of expenditures. Expenditures  reported after the 2-year filing limit are generally not eligible for a federal  match, with certain exceptions.

The CMS-64 is a series of forms that capture expenditure data for  different aspects of states’ Medicaid programs, such as different types of  services, populations, and different federal matching rates. (See table 1  for examples of the expenditure types captured by the CMS-64.) States  report their expenditures quarterly on the CMS-64 at an aggregate level— such as a state’s total expenditures for such categories of services as  inpatient hospital services—and these reported expenditures are not  linked to individual enrollees or services. States’ reporting may vary  depending on the features of their Medicaid program. Some examples of  this variation include the following:

States that expanded eligibility under PPACA would need to report  expenditures not only by the type of services (e.g., inpatient hospital  services), but also by populations receiving different federal matching  rates, such as expansion enrollees.

States with waivers—that is, where the state received approval from  HHS to waive certain Medicaid requirements in order to test and  evaluate new approaches for delivering and financing care under a  demonstration—would need to report those expenditures associated  with these waivers on additional forms.

CMS Oversight of State Expenditure Reporting

CMS is responsible for assuring that expenditures reported by states are  supported and allowable, meaning that the state actually made and  recorded the expenditure and that the expenditure is consistent with  Medicaid requirements. CMS regional offices perform the ongoing  oversight, with enhanced oversight procedures in the 20 states with the  highest federal Medicaid expenditures. (See fig.1)

CMS is required to review the expenditures reported by states each  quarter. (See fig. 2.) Regional office reviewers have 50 days to review the  expenditures and compute the federal share of states’ Medicaid  expenditures.

As part of the quarterly review, regional office reviewers also check that  expenditures receive the correct matching rate. In general, the amount of  federal funds that states receive for Medicaid services is determined  annually by a statutory formula—the Federal Medical Assistance  Percentage (FMAP), which results in a specific federal matching rate for  each state. However, there are a number of exceptions where higher  federal matching rates can apply for certain types of beneficiaries,  services, or administrative costs. See table 2 for examples of higher  matching rates that apply for expenditures for certain types of enrollees,  services, or administrative costs.

When CMS identifies questionable expenditures or errors through its  reviews, there are several ways that they can be resolved, as  summarized below.

Deferral of federal funds. CMS can defer federal matching funds if,  during the quarterly review, the regional office reviewer needs  additional information to determine whether a particular expenditure is  allowable. The reviewer may recommend that CMS defer the  expenditure until the state provides additional support or corrects the  reporting.

State reducing reported expenditures. If the state agrees that the  questionable expenditure is an error, the state can submit an adjusted  report during the quarterly review or make an adjustment in a  subsequent quarter. These adjustments prevent federal payments  for those expenditures.

Disallowance of expenditure. If CMS determines an expenditure is  not allowable, CMS can issue a disallowance, and the state returns  federal funds through reductions in future federal allocations. States  may appeal disallowances.

CMS Has Processes in Place to Assure that State-Reported Medicaid Expenditures Are Supported and Allowable, but Weaknesses Limit Its Ability to Effectively Target Risk

CMS uses a variety of processes to assure that state-reported  expenditures are supported during quarterly reviews and performs  focused financial management reviews on expenditures considered at  risk of not complying with Medicaid requirements. Although we found that  CMS was identifying errors and compliance issues using both review  methods, we also found weaknesses in how CMS targets its oversight  resources to address risks.

CMS Uses Quarterly Reviews, Supplemented with More Focused Reviews, to Assure that Reported Expenditures Are Supported and Allowable and Has Detected Errors in the Process

CMS uses quarterly reviews to assess whether expenditures are  supported by the state’s accounting systems; are in accordance with  CMS approved methodologies, plans, and spending caps; and whether  there are significant unexplained variances—changes in expenditures— from one quarter to the next (referred to as a variance analysis). CMS  review procedures include validation measures that check to ensure that  expenditures were reported within the 2-year limit, which is a check done  on all types of expenditures. Another validation measure compares  expenditures to various approval documents. For example, when a state  has a waiver in place, expenditures are reviewed against waiver  agreements that authorize payment for specified services or populations.  Other examples include comparing supplemental payment expenditures  to caps set for those expenditures. (See table 3.)

Our examination of the quarterly reviews indicated that the reviews  involved significant coordination with other CMS staff and the state. In  addition to reviewing state documentation, officials from two regional  offices told us that they consult other regional office staff who oversee the  approval of new expenditures to ensure that expenditures reflect  approved program features. For example, officials in region 9 told us that  in reviewing managed care expenditures, they consult with their  colleagues who review the state’s payment methodologies for capitated  payments. In reviewing information technology development  expenditures—which are subject to a higher federal matching rate— reviewers for all six selected states examined advanced planning  documents, which requires coordination with staff who approve those  documents to ensure that the state was receiving the correct matching  rates and staying within the approved amounts. With regard to  coordination with states, we found that regional reviewers for all six  reviews contacted states to follow-up on issues identified during the  review. Officials also described being in regular contact with states to stay  abreast of program, system, and staffing changes to inform their reviews.  For example, according to regional officials, Arkansas experienced some  significant and unexpected staffing challenges in 2016 that resulted in  delays in the state reporting expenditures and returning federal  overpayments, and the reviewer worked closely with state staff to track  the state’s progress.

We found evidence that reviewers identified errors during their quarterly  reviews. In the six quarterly reviews we examined, regional offices  identified errors in three of the six states. For example, region 3  reviewers found errors in Maryland’s expenditure reporting—including  claims for the wrong matching rate for two enrollees who were not eligible  for PPACA’s Medicaid expansion and reporting provider incentive  payments on the wrong line—and worked with the state to correct those  errors. Additionally, region 9 reviewers found errors in California’s  reporting of expenditures. For example, they found that the state reported  waiver expenditures for the incorrect time period, which has implications  for CMS’s ability to monitor and enforce spending limits for the waiver.  Reviewers worked with the state to correct those errors.

To supplement the quarterly reviews, CMS generally directs regional  offices to conduct a focused financial management review (FMR) each  year on an area of high risk within the region, typically within one state.  According to regional officials, CMS uses these reviews to investigate  expenditures in greater depth and detail than is reasonable within the  timeframes of a quarterly review. For example, reviewers can examine  individual claims for services from providers or the methodologies  developed for certain payment types. Regional reviewers also use these  reviews to investigate errors that could not have been detected by the  quarterly review. For example, regional office 6 officials told us that they  uncovered inappropriate financing arrangements when they used an FMR  to examine how Texas financed the state share of its supplemental  payments to hospitals in one of its counties. To do so, the regional office  reviewed payments from the state to the provider, project plans, and  interviewed providers—steps that are not part of the quarterly review  process. Rather, in the quarterly review, the reviewer only checks that  state-reported payments are supported by state accounting records and  are within applicable caps; thus, inappropriate financing of the state share  would not have been detected through the quarterly review.

In fiscal years 2014 through 2017, CMS used FMRs to review various  expenditures considered to be at risk for not complying with Medicaid  requirements. Specifically, as outlined in annual work plans, regional  offices planned to conduct 31 FMRs and estimated that the total amount  of federal funds at risk in expenditure areas covered by their planned  reviews was $12 billion. (See app. I.) Planned FMRs targeted a wide  range of topics, with the reviews most frequently targeting expenditures  for the Medicaid expansion population. (See table 4.)

We found that CMS frequently identified compliance issues through  FMRs. As of March 2018, CMS reported that reviewers had identified  compliance issues with financial impact in 11 of the 31 planned FMRs,  though most of those findings were still under review. More findings from  the planned FMRs are likely as some of the reviews were still ongoing.  We reviewed the draft results for 5 FMRs. Among these, CMS found  that four states were reporting expenditures that were not allowable. For  example, as noted earlier, a 2014 FMR on supplemental payments in  Texas revealed inappropriate funding arrangements, and CMS issued a  disallowance for approximately $27 million. In some cases, FMRs did not  have apparent financial findings, but identified significant internal control  weaknesses in the state and recommended specific corrective actions— such as better aligning eligibility and expenditures systems to better  detect and correct irregularities—that would provide greater assurances  that federal funds are appropriately spent.

Both the quarterly reviews and the FMRs occur in conjunction with other  ongoing CMS financial oversight activities. For example in addition to  reviewing expenditures, regional office reviewers assess how states  estimate their costs, set payment rates for managed care and home and  community based services, and allocate costs among different Medicaid  administrative activities under their cost allocation plans. CMS officials  told us that issues relating to state compliance with Medicaid  requirements for expenditures could be identified during these other  oversight activities and could inform follow-up during the quarterly reviews  or be the subject of a FMR. Officials also told us that since FMRs were  instituted, the agency has built in more front-end procedures for  preventing problems with the accuracy and allowability of reported  expenditures. As examples, they cited their work on managed care rate  reviews, among other things.

Weaknesses Limit CMS’s Ability to Effectively Target Risk in Its Oversight of Expenditures

We identified two weaknesses in how CMS is allocating resources for  overseeing state-reported expenditures that limited the agency’s ability to  target risk in its efforts to assure that these expenditures are supported  and consistent with Medicaid requirements. First, we found that CMS has  allocated similar staff resources to states with differing levels of risk. For  example, the staff resources dedicated to reviewing California’s  expenditures—ranking first nationally in expenditures and constituting 15  percent of all federal Medicaid expenditures—are comparable to  significantly smaller states in other regions, despite California’s history of  reporting challenges and its inability to provide electronic records, which  requires on-site review. (See fig. 3.) CMS has allocated 2.2 staff to  review California’s expenditures in contrast to one person to review  Arkansas’ expenditures, which constitute 1 percent of federal Medicaid  expenditures, and Arkansas does not have a similar history of complex  reporting challenges. We also found that California’s reviewers have set a  higher threshold for investigating variances in reported expenditures than  in the five other selected states. Specifically, reviewers investigated  variances in California of plus or minus 10 percent if the variances  represented more than 2 percent of medical expenditures, or $450 million  in the quarter we reviewed. The state experienced an approximately 24  percent increase in its prescription drug expenditures—roughly $200  million—during that quarter, but the variance was deemed not  significant. In contrast, for two of our five other selected states, we  found that reviewers generally investigated variances of plus or minus 10  percent regardless of the dollar amount of the variance and in the  remaining three states they had significantly lower dollar thresholds than  used for California.

Second, CMS reported cancelling the FMR requirement for regional  offices in 17 out of 51 instances in the last 5 years when faced with  resource constraints. In some cases, CMS excused individual regional  offices from conducting planned FMRs due to staff shortage as the  agency did for regions 3 and 7 in 2014; region 8 in 2016; and regions 3,  7, 8, and 9 in 2018. In 2015, according to CMS officials, all 10 regions  were excused from conducting an FMR, because the regional offices  needed their staff to focus on implementing new procedures for validating  expenditures for the Medicaid expansion population. In addition to  cancelling FMRs, CMS was delayed in finalizing FMRs. Among the eight  FMRs that were conducted in fiscal year 2014,  three have been issued as final reports,

CMS decided no report was needed on a fourth, and  the four remaining FMRs from 2014 were still under review as of  March 2018, delaying important feedback to states on their  vulnerabilities.

According to CMS officials, resource constraints have contributed to both  of these weaknesses. Our analysis of staffing data indicated that, from  fiscal years 2014 to 2018, the number of full time equivalent staff  dedicated to financial oversight activities declined by approximately 19  percent across all 10 regions. These staff are responsible not only for  completing the quarterly reviews and FMRs, but also other financial  oversight activities, including resolving audit findings and other on-going  oversight activities noted previously. During this period, federal  Medicaid expenditures are estimated to have increased by approximately  31 percent, and the reporting of expenditures has grown more complex.  In addition to the decline in dedicated staff, officials told us they faced  challenges in filling vacancies either because of hiring restrictions or  challenges in recruiting qualified candidates. Officials described  instances where regional offices shared resources with other offices to  address critical gaps in resources. For example region 9 was able to  obtain part-time assistance from a region 6 reviewer to help review  California’s expenditures. However, CMS officials told us that they had  not permanently reallocated resources between regional offices, because  all regional offices are under-resourced given their various oversight  responsibilities as of May 2018. With regard to cancelling FMRs, CMS  officials noted that other oversight responsibilities, including the quarterly  reviews, are required under statute or regulation and thus have a higher  priority than FMRs.

Compounding its resource allocation challenges, CMS has not conducted  a comprehensive, national assessment of risk to determine whether  resources for financial oversight activities are (1) adequate and (2)  allocated—both across regional offices and oversight tools—to focus on  the greatest areas of risk. Agency officials told us that they have not  conducted a formal risk assessment, because they are assessing risk on  an on-going basis, allocating resources within each region accordingly  and sharing resources across regions to the extent possible. However,  this approach does not make clear whether the level of resources  dedicated to financial oversight nationally is adequate given the risk.

Federal internal control standards for risk assessment require agencies to  identify and analyze risks related to achieving the defined objectives (i.e.,  assuring that state-reported expenditures are in accordance with  Medicaid rules), and respond to risks based on the significance of the  risk. Without completing a comprehensive, national assessment of risk  and determining whether staff resources dedicated to financial oversight  are adequate and allocated commensurate with risk, CMS is missing an  opportunity to improve its ability to identify errors in reported expenditures  that could result in hundreds of millions of dollars in potential savings to  the Medicaid program.

Vulnerabilities Exist in CMS’s Review of Expenditures for Which States Receive Higher Federal Matching Rates

CMS reviewers in the selected regional offices we reviewed did not  consistently perform variance analyses—which compare changes in  expenditures from the quarter under review to the previous quarter—of  higher matched expenditures during quarterly reviews. Further, the  sampling procedures used to examine Medicaid expansion expenditures  did not account for varying risks across states.

CMS Did Not Consistently Conduct Variance Analyses When Reviewing Certain Types of Expenditures that Receive Higher Federal Matching Rates

CMS has multiple procedures in place to review expenditures that receive  a higher federal matching rate. As with other expenditures, reviewers are  required to complete a variance analysis, comparing reported  expenditures in the quarter under review to those reported in the prior  quarter and investigating variances above a certain threshold. However,  we found that our three selected regional offices were not consistently  conducting these analyses across several different types of expenditures  with higher matching rates.

While CMS’s internal guidance required that regional offices conduct  variance analyses on expenditures with higher matching rates, we found  that for the quarter we investigated (generally the 1st quarter of fiscal year  2017), our selected regional offices did not consistently do so for three  types of expenditures that we reviewed: IHS, family planning, and certain  women with breast or cervical cancer. Two of the three regional offices  (regions 3 and 9) did not conduct or did not document these required  variance analyses, and the remaining regional office (region 6) conducted  the analyses but deviated from standard procedures outlined in CMS  guidance, as summarized below.

CMS region 3. Reviewers did not conduct variance analyses for either  Maryland or Pennsylvania. Regional office staff with whom we spoke  said that as part of the quarterly review they conduct the standard  variance analysis on category of service lines of the CMS-64.  Expenditures for IHS, family planning and services for certain women  with breast or cervical cancer are not separately identified at that  level. Although CMS reviewers said they thought the standard  analysis was sufficient, net changes within a broad service category  may obscure major changes within these higher matched  expenditures. For example, examining changes in total inpatient  hospital expenditures would not necessarily reveal a significant  variance limited to inpatient expenditures in IHS facilities that receive  a higher federal match.

CMS region 9. Reviewers told us that they examined higher matched  expenditures for California; however, no variance analyses of IHS,  family planning, or breast or cervical cancer services were included in  the work papers provided to us. In addition, they told us that they do  not conduct a variance analysis on IHS, family planning, and services  for certain women with breast or cervical cancer for Nevada, noting  that expenditures in these areas tend to be quite small.

CMS region 6. Reviewers conducted a variance analysis of these  higher matched expenditures for Arkansas and Texas and provided  us documentation; however, the documentation showed some  deviation from the required steps specified in CMS’s guidance. For  example, for Texas, spending on two of the three categories was  beyond the threshold for significance, but the reviewer did not  document any follow-up with the state.

Although expenditures for IHS, family planning, and certain women with  breast or cervical cancer constituted a small share of total federal  spending on Medicaid services—roughly 1 percent—combined spending  on these categories was approximately $1 billion in the first quarter of  fiscal year 2017. Our analysis indicated that variances in spending for  these three services ranged widely across our six states, and in four of  the states, some of their expenditures were above the thresholds for  significance. (See fig. 4.) For example, in regional office 3, Maryland  experienced a significant variance in its family planning expenditures—an  increase of approximately $8 million dollars or 7,700 percent from the  previous quarter—but there was no indication in the documentation  provided that the regional office identified or investigated that variance.

Similar to the variance analyses for other higher matched expenditure  types, we found that the selected regional offices did not consistently  conduct variance analyses on expenditures reported for the Medicaid  expansion population. First, although five of our six states opted to  expand Medicaid under PPACA, two of the five states (Maryland and  Pennsylvania) were not subjected to a variance analysis for their  expansion populations, a segment that accounted for nearly $7 billion in  Medicaid expenditures in fiscal year 2016. Among the remaining three  states, CMS regional office staff conducted a variance analysis, but in two  of them, the reviewers did not document whether they investigated  significant variances, leaving it unclear whether this required step was  taken. Specifically, for two of the three remaining states—Arkansas and  Nevada—reviewers did not document which variances were deemed  significant or that any such variances were discussed with state officials.

The guidance specified in CMS’s quarterly review guide is not always  clear or consistent. For example:

For IHS, family planning, and certain women with breast or cervical  cancer, the guidance is explicit that the analysis is required, but the  automated variance report used by reviewers for the step does not  include these expenditures.

For Medicaid expansion expenditures, the review guide is not explicit  about whether a variance analysis is required, but CMS has an  automated variance report available for these expenditures, which  suggests that such an analysis was expected.

The guidance suggests that a variance analysis should be conducted  for expansion enrollees; however, it does not specify whether the  analysis should be conducted in conjunction with—or take the place  of—more in-depth examinations.

According to federal internal controls standards for information and  communication, agencies should communicate the information necessary  for staff to achieve the agency’s objectives. CMS’s guidance on  conducting variance analyses for types of expenditures with higher  federal matching rates has not been sufficiently clear to assure that such  analyses are being consistently conducted. By not consistently  conducting such checks, errors may be going undetected and CMS may  be providing federal funds at a higher matching rate than is allowable.

The Sampling Procedures Used to Examine Medicaid Expansion Expenditures Did Not Account for Varying Risks across States

CMS has additional procedures in place to review service expenditures  reported for the Medicaid expansion population, a category of  expenditures that received a 95 percent federal match in 2017.  Specifically, in addition to a variance analysis, CMS guidance specifies  that each regional office reviewer is to review claims for a sample. The  guide directs the reviewer to obtain a full list of all expansion enrollees  from the state and to select 30 to 40 for further review. Next, the reviewer  is to obtain supporting documentation from the state listing the eligibility  factors for the sampled enrollees, such as age, pregnancy status,  Medicare enrollment, and income. The reviewer is to select a single claim  for each enrollee and verify that the corresponding expenditures were  reported under the correct federal matching rate category—i.e., that the  sample claim for each individual was accounted for in the relevant section  of the CMS-64. The review guide specifies that the sample review be  conducted each quarter unless the state has had four consecutive  quarters with three or fewer errors, in which case, the sampling must be  performed only annually.

We found that regional offices were identifying errors in their sampling  reviews. For example, region 3 reviewers found that Pennsylvania had  incorrectly categorized an individual in the sample as a Medicaid  expansion enrollee, with the selected expenditures initially reported as  eligible for the higher matching rate. According to CMS central office  officials, the sampling methodology has helped identify systemic issues  with state expenditure systems in some states and resulted in corrections,  adjustments, and in one case, a disallowance. Under current procedures,  among our five selected states that expanded Medicaid under PPACA, all  five were determined to have had four consecutive clean quarters  according to agency officials; that is, the state had three or fewer errors in  each quarter. Nationally, all but one of the 33 states that have  implemented Medicaid expansion under PPACA had four consecutive  clean quarters as of March 2018, according to CMS officials.

We found, however, that CMS’s procedures for sampling reviews had a  key weakness in that they did not account for varying risks across states,  as illustrated in the following examples.

We found that sample size does not account for significant differences  in program size. For example, both California and Arkansas have  expanded Medicaid under PPACA, and regional office staff told us  they reviewed claims for 30 expansion enrollees in each of the two  states, despite the fact that California has over 10 times as many  expansion enrollees as Arkansas. Region 9 officials told us that for  California they had initially sampled 100 enrollees during the first  quarter they were required to conduct this analysis, but the review  was time consuming given staff resources, and they were advised by  CMS’s central office to limit their sample to 30 individuals. CMS  officials told us that the sampling procedures are resource intensive  and that the sample size they decided upon was what they thought  they had the resources to complete.

Additionally, the sample size does not account for previously identified  risks in a state’s program. Specifically, as we noted in a 2015 report,  CMS’s sampling review of expansion expenditures was not linked to  or informed by reviews of eligibility determinations conducted by CMS,  some of which identified high levels of eligibility determination  errors. According to CMS officials, the expenditure review is  primarily intended to ensure that states are correctly assigning  expenditures for the expanded eligibility groups as initially determined,  not whether the eligibility determination is correct.

Federal standards for internal control related to risk assessment require  that agencies identify, analyze, and respond to risks. However, because  CMS’s sampling methodology does not account for risk factors like  program size and high levels of eligibility determination errors, the  agency’s review of expansion population expenditures may be missing  opportunities to detect systemic issues with improperly matched  expenditures.

Quarterly variance analyses and sampling of Medicaid expansion  enrollees can be supplemented by financial management reviews. For  fiscal year 2016, CMS recommended regional offices conduct FMRs on  expenditure claims for expansion enrollees. As of March 2018, however,  regional offices had completed an FMR on Medicaid expansion  expenditures in only one state, with no findings, and were in the process  of completing FMRs for five other states. According to CMS officials, no  additional reviews in this area were planned for fiscal year 2018.

CMS Resolved over $5.1 Billion in Expenditure Errors in Fiscal Years 2014 through 2017

Financial Impact of Expenditure Reviews  Compared with Program Integrity  Recoveries   The impact of CMS’s expenditure review  activities is greater than the impact from other  program integrity efforts. For example, in  fiscal year 2015, CMS resolved errors through  expenditure reviews that saved over $1.4  billion in federal funds. In the same year,  CMS reported that efforts by states and the  federal government to identify improper  payments to providers—for example, services  that were billed by a provider but were not  received by a beneficiary—resulted in  recoveries that totaled $852.9 million, in both  state and federal funds.

In fiscal years 2014 through 2017, CMS’s regional offices resolved  expenditure errors that reduced federal spending by over $5.1 billion, with  at least $1 billion in errors resolved in each of three of those four years.  Errors were resolved through states agreeing to reduce their reported  expenditures, which prevented federal payments to the state for those  expenditures; and through CMS issuing disallowances, under which  states are required to return federal funds. Although CMS resolved over  $1 billion in expenditure errors in each year of fiscal years 2014 through  2016, CMS resolved less than $600 million in fiscal year 2017. CMS  officials explained that this change likely reflects delays in clearance of  disallowances due to the transition between presidential administrations.  (See fig. 3.) In addition to these resolved errors, as of the end of 2017,  CMS had $4.47 billion in outstanding deferrals of federal funds, where  CMS was delaying federal funds until additional information was provided.  Expenditures flagged for deferrals may or may not represent errors.

All 10 CMS regional offices resolved errors from fiscal years 2014 through  2017, though the magnitude varied across regions. (See table 5.) Among  the 10 regional offices, 9 reported that they had resolved errors through  states agreeing to reduce reported expenditures. Additionally, 9 regional  offices issued a total of 49 disallowances across 16 states, with the  majority of the disallowances occurring in regional offices 2 and 3. Finally,  all 10 regional offices had taken deferrals for questionable expenditures,  with 22 states having outstanding “active” deferrals that had not been  resolved as of the fourth quarter of fiscal year 2017, which ranged in  amount from $178 to $444 million. CMS officials told us that the range of  resolved errors and deferred funds across regional offices may reflect  differences in the proportion of high-expenditure states. For example,  regional office 4 oversees four states ranking in the top 20 in terms of  Medicaid expenditures, while regional office 8 does not oversee any top- 20 states. The variation may also reflect large actions taken in specific  states. For example, the majority of the disallowed funds in regional office  2 from fiscal years 2014 to 2017 were due to a single disallowance of  $1.26 billion in one state.

The financial significance of individual errors resolved by CMS’s regional  offices varied significantly. We found that regional offices resolved errors  that ranged from reporting errors that had no federal financial impact— such as expenditures that were allowable, but were reported on the  incorrect line—to hundreds of millions of dollars in expenditures that were  found to be unallowable under Medicaid requirements. Over the fiscal  years we reviewed, more than half of the disallowances CMS issued were  less than $15 million; however, in four states CMS issued disallowances  of over $100 million, including a disallowance of over $1 billion in New  York. (See fig. 5.)

In some cases, actions taken by CMS to resolve errors were the  culmination of years of work. For example, over several years the  California Medicaid program reported a large volume of expenditures for  which it did not yet have sufficient supporting documentation. The  regional office officials told us that the state reported these expenditures  in order to comply with the 2-year filing limit, and had reported these as  “placeholder claims,” with the intention of providing additional support at a  later time. Over the course of at least 6 years, CMS deferred hundreds of  millions of dollars in federal funds related to these placeholder claims. Of  the active deferrals as of the end of fiscal year 2017, most of the total  amount of deferred funds was taken for expenditures in California, which  represented $3.4 billion of the $4.5 billion in total active deferrals.  According to CMS officials, in 2015, CMS prohibited California from  reporting additional placeholder claims. Region 9 officials told us that they  continue to work with the state to clear the deferrals related to this issue.  They were able to resolve 9 related deferrals in fiscal year 2017;  however, another over 60 deferrals were still unresolved.

The growth of federal Medicaid expenditures, estimated at about $370  billion in fiscal year 2017, makes it critically important to assure  expenditures are consistent with Medicaid requirements. CMS has a  variety of processes in place to review state-reported expenditures, and  those reviews have resulted in CMS resolving errors that have saved the  federal government a considerable amount of money; over $5 billion in  the last 4 years. However, the increasing complexity of expenditure  reporting is occurring as resources to review these expenditures are  decreasing, hindering CMS’s ability to target risk and potentially allowing  for hundreds of millions of federal dollars in errors to go undetected. In  the absence of a comprehensive risk assessment, which CMS has not  conducted, CMS may be missing opportunities to better target resources  to higher risk expenditures and increase the savings from these oversight  activities.

The variety of different matching rates has contributed to the increased  complexity of CMS’s expenditure reviews. Although CMS has review  procedures in place to assure that the correct matching rate is applied for  services and populations receiving a higher federal matching rate, unclear  guidance has contributed to inconsistency in the extent to which these  reviews are conducted. In addition, we found weaknesses in the sampling  methodology CMS requires its regional offices to use to help ensure that  expenditures for Medicaid expansion enrollees—expenditures that  receive a higher matching rate and that represented almost 20 percent of  total federal Medicaid spending in 2016—are consistent with Medicaid  requirements. In particular, the methodology does not account for risk  factors like program size or vulnerabilities in state eligibility-determination  processes and systems. As a result of the inconsistency in reviews and a  sampling methodology that does not consider program risk, errors may be  going undetected, resulting in CMS providing federal funds at higher  federal matching rates than is allowable. In addition, CMS could be  missing opportunities to identify any systemic issues that may contribute  to such errors.

We are making the following three recommendations to CMS:  1.  The Administrator of CMS should complete a comprehensive, national  risk assessment and take steps, as needed, to assure that resources  to oversee expenditures reported by states are adequate and  allocated based on areas of highest risk. (Recommendation 1)  2.  The Administrator of CMS should clarify in internal guidance when a  variance analysis on expenditures with higher match rates is required.  (Recommendation 2)  3.  The Administrator of CMS should revise the sampling methodology for  reviewing expenditures for the Medicaid expansion population to  better target reviews to areas of high risk. (Recommendation 3)

We provided a draft of this report to HHS for review and comment. HHS  concurred with all three recommendations, noting that it takes seriously  its responsibilities to protect taxpayer funds by conducting thorough  oversight of states’ claims for federal Medicaid expenditures. Regarding  our first recommendation—that CMS complete a comprehensive, national  risk assessment and take steps to assure that resources are adequate  and allocated based on risk—HHS noted that CMS will complete such an  assessment, and, based on this review, will determine the appropriate  allocation of resources based on expenditures, program risk, and  historical financial issues. CMS will also identify opportunities to increase  resources. Regarding our second recommendation—clarifying internal  guidance on when a variance analysis on higher matched expenditures is  required—HHS noted that CMS will issue such internal guidance.  Regarding our third recommendation—that CMS revise the sampling  methodology for reviewing expenditures for the Medicaid expansion  population to better target reviews to areas of high risk—HHS noted CMS  is considering ways to revise its methodology.

HHS’s comments are reproduced in appendix II.

As agreed with your offices, unless you publicly announce the contents of  this report earlier, we plan no further distribution until 30 days from the  report date. At that time, we will send copies of this report to the  Secretary of Health and Human Services, appropriate congressional  committees, and other interested parties. The correspondence is also  available at no charge on the GAO website at http://www.gao.gov.

If you or your staff members have any questions about this report, please  contact me at (202) 512-7114 or yocomc@gao.gov. Contact points for our  Offices of Congressional Relations and Public Affairs may be found on  the last page of this report. GAO staff who made key contributions to this  report are listed in appendix III.

Appendix I: CMS Financial Management Review (FMR) Topics and Estimated Amounts at Risk, Fiscal Years 2014 through 2017

Public psychiatric residential treatment facilities   Medicare Part B premium buy-ins  Outpatient hospital reimbursement for mental health services  Review of comprehensive psychiatric emergency program rates  Provider taxes implemented to avoid program reductions  Health homes data and expenditures reporting  Provider incentive payments for health information technology   1115 demonstration provider incentive payments  Public psychiatric residential treatment facilities  Managed care organizations’ provider payments  Provider incentive payments for health information technology   Federally qualified health center reimbursement payments  Eligibility and enrollment maintenance and operations  Managed care organizations’ reporting of drug rebates   3   CMS cancelled these 2014 FMRs due to a staffing shortage.  Region 8 was excused from the requirement to conduct an FMR in 2016 due to staffing constraints.

Appendix II: Comments from the Department of Health and Human Services

Appendix III: GAO Contact and Staff Acknowledgments

In addition to the contact named above, Susan Barnidge (Assistant  Director), Jasleen Modi (Analyst-in-Charge), Caroline Hale, Perry  Parsons, and Sierra Gaffney made key contributions to this report. Also  contributing were Giselle Hicks, Drew Long, and Jennifer Whitworth.

The Centers for Medicare & Medicaid Services (CMS) review state spending reports to verify that states appropriately spent their federal Medicaid funds.

CMS reviewers have saved over $5 billion in the past 4 years by identifying errors in state spending reports—finding expenditures that lacked supporting data or were not allowed under Medicaid rules.

Could they be finding more? CMS may be missing chances to save because of how it targets its reviews. For example, CMS has 1 staff member reviewing Arkansas reports and only 2.2 staff reviewing California, which spends 15 times as much. Our recommendations address this and other issues we found.


DOD Financial Management: Additional Actions Needed to Complete the Army's Analyses of Unsupported Accounting Entries for Its General Fund

The Department of Defense (DOD) remains on GAO's High-Risk List in part because of its long-standing financial management deficiencies, which have prevented it from having auditable financial statements. One of the contributing factors is the billions of dollars of unsupported JVs within DOD's accounting systems, with the largest portion attributable to the Army's general fund. Because the National Defense Authorization Act for Fiscal Year 2014 required that DOD submit audit results to Congress for fiscal year 2018, a Working Group was established to address the Army's unsupported JVs, including analyzing root causes and developing corrective action plans.

This report examines to what extent the Working Group, as of March 2017, has performed analyses and developed corrective action plans to address identified root causes. GAO reviewed and analyzed relevant documentation and interviewed agency officials and members of the Working Group.

Since February 2015, the Journal Voucher Working Group (Working Group), which is comprised of Department of the Army (Army) and Defense Finance and Accounting Service personnel, has been actively working toward implementing new processes to address inadequate support for journal vouchers (JV) in the Army's general fund. JVs are accounting entries manually entered or system generated to record corrections or adjustments in an accounting system. From October 2016 to March 2017, the Working Group identified more than 121,000 unsupported JVs totaling $455 billion in one of its reporting systems, Defense Departmental Reporting System-Budgetary (DDRS-B).

In the May 2017 Financial Improvement and Audit Readiness Plan Status Report, the Army stated that it had completed its root cause analyses for all JVs. However, GAO found that the Working Group had conducted the analyses on only a small percentage of the total number of unsupported JVs that existed as of March 2017. Specifically, as of March 2017, the Working Group had been focusing on manual JVs processed in DDRS-B, which only represent 10 percent of the dollar value and 3 percent in the total number of unsupported JVs in that system alone. Therefore, the analyses cannot be considered complete because the Working Group had not yet analyzed the remainder of the population, including those in other systems. Members of the Working Group indicated that in March 2017, the Working Group began including system-generated JVs in its analyses, which made up 90 percent in dollar value and 97 percent in total number of unsupported JVs processed in DDRS-B as of March 2017, but had not yet begun identifying any root causes. Members of the Working Group stated that these efforts will be an ongoing, iterative process because of anticipated new challenges that continually arise from new business processes or programs.

As of March 2017, the Working Group reported that it had developed 38 corrective action plans to address all of the identified root causes of unsupported manual JVs in DDRS-B for the Army's general fund. According to members of the Working Group, 18 of the 38 have been implemented. However, the Working Group is unable to determine how many more corrective action plans will need to be developed to resolve the unsupported JV issue until the root cause analyses are complete. Further, GAO found that the Working Group's monitoring of corrective action plan implementation does not include a method that sufficiently identifies the progress toward fully addressing the issue of unsupported JVs or to what extent each implemented corrective action plan has reduced unsupported JVs. Members of the Working Group stated that the Working Group uses monthly JV metrics reports to monitor its implemented corrective actions, but the reports are not designed to provide the level of detail necessary to sufficiently monitor whether root causes identified are resolved through corrective action plans. Therefore, the metrics cannot demonstrate to what extent the Working Group has reduced unsupported JVs and how much more effort is required to fully address the issue and help ensure that the Army's financial statements are auditable for fiscal year 2018.

GAO recommends that the Army (1) ensure that the entire population of unsupported JVs is identified and analyzed and (2) develop metrics that sufficiently monitor the extent to which the Working Group has identified root causes and determine the extent to which unsupported JVs are being reduced based on the implemented corrective actions. The Army concurred with GAO's recommendations and provided information on actions it has taken or plans to take to address them.

The Department of Defense (DOD) has been on GAO’s High-Risk List  since 1995 in part because of long-standing, uncorrected deficiencies  with its financial management systems, business processes, financial  manager qualifications, and material internal control and financial  reporting weaknesses. These deficiencies prevent DOD from having  auditable financial statements, which is one of the three major  impediments preventing us from expressing an opinion on the  consolidated financial statements of the U.S. government. According to  DOD, one of the contributing factors to its inability to produce auditable  financial statements is the billions of dollars of unsupported journal  vouchers (JV) within its accounting systems, with the largest portion  attributed to the Department of the Army’s (Army) general fund. JVs are  accounting entries to record corrections or adjustments to a business  transaction in an accounting system. While the use of JVs is a common  accounting practice, they should be fully supported with detailed  information to appropriately justify the accounting entries. Without such  support, management and auditors are unable to assess the validity of  the accounting entries, and to the extent that the unsupported JVs are  material to the financial statements, the auditors would be unable to  complete their audit. When financial statements are not prepared with  supported accounting entries, there is a risk that DOD and Army management cannot rely on the Army’s accounting system data when  making management and resource decisions.

The National Defense Authorization Act (NDAA) for Fiscal Year 2014  required that the Secretary of Defense ensure that a full audit is  performed on DOD’s fiscal year 2018 financial statements and that the  results be submitted to Congress no later than March 31, 2019.  Therefore, with oversight from the Office of the Assistant Secretary of the  Army for Financial Management and Comptroller (ASA(FM&C)),  personnel from the Army and the Defense Finance and Accounting  Service (DFAS), the Army’s service provider, formed a Journal Voucher  Working Group (Working Group) in February 2015 to address the  inadequate support of JVs affecting the Army’s financial statements. The  Working Group has been tasked to actively work toward reducing the  number of unsupported JVs for the Army’s general fund. Specifically,  one of the main focuses of the Working Group is to determine the root  causes of unsupported JVs and to develop corrective action plans for the  identified root causes. The Working Group conducts biweekly meetings  to discuss current initiatives, any outstanding issues, and progress toward  its goals. Additionally, ad hoc meetings are scheduled as needed.

This audit was initiated as part of the mandate that requires GAO to audit  the U.S. government’s consolidated financial statements, which cover all  accounts and associated activities of the executive branch agencies,  including DOD, because of the significance of the military services’  financial statements to the audit of the consolidated financial statements  of the U.S. government. Our objectives were to report the extent to which  the Working Group, as of March 2017, (1) performed analyses to  determine the root causes of unsupported JVs for the Army’s general  fund and (2) developed and monitored the implementation of corrective  action plans to address identified root causes of unsupported JVs.

To address our first objective, we reviewed various Army, DFAS, and  DOD financial reporting guidance; performed walk-throughs of the JV  process; and interviewed agency officials to gain an understanding of the  processes for recording JVs and analyzing causes of unsupported JVs.  We also reviewed documentation provided and interviewed the Working  Group members to determine the extent to which root cause analyses  have been performed and completed as of March 2017 and whether the  population of accounting entries used for analyses included all  unsupported JVs. To address our second objective, we obtained  documentation of and inquired about the development and monitoring of  the implementation of the Working Group’s corrective action plans to  address the root causes identified as of March 2017. We also obtained  and analyzed monthly JV metrics reports (metrics) produced by DFAS.  Members of the Working Group use the metrics as their primary source  for monitoring progress. We inquired about any limitations or challenges  that prevented the Working Group from fully implementing any developed  corrective action plans. Further details on our scope and methodology are  provided in appendix I.

We conducted this performance audit from December 2015 to October  2017 in accordance with generally accepted government auditing  standards. Those standards require that we plan and perform the audit to  obtain sufficient, appropriate evidence to provide a reasonable basis for  our findings and conclusions based on our audit objectives. We believe  that the evidence obtained provided a reasonable basis for our findings  and conclusions based on our audit objectives.

The federal government began preparing and we began auditing the  consolidated financial statements of the U.S. government in fiscal year  1997. However, we have been unable to render an opinion on them in  part because of serious financial management problems at DOD that  have prevented its financial statements from being auditable. Pursuant to  the NDAA for Fiscal Year 2010, DOD developed and has updated a  Financial Improvement and Audit Readiness (FIAR) Plan. The FIAR Plan  includes the specific actions to be taken and costs associated with   (1) correcting the financial management deficiencies that impair DOD’s  ability to prepare complete, reliable, and timely financial management  information and (2) ensuring that DOD’s financial statements are  validated as ready for audit by September 30, 2017. Further, the NDAA  for Fiscal Year 2014 mandated that the Secretary of Defense ensure that  an audit is performed on DOD’s fiscal year 2018 financial statements and  that the results are submitted to Congress no later than March 31, 2019.

DOD has undertaken several financial management improvement  initiatives over the years to address deficiencies in business systems,  processes, and controls through its FIAR Plan and financial management  reform methodology contained in its FIAR Guidance. In its April 2016  FIAR Guidance, DOD identified seven critical capabilities that are  necessary to achieve auditability. One of the seven critical capabilities  identified is the ability to support or eliminate certain material JVs and  other adjustments made to financial transactions, trial balances, and  financial statements. As of September 2015, DOD determined that the  largest portion attributable to the billions of dollars of unsupported JVs  relates to the Army’s general fund. In 2015, DOD created the Working  Group, made up of both Army and DFAS personnel, to develop solutions  to reduce the number of required JVs and reduce or eliminate the number  of unsupported JVs that affect the Army’s general fund.

In July 2016, DOD’s Office of the Inspector General (OIG) released a  report indicating that about 90 percent of the dollar value and number of  the Army general fund JVs the OIG tested, which were defined by the  Army as “supported,” were in fact unsupported because the JVs either   (1) forced account balances to agree with other data sources without  reconciling the differences or determining which data sources were  correct, (2) corrected errors or reclassified amounts to other accounts  without adequately documenting why the JVs were needed, or   (3) changed ending balances of accounts without adequate  documentation to support the JVs.

DOD acknowledged in its November 2016 FIAR Plan Status Report that it  still faces a significant challenge in reducing the number and amount of  unsupported JVs. The November 2016 FIAR Plan Status Report also  set a December 2016 completion date for the Army to (1) perform JV root  cause analyses for all financial statements for all JVs and (2) implement  corrective action plans and verify successful implementation of DFAS’s  corrective actions.

As shown in figure 1, the Army uses multiple systems to document,  record, and report activities at the transaction level, which are then  consolidated and uploaded into DOD’s reporting system known as the  Defense Departmental Reporting System (DDRS). JVs can be used to  record accounting entries and make any necessary corrections or  adjustments within any of these systems at the transaction level or  consolidated level. JVs can also be manually entered or system  generated in the accounting systems. Manual JVs are those prepared by  DFAS personnel to adjust errors identified during financial statement  compilation, to record necessary accounting entries caused by system  limitations or timing differences, and to prepare required month- and year- end closing accounting entries. System-generated JVs are those  automatically generated based on system change requests and without  manual involvement by DFAS personnel.

The General Fund Enterprise Business System (GFEBS) is the Army’s  primary accounting system used to record the majority of the Army’s  activities, including budget execution, procurement, civilian pay,  collections, and disbursements. The Army also has a separate accounting  system for supply-related transactions called the Global Combat Support  System (GCSS). Accounting entries for transactions recorded in GCSS  are sent to GFEBS to consolidate all of the Army’s transaction data into a  single accounting system. Then, at month’s end, all the information in  GFEBS is uploaded into the budgetary module of DDRS known as the  Defense Departmental Reporting System-Budgetary (DDRS-B).

The Army also has several legacy systems that continue to process  transactions but were not designed to interface with GFEBS as the  accounting formats are not compatible. Therefore, at each month’s end,  the balances for the legacy systems are configured into a format that can  be read by DDRS-B and crosswalks to the accounts within the DDRS-B  accounting system before they are sent to DDRS-B. Once the balances  have been uploaded, DDRS-B performs edit checks to identify any errors  that may exist. DFAS personnel then pull the data into the Electronic  Error Correction and Transaction Analysis (ELECTRA) application to  review any errors identified during the edit checks and use ELECTRA to  create a JV to be uploaded into DDRS-B that makes necessary  corrections or adjustments.

After the Army has consolidated all information into DDRS-B from both  GFEBS and legacy systems each month, DFAS personnel will review the  information to determine whether any additional JVs are necessary to  correct errors identified during the reconciliation process or to record any  JVs that could not be processed prior to the upload into DDRS-B.

On a quarterly basis after all necessary corrections are made, all  information in DDRS-B is consolidated and uploaded into a second  module within DDRS known as the Defense Departmental Reporting  System-Audited Financial Statements (DDRS-AFS), which is used to  prepare the financial statements. At this level, additional JVs can be  made if DFAS personnel determine that further corrections are necessary  or if information is received subsequent to the upload from DDRS-B.

The Working Group Has Identified Some Root Causes but Has Not Started Analyses of the Majority of Unsupported Journal Vouchers

The Working Group has been actively working toward implementing new  processes to support JVs and eliminate unsupported JVs in the Army’s  general fund. From October 2016 to March 2017, the Working Group,  based on DFAS-produced metrics, reported that it had identified more  than 121,000 unsupported JVs totaling $455 billion.

The Working Group prioritized its identifying of root causes of  unsupported JVs based upon factors such as potential correction  complexity, materiality, and volume. In the May 2017 FIAR Plan Status  Report, DOD stated that the Army had completed its root cause analyses  for all JVs. However, we found that the analyses have been performed on  only a small percentage of the total number of unsupported JVs that  existed as of March 2017 and cannot be considered completed for all  unsupported JVs. In addition, members of the Working Group confirmed  as of June 2017 that the Working Group has not yet performed all  analyses necessary and stated that the Working Group’s efforts will be an  ongoing, iterative process because of anticipated new challenges that  continually arise from new business processes or programs.

A critical capability to achieve auditability, described in the April 2016  FIAR Guidance, is that all material JVs be supported and the population  of accounting entries reconcile with each financial statement line item as  well as the originating system of the accounting entry. As highlighted in  figure 2, the Working Group focused its efforts on manual JVs processed  at the consolidated level within DDRS-B as these JVs were consistent  with its prioritization method in conducting the analyses and getting the  financial statements audit ready.

In December 2015, DFAS began requiring a form to be attached to all  manual DDRS-B JVs that serves as a checklist of all documents  necessary to be included for a JV to be considered supported. However,  as indicated on the metrics provided through March 2017, manual  unsupported JVs were still being recorded in DDRS-B. Further, as of  March 2017, the Working Group had not included in its root cause  analyses (1) any unsupported JVs at the transaction level, such as within  GFEBS, which are mostly attributed to year-end closing accounting  entries; (2) any unsupported JVs within DDRS-AFS, which are used to  prepare the financial statements; or (3) system-generated JVs. As a  result, a significant number of JVs still require analyses.

Our review of the population of unsupported JVs from October 2016 to  March 2017 found that system-generated JVs made up 90 percent in  dollar value and 97 percent in number of total unsupported JVs. In July  2016, the DOD OIG similarly found that the Working Group had not been  analyzing its system-generated JVs and recommended that the Working  Group periodically review system-generated JVs to understand the  reasons for the JVs and to verify the support for the JVs. Acting on the  DOD OIG’s recommendation, members of the Working Group indicated  that in March 2017, the Working Group began including system- generated JVs in its population of JVs to analyze but had not yet begun  its analyses or identified any root causes. In addition, members of the  Working Group stated that in February 2017, the Working Group began  planning a new initiative called the Business Mission Area Champions  (BMAC) Initiative. This initiative is to expand the Working Group’s  analyses of root causes for JVs beyond those recorded at the  consolidated level within DDRS-B and begin analyzing transaction-level  JVs recorded in its systems that feed into DDRS-B before consolidation,  such as GFEBS. However, as of May 2017, no details have been  developed, such as planned actions or timelines. Therefore, because of  the recent inclusion of the large population of system-generated JVs in  the total population and because the BMAC Initiative is not yet under way,  a significant amount of analyses remains to fully identify root causes and  ultimately correct the Army’s overall unsupported JV issue. Figure 3  summarizes the progress of the Working Group’s root cause analyses of  unsupported JVs as of March 2017.

According to OMB Circular A-123, agencies should perform a root  cause analysis of the deficiencies to ensure that subsequent strategies  and plans address the root cause of the problem and not just the  symptoms. Identifying and developing an understanding of the root cause  is management’s responsibility. In addition, Standards for Internal Control  in the Federal Government states that management should complete and  document corrective actions to remediate control deficiencies on a timely  basis. Because it has not yet performed root cause analyses on the  majority of unsupported JVs, the Working Group has not been able to  identify appropriate corrective actions to eliminate such unsupported JVs  and ultimately help produce auditable financial statements for the Army’s  general fund.

The Working Group Has Developed Corrective Action Plans for All Identified Root Causes but Is Not Sufficiently Monitoring Implementation

As of March 2017, members of the Working Group reported that the  Working Group had developed 38 corrective action plans to address all of  the identified root causes of unsupported manual JVs at the consolidated  level in DDRS-B for the Army’s general fund. According to these  members, of the 38 corrective action plans developed, 18 have been  implemented. In addition, because the root cause analyses have been  limited, the Working Group has not yet been able to determine how many  more corrective action plans will need to be developed to resolve the  unsupported JV issue.

Further, we found that the Working Group’s monitoring of corrective  action plan implementation does not include a method that sufficiently  identifies the progress that has been made toward fully addressing the  issue of unsupported JVs or to what extent each implemented corrective  action plan has reduced unsupported JVs. The April 2016 FIAR Guidance  provides specific tasks for DOD reporting entities, including the Army, to  complete so that DOD can achieve its audit readiness objective. One of  these tasks specific to JVs is to describe plans for implementing  corrective actions to address the root causes of unsupported JVs. In  addition, the Implementation Guide for OMB Circular A-123 recommends  that management identify measurable indicators to better assess  progress and more rapidly make course corrections to ensure timely and  effective resolution of identified issues. In order to monitor whether a  corrective action plan was implemented effectively, members of the  Working Group stated that the Working Group uses metrics to monitor  implementation of corrective actions for unsupported manual JVs at the  consolidated level in DDRS-B. DFAS creates monthly metrics reports of  DDRS-B accounting entries that include all unsupported and supported  JVs for the month.

The JVs used to create these metrics are the same JVs that the Working  Group uses to conduct its JV root cause analyses. However, the metrics  organize the JVs into broad categories that do not provide enough details  to link to the categories that the Working Group uses. For example, the  metrics use broad categories, such as data calls or correcting entries to  classify the JVs, whereas the root cause analyses are conducted at a  more detailed level, such as for a specific transaction. The Working  Group was unable to demonstrate to us which metric category was  affected by the corrective action plan implemented for each root cause  identified. In addition, the Working Group’s reported progress was based  on an increase in the percentage of supported JVs in relation to the total  population of JVs from October 2016 to March 2017 as reported in the  metrics. However, during this period, the metrics also show an increase in  the actual number and dollar amount of manual unsupported JVs.  Specifically, based on the Working Group’s reporting method, the  percentage of unsupported manual JVs decreased in relation to the total  population of manual JVs from October 2016 to March 2017 by 8 percent  in the number of JVs and 14 percent in the dollar value of JVs. However,  the actual number and dollar value of the unsupported manual JVs  reported on the October 2016 and March 2017 metrics increased from  329 to 462 and from a total of $3.3 billion and $7.0 billion, respectively.  Because the metrics used to monitor corrective action plans do not clearly  indicate which JVs are affected by a specific root cause identified,  resolved JVs cannot be tied to an implemented corrective action plan.  Therefore, the Working Group is unable to demonstrate to what extent it  has moved closer to eliminating and reducing unsupported JVs and to  what extent the Army’s financial statements are becoming auditable for  fiscal year 2018.

In addition, according to members of the Working Group as of March  2017, 16 of the 20 remaining corrective action plans developed are  pending implementation because they require system changes, which  need to be negotiated with the contractor selected to make the system  changes. Therefore, the Working Group has developed temporary  mitigating procedures to support those JVs required to be recorded until  system changes are implemented. For example, one of the root causes  that the Working Group identified was a JV recorded in DDRS-B related  to the accounting entry to record a customer refund from a prior year  purchase. When DFAS personnel record an accounting entry for a  customer refund from a prior year purchase into GFEBS, the system  erroneously records the transaction as a current year refund, through the  reimbursements and other income earned—collected account, rather than  as a current year obligation and outlay as required by OMB Circular A-11,  Preparation, Submission, and Execution of the Budget. Until this system  change is made to GFEBS so that it can differentiate between the return  of a prior year purchase or a current year purchase, DFAS has to reverse  each entry and record the current year obligation and outlay with an additional JV into DDRS-B to correct the error made and include with the  JV an explanation of the situation as well as detail level transactions to  support the JV. DFAS considers this type of support to be a temporary  solution; however, until system changes are made, the Working Group  will be unable to implement the corrective action plans developed and  resolve the root causes identified or determine whether the corrective  action plan developed for this issue will be effective.

Since 2015, the Working Group has been analyzing manual unsupported  JVs in DDRS-B to determine their root causes and to concentrate its  efforts on getting the Army’s financial statements audit ready. As of March  2017, the Working Group had not analyzed system-generated JVs that  constitute 90 percent of the total dollar value or 97 percent of the total  number of unsupported JVs because of the volume and potential  correction complexity of these JVs. Also, the Working Group had not  analyzed unsupported JVs at the transaction level or in DDRS-AFS.  Although we recognize that these efforts will be an ongoing, iterative  process, until the Working Group has identified and completed its  analyses of root causes for all unsupported JVs, the Army will not be able  to correct the overall unsupported JV issue.

As of March 2017, the Working Group had developed 38 corrective action  plans and verified successful implementation of 18 corrective action plans  to address the issue of unsupported JVs in the Army’s general fund.  However, because the Working Group’s root cause analyses were limited  to a small percentage of the total unsupported JVs, the development of  corrective action plans was likewise limited. In addition, the metrics used  to analyze JVs and monitor implemented corrective actions are not  designed to provide the level of detail necessary to sufficiently monitor  whether root causes identified are resolved through corrective action  plans. As a result, the Army cannot determine to what extent it has  reduced unsupported JVs in its general fund and how much more effort is  required to fully address the issue and help ensure that the Army’s  financial statements will be auditable for fiscal year 2018.

We are making the following two recommendations to the Army:  The Assistant Secretary of the Army for Financial Management and  Comptroller should ensure that the Working Group identifies and  analyzes the full population of manual unsupported JVs at the transaction  level and in DDRS-AFS and determines the root causes for these JVs.  (Recommendation 1)

The Assistant Secretary of the Army for Financial Management and  Comptroller should work with DFAS to enhance the monthly JV metrics  report or develop another method to sufficiently monitor the extent to  which the Working Group has identified the root causes of unsupported  JVs and to determine the extent to which unsupported JVs are being  reduced based on the implemented corrective actions. (Recommendation  2)

We provided a draft of this report to the Army for review and comment. In  its written comments, reprinted in appendix II, the Army concurred with  our recommendations and provided information on actions it has taken or  plans to take to address them.

We are sending copies of this report to the appropriate congressional  committees, the Secretary of Defense, the Under Secretary of Defense  (Comptroller) and Chief Financial Officer, the Deputy Chief Financial  Officer, the Director of Financial Improvement and Audit Readiness, the  Secretary of the Army, and the Director of the Defense Finance and  Accounting Service. In addition, the report is available at no charge on the  GAO website at http://www.gao.gov.

If you or your staff have any questions about this report, please contact  me at (202) 512-9869 or khana@gao.gov. Contact points for our Offices  of Congressional Relations and Public Affairs may be found on the last  page of this report. Key contributors to this report are listed in appendix  III.

Appendix I: Objectives, Scope, and Methodology

Our objectives were to report on the extent to which the Journal Voucher  Working Group (Working Group) had, as of March 2017, (1) performed  analyses to determine the root causes of unsupported journal vouchers  (JV) for the Department of the Army’s (Army) general fund and   (2) developed and monitored the implementation of corrective action  plans to address identified root causes of unsupported JVs.

To address our first objective, we reviewed our prior relevant reports and  reports by the Department of Defense (DOD) and DOD’s Office of  Inspector General to gain an understanding of the nature of the issues  identified related to the Army’s unsupported JVs for its general fund and  how they affect DOD’s audit readiness as described in the Financial  Improvement and Audit Readiness (FIAR) Guidance. We also reviewed  various Army, Defense Finance and Accounting Service, and DOD  financial reporting guidance; performed walk-throughs of the JV process;  and interviewed agency officials to gain an understanding of the  processes for recording JVs and analyzing causes of unsupported JVs,  including (1) the various types of JVs recorded and reasons why the JVs  are unsupported, (2) parties responsible for preparing and approving JVs,  and (3) requirements for determining and documenting the root causes of  unsupported JVs and monitoring such efforts.

Further, we obtained the Working Group’s root cause analyses performed  and completed as of March 2017. We analyzed the documentation  provided and interviewed agency officials to determine the extent to which  (1) root cause analyses have been performed for all unsupported JVs of  the Army’s general fund and (2) root causes had been identified to  address the issue of unsupported JVs. We also reviewed documentation  provided to determine whether the Working Group was including all  unsupported JVs in the population used for analyses.

To address our second objective, we obtained the Working Group’s  documentation of corrective action plans developed and implemented as  of March 2017 to address the root causes identified by the Working  Group. We inquired about the development and the status and  implementation of each corrective action plan. We also inquired about the  steps the Working Group has taken to validate and monitor the  effectiveness of corrective action plans that have been implemented to  address root causes identified. We also inquired about how the Working  Group measures its progress using the monthly JV metrics reports, which  the Working Group identified as its primary source for monitoring  progress, and analyzed the JV metrics reports from October 2016 to  March 2017. Further, we inquired of the reasons why corrective action  plans had not been fully implemented.

We also interviewed members of the Working Group to confirm our  understanding of any limitations or challenges identified during the root  cause analyses. We obtained their views on these or other concerns and  reviewed relevant documentation supporting their evaluation of the root  causes, efforts to address the root causes, and the potential impact on  the Army’s financial management and future auditability.

We interviewed Army officials about efforts to monitor the effectiveness of  the Working Group’s corrective action plans to determine what actions, if  any, the Army has taken to monitor the corrective action plans regarding  deficiencies related to unsupported JVs. We considered whether the  Working Group’s efforts for developing and monitoring the implementation  of corrective action plans addressing identified deficiencies followed the  relevant criteria contained in internal control standards; Office of  Management and Budget Circular A-123, Management’s Responsibility  for Enterprise Risk Management and Internal Control; and DOD FIAR  Guidance.

We conducted this performance audit from December 2015 to October  2017 in accordance with generally accepted government auditing  standards. Those standards require that we plan and perform the audit to  obtain sufficient, appropriate evidence to provide a reasonable basis for  our findings and conclusions based on our audit objectives. We believe  that the evidence obtained provides a reasonable basis for our findings  and conclusions based on our audit objectives.

Appendix II: Comments from the Department of the Army

In addition to the contact named above, the following individuals made  key contributions to this report: Lynda Downing (Assistant Director),  Francine DelVecchio, Natasha Guerra, Cole Haase, Jason Kelly, and  David Scouten.