oversight

Medicare Trust Funds Actuarial Estimates: Efforts Have Been Made to Improve Internal Control over Projection Process but Some Weaknesses Remain

Published by the Government Accountability Office on 2003-03-04.

Below is a raw (and likely hideous) rendition of the original report. (PDF)

United States General Accounting Office
Washington, DC 20548



          March 4, 2003



          The Honorable Thomas A. Scully
          Administrator
          Centers for Medicare and Medicaid Services

          Subject: Medicare Trust Funds Actuarial Estimates: Efforts Have Been Made to
          Improve Internal Control over Projection Process but Some Weaknesses Remain

          Dear Mr. Scully:

          Medicare spending growth remains one of the most pressing and complex issues
          facing the Congress and the nation. During calendar year 2001, the most recent year
          for which complete data were available at the time of our review, over 40 million
          Medicare enrollees received $240.9 billion in benefits from the trust funds maintained
          for Hospital Insurance (HI) and Supplementary Medical Insurance (SMI), Medicare’s
          two components.

          The Boards of Trustees1 of the trust funds are required to report annually on the
          current and projected financial status of the Medicare program to the Congress and
                                2
          the American people. The Centers for Medicare and Medicaid Services’ (CMS) Office
          of the Actuary (OACT) provides estimates to the boards to assist them in setting
          certain assumptions about HI and SMI future performance that are needed to prepare
          long-range and short-range projections of the financial status of the trust funds for
          the Trustees’ reports. Based on the boards’ assumptions, OACT then prepares the
          projections and the Trustees’ reports for the boards. In its 2002 annual report, the
          Board of Trustees estimated that, under current rules, HI expenditures would begin




          1
            The Medicare Boards of Trustees were established under the Social Security Act, as amended, to
          oversee the financial operations of the Medicare trust funds. The boards are composed of the
          Secretary of the Treasury, the Secretary of Labor, the Secretary of Health and Human Services, the
          Commissioner of Social Security, and two members of the public who are appointed by the President
          and confirmed by the Senate. These same Trustees serve on the Board of Trustees for the Social
          Security trust funds. Many of the demographic and economic assumptions that determine Medicare
          costs and income are common to the Social Security trust funds.
          2
            42 U.S.C. 1395i requires the Medicare Trustees to submit an annual report on the HI Trust Fund; 42
          U.S.C. 1395t requires the Trustees to submit an annual report on the SMI Trust Fund.



                                                        GAO-03-247R CMS’s Controls over Projections
to exceed tax revenue in calendar year 2016, causing the trust fund to be exhausted in
2030.3

A wide spectrum of users relies on these projections for a variety of purposes. These
include the Congress, which needs reliable information about the Medicare trust
funds to make informed decisions about future HI and SMI program funding and
benefits. Providing decision makers with reasonable assurance about the reliability
of financial reporting is one of the specific objectives of internal control. The
Standards for Internal Control in the Federal Government4 issued by the
Comptroller General consider an entity’s internal control in terms of its control
environment, risk assessment, control activities, information and communication,
and monitoring and apply to all aspects of an agency’s operations: programmatic,
financial, and compliance. Strong internal control is particularly important in OACT,
where making reliable projections is intensively people and process oriented.
Control activities—the policies, procedures, techniques, and mechanisms that
enforce management’s directives—are a key aspect of an effective system of internal
control and include proper reviews, approvals, and documentation that help ensure
work processes are carried out according to management’s directives. For example,
control activities include checks and balances that provide reasonable assurance that
data are entered correctly and calculated results are reported properly. Control
activities also include effective management of an organization’s workforce—its
human capital—which is essential to achieving results. Monitoring activities, another
key aspect of internal control, help track the effectiveness of control activities,
including those to ensure that findings of audits and other reviews are promptly
resolved.

We selected these activities for review because of their importance in the preparation
of long-range financial projections for the HI and SMI trust funds. Our specific
objectives were to identify and evaluate the adequacy of OACT’s (1) control activities
over the projection process, (2) human capital practices related to workforce
planning, and (3) tracking and resolution process to address recommendations from
technical panels and other reviewers. To achieve these objectives, we reviewed prior
reports by technical panels and other reviewers, interviewed OACT management and
staff and certain other CMS officials, and obtained and reviewed available
documentation concerning the projection process. We used as a guide the Standards
                                                 5
of Internal Control in the Federal Government with a focus on OACT control
activities over the long-range projection process used for the 2002 Trustees’ report.
We conducted our work in Washington, D.C., and Baltimore, Md., from October 2001
to November 2002 in accordance with generally accepted government auditing
standards. We did not evaluate the actuarial assumptions and methodology because
they are subject to periodic reviews by technical panels and others. Further details of
our scope and methodology are provided in enclosure I.

3
  The SMI premium and corresponding income from general revenues are established annually at a
level sufficient to cover the following year’s expenditures. Thus SMI is automatically in financial
balance under present law.
4
  U.S. General Accounting Office, Standards for Internal Control in the Federal Government,
GAO/AIMD-00-21.3.1 (Washington, D.C.: November 1999). 31 U.S.C. 3512(c),(d) (The Federal
Managers’ Financial Integrity Act of 1982 (FMFIA)) requires GAO to issue standards for internal
control in the federal government.
5
  GAO/AIMD-00-21.3.1.


Page 2                                         GAO-03-247R CMS’s Controls over Projections
Results in Brief

Since fiscal year 2000, OACT has taken significant steps toward improving internal
control over its trust fund projection processes. During 2000, the Department of
                                                               6
Health and Human Services (HHS) engaged KPMG Consulting to perform a study of
OACT’s workload and workforce. Assisted by KPMG Consulting, OACT addressed
the consultants’ initial recommendations by developing a guide for preparing work
products, developing a workforce management plan, beginning implementation of
those tools, and beginning to address recommendations of a fiscal year 2000
                  7
Technical Panel. Although the Technical Panel found OACT’s work to be of
excellent quality, room for improvement exists, as important elements of OACT’s
recently planned initiatives have not yet been fully implemented and several controls
over its projection processes for Trustees’ reports are not formalized, thus increasing
the risk that errors in OACT’s future projections of Medicare trust funds’ financial
status would go undetected.

Our review found that OACT had not documented a comprehensive, detailed
description of the processes necessary to prepare the long-range projection for the
Trustees’ report and that documentation of the procedures performed by OACT’s
staff and reviewers during the projection process was limited. We also found that
documentation of criteria for adjustments and reviews and the changes to data made
by staff were lacking. Documentation weaknesses were also reported by two
previous independent reviewers of OACT. Without explicit documentation of OACT’s
work processes and work performed, reviewers’ opportunity for beneficial oversight
was reduced, and the risk that errors in the projection process would go undetected
was increased. While no errors have been identified in reviews of OACT’s actuarial
assumptions and methodologies, these reviews have also pointed out the need for
increased documentation. According to OACT officials, resource constraints were a
key reason limiting the extent to which documentation was prepared.

OACT has developed a human capital management plan that focuses on workforce
planning activities and addresses, among other issues, succession planning. As part
of this plan, OACT has determined that approximately one-fourth of the group that
prepares the Trustees’ report would be eligible to retire over the next 5 years. Also,
as part of the plan, OACT has begun to implement a professional development
program, which identifies key technical and professional competencies for staff.
However, OACT has not yet developed a formal training plan to align targeted
training opportunities with the key competencies established by the professional
development program. OACT officials indicated that a lack of resources has limited

6
  In October 2002, KPMG Consulting changed its name to BearingPoint.
7
  The purpose of the Technical Panel was to review and make recommendations about the methods
and assumptions underlying the Medicare Trustees’ reports. The Technical Panel was convened on
behalf of the Medicare Board of Trustees and was governed by provisions of the Federal Advisory
Committee Act (5 U.S.C. Appendix), which set forth standards for the formation and use of advisory
committees. Per requirements established under the Technical Panel charter, the Technical Panel
consisted of seven members, selected by the Secretary of HHS, or designee, who were experts in the
fields of economics and actuarial science.




Page 3                                        GAO-03-247R CMS’s Controls over Projections
the number of training and professional development opportunities they have been
able to offer staff. With impending staff retirements and without fully implemented
programs to enhance staff knowledge and expertise, the risk that OACT staff could
fall short of developing skills needed to achieve organizational goals is increased.
In 2000, HHS initiated two studies of OACT—the aforementioned KPMG Consulting
study and the Technical Panel review—that resulted in a number of
recommendations related to workforce planning, actuarial methodology, and
assumptions. While OACT has taken steps to prioritize and resolve some of these
recommendations, it lacks a formal monitoring policy and standard process for
(1) tracking recommendations it has received, (2) deciding which recommendations
should be implemented, (3) determining the priority recommendations should
receive, and (4) documenting the resolution of each recommendation. Without a
formal tracking and resolution process, OACT leaves open the possibility that
identified deficiencies or important initiatives may not be resolved, and operations
may not be improved in a timely manner.

We are making recommendations aimed at strengthening OACT’s internal controls
over documentation of planned and performed procedures, training of staff, and
tracking the resolution of reviewers’ recommendations. In comments on a draft of
this report, CMS generally agreed in principle with our recommendations and
described initiatives it has planned or recently begun for resolving the underlying
internal control issues. CMS also emphasized that management should design and
implement internal control based on related costs and benefits and expressed
concern about its ability to implement some of our recommendations given its
current lack of resources. These resource constraints have resulted in the need for
continued prioritization of improvement efforts. Further, in recognition of these
resource constraints, we included in our recommendations that CMS consider the use
of alternative approaches such as additional contractor assistance, to address our
recommendations.

Background

Medicare provides health care coverage to citizens and permanent residents of the
United States under specific circumstances as a responsibility of the government.
CMS, an agency under HHS, is responsible for administering Medicare and other
programs that address the nation’s health care needs. The Medicare program is
comprised of two parts, HI and SMI. HI pays for hospital, some home health, skilled
nursing facility, and hospice care for Medicare beneficiaries and is financed primarily
by payroll taxes paid by employees and employers. SMI pays for physician,
outpatient hospital, some home health, and other services for Medicare beneficiaries.
It is financed primarily by the general fund of the federal government and by monthly
premiums paid by beneficiaries. Income in excess of expenditures is held in the HI
and SMI trust funds and invested in federal government securities.

OACT’s primary mission is to provide the most accurate information and projections
to aid policy makers during their decision-making process. OACT is divided into




Page 4                                  GAO-03-247R CMS’s Controls over Projections
                                           8
three offices: The Immediate Office, the Medicare and Medicaid Cost Estimates
Group, and the National Health Statistics Group. Two independent studies have
included recommendations that more resources be devoted to OACT. OACT’s
workload has increased due to legislation, such as the Medicare, Medicaid, and
                                                          9
SCHIP Benefits Improvement and Protection Act of 2000, which requires OACT to
review all Medicare+Choice10 benefit package proposals submitted on or after May 1,
2001, to determine if all underlying actuarial assumptions and data used by providers
in their proposals are appropriate. In addition, the Medicare, Medicaid, and SCHIP
Balanced Budget Refinement Act of 199911 required OACT to compute Medicare fee-
for-service expenditures on a county-specific basis and publish its results.

While new legislation has added to OACT’s workload, the office also has continued to
respond to ad hoc requests, including those from the Congress, and to complete its
recurring work products, such as the Trustees’ report. The Medicare and Medicaid
Cost Estimates Group within OACT produces the annual report of the Board of
Trustees on the current and projected financial condition of the HI and SMI trust
funds based on assumptions set by the Trustees, in addition to assisting with certain
OACT activities discussed above. Work on the Trustees’ reports, for the most part,
takes place during February and March.

The Trustees’ reports present both short-range (10-year) and long-range (75-year)
projections of the HI and SMI trust funds’ future financial condition. The estimates
are made based on current law and board-approved assumptions about the factors
that affect the income and expenditures of the trust funds. These factors include
demographic, economic, and health care cost assumptions. OACT primarily uses
economic and demographic assumptions developed by the Social Security
Administration (SSA) OACT and approved by the board. However, OACT is
responsible for developing assumptions about health care costs for board
consideration, including assumptions about increases in medical prices and
utilization of medical services.12 OACT uses a complex model, consisting of a series
of computer spreadsheets, to generate the long-range projections for HI and SMI.
Data used in the projection come primarily from the SSA and CMS’s Office of
Information Services.

The Board of Trustees’ projection assumptions and OACT’s actuarial projection
methodology are subject to periodic review by independent experts to ensure their
validity and reasonableness. In fiscal year 2000, a Medicare Technical Review Panel
was convened by the Secretary of HHS at the request of the Medicare Boards of
Trustees to review the assumptions and methods underlying the projections included

8
   The Immediate Office, which includes the Chief Actuary, is responsible for responding to highly
specialized requests that include pension audits, policy analysis, and unique legislative or regulatory
initiatives.
9
   Public Law 106-554, Appendix F, 114 Stat. 2763A-463, 2763A-566.
10
   The Medicare+Choice program was created in 1997 in an effort to expand beneficiaries’ managed
care options. A Medicare+Choice plan is a type of health plan offered by a private company and
approved by Medicare.
11
   Public Law 106-113, Appendix F, 113 Stat. 1501A-321, 1501A-383.
12
   For example, to help project increases in hospital inpatient costs, OACT estimates changes in the
hospital market basket index, which tracks the prices of goods and services purchased by hospitals for
use in providing care to hospital inpatients.


Page 5                                         GAO-03-247R CMS’s Controls over Projections
                            13
in the Trustees’ reports. While making numerous recommendations about actuarial
methodologies and assumptions and documentation regarding the projection process,
the Technical Panel reported that the projection work of OACT is of excellent quality
and that OACT performs in a highly competent and completely professional manner.

Also in fiscal year 2000, HHS hired KPMG Consulting to perform a study of OACT’s
workload and workforce. KPMG Consulting benchmarked CMS’s OACT with other
organizations, including SSA, in order to provide OACT with best-practices strategies
that addressed areas the consultants identified as being critical to its successful
operations. While OACT has been subjected to reviews by technical panels and
KPMG Consulting, internal control over OACT's projection processes had not
previously been independently reviewed.

Although projections are inherently uncertain because they depend on assumptions
about the occurrence of future events, an effective system of internal control can
help provide reasonable assurance that projections included in financial reports are
reliable. The Comptroller General issues standards for internal control in the federal
              14
government that provide the overall framework for management to establish and
maintain internal control and to identify and address major performance and
management challenges. According to these standards, internal control, also referred
to as management control, comprises the plans, methods, and procedures used to
meet the missions, goals, and objectives of an organization. One of its objectives is
the reliability of financial reporting, including financial statements and other reports
for internal and external use.

The Federal Accounting Standards Advisory Board15 (FASAB) promulgates federal
accounting standards which form the foundation for preparing consistent and
meaningful financial statements both for individual agencies and the government as a
whole. FASAB is currently reviewing the accounting and financial reporting
requirements for social insurance trust funds. The provisions of Statement of Federal
Financial Accounting Standards No. 17 currently require reporting social insurance
                                                                   16
information as Required Supplementary Stewardship Information, resulting in
limited audit coverage. Reclassifying the required information as basic financial
information, as currently discussed by FASAB, would subject the information to more
extensive audit scrutiny. While specific procedures to audit social insurance
information have not been developed, typical audit procedures would likely include
obtaining an understanding of policies and procedures, assessing the adequacy of
internal control, and analyzing key projections.


13
   The 2000 Technical Panel report is available on CMS’s Web site: http://cms.hhs.gov.
14
   U.S. General Accounting Office, Standards for Internal Control in the Federal Government,
GAO/AIMD-00-21.3.1 (Washington, D.C.: November 1999).
15
   In October 1990, the Secretary of the Treasury, the Director of the Office of Management and Budget,
and the Comptroller General (the Principals) established FASAB to develop a set of generally accepted
accounting standards for the federal government. Effective July 1, 2002, FASAB is comprised of six
nonfederal or public members and representatives of the three Principals.
16
   Federal Accounting Standards Advisory Board, Statement of Federal Financial Accounting Standards
No. 17, Accounting for Social Insurance, August 1999.




Page 6                                         GAO-03-247R CMS’s Controls over Projections
Further Improvements in
Documentation of Projection
Process Are Needed

As part of its initiative to improve its quality control process, OACT has begun to
document projection methods and results, but significant gaps remain. We noted that
OACT had not fully documented the procedures required for preparing Trustees’
report projections of the HI and SMI trust funds. Also, when preparing the
projections, documentation of the work that staff performed was incomplete and
adjustments and changes to data or results were undocumented. Further, criteria for
reasonableness reviews of data and projections results were lacking, and
documentation of managerial and supervisory reviews was inadequate. OACT
management cited resource constraints as a key reason for not performing these
control activities. Individually or collectively, the lack of documented planned
procedures, work performed, and reviews increases the risk that errors in the
projection process could go undetected, and impedes efforts by those who evaluate
the projections.

According to the Standards for Internal Control in the Federal Government, 17
management is responsible for developing the detailed policies, procedures, and
practices to fit their agency’s operations and to ensure that internal control is built
into and an integral part of operations. The Standards also state that internal control
events need to be clearly documented, and the documentation should be readily
available for examination. Moreover, actuarial standards of practice18 state that
actuaries should identify the data, assumptions, and methods they use with sufficient
clarity so that another actuary qualified in the same practice area could evaluate the
                                        19
reasonableness of the actuary’s work. These standards also stipulate that this
documentation be retained for a reasonable period of time.

We found that OACT was beginning to document more of its processes, as it had
developed two checklists describing the procedures necessary to prepare the
projections. These checklists generally included an indication of the computer
spreadsheets that OACT must complete to prepare its projections, data sources
needed to complete each spreadsheet, and notes related to the spreadsheets.
However, we found that the checklists were sometimes incomplete or outdated, or
completed improperly. For example, the checklist used by the HI team for the most
recent Trustees’ report did not include several steps necessary to complete the
projection process, and the other checklist used by the SMI team had not been
updated for the most recent Trustees’ report projection and included a step that was
the responsibility of a different team. Also, actuaries completing the work specified
by the checklists were not required to initial or date the checklist to indicate they had
completed the work. In the absence of such controls, OACT management must rely


17
   GAO/AIMD-00-21.3.1.
18
   Actuarial standards of practice are promulgated by the Actuarial Standards Board. These standards
are designed to provide practicing actuaries with a basis for ensuring that their work will conform to
generally accepted principles and practices and to assure the public that actuaries are professionally
accountable.
19
   Actuarial Standard of Practice Number 41, Actuarial Communications (Washington, D.C.: March
2002).


Page 7                                         GAO-03-247R CMS’s Controls over Projections
on staff’s institutional knowledge of the process to obtain assurance that the work
was properly completed.

CMS actuaries told us that they did not typically document data abnormalities or
adjustments they made to source data. For example, during the preparation of the
projection for the 2002 Trustees’ reports, a CMS staff member noticed that an
element of source data differed dramatically from prior years’ data. The staff
member investigated the data and concluded that one hospital had erroneously
reported a large amount of payments that was skewing the data. Based on his
professional judgment, the staff member unilaterally removed the data in question
from the projection calculation to correct the problem. The staff member indicated
that this was the type of adjustment that could be made without presenting the
problem before the entire projection team or documenting the adjustment. In our
view, this change appears to have been reasonable because, according to the actuary,
the amounts reported by the hospital were skewed, compared to historical trends.
However, the adjustment was not documented and therefore not subjected to
supervisory review and scrutiny. Proper documentation of these types of changes
would show the nature of the adjustment made and an indication of supervisory
approval.

We also found that OACT had not documented criteria for acceptable ranges of
fluctuation for ratios and trends between reporting periods to provide guidance for
consistently judging reasonableness of data and projection results from year to year.
For example, CMS actuaries told us that, as a general rule, they compare data
obtained internally with data from the Department of the Treasury and use a 1
percent variance as a general criterion; however, this criterion is not documented.
Establishing and documenting acceptable ranges for fluctuation of ratios and trends
are important because these tests are used to judge the reasonableness of source
data, calculations of projection components, and overall results from the model.

OACT’s primary control over preparing reliable financial projections is a series of
reasonableness reviews involving comparisons of the current year’s source data,
component calculations, and final projected results with those from the prior year.
OACT staff members provided us with several graphs and trend analyses of specific
data elements used in making their estimates, and told us that about 50 to 60 graphs
and charts would typically be used as part of the final review process. While OACT
officials said they included these graphs and trend analyses in their review, the
documents we reviewed lacked any evidence to demonstrate that the reviews were
completed. OACT staff also told us that they are required to initial each table and
graph in a draft copy of the Trustees’ report to indicate their review, but because that
report draft copy had already been discarded, no documentation was available as
evidence of these reviews. Although we found that documentation was limited,
according to OACT, several reviews were conducted as part of the projection
process. For example, OACT told us that these reviews included an internal peer
review involving more than one person at each stage of the projection process, within
the group that prepares the projections, and a “summary phase” at the end of work on
the Trustees’ report, when every staff member in the office was given a copy of the
work and asked to review it for reasonableness. While such reviews provide quality
control, a lack of documentation of these reviews limits assurance to management



Page 8                                  GAO-03-247R CMS’s Controls over Projections
that its directives have been carried out and limits the ability of subsequent reviewers
to rely on procedures performed.

OACT management told us they are only able to document their processes and
related controls as time allows. The 2000 Technical Panel, which recommended that
more explicit documentation be made available, recognized the need for more
resources to be devoted to OACT. In addition, KPMG Consulting’s 2001 report noted
                                 20
that benchmarked organizations used 30 percent of their workload hours
documenting their methods and results, but that OACT spent only 10 percent of its
time on documentation. The KPMG Consulting report also noted that OACT is
currently understaffed.

The OACT’s Quality Council chartered a team within the office to address how work
products should be developed and delivered. Based on the team’s findings, OACT,
with assistance from KPMG Consulting, developed and is currently implementing a
guide, the OACT Collaborative Peer Review System. This guide generally provides
for review of data inputs and adjustments made to input data; analytical review of all
component calculations; a final review for accuracy, reasonableness, and consistency
with prior results; and “preferred operating procedures” for actuaries to use in
anticipation of a review, such as the “use of checklists of procedures” and
maintaining an “audit trail of procedures and of adjustments.”

We generally found the new OACT Collaborative Peer Review System to be a
sufficient general guide for OACT’s work processes although at the time of our
review, many of the preferred operating procedures established by the guide were not
yet being followed for work performed for the Trustees’ report. OACT management
told us that the peer review system was implemented for all team and individual work
projects in August 2002, and they plan to follow its guidelines when preparing the
2003 Trustees’ report.

OACT officials also told us that, after piloting, implementation of the OACT
Collaborative Peer Review System was initially focused on projects such as
legislative proposal projections because these types of projections present new and
different challenges to the projection process with each request, while preparation of
Trustees’ reports is a recurring activity for which institutional knowledge exists.
Nevertheless, the importance of these projections along with broad public access to
and scrutiny of Trustees’ report projections suggests effective internal controls over
their preparation are needed.

Collectively, the lack of complete and current documentation of (1) the planned
projection procedures, (2) work completed during the projection process including
adjustment of data and component calculations, (3) criteria for review of data
projection results, and (4) the reviews by supervisors and managers increases the risk
that errors could occur in future projections and not be detected. In addition, these
documentation deficiencies limit



20
  This analysis included an examination of several diverse public and private organizations employing
actuaries, economists, and statisticians in health-care related environments.


Page 9                                        GAO-03-247R CMS’s Controls over Projections
•    guidance available to staff on projection preparation;
•    evidence that proper practices are consistently followed from year to year, as
     planned;
•    assurance to OACT’s management regarding projection reliability;
•    opportunities to provide staff, especially new staff, with an overview of the entire
     projection process; and
•    effectiveness and efficiency of reviews within and outside of OACT, such as
     OACT’s ability to effectively and efficiently communicate its projection
     procedures.

In addition, increased audit scrutiny that could result from FASAB’s current
consideration of changes to social insurance reporting requirements would magnify
the need for documentation of projection procedures and planned steps performed.
Furthermore, as discussed in the next section, retirement eligibility will seriously
impact OACT in the next 5 years. When experienced actuaries retire and less
experienced actuaries replace them, the documentation needed to bridge the
knowledge gap becomes more critical. In consideration of potential near-term
retirements and associated staff changes, documenting the projection process is
critical for an efficient transition of workload.

Full Implementation of
Human Capital Plan Will Further
Enhance Workforce Management

According to KPMG Consulting, OACT has effective human capital practices in place
to ensure it is hiring staff with the appropriate skill sets. OACT has developed a
human capital management plan that focuses on workforce planning issues and that
incorporates a professional development program. As part of this workforce
management plan, OACT determined that one-fourth of the Medicare and Medicaid
Cost Estimates Group would be eligible to retire over the next 5 years, including key
management, and developed a succession plan to help it prepare for impending
retirements. OACT has begun to implement its workforce management plan, and full
implementation of the professional development program is expected during fiscal
year 2003. However, OACT has not yet developed a training plan to identify courses
critical for staff in their professional development.

According to the Standards for Internal Control in the Federal Government,
effective management of an organization’s workforce—its human capital—is
essential to achieving results and an important part of internal control. Management
should ensure that skill needs are continually assessed and that the organization is
able to obtain a workforce that has the required skills to match those necessary to
achieve organizational goals. Training should be aimed at developing and
maintaining employee skill levels to meet changing organizational needs.

Our analysis of training programs at federal agencies21 emphasized that to design and
implement effective training programs, agencies must (1) identify the competencies
needed to achieve their specific mission and goals and measure the extent to which
21
 U.S. General Accounting Office, Human Capital: Design, Implementation and Evaluation of
Training at Selected Agencies, GAO/T-GGD-00-131 (Washington, D.C.: May 18, 2000).


Page 10                                    GAO-03-247R CMS’s Controls over Projections
their employees exhibit those competencies, (2) identify training and development
needs to be addressed, and (3) evaluate the extent to which their training programs
are actually increasing employees’ individual competencies and individual and overall
organization performance levels. Effective training programs include training
curricula for developing employee skills in selected occupations; require or
recommend that employees complete training on specific topics or meet a minimum
number of training hours; and make training slots available each year on the basis of
estimated needs, priorities, and available resources.

As previously discussed, KPMG Consulting studied OACT’s workload and workforce.
At the time of KPMG Consulting’s study, OACT had about 61 full-time equivalent staff,
and the consultants’ analysis determined that OACT was understaffed by 26.5 full-
time equivalent staff, or approximately one-third of recommended staff levels. KPMG
Consulting concluded that OACT’s staff was “skilled and professionally certified with
a high degree of experience in both actuarial science and economics.” KPMG
Consulting also found that OACT has a “high level of commitment to recruiting and
targeting of KSAs (knowledge, skills, and abilities)” and has worked closely with the
CMS human resources staff to acquire the necessary talent.

In order to address key human resource issues, OACT worked with KPMG Consulting
to develop a human capital plan that focuses on workforce planning issues.
According to OACT management, this plan is being used as a model for CMS. This
plan includes a succession plan and table identifying employees eligible to retire
within the next 5 years. During its planning process, OACT determined that in the
next 5 years, approximately 25 percent of the Medicare and Medicaid Cost Estimates
Group would be eligible for retirement, including two of its three current managers.
OACT has developed and begun to implement a targeted recruiting strategy to
address this problem.

To further prepare for future retirements, OACT management designed a professional
development program to expand OACT’s current training program, which primarily
consisted of allowing staff to use work time to study for exams given by the Society
of Actuaries22 and in-house training courses tailored to meet immediate office needs.
Under the professional development program, which was starting to be implemented
at the end of fiscal year 2002, key technical and professional competencies that staff
and managers should have were identified.

Using these key competencies as a baseline, management and staff are currently
working cooperatively to prepare development plans for each staff member by
identifying specific areas in which improvement is needed. However, OACT has
struggled to identify and make available appropriate development resources that will
help staff enhance their performance. Although OACT management has identified
certain training opportunities, they have not aligned the training opportunities with
the key competencies. Also, according to OACT management, budgetary restraints

22
  The Society of Actuaries (SOA) is an educational, research, and professional membership
organization with the purpose of advancing actuarial knowledge and enhancing the ability of actuaries.
To become a member of SOA, one must successfully complete a series of SOA examinations.




Page 11                                       GAO-03-247R CMS’s Controls over Projections
have limited its ability to aggressively pursue training and professional development
opportunities. Until these obstacles are overcome, OACT cannot fully implement its
planned professional development program.

Lack of a Formal Policy and Process
to Track and Address Recommendations
Could Reduce Opportunity for Improvements

OACT management has begun a number of initiatives to respond to recommendations
from external reviews, including the KPMG Consulting study and the Technical Panel
report. However, OACT currently handles recommendations primarily through
informal planning sessions and has not developed a formal monitoring policy and
process to document decisions made at its planning sessions and to ensure that
recommendations from technical panels and other reviewers are tracked and
addressed in a timely manner.

According to Standards for Internal Control in the Federal Government, monitoring
of internal control should include policies and procedures for ensuring that the
findings of audits and other reviews are promptly resolved. The resolution process
begins when audit or other review results are reported to management and is
completed only after action has been taken that (1) corrects identified deficiencies,
(2) produces improvements, or (3) demonstrates that the findings and
recommendations do not warrant management action. Evaluation of an
organization’s programs and its successes in identifying and implementing additional
actions is an integral element of continued improvement in operations. The Office of
Management and Budget (OMB) Circular A-50, Audit Followup, provides policies for
executive branch agencies to use when following up on our reports, and reports
issued by the inspectors general (IG) and others, and emphasizes the importance of
establishing a system to provide a complete record of action taken on
recommendations.

As previously discussed, in fiscal year 2000, HHS hired KPMG Consulting to perform
a study of OACT’s workload and workforce, which resulted in a number of KPMG
Consulting recommendations. OACT has continued to contract with KPMG
Consulting for assistance in addressing these recommendations. To deal with
recommendations included in KPMG Consulting’s report, management held several
informal discussions to decide which recommendations would receive higher priority
and how they could be addressed. For example, OACT worked with KPMG
Consulting to develop a workforce management plan that addressed
recommendations from the original KPMG Consulting study. However, OACT
management indicated that this plan was not actually being followed step-by-step, as
originally intended, nor have deadlines set in this plan been met. For example, the
workload balancing plan was to have been implemented by December 14, 2001.
However, while OACT managers have begun informally to consider which work areas
are the most understaffed, they told us there was still much work that needed to be
done before the workload balancing plan was fully implemented.

In fiscal year 2000, the Medicare Technical Review Panel, convened to review the
methods and assumptions underlying the Medicare Trustees’ reports, made 28
recommendations, 60 percent of which have been fully or partially addressed,


Page 12                                GAO-03-247R CMS’s Controls over Projections
according to management. These recommendations ranged from being very specific,
including a recommendation that OACT assume faster growth in long-term health
care costs, to very broad, including recommendations that OACT’s staff and research
budgets be significantly expanded and that documentation needed to be made more
explicit. A KPMG Consulting advisor reviewed the Technical Panel’s
recommendations and in turn recommended that a multiyear plan be developed to
implement the remaining Technical Panel recommendations. Even though OACT is
not required to respond formally to the Technical Panel, after the Technical Panel
released its results, OACT managers discussed the results informally and worked to
categorize the recommendations by those that could be handled within their office,
those that could be handled with other components within CMS, and those that
would need to be contracted out. However, this information was not incorporated
into a formal plan that indicated how the recommendations were assigned and
established a timetable for resolving the Technical Panel’s recommendations.

In response to our work, OACT management has improved its tracking system to
handle recommendations from the Technical Panel report. This tracking document
lists each Technical Panel recommendation and provides notes (e.g., “considered” or
“implemented”) for most of the recommendations. However, this tracking document
does not provide management’s position on the recommendations, establish a
timetable for resolving the recommendations, or designate a management official to
oversee the resolution process, which are provided for in OMB Circular A-50
regarding audit follow-up.23 Moreover, this tracking document does not assign risk
levels to establish a priority for resolving recommendations, as suggested by the
Standards for Internal Control in the Federal Government.24 In addition, the
tracking document did not yet include recommendations from KPMG Consulting.

OACT managers have reacted positively to recommendations issued by KPMG
Consulting and the Technical Panel, using these reports to develop an understanding
of challenges OACT is facing. However, unless OACT builds upon the informal
resolution process it currently uses, management risks being uninformed about the
status of planned actions, leaving open the possibility that initiatives may not be
completed in a timely manner or that they may go uncompleted. Untimely attention
or inattention to planned actions delays expected operational or efficiency
improvements to OACT’s processes and might effectively waste the resources
expended by technical panels and other reviewers.

Conclusion

The Congress and other decision makers need reliable information to make difficult
policy decisions concerning the rising costs of the Medicare program that are
expected to significantly impact federal spending in the not-too-distant future.
Effective internal control over OACT’s projection process can help provide assurance
that information is reliable. While OACT has taken a number of important steps to

23
   While the policies outlined in OMB Circular A-50 are applicable to audit follow-up, and the review by
the Technical Panel would not appear to be considered an audit for purposes of the Circular, we view
these policies as critical in providing assurance to OACT management that the resolution process has
been properly completed.
24
   GAO/AIMD-00-21.3.1.


Page 13                                         GAO-03-247R CMS’s Controls over Projections
improve its system of internal control, certain controls are not functioning effectively.
Most significantly, inadequate documentation of the procedures used to make the
projections, work completed during the projection process, and reviews of projection
work and products by supervisors and managers increases the risk that errors could
occur in projections and not be detected. While resource constraints have impeded
OACT’s documentation efforts, documenting all tasks is important for proper
oversight of the process and the efficient transfer of knowledge concerning policies,
procedures, and processes to new staff.

Furthermore, while OACT has developed a workforce management plan, it has not
yet fully implemented the professional development program to ensure that staff
skills are commensurate with organizational needs. Without linking training
opportunities to key competencies, OACT will be prevented from maximizing the
effectiveness of its planned professional development program. Moreover,
management has not documented the priority and other key elements of actions
planned and taken to address recommendations from technical panels and other
reviewers, increasing the risk that significant recommendations might not be
addressed in a timely manner.

Recommendations for Executive Action

To address the internal control weaknesses we identified related to documentation,
workforce management, and monitoring follow-up of external review
recommendations, we recommend that the Administrator of CMS direct the Chief
Actuary to

•   fully implement plans to document the

    •   current procedures needed to prepare the projections, including acceptable
        criteria for reasonableness tests,
    •   work performed by staff to prepare projections, and
    •   supervisory and management reviews;

•   fully implement the professional development program and develop a formal
    training curriculum that includes identification of appropriate training
    opportunities linked to key competencies; and

•   develop and implement a formal policy to track, follow-up, and resolve findings
    and recommendations of external audits and reviews.

In addition, to overcome the challenge of limited resources, we recommend that the
Administrator of CMS, in consultation with the Chief Actuary, consider use of
alternative approaches, such as additional contractor assistance, to address the
above recommendations.

Agency Comments and Our Evaluation

In written comments (reprinted in enclosure II) on a draft of this report, CMS
generally agreed in principle with our recommendations and discussed steps it has


Page 14                                 GAO-03-247R CMS’s Controls over Projections
begun or is planning to take to address OACT’s internal control challenges. CMS also
recognized the need for improvement, but expressed concern that significant
understaffing relative to its workload would impact OACT’s efforts to implement our
recommendations. While we recognize that OACT has limited resources, OACT could
use to the extent feasible alternative approaches, such as contractor assistance, to
implement necessary controls, as we included in our recommendations. Although
CMS did not address this recommendation in its comments, in subsequent
discussions, an OACT official indicated they plan to continue to use contractor
assistance to implement certain initiatives.

In its comments, CMS reaffirmed its strong commitment to effectiveness, efficiency,
and accountability in both the performance of its work and the conduct of control
activities. It also described its continuing efforts to fully implement its new peer
review system and to refine its workforce management program. We encourage CMS
to follow through and continue its practice of prioritizing its improvement efforts. In
addition, CMS provided technical and editorial comments, which we incorporated as
appropriate.

                      ____________________________________

This report contains recommendations to you. The head of a federal agency is
required by 31 U.S.C. 720 to submit a written statement on actions taken on these
recommendations to the Senate Committee on Governmental Affairs and the House
Committee on Government Reform and Oversight within 60 days of the date of this
report. You must also send a written statement to the House and Senate Committees
on Appropriations with the agency’s first request for appropriations more than 60
days after the date of this report.

We are sending copies of this report to the Chairman and Ranking Minority Member,
Senate Committee on Governmental Affairs; the Chairman and Ranking Minority
Member, Senate Committee on Finance; the Chairman and Ranking Minority Member,
House Committee on Government Reform; the Chairman and Ranking Minority
Member, House Committee on Ways and Means; the Chairman and Ranking Minority
Member, Subcommittee on Health, House Committee on Energy and Commerce; and
other interested congressional committees. In addition, this report is available at no
charge on our Internet home page at http://www.gao.gov. If you have any questions
about this report, please contact me at (202) 512-9508 or Kay L. Daly, Assistant
Director, (202) 512-9312. You may also reach us by e-mail at calboml@gao.gov or




Page 15                                 GAO-03-247R CMS’s Controls over Projections
dalykl@gao.gov. Key contributors to this assignment were Joseph Applebaum, Lisa
Crye, Marie Novak, Taya Tasse, Jack Warner, and Brooke Whittaker.

Sincerely yours,




Linda Calbom
Director, Financial Management and Assurance

Enclosures




Page 16                              GAO-03-247R CMS’s Controls over Projections
Enclosure I                                                         Enclosure I

                             Scope and Methodology

Because of the importance of long-range projections, their inclusion in agency and
governmentwide financial reports, and the potential for their being subjected to
increased audit scrutiny as basic financial information, we focused on internal
control over the procedures used by OACT to prepare the 2002 long-range projection.
Throughout our work, we used as a guide the Standards of Internal Control in the
                       25
Federal Government. Because of the technical nature of OACT’s work, we focused
on assessing control activities, including workforce management and monitoring
activities, including recommendation follow-up.

To achieve our overall objectives, we obtained and reviewed past Trustees’ reports
and technical panel reports to gain an understanding of the assumptions and methods
used by OACT. We also reviewed pertinent documentation provided by OACT and
actuarial standards of practice promulgated by the Actuarial Standards Board.

To identify and evaluate OACT’s control activities over documentation of the
projection process, we interviewed OACT managers and staff to identify policies and
procedures, including reviews made by supervisors and managers of interim and final
results. We also reviewed available paper and electronic documentation from OACT,
including checklists of steps needed to complete the projections, trend analyses, and
other printouts used to conduct reasonableness reviews, a KPMG Consulting report
of OACT’s workforce and workload, OACT’s executive guide detailing its new peer
review system, and the actuarial standard of practice relating to actuarial
communications and documentation.

To identify and evaluate OACT’s practices related to workforce planning, we
obtained and reviewed OACT’s workforce management plan and its professional
development plan, in addition to the KPMG Consulting report on OACT’s workforce
and workload. We also made inquiries of OACT managers to identify their human
capital practices and related policies and determine the status of their
implementation of a workforce management plan and professional development plan.
We pursued, as necessary, any further inquiries.

To assess OACT’s tracking and resolution process to address recommendations from
technical panels and other reviewers, we interviewed OACT management and
officials from the HHS Office of Inspector General about policies and procedures for
ensuring that the findings of audits and other reviews are promptly resolved. We also
obtained documentation of OACT’s response to recommendations included in a 2000
Technical Panel report.

When controls were identified, we evaluated whether the controls as designed and
implemented would provide management with reasonable assurance that the control
objectives were achieved. We confirmed our understanding of the internal control
system currently in place through discussions with OACT officials. We did not
evaluate the assumptions and methods used by OACT or the accuracy of the data and

25
     GAO/AIMD-00-21.3.1.


Page 17                                GAO-03-247R CMS’s Controls over Projections
Enclosure I                                                        Enclosure I

information they used. Our work was not designed to assess the effect of control
weaknesses that we identified on the reliability of previous projections prepared by
OACT. We conducted our work from October 2001 through November 2002, in
Washington, D.C., and Baltimore, Md., in accordance with generally accepted
government auditing standards. We requested and obtained written comments on a
draft of this report from the Administrator of CMS. These comments are reprinted in
enclosure II.




Page 18                                GAO-03-247R CMS’s Controls over Projections
Enclosure II                                                  Enclosure II

          Comments from the Department of Health and Human Services




Page 19                            GAO-03-247R CMS’s Controls over Projections
Enclosure II                              Enclosure II




Page 20        GAO-03-247R CMS’s Controls over Projections
Enclosure II                              Enclosure II




Page 21        GAO-03-247R CMS’s Controls over Projections
Enclosure II                              Enclosure II




Page 22        GAO-03-247R CMS’s Controls over Projections
Enclosure II                              Enclosure II




Page 23        GAO-03-247R CMS’s Controls over Projections
Enclosure II                              Enclosure II




Page 24        GAO-03-247R CMS’s Controls over Projections
Enclosure II                              Enclosure II




Page 25        GAO-03-247R CMS’s Controls over Projections
Enclosure II                              Enclosure II




(190080)




Page 26        GAO-03-247R CMS’s Controls over Projections