United States General Accounting Office Washington, DC 20548 March 4, 2003 The Honorable Thomas A. Scully Administrator Centers for Medicare and Medicaid Services Subject: Medicare Trust Funds Actuarial Estimates: Efforts Have Been Made to Improve Internal Control over Projection Process but Some Weaknesses Remain Dear Mr. Scully: Medicare spending growth remains one of the most pressing and complex issues facing the Congress and the nation. During calendar year 2001, the most recent year for which complete data were available at the time of our review, over 40 million Medicare enrollees received $240.9 billion in benefits from the trust funds maintained for Hospital Insurance (HI) and Supplementary Medical Insurance (SMI), Medicare’s two components. The Boards of Trustees1 of the trust funds are required to report annually on the current and projected financial status of the Medicare program to the Congress and 2 the American people. The Centers for Medicare and Medicaid Services’ (CMS) Office of the Actuary (OACT) provides estimates to the boards to assist them in setting certain assumptions about HI and SMI future performance that are needed to prepare long-range and short-range projections of the financial status of the trust funds for the Trustees’ reports. Based on the boards’ assumptions, OACT then prepares the projections and the Trustees’ reports for the boards. In its 2002 annual report, the Board of Trustees estimated that, under current rules, HI expenditures would begin 1 The Medicare Boards of Trustees were established under the Social Security Act, as amended, to oversee the financial operations of the Medicare trust funds. The boards are composed of the Secretary of the Treasury, the Secretary of Labor, the Secretary of Health and Human Services, the Commissioner of Social Security, and two members of the public who are appointed by the President and confirmed by the Senate. These same Trustees serve on the Board of Trustees for the Social Security trust funds. Many of the demographic and economic assumptions that determine Medicare costs and income are common to the Social Security trust funds. 2 42 U.S.C. 1395i requires the Medicare Trustees to submit an annual report on the HI Trust Fund; 42 U.S.C. 1395t requires the Trustees to submit an annual report on the SMI Trust Fund. GAO-03-247R CMS’s Controls over Projections to exceed tax revenue in calendar year 2016, causing the trust fund to be exhausted in 2030.3 A wide spectrum of users relies on these projections for a variety of purposes. These include the Congress, which needs reliable information about the Medicare trust funds to make informed decisions about future HI and SMI program funding and benefits. Providing decision makers with reasonable assurance about the reliability of financial reporting is one of the specific objectives of internal control. The Standards for Internal Control in the Federal Government4 issued by the Comptroller General consider an entity’s internal control in terms of its control environment, risk assessment, control activities, information and communication, and monitoring and apply to all aspects of an agency’s operations: programmatic, financial, and compliance. Strong internal control is particularly important in OACT, where making reliable projections is intensively people and process oriented. Control activities—the policies, procedures, techniques, and mechanisms that enforce management’s directives—are a key aspect of an effective system of internal control and include proper reviews, approvals, and documentation that help ensure work processes are carried out according to management’s directives. For example, control activities include checks and balances that provide reasonable assurance that data are entered correctly and calculated results are reported properly. Control activities also include effective management of an organization’s workforce—its human capital—which is essential to achieving results. Monitoring activities, another key aspect of internal control, help track the effectiveness of control activities, including those to ensure that findings of audits and other reviews are promptly resolved. We selected these activities for review because of their importance in the preparation of long-range financial projections for the HI and SMI trust funds. Our specific objectives were to identify and evaluate the adequacy of OACT’s (1) control activities over the projection process, (2) human capital practices related to workforce planning, and (3) tracking and resolution process to address recommendations from technical panels and other reviewers. To achieve these objectives, we reviewed prior reports by technical panels and other reviewers, interviewed OACT management and staff and certain other CMS officials, and obtained and reviewed available documentation concerning the projection process. We used as a guide the Standards 5 of Internal Control in the Federal Government with a focus on OACT control activities over the long-range projection process used for the 2002 Trustees’ report. We conducted our work in Washington, D.C., and Baltimore, Md., from October 2001 to November 2002 in accordance with generally accepted government auditing standards. We did not evaluate the actuarial assumptions and methodology because they are subject to periodic reviews by technical panels and others. Further details of our scope and methodology are provided in enclosure I. 3 The SMI premium and corresponding income from general revenues are established annually at a level sufficient to cover the following year’s expenditures. Thus SMI is automatically in financial balance under present law. 4 U.S. General Accounting Office, Standards for Internal Control in the Federal Government, GAO/AIMD-00-21.3.1 (Washington, D.C.: November 1999). 31 U.S.C. 3512(c),(d) (The Federal Managers’ Financial Integrity Act of 1982 (FMFIA)) requires GAO to issue standards for internal control in the federal government. 5 GAO/AIMD-00-21.3.1. Page 2 GAO-03-247R CMS’s Controls over Projections Results in Brief Since fiscal year 2000, OACT has taken significant steps toward improving internal control over its trust fund projection processes. During 2000, the Department of 6 Health and Human Services (HHS) engaged KPMG Consulting to perform a study of OACT’s workload and workforce. Assisted by KPMG Consulting, OACT addressed the consultants’ initial recommendations by developing a guide for preparing work products, developing a workforce management plan, beginning implementation of those tools, and beginning to address recommendations of a fiscal year 2000 7 Technical Panel. Although the Technical Panel found OACT’s work to be of excellent quality, room for improvement exists, as important elements of OACT’s recently planned initiatives have not yet been fully implemented and several controls over its projection processes for Trustees’ reports are not formalized, thus increasing the risk that errors in OACT’s future projections of Medicare trust funds’ financial status would go undetected. Our review found that OACT had not documented a comprehensive, detailed description of the processes necessary to prepare the long-range projection for the Trustees’ report and that documentation of the procedures performed by OACT’s staff and reviewers during the projection process was limited. We also found that documentation of criteria for adjustments and reviews and the changes to data made by staff were lacking. Documentation weaknesses were also reported by two previous independent reviewers of OACT. Without explicit documentation of OACT’s work processes and work performed, reviewers’ opportunity for beneficial oversight was reduced, and the risk that errors in the projection process would go undetected was increased. While no errors have been identified in reviews of OACT’s actuarial assumptions and methodologies, these reviews have also pointed out the need for increased documentation. According to OACT officials, resource constraints were a key reason limiting the extent to which documentation was prepared. OACT has developed a human capital management plan that focuses on workforce planning activities and addresses, among other issues, succession planning. As part of this plan, OACT has determined that approximately one-fourth of the group that prepares the Trustees’ report would be eligible to retire over the next 5 years. Also, as part of the plan, OACT has begun to implement a professional development program, which identifies key technical and professional competencies for staff. However, OACT has not yet developed a formal training plan to align targeted training opportunities with the key competencies established by the professional development program. OACT officials indicated that a lack of resources has limited 6 In October 2002, KPMG Consulting changed its name to BearingPoint. 7 The purpose of the Technical Panel was to review and make recommendations about the methods and assumptions underlying the Medicare Trustees’ reports. The Technical Panel was convened on behalf of the Medicare Board of Trustees and was governed by provisions of the Federal Advisory Committee Act (5 U.S.C. Appendix), which set forth standards for the formation and use of advisory committees. Per requirements established under the Technical Panel charter, the Technical Panel consisted of seven members, selected by the Secretary of HHS, or designee, who were experts in the fields of economics and actuarial science. Page 3 GAO-03-247R CMS’s Controls over Projections the number of training and professional development opportunities they have been able to offer staff. With impending staff retirements and without fully implemented programs to enhance staff knowledge and expertise, the risk that OACT staff could fall short of developing skills needed to achieve organizational goals is increased. In 2000, HHS initiated two studies of OACT—the aforementioned KPMG Consulting study and the Technical Panel review—that resulted in a number of recommendations related to workforce planning, actuarial methodology, and assumptions. While OACT has taken steps to prioritize and resolve some of these recommendations, it lacks a formal monitoring policy and standard process for (1) tracking recommendations it has received, (2) deciding which recommendations should be implemented, (3) determining the priority recommendations should receive, and (4) documenting the resolution of each recommendation. Without a formal tracking and resolution process, OACT leaves open the possibility that identified deficiencies or important initiatives may not be resolved, and operations may not be improved in a timely manner. We are making recommendations aimed at strengthening OACT’s internal controls over documentation of planned and performed procedures, training of staff, and tracking the resolution of reviewers’ recommendations. In comments on a draft of this report, CMS generally agreed in principle with our recommendations and described initiatives it has planned or recently begun for resolving the underlying internal control issues. CMS also emphasized that management should design and implement internal control based on related costs and benefits and expressed concern about its ability to implement some of our recommendations given its current lack of resources. These resource constraints have resulted in the need for continued prioritization of improvement efforts. Further, in recognition of these resource constraints, we included in our recommendations that CMS consider the use of alternative approaches such as additional contractor assistance, to address our recommendations. Background Medicare provides health care coverage to citizens and permanent residents of the United States under specific circumstances as a responsibility of the government. CMS, an agency under HHS, is responsible for administering Medicare and other programs that address the nation’s health care needs. The Medicare program is comprised of two parts, HI and SMI. HI pays for hospital, some home health, skilled nursing facility, and hospice care for Medicare beneficiaries and is financed primarily by payroll taxes paid by employees and employers. SMI pays for physician, outpatient hospital, some home health, and other services for Medicare beneficiaries. It is financed primarily by the general fund of the federal government and by monthly premiums paid by beneficiaries. Income in excess of expenditures is held in the HI and SMI trust funds and invested in federal government securities. OACT’s primary mission is to provide the most accurate information and projections to aid policy makers during their decision-making process. OACT is divided into Page 4 GAO-03-247R CMS’s Controls over Projections 8 three offices: The Immediate Office, the Medicare and Medicaid Cost Estimates Group, and the National Health Statistics Group. Two independent studies have included recommendations that more resources be devoted to OACT. OACT’s workload has increased due to legislation, such as the Medicare, Medicaid, and 9 SCHIP Benefits Improvement and Protection Act of 2000, which requires OACT to review all Medicare+Choice10 benefit package proposals submitted on or after May 1, 2001, to determine if all underlying actuarial assumptions and data used by providers in their proposals are appropriate. In addition, the Medicare, Medicaid, and SCHIP Balanced Budget Refinement Act of 199911 required OACT to compute Medicare fee- for-service expenditures on a county-specific basis and publish its results. While new legislation has added to OACT’s workload, the office also has continued to respond to ad hoc requests, including those from the Congress, and to complete its recurring work products, such as the Trustees’ report. The Medicare and Medicaid Cost Estimates Group within OACT produces the annual report of the Board of Trustees on the current and projected financial condition of the HI and SMI trust funds based on assumptions set by the Trustees, in addition to assisting with certain OACT activities discussed above. Work on the Trustees’ reports, for the most part, takes place during February and March. The Trustees’ reports present both short-range (10-year) and long-range (75-year) projections of the HI and SMI trust funds’ future financial condition. The estimates are made based on current law and board-approved assumptions about the factors that affect the income and expenditures of the trust funds. These factors include demographic, economic, and health care cost assumptions. OACT primarily uses economic and demographic assumptions developed by the Social Security Administration (SSA) OACT and approved by the board. However, OACT is responsible for developing assumptions about health care costs for board consideration, including assumptions about increases in medical prices and utilization of medical services.12 OACT uses a complex model, consisting of a series of computer spreadsheets, to generate the long-range projections for HI and SMI. Data used in the projection come primarily from the SSA and CMS’s Office of Information Services. The Board of Trustees’ projection assumptions and OACT’s actuarial projection methodology are subject to periodic review by independent experts to ensure their validity and reasonableness. In fiscal year 2000, a Medicare Technical Review Panel was convened by the Secretary of HHS at the request of the Medicare Boards of Trustees to review the assumptions and methods underlying the projections included 8 The Immediate Office, which includes the Chief Actuary, is responsible for responding to highly specialized requests that include pension audits, policy analysis, and unique legislative or regulatory initiatives. 9 Public Law 106-554, Appendix F, 114 Stat. 2763A-463, 2763A-566. 10 The Medicare+Choice program was created in 1997 in an effort to expand beneficiaries’ managed care options. A Medicare+Choice plan is a type of health plan offered by a private company and approved by Medicare. 11 Public Law 106-113, Appendix F, 113 Stat. 1501A-321, 1501A-383. 12 For example, to help project increases in hospital inpatient costs, OACT estimates changes in the hospital market basket index, which tracks the prices of goods and services purchased by hospitals for use in providing care to hospital inpatients. Page 5 GAO-03-247R CMS’s Controls over Projections 13 in the Trustees’ reports. While making numerous recommendations about actuarial methodologies and assumptions and documentation regarding the projection process, the Technical Panel reported that the projection work of OACT is of excellent quality and that OACT performs in a highly competent and completely professional manner. Also in fiscal year 2000, HHS hired KPMG Consulting to perform a study of OACT’s workload and workforce. KPMG Consulting benchmarked CMS’s OACT with other organizations, including SSA, in order to provide OACT with best-practices strategies that addressed areas the consultants identified as being critical to its successful operations. While OACT has been subjected to reviews by technical panels and KPMG Consulting, internal control over OACT's projection processes had not previously been independently reviewed. Although projections are inherently uncertain because they depend on assumptions about the occurrence of future events, an effective system of internal control can help provide reasonable assurance that projections included in financial reports are reliable. The Comptroller General issues standards for internal control in the federal 14 government that provide the overall framework for management to establish and maintain internal control and to identify and address major performance and management challenges. According to these standards, internal control, also referred to as management control, comprises the plans, methods, and procedures used to meet the missions, goals, and objectives of an organization. One of its objectives is the reliability of financial reporting, including financial statements and other reports for internal and external use. The Federal Accounting Standards Advisory Board15 (FASAB) promulgates federal accounting standards which form the foundation for preparing consistent and meaningful financial statements both for individual agencies and the government as a whole. FASAB is currently reviewing the accounting and financial reporting requirements for social insurance trust funds. The provisions of Statement of Federal Financial Accounting Standards No. 17 currently require reporting social insurance 16 information as Required Supplementary Stewardship Information, resulting in limited audit coverage. Reclassifying the required information as basic financial information, as currently discussed by FASAB, would subject the information to more extensive audit scrutiny. While specific procedures to audit social insurance information have not been developed, typical audit procedures would likely include obtaining an understanding of policies and procedures, assessing the adequacy of internal control, and analyzing key projections. 13 The 2000 Technical Panel report is available on CMS’s Web site: http://cms.hhs.gov. 14 U.S. General Accounting Office, Standards for Internal Control in the Federal Government, GAO/AIMD-00-21.3.1 (Washington, D.C.: November 1999). 15 In October 1990, the Secretary of the Treasury, the Director of the Office of Management and Budget, and the Comptroller General (the Principals) established FASAB to develop a set of generally accepted accounting standards for the federal government. Effective July 1, 2002, FASAB is comprised of six nonfederal or public members and representatives of the three Principals. 16 Federal Accounting Standards Advisory Board, Statement of Federal Financial Accounting Standards No. 17, Accounting for Social Insurance, August 1999. Page 6 GAO-03-247R CMS’s Controls over Projections Further Improvements in Documentation of Projection Process Are Needed As part of its initiative to improve its quality control process, OACT has begun to document projection methods and results, but significant gaps remain. We noted that OACT had not fully documented the procedures required for preparing Trustees’ report projections of the HI and SMI trust funds. Also, when preparing the projections, documentation of the work that staff performed was incomplete and adjustments and changes to data or results were undocumented. Further, criteria for reasonableness reviews of data and projections results were lacking, and documentation of managerial and supervisory reviews was inadequate. OACT management cited resource constraints as a key reason for not performing these control activities. Individually or collectively, the lack of documented planned procedures, work performed, and reviews increases the risk that errors in the projection process could go undetected, and impedes efforts by those who evaluate the projections. According to the Standards for Internal Control in the Federal Government, 17 management is responsible for developing the detailed policies, procedures, and practices to fit their agency’s operations and to ensure that internal control is built into and an integral part of operations. The Standards also state that internal control events need to be clearly documented, and the documentation should be readily available for examination. Moreover, actuarial standards of practice18 state that actuaries should identify the data, assumptions, and methods they use with sufficient clarity so that another actuary qualified in the same practice area could evaluate the 19 reasonableness of the actuary’s work. These standards also stipulate that this documentation be retained for a reasonable period of time. We found that OACT was beginning to document more of its processes, as it had developed two checklists describing the procedures necessary to prepare the projections. These checklists generally included an indication of the computer spreadsheets that OACT must complete to prepare its projections, data sources needed to complete each spreadsheet, and notes related to the spreadsheets. However, we found that the checklists were sometimes incomplete or outdated, or completed improperly. For example, the checklist used by the HI team for the most recent Trustees’ report did not include several steps necessary to complete the projection process, and the other checklist used by the SMI team had not been updated for the most recent Trustees’ report projection and included a step that was the responsibility of a different team. Also, actuaries completing the work specified by the checklists were not required to initial or date the checklist to indicate they had completed the work. In the absence of such controls, OACT management must rely 17 GAO/AIMD-00-21.3.1. 18 Actuarial standards of practice are promulgated by the Actuarial Standards Board. These standards are designed to provide practicing actuaries with a basis for ensuring that their work will conform to generally accepted principles and practices and to assure the public that actuaries are professionally accountable. 19 Actuarial Standard of Practice Number 41, Actuarial Communications (Washington, D.C.: March 2002). Page 7 GAO-03-247R CMS’s Controls over Projections on staff’s institutional knowledge of the process to obtain assurance that the work was properly completed. CMS actuaries told us that they did not typically document data abnormalities or adjustments they made to source data. For example, during the preparation of the projection for the 2002 Trustees’ reports, a CMS staff member noticed that an element of source data differed dramatically from prior years’ data. The staff member investigated the data and concluded that one hospital had erroneously reported a large amount of payments that was skewing the data. Based on his professional judgment, the staff member unilaterally removed the data in question from the projection calculation to correct the problem. The staff member indicated that this was the type of adjustment that could be made without presenting the problem before the entire projection team or documenting the adjustment. In our view, this change appears to have been reasonable because, according to the actuary, the amounts reported by the hospital were skewed, compared to historical trends. However, the adjustment was not documented and therefore not subjected to supervisory review and scrutiny. Proper documentation of these types of changes would show the nature of the adjustment made and an indication of supervisory approval. We also found that OACT had not documented criteria for acceptable ranges of fluctuation for ratios and trends between reporting periods to provide guidance for consistently judging reasonableness of data and projection results from year to year. For example, CMS actuaries told us that, as a general rule, they compare data obtained internally with data from the Department of the Treasury and use a 1 percent variance as a general criterion; however, this criterion is not documented. Establishing and documenting acceptable ranges for fluctuation of ratios and trends are important because these tests are used to judge the reasonableness of source data, calculations of projection components, and overall results from the model. OACT’s primary control over preparing reliable financial projections is a series of reasonableness reviews involving comparisons of the current year’s source data, component calculations, and final projected results with those from the prior year. OACT staff members provided us with several graphs and trend analyses of specific data elements used in making their estimates, and told us that about 50 to 60 graphs and charts would typically be used as part of the final review process. While OACT officials said they included these graphs and trend analyses in their review, the documents we reviewed lacked any evidence to demonstrate that the reviews were completed. OACT staff also told us that they are required to initial each table and graph in a draft copy of the Trustees’ report to indicate their review, but because that report draft copy had already been discarded, no documentation was available as evidence of these reviews. Although we found that documentation was limited, according to OACT, several reviews were conducted as part of the projection process. For example, OACT told us that these reviews included an internal peer review involving more than one person at each stage of the projection process, within the group that prepares the projections, and a “summary phase” at the end of work on the Trustees’ report, when every staff member in the office was given a copy of the work and asked to review it for reasonableness. While such reviews provide quality control, a lack of documentation of these reviews limits assurance to management Page 8 GAO-03-247R CMS’s Controls over Projections that its directives have been carried out and limits the ability of subsequent reviewers to rely on procedures performed. OACT management told us they are only able to document their processes and related controls as time allows. The 2000 Technical Panel, which recommended that more explicit documentation be made available, recognized the need for more resources to be devoted to OACT. In addition, KPMG Consulting’s 2001 report noted 20 that benchmarked organizations used 30 percent of their workload hours documenting their methods and results, but that OACT spent only 10 percent of its time on documentation. The KPMG Consulting report also noted that OACT is currently understaffed. The OACT’s Quality Council chartered a team within the office to address how work products should be developed and delivered. Based on the team’s findings, OACT, with assistance from KPMG Consulting, developed and is currently implementing a guide, the OACT Collaborative Peer Review System. This guide generally provides for review of data inputs and adjustments made to input data; analytical review of all component calculations; a final review for accuracy, reasonableness, and consistency with prior results; and “preferred operating procedures” for actuaries to use in anticipation of a review, such as the “use of checklists of procedures” and maintaining an “audit trail of procedures and of adjustments.” We generally found the new OACT Collaborative Peer Review System to be a sufficient general guide for OACT’s work processes although at the time of our review, many of the preferred operating procedures established by the guide were not yet being followed for work performed for the Trustees’ report. OACT management told us that the peer review system was implemented for all team and individual work projects in August 2002, and they plan to follow its guidelines when preparing the 2003 Trustees’ report. OACT officials also told us that, after piloting, implementation of the OACT Collaborative Peer Review System was initially focused on projects such as legislative proposal projections because these types of projections present new and different challenges to the projection process with each request, while preparation of Trustees’ reports is a recurring activity for which institutional knowledge exists. Nevertheless, the importance of these projections along with broad public access to and scrutiny of Trustees’ report projections suggests effective internal controls over their preparation are needed. Collectively, the lack of complete and current documentation of (1) the planned projection procedures, (2) work completed during the projection process including adjustment of data and component calculations, (3) criteria for review of data projection results, and (4) the reviews by supervisors and managers increases the risk that errors could occur in future projections and not be detected. In addition, these documentation deficiencies limit 20 This analysis included an examination of several diverse public and private organizations employing actuaries, economists, and statisticians in health-care related environments. Page 9 GAO-03-247R CMS’s Controls over Projections • guidance available to staff on projection preparation; • evidence that proper practices are consistently followed from year to year, as planned; • assurance to OACT’s management regarding projection reliability; • opportunities to provide staff, especially new staff, with an overview of the entire projection process; and • effectiveness and efficiency of reviews within and outside of OACT, such as OACT’s ability to effectively and efficiently communicate its projection procedures. In addition, increased audit scrutiny that could result from FASAB’s current consideration of changes to social insurance reporting requirements would magnify the need for documentation of projection procedures and planned steps performed. Furthermore, as discussed in the next section, retirement eligibility will seriously impact OACT in the next 5 years. When experienced actuaries retire and less experienced actuaries replace them, the documentation needed to bridge the knowledge gap becomes more critical. In consideration of potential near-term retirements and associated staff changes, documenting the projection process is critical for an efficient transition of workload. Full Implementation of Human Capital Plan Will Further Enhance Workforce Management According to KPMG Consulting, OACT has effective human capital practices in place to ensure it is hiring staff with the appropriate skill sets. OACT has developed a human capital management plan that focuses on workforce planning issues and that incorporates a professional development program. As part of this workforce management plan, OACT determined that one-fourth of the Medicare and Medicaid Cost Estimates Group would be eligible to retire over the next 5 years, including key management, and developed a succession plan to help it prepare for impending retirements. OACT has begun to implement its workforce management plan, and full implementation of the professional development program is expected during fiscal year 2003. However, OACT has not yet developed a training plan to identify courses critical for staff in their professional development. According to the Standards for Internal Control in the Federal Government, effective management of an organization’s workforce—its human capital—is essential to achieving results and an important part of internal control. Management should ensure that skill needs are continually assessed and that the organization is able to obtain a workforce that has the required skills to match those necessary to achieve organizational goals. Training should be aimed at developing and maintaining employee skill levels to meet changing organizational needs. Our analysis of training programs at federal agencies21 emphasized that to design and implement effective training programs, agencies must (1) identify the competencies needed to achieve their specific mission and goals and measure the extent to which 21 U.S. General Accounting Office, Human Capital: Design, Implementation and Evaluation of Training at Selected Agencies, GAO/T-GGD-00-131 (Washington, D.C.: May 18, 2000). Page 10 GAO-03-247R CMS’s Controls over Projections their employees exhibit those competencies, (2) identify training and development needs to be addressed, and (3) evaluate the extent to which their training programs are actually increasing employees’ individual competencies and individual and overall organization performance levels. Effective training programs include training curricula for developing employee skills in selected occupations; require or recommend that employees complete training on specific topics or meet a minimum number of training hours; and make training slots available each year on the basis of estimated needs, priorities, and available resources. As previously discussed, KPMG Consulting studied OACT’s workload and workforce. At the time of KPMG Consulting’s study, OACT had about 61 full-time equivalent staff, and the consultants’ analysis determined that OACT was understaffed by 26.5 full- time equivalent staff, or approximately one-third of recommended staff levels. KPMG Consulting concluded that OACT’s staff was “skilled and professionally certified with a high degree of experience in both actuarial science and economics.” KPMG Consulting also found that OACT has a “high level of commitment to recruiting and targeting of KSAs (knowledge, skills, and abilities)” and has worked closely with the CMS human resources staff to acquire the necessary talent. In order to address key human resource issues, OACT worked with KPMG Consulting to develop a human capital plan that focuses on workforce planning issues. According to OACT management, this plan is being used as a model for CMS. This plan includes a succession plan and table identifying employees eligible to retire within the next 5 years. During its planning process, OACT determined that in the next 5 years, approximately 25 percent of the Medicare and Medicaid Cost Estimates Group would be eligible for retirement, including two of its three current managers. OACT has developed and begun to implement a targeted recruiting strategy to address this problem. To further prepare for future retirements, OACT management designed a professional development program to expand OACT’s current training program, which primarily consisted of allowing staff to use work time to study for exams given by the Society of Actuaries22 and in-house training courses tailored to meet immediate office needs. Under the professional development program, which was starting to be implemented at the end of fiscal year 2002, key technical and professional competencies that staff and managers should have were identified. Using these key competencies as a baseline, management and staff are currently working cooperatively to prepare development plans for each staff member by identifying specific areas in which improvement is needed. However, OACT has struggled to identify and make available appropriate development resources that will help staff enhance their performance. Although OACT management has identified certain training opportunities, they have not aligned the training opportunities with the key competencies. Also, according to OACT management, budgetary restraints 22 The Society of Actuaries (SOA) is an educational, research, and professional membership organization with the purpose of advancing actuarial knowledge and enhancing the ability of actuaries. To become a member of SOA, one must successfully complete a series of SOA examinations. Page 11 GAO-03-247R CMS’s Controls over Projections have limited its ability to aggressively pursue training and professional development opportunities. Until these obstacles are overcome, OACT cannot fully implement its planned professional development program. Lack of a Formal Policy and Process to Track and Address Recommendations Could Reduce Opportunity for Improvements OACT management has begun a number of initiatives to respond to recommendations from external reviews, including the KPMG Consulting study and the Technical Panel report. However, OACT currently handles recommendations primarily through informal planning sessions and has not developed a formal monitoring policy and process to document decisions made at its planning sessions and to ensure that recommendations from technical panels and other reviewers are tracked and addressed in a timely manner. According to Standards for Internal Control in the Federal Government, monitoring of internal control should include policies and procedures for ensuring that the findings of audits and other reviews are promptly resolved. The resolution process begins when audit or other review results are reported to management and is completed only after action has been taken that (1) corrects identified deficiencies, (2) produces improvements, or (3) demonstrates that the findings and recommendations do not warrant management action. Evaluation of an organization’s programs and its successes in identifying and implementing additional actions is an integral element of continued improvement in operations. The Office of Management and Budget (OMB) Circular A-50, Audit Followup, provides policies for executive branch agencies to use when following up on our reports, and reports issued by the inspectors general (IG) and others, and emphasizes the importance of establishing a system to provide a complete record of action taken on recommendations. As previously discussed, in fiscal year 2000, HHS hired KPMG Consulting to perform a study of OACT’s workload and workforce, which resulted in a number of KPMG Consulting recommendations. OACT has continued to contract with KPMG Consulting for assistance in addressing these recommendations. To deal with recommendations included in KPMG Consulting’s report, management held several informal discussions to decide which recommendations would receive higher priority and how they could be addressed. For example, OACT worked with KPMG Consulting to develop a workforce management plan that addressed recommendations from the original KPMG Consulting study. However, OACT management indicated that this plan was not actually being followed step-by-step, as originally intended, nor have deadlines set in this plan been met. For example, the workload balancing plan was to have been implemented by December 14, 2001. However, while OACT managers have begun informally to consider which work areas are the most understaffed, they told us there was still much work that needed to be done before the workload balancing plan was fully implemented. In fiscal year 2000, the Medicare Technical Review Panel, convened to review the methods and assumptions underlying the Medicare Trustees’ reports, made 28 recommendations, 60 percent of which have been fully or partially addressed, Page 12 GAO-03-247R CMS’s Controls over Projections according to management. These recommendations ranged from being very specific, including a recommendation that OACT assume faster growth in long-term health care costs, to very broad, including recommendations that OACT’s staff and research budgets be significantly expanded and that documentation needed to be made more explicit. A KPMG Consulting advisor reviewed the Technical Panel’s recommendations and in turn recommended that a multiyear plan be developed to implement the remaining Technical Panel recommendations. Even though OACT is not required to respond formally to the Technical Panel, after the Technical Panel released its results, OACT managers discussed the results informally and worked to categorize the recommendations by those that could be handled within their office, those that could be handled with other components within CMS, and those that would need to be contracted out. However, this information was not incorporated into a formal plan that indicated how the recommendations were assigned and established a timetable for resolving the Technical Panel’s recommendations. In response to our work, OACT management has improved its tracking system to handle recommendations from the Technical Panel report. This tracking document lists each Technical Panel recommendation and provides notes (e.g., “considered” or “implemented”) for most of the recommendations. However, this tracking document does not provide management’s position on the recommendations, establish a timetable for resolving the recommendations, or designate a management official to oversee the resolution process, which are provided for in OMB Circular A-50 regarding audit follow-up.23 Moreover, this tracking document does not assign risk levels to establish a priority for resolving recommendations, as suggested by the Standards for Internal Control in the Federal Government.24 In addition, the tracking document did not yet include recommendations from KPMG Consulting. OACT managers have reacted positively to recommendations issued by KPMG Consulting and the Technical Panel, using these reports to develop an understanding of challenges OACT is facing. However, unless OACT builds upon the informal resolution process it currently uses, management risks being uninformed about the status of planned actions, leaving open the possibility that initiatives may not be completed in a timely manner or that they may go uncompleted. Untimely attention or inattention to planned actions delays expected operational or efficiency improvements to OACT’s processes and might effectively waste the resources expended by technical panels and other reviewers. Conclusion The Congress and other decision makers need reliable information to make difficult policy decisions concerning the rising costs of the Medicare program that are expected to significantly impact federal spending in the not-too-distant future. Effective internal control over OACT’s projection process can help provide assurance that information is reliable. While OACT has taken a number of important steps to 23 While the policies outlined in OMB Circular A-50 are applicable to audit follow-up, and the review by the Technical Panel would not appear to be considered an audit for purposes of the Circular, we view these policies as critical in providing assurance to OACT management that the resolution process has been properly completed. 24 GAO/AIMD-00-21.3.1. Page 13 GAO-03-247R CMS’s Controls over Projections improve its system of internal control, certain controls are not functioning effectively. Most significantly, inadequate documentation of the procedures used to make the projections, work completed during the projection process, and reviews of projection work and products by supervisors and managers increases the risk that errors could occur in projections and not be detected. While resource constraints have impeded OACT’s documentation efforts, documenting all tasks is important for proper oversight of the process and the efficient transfer of knowledge concerning policies, procedures, and processes to new staff. Furthermore, while OACT has developed a workforce management plan, it has not yet fully implemented the professional development program to ensure that staff skills are commensurate with organizational needs. Without linking training opportunities to key competencies, OACT will be prevented from maximizing the effectiveness of its planned professional development program. Moreover, management has not documented the priority and other key elements of actions planned and taken to address recommendations from technical panels and other reviewers, increasing the risk that significant recommendations might not be addressed in a timely manner. Recommendations for Executive Action To address the internal control weaknesses we identified related to documentation, workforce management, and monitoring follow-up of external review recommendations, we recommend that the Administrator of CMS direct the Chief Actuary to • fully implement plans to document the • current procedures needed to prepare the projections, including acceptable criteria for reasonableness tests, • work performed by staff to prepare projections, and • supervisory and management reviews; • fully implement the professional development program and develop a formal training curriculum that includes identification of appropriate training opportunities linked to key competencies; and • develop and implement a formal policy to track, follow-up, and resolve findings and recommendations of external audits and reviews. In addition, to overcome the challenge of limited resources, we recommend that the Administrator of CMS, in consultation with the Chief Actuary, consider use of alternative approaches, such as additional contractor assistance, to address the above recommendations. Agency Comments and Our Evaluation In written comments (reprinted in enclosure II) on a draft of this report, CMS generally agreed in principle with our recommendations and discussed steps it has Page 14 GAO-03-247R CMS’s Controls over Projections begun or is planning to take to address OACT’s internal control challenges. CMS also recognized the need for improvement, but expressed concern that significant understaffing relative to its workload would impact OACT’s efforts to implement our recommendations. While we recognize that OACT has limited resources, OACT could use to the extent feasible alternative approaches, such as contractor assistance, to implement necessary controls, as we included in our recommendations. Although CMS did not address this recommendation in its comments, in subsequent discussions, an OACT official indicated they plan to continue to use contractor assistance to implement certain initiatives. In its comments, CMS reaffirmed its strong commitment to effectiveness, efficiency, and accountability in both the performance of its work and the conduct of control activities. It also described its continuing efforts to fully implement its new peer review system and to refine its workforce management program. We encourage CMS to follow through and continue its practice of prioritizing its improvement efforts. In addition, CMS provided technical and editorial comments, which we incorporated as appropriate. ____________________________________ This report contains recommendations to you. The head of a federal agency is required by 31 U.S.C. 720 to submit a written statement on actions taken on these recommendations to the Senate Committee on Governmental Affairs and the House Committee on Government Reform and Oversight within 60 days of the date of this report. You must also send a written statement to the House and Senate Committees on Appropriations with the agency’s first request for appropriations more than 60 days after the date of this report. We are sending copies of this report to the Chairman and Ranking Minority Member, Senate Committee on Governmental Affairs; the Chairman and Ranking Minority Member, Senate Committee on Finance; the Chairman and Ranking Minority Member, House Committee on Government Reform; the Chairman and Ranking Minority Member, House Committee on Ways and Means; the Chairman and Ranking Minority Member, Subcommittee on Health, House Committee on Energy and Commerce; and other interested congressional committees. In addition, this report is available at no charge on our Internet home page at http://www.gao.gov. If you have any questions about this report, please contact me at (202) 512-9508 or Kay L. Daly, Assistant Director, (202) 512-9312. You may also reach us by e-mail at firstname.lastname@example.org or Page 15 GAO-03-247R CMS’s Controls over Projections email@example.com. Key contributors to this assignment were Joseph Applebaum, Lisa Crye, Marie Novak, Taya Tasse, Jack Warner, and Brooke Whittaker. Sincerely yours, Linda Calbom Director, Financial Management and Assurance Enclosures Page 16 GAO-03-247R CMS’s Controls over Projections Enclosure I Enclosure I Scope and Methodology Because of the importance of long-range projections, their inclusion in agency and governmentwide financial reports, and the potential for their being subjected to increased audit scrutiny as basic financial information, we focused on internal control over the procedures used by OACT to prepare the 2002 long-range projection. Throughout our work, we used as a guide the Standards of Internal Control in the 25 Federal Government. Because of the technical nature of OACT’s work, we focused on assessing control activities, including workforce management and monitoring activities, including recommendation follow-up. To achieve our overall objectives, we obtained and reviewed past Trustees’ reports and technical panel reports to gain an understanding of the assumptions and methods used by OACT. We also reviewed pertinent documentation provided by OACT and actuarial standards of practice promulgated by the Actuarial Standards Board. To identify and evaluate OACT’s control activities over documentation of the projection process, we interviewed OACT managers and staff to identify policies and procedures, including reviews made by supervisors and managers of interim and final results. We also reviewed available paper and electronic documentation from OACT, including checklists of steps needed to complete the projections, trend analyses, and other printouts used to conduct reasonableness reviews, a KPMG Consulting report of OACT’s workforce and workload, OACT’s executive guide detailing its new peer review system, and the actuarial standard of practice relating to actuarial communications and documentation. To identify and evaluate OACT’s practices related to workforce planning, we obtained and reviewed OACT’s workforce management plan and its professional development plan, in addition to the KPMG Consulting report on OACT’s workforce and workload. We also made inquiries of OACT managers to identify their human capital practices and related policies and determine the status of their implementation of a workforce management plan and professional development plan. We pursued, as necessary, any further inquiries. To assess OACT’s tracking and resolution process to address recommendations from technical panels and other reviewers, we interviewed OACT management and officials from the HHS Office of Inspector General about policies and procedures for ensuring that the findings of audits and other reviews are promptly resolved. We also obtained documentation of OACT’s response to recommendations included in a 2000 Technical Panel report. When controls were identified, we evaluated whether the controls as designed and implemented would provide management with reasonable assurance that the control objectives were achieved. We confirmed our understanding of the internal control system currently in place through discussions with OACT officials. We did not evaluate the assumptions and methods used by OACT or the accuracy of the data and 25 GAO/AIMD-00-21.3.1. Page 17 GAO-03-247R CMS’s Controls over Projections Enclosure I Enclosure I information they used. Our work was not designed to assess the effect of control weaknesses that we identified on the reliability of previous projections prepared by OACT. We conducted our work from October 2001 through November 2002, in Washington, D.C., and Baltimore, Md., in accordance with generally accepted government auditing standards. We requested and obtained written comments on a draft of this report from the Administrator of CMS. These comments are reprinted in enclosure II. Page 18 GAO-03-247R CMS’s Controls over Projections Enclosure II Enclosure II Comments from the Department of Health and Human Services Page 19 GAO-03-247R CMS’s Controls over Projections Enclosure II Enclosure II Page 20 GAO-03-247R CMS’s Controls over Projections Enclosure II Enclosure II Page 21 GAO-03-247R CMS’s Controls over Projections Enclosure II Enclosure II Page 22 GAO-03-247R CMS’s Controls over Projections Enclosure II Enclosure II Page 23 GAO-03-247R CMS’s Controls over Projections Enclosure II Enclosure II Page 24 GAO-03-247R CMS’s Controls over Projections Enclosure II Enclosure II Page 25 GAO-03-247R CMS’s Controls over Projections Enclosure II Enclosure II (190080) Page 26 GAO-03-247R CMS’s Controls over Projections
Medicare Trust Funds Actuarial Estimates: Efforts Have Been Made to Improve Internal Control over Projection Process but Some Weaknesses Remain
Published by the Government Accountability Office on 2003-03-04.
Below is a raw (and likely hideous) rendition of the original report. (PDF)