Pervasive deficiencies in internal controls over contract management at the Centers for Medicare and Medicaid Services increase the risk of improper payments or waste, GAO has said.
Based on a statistical random sample of 2008 CMS contract actions, GAO estimated that at least 84 percent of fiscal 2008 contract actions contained at least one instance where a key control was not adequately implemented, and that at least 37 percent had three or more.
CMS used cost reimbursement contracts without first ensuring that the contractor had an adequate accounting system, and project officers did not always certify invoices for payment, according to GAO-10-60.
It said these deficiencies were due in part to a lack of agency-specific policies and procedures to help ensure proper contracting expenditures, and that the deficiencies also stem from a weak overall control environment as characterized primarily by inadequate strategic planning for staffing and funding resources.
CMS also did not accurately capture data on the nature and extent of its contracting, which hinders CMS’s ability to manage its acquisition function by identifying areas of risk, due to a lack of quality assurance procedures over data entry, the report said.
