This is an archive page. The links are no longer being updated.
Performance and Accountability Report Fiscal Year 2002
Appendix C - HHS FY 2002 Federal Managers' Financial Integrity Act (FMFIA) Report on Systems and Controls
Background
HHS' management control program under the Federal Managers' Financial Integrity Act (FMFIA) and revised OMB Circular A-123, Management Accountability and Control, reflects the Department's continuing commitment to safeguard the resources entrusted to it by reducing fraud, waste, and abuse and preventing financial losses in HHS programs. HHS continually evaluates its program operations and systems, through CFO annual financial statement audits, as well as other OIG and GAO audits, management reviews, systems reviews, etc., to ensure the integrity and efficiency of its operations. HHS program managers continue to improve management controls by identifying and correcting management control deficiencies.
The Department's FMFIA program supports a key objective in our HHS FY 2002 CFO Financial Management Plan to respond to our diverse customers' needs by ensuring that the financial information for their programs is accurate and that the financial systems and processes that support them maintain the highest level of integrity. HHS components are to have written strategies for assessing management controls on an ongoing basis and these strategies should be consistent with the Financial Management Plan goals and targets.
In addition to our goal of obtaining a clean audit opinion on our annual audited financial statements, we have a related goal of resolving all internal control material weaknesses and reportable conditions cited by the auditors, including instances of non-compliance with the Federal Financial Management Improvement Act (FFMIA) as well as those identified through FMFIA reviews. For tracking and reporting on audit material weaknesses, HHS has developed a department-wide CFO audit Corrective Action Plan, referred to as the "CAP". The CAP includes all of the findings resulting from the financial statement audits, including qualifications (if any), material weaknesses, and reportable conditions. The CAP was submitted to OMB on a quarterly basis beginning in FY 2002. The milestones for the material weaknesses included in this FMFIA report (see below) are consistent with the CAP milestones.
Report Summary
The FMFIA annual assurance required by the act is contained in the Message from the Secretary at the beginning of this Performance and Accountability Report. The details of this year's FMFIA Annual Report, in addition to this narrative summary, are in the statistical summary in this Appendix. It reflects the cumulative total of material weaknesses identified and corrected.
Section 2 Material Weakness: Weakness in the Enforcement Program for Imported Foods
At publication time, there is one material weakness pending correction under Section 2 of the Act; specifically, Weakness in the Enforcement Program for Imported Foods in the Food and Drug Administration (FDA 89-02). A second material weakness from last year's report at NIH, Deficiencies in the Public Health Service Technology Transfer Activities (NIH 93-02) has been corrected due to the implementation of a new Technology Transfer System. In FY 2002, NIH completed the milestones intended to implement a new system and resolve the material weakness cited in prior years for Deficiencies in Technology Transfer Activities. We believe sufficient corrective actions have been taken and the desired results achieved. Both of these findings originally resulted from prior year OIG program audits and/or internal management reviews.
Section 4 Material Non-Conformance: Financial Systems and Processes Deparmentwide
Under Section 4 of the Act, there is one pending financial systems material non-conformance. The FMFIA-style corrective action plans (CAPs) for the Section 2 and Section 4 material non-conformance are included in this Appendix.
The Department continues to have serious internal control weaknesses in its financial systems and processes for producing financial statements. The FY 2001 department-wide financial statement audit and the FMFIA Report reflected a material non-conformance department-wide under Section 4 of the FMFIA called Financial Systems and Processes (HHS-00-01). This finding combined the department-wide audit finding, Financial Systems and Processes, with the audit findings at the Centers for Medicare and Medicaid Services (CMS) specifically: Financial Systems and Regional Central Office (CO) Oversight, and Medicare EDP Controls (CMS 01-02). For FY 2002, the CFO auditors reported the same material weaknesses at the department and at CMS which are again combined under the one Section 4 material non-conformance, Financial Systems and Processes. This material non-conformance also encompasses the auditors findings that NIH was in non-compliance with the FFMIA. The Central Accounting System (CAS) uses most, but not all, of the U.S. Standard General Ledger accounts and processing rules at the transaction level. Some mixed systems do not provide financial transactions to the CAS using consistent processing rules. In addition, some of these systems are not fully and seamlessly integrated but are otherwise linked with the CAS. For instance, the property management information system does not comply with financial systems requirements. In addition, the audits of several HHS components which also identified continuing problems related to account analyses and reconciliation.
While the problems have not been totally resolved, HHS components have made substantial progress in addressing account analysis and reconciliation problems. For example:
Preparation and analysis of financial statements: The Program Support Center (PSC) has improved the reconciliation and financial reporting processes during FY 2002. PSC contracted out to assist in the monthly reconciliations between general ledger and subsidiary ledger balances. The PSC continued to develop enhancements and streamline the manual preparation of financial statements to implement a more efficient process for preparing financial statements.
Reconciling fund balances with Treasury: In response to the auditor's finding that IHS continues to have difficulty reconciling fund balances in Agency records with the fund balances at Treasury, IHS has developed and adopted a standard mechanized system for reconciling cash balances and validating general ledger accounts.
Strengthening year-end closing process: NIH has implemented a new, more disciplined and controlled process to prepare the trial balances from which financial statements are prepared.
Unified Financial Management System: The Long-Term Solution
The Unified Financial Management System (UFMS) initiative�a critical component of the Department's efforts to modernize its financial management systems and information technology infrastructure�was initiated during FY 2001 at the direction of Secretary Thompson. The initiative is a key element of HHS' effort to improve its financial operations and supports the "improve financial performance" initiative of the President's Management Agenda. The Program's overall strategic goal is to unify HHS' financial management by designing and implementing a modern, department-wide financial management system.
UFMS will replace the five core accounting systems currently in use across HHS. The unified system will be comprised or two primary sub-components�a system for CMS and its Medicare contractors (the Heathcare Integrated General Ledger and Accounting System (HIGLAS) and another system for the rest of HHS. UFMS will also institute a consolidated departmental financial reporting capability. The Program is projected to continue through FY 2007, when UFMS is to be fully implemented across the Department.
The system, once fully implemented, will significantly enhance the Department's internal controls, management's stewardship and accountability over financial transactions, operations and assets. The system will resolve a number of material weaknesses identified by the Department's Office of the Inspector General in HHS' financial operations.
The UFMS Program Management Office (PMO) carries out the day-to-day management of the Program. During fiscal year 2002, the PMO primarily conducted pre-implementation planning activities. During the fiscal year, the UFMS Program completed its major planning activities and related documents, culminating with the Departmental approval of the UFMS Implementation Plan on September 27, 2002. The Department formally approved the UFMS business case on November 5, 2002.
The Program entered its implementation phase in October 2002. Following are the key Program accomplishments during FY 2002.
Established the UFMS PMO, including hiring the UFMS Program Director, to lead the effort.
Hired a nationally recognized company to serve as the Program's systems integrator.
Established the UFMS governance structure in which top departmental executives, including the operating components' Chief Financial Officers and Chief Information Officers, actively participate.
Selected the commercial off-the-shelf software to serve as the core system application/infrastructure.
Developed a department-wide budget and accounting classification structure (BACS).
Compiled department-wide financial requirements applicable to UFMS.
Developed key planning documents, including Risk Assessment and Mitigation Plan, Change Management (Business Transformation) Plan, Performance Management Plan, and Core Target Business Model.
Developed the UFMS business case (which was finalized by the UFMS PMO and approved by the HHS Information Technology Internal Review Board on November 5, 2002).
Additionally, shortly after the end of FY 2002, the HHS Investment Technology Investment Review Board (ITIRB) formally approved the UFMS business case.
Implementation of UFMS in accordance with the approved implementation plan will allow HHS to comply with the requirements of the Federal Financial Management Improvement Act by the end of fiscal year 2005. OMB, as a result of its review of key UFMS planning documents and discussions with HHS officials, recognized in its first quarter progress report that the Department's current financial management "status could improve when [the] new accounting system [UFMS] is substantially implemented at the end of [FY] 2005."
CMS: Financial Systems, Analyses and Oversight (CMS-01-01) (Formerly titled: Financial Systems and Regional Central Office Oversight) Note: This finding is a sub-set of the material non-conformance Financial Systems and Processes Department-wide (HHS-00-01)
The financial statements auditors reported that, overall, the Medicare contractors have made significant improvements in maintaining supporting records for Medicare activities and year-end balances. However, the lack of an integrated financial management system continues to impair CMS and its Medicare contractors' abilities to adequately support and analyze accounts receivable and other reported financial balances. Additionally, the auditors reported that, CMS' regional office (RO) and central office (CO) staff did not perform certain oversight procedures to ensure that all financial data, including data provided by Medicare contractors, was reliable, accurate and complete.
The CMS required Medicare contractors that had audit findings during the FY 2001 audit to submit CAPs to resolve those findings. The CMS evaluated the CAPs submitted and provided comments to the Medicare contractors on the adequacy of their CAPs. The CMS also requires quarterly updates to the CAPs that describe the status or progress of their CAP implementation to correct prior year findings.
At CMS CO, procedures were implemented related to preparing trend analyses to validate the accuracy of financial data. Additionally, CMS created workgroups comprised of CO and RO consortia staff responsible for addressing four key areas identified by auditors: follow up on CAPs, reconciliations of funds expended to paid claims, trend analysis, and internal controls. The objectives of each workgroup are to clearly define CO and RO roles and responsibilities, as well as developing the national strategic plans to strengthen CMS' Medicare contractor financial management oversight in these areas. The detailed CAP to correct this material weakness is included in this report and is consistent with the quarterly CAP provided to OMB.
CMS: Medicare EDP Controls (CMS 01-02) Note: This finding is also a sub-set of the material non-conformance Financial Systems and Processes Department-wide (HHS-00-01)
The financial statements auditors reported that CMS relies on extensive EDP operations to administer the Medicare program and process accounts for Medicare expenditures. Internal controls over these operations are essential to ensure the integrity, confidentiality, and reliability of critical data while reducing the risk of errors, fraud, and other illegal acts. Numerous weaknesses at the Medicare contractors, as well as certain application control weaknesses with the Medicare contractors' shared systems were prevalent. Such weaknesses do not effectively prevent 1) unauthorized access to and disclosure of sensitive information, 2) malicious changes that could interrupt data processing or destroy files, 3) improper Medicare payments, or 4) disruption of critical operations.
Additionally, the auditors reported that weaknesses in CMS' entity-wide security plans; Medicare data file and physical data center access controls; and service continuity do not ensure that EDP security controls are adequate and operating effectively. The CMS continues to make progress toward resolving these issues by revising its information systems security requirements for both CMS central office and the Medicare contractors. CMS received $9.7 million in August 2002 for distribution to the Medicare contractors. While the funding enabled CMS to make a start on correction of this material weakness in FY 2002, it was not sufficient to complete the project which is currently estimated for completion in FY 2003. The detailed CAP to correct this material weakness is included in this Appendix and is consistent with the quarterly CAP provided to OMB.
The lack of an integrated financial management system at CMS continues to impair CMS' and the Medicare contractors' abilities to adequately support accounts receivable and other financial balances reported. The CMS is implementing a comprehensive plan to bring its systems into compliance. Specifically, CMS has initiated steps to implement an integrated general ledger system known as HIGLAS for the Medicare contractors, regional and central offices. HIGLAS will replace the 53 different systems currently used by Medicare contractors. HIGLAS will integrate the new system with Medicare's three existing standard claims processing systems. In addition, the current mainframe-based financial system will be replaced by HIGLAS, a web-based system. HIGLAS is expected to be compliant with FFMIA by the end of FY 2005 (the largest Medicare Contractors will be using the new HIGLAS system); and fully operational by 2007.
Financial Statement Audits and the FMFIA
The 2002 FMFIA Report continues to more closely align the findings from the financial statement audits and the FMFIA. HHS components are to report to the Department all deficiencies (findings) from the audit consistent with OMB Circular A-123, which requires that a deficiency should be reported if it is or should be of interest to the next level of management. This includes all material weaknesses and instances of systems non-compliance with FFMIA identified in the FY 2001 financial statement audits, including any which the HHS component may be aware of from the FY 2002 financial statement audit at the time they prepared their FMFIA Report.
HHS components are asked by the ASBTF/Office of Finance to recommend which, if any, of their financial statement audit material weaknesses and FFMIA non-compliance should be included as an FMFIA material weakness in the Department's Report, i.e., are significant enough to be reported outside the agency to the President and Congress. For those material weaknesses and FFMIA non-compliances an HHS component recommends for inclusion in the Department's FMFIA Report, the component is required to include a corrective action plan in the FMFIA format and submit it with their report.
However, with the exception of those material findings discussed above, all of the audit material weaknesses reported by the HHS components are not included in the Department's FMFIA report because HHS believes that the remaining material weaknesses do not reach a level of significance that require reporting to the President and Congress as defined under Revised OMB Circular A-123. Further,since HHS requires corrective action plans to address all of the findings resulting from the financial statement audits, including qualifications, material weaknesses and reportable conditions. HHS submits a department-wide CAP update quarterly to OMB and the most recent OMB scorecard recognizes that HHS has made "good progress" in the CAP.
2002 FMFIA SECTION 4 MATERIAL NON-CONFORMANCE: SCHEDULE OF CORRECTIVE ACTIONS (HHS 00-01)
Title and Description of Material Non-Conformance: Financial Systems and Processes
The Department continues to have serious internal control weaknesses in its financial systems and processes for producing financial statements. (Note: The FY 2001 department-wide financial statement audit and the FMFIA Report reflected a material non-conformance department-wide under Section 4 of the FMFIA called Financial Systems and Processes (HHS-00-01). This finding combined the department-wide audit finding, Financial Systems and Processes, with the audit findings at the Centers for Medicare & Medicaid Services (CMS), specifically, Financial Systems and Regional Central Office Oversight, and Medicare EDP Controls (CMS 01-02). For FY 2002, the CFO auditors reported the same material weaknesses at the Department and at CMS which are again combined under the one Section 4 material non-conformance, Financial Systems and Processes). Financial Systems and Processes also encompasses the audit findings that NIH was in non-compliance with FFMIA. The Central Accounting System (CAS) uses most, but not all, of the U.S. Standard General Ledger accounts and processing rules at the transaction level. Some mixed systems do not provide financial transactions to the CAS using consistent processing rules. In addition, some of these systems are not fully and seamlessly integrated but are otherwise linked with the CAS. For instance, the property management information system does not comply with financial systems requirements. In addition to the CMS findings and NIH findings, the audits of several HHS components (PSC and IHS) also identified continuing problems related to account analyses and reconciliation.
Pace of Corrective Action Year Identified: FY 2000 Original Targeted Correction Date: N/A Correction Date in Last Report: FY 2007
Current Correction Date:
FY 2005 � FFMIA Compliance for UFMS and HIGLAS (the largest Medicare Contractors will be using the new HIGLAS system)1/;
FY 2007 � full HIGLAS implementation Reason for Changes in Dates: 1/ Implementation of UFMS in accordance with approved implementation plan will allow HHS to comply with the FFMIA by the end of FY 2005. OMB, as a result of its review of key UFMS planning documents and discussions with HHS officials, recognized in its first quarter progress report that the Department's current financial management "status" could improve when the new accounting system (UFMS) is substantially implemented at the end of FY 2005.
Lead Managerial Contact: Margie Yanchuk, Director, Division of Financial Systems and Damon Sutton, Acting Director, Division of Accounting and Fiscal Policy, Office of Program Management and Systems Policy Source of Discovery: FY 2000, FY 2001 and FY 2002 financial statement audits by OIG Appropriation/Account #:
For Corrected Items Only
Validation Process Used:
Results Indicators:
2002 FMFIA SECTION 4 MATERIAL NON-CONFORMANCE: SCHEDULE OF CORRECTIVE ACTIONS (HHS 00-01)
Department-wide:
The Department continues to have serious internal control weaknesses in its financial systems and processes for producing financial statements. The FY 2001 CFO audit and the FMFIA Report reflected a material non-conformance department-wide under the FFMIA, which was reported under Section 4 of the FMFIA called Financial Systems and Processes (HHS-00-01). This finding combined the Department-wide audit finding with the audit findings at the Centers for Medicare & Medicaid Services (CMS). CMS' FY 2002 financial statements audit revealed the same two material weaknesses as in the FY 2001 audit, specifically: Financial Systems and Regional Central Office Oversight (CMS-01-01) and Medicare EDP Controls (CMS 01-02).
Briefly Define (purpose, scope, methodology, resources) the Corrective Action Plan (CAP) That Corrects/Improves This Material Non-Conformance:
The Unified Financial Management System (UFMS) initiative�a critical component of the Department's efforts to modernize its financial management systems and information technology infrastructure�was initiated during fiscal year 2001 at the direction of Secretary Thompson. The initiative is a critical element of HHS' effort to improve its financial operations and supports the "Improve Financial Performance" initiative of the President's Management Agenda. The program's overall strategic goal is to unify HHS' financial management by designing and implementing a modern, department-wide financial management system.
UFMS will replace the five core accounting systems currently in use across HHS. The unified system will be comprised or two primary sub-components�a system for CMS and its Medicare contractors, the Heathcare Integrated General Ledger and Accounting System (HIGLAS), and another system for the rest of HHS. UFMS will also institute a consolidated departmental financial reporting capability. The program is projected to continue through fiscal year 2007, when UFMS is to be fully implemented across the Department.
The system, once fully implemented, will significantly enhance the Department's internal controls, management's stewardship and accountability over financial transactions, operations, and assets. The system will resolve a number of material weaknesses identified by the Department's Office of the Inspector General in HHS' financial operations.
The UFMS Program Management Office (PMO) carries out the day-to-day management of the program. During fiscal year 2002, the PMO primarily conducted pre-implementation planning activities. During the fiscal year, the UFMS program completed its major planning activities and related documents, culminating with the Departmental approval of the UFMS Implementation Plan on September 27, 2002. The Department formally approved the UFMS business case on November 5, 2002.
The Program entered its implementation phase in October 2002. Following are the key Program accomplishments during fiscal year 2002.
Established the UFMS PMO, including hiring the UFMS Program Director, to lead the effort.
Hired a nationally recognized company to serve as the program's systems integrator.
Established the UFMS governance structure in which top departmental executives, including the operating components' Chief Financial Officers and Chief Information Officers, actively participate.
Selected the commercial off-the-shelf software to serve as the core system application/infrastructure.
Developed a department-wide budget and accounting classification structure (BACS).
Compiled department-wide financial requirements applicable to UFMS.
Developed key planning documents, including Risk Assessment and Mitigation Plan, Change Management (Business Transformation) Plan, Performance Management Plan, and Core Target Business Model.
Developed the UFMS business case (which was finalized by the UFMS PMO and approved by the HHS Information Technology Internal Review Board on November 5, 2002).
Additionally, shortly after the end of FY 2002, the HHS Investment Technology Investment Review Board (ITIRB) formally approved the UFMS business case.
Implementation of UFMS in accordance with the approved implementation plan will allow HHS to comply with the requirements of the Federal Financial Management Improvement Act by the end of fiscal year 2005. OMB, as a result of its review of key UFMS planning documents and discussions with HHS officials, recognized in its first quarter progress report that the Department's current financial management "status could improve when [the] new accounting system [UFMS] is substantially implemented at the end of [FY] 2005."
2002 FMFIA SECTION 4 MATERIAL NON-CONFORMANCE: SCHEDULE OF CORRECTIVE ACTIONS (HHS 00-01)
Overall Status of Material Non-Conformance:
Department-wide:
During FY 2002, the following efforts were made to resolve the material non-conformance:
The financial audits of several HHS components, identified continuing problems related to account analyses and reconciliation. HHS components have made substantial progress in addressing account analysis and reconciliation problems. For example:
Preparation and analysis of financial statements -- The Program Support Center (PSC) has improved the reconciliation and financial reporting processes during FY 2002. PSC contracted out to assist in the monthly reconciliations between general ledger and subsidiary ledger balances.
Reconciling fund balances with Treasury � In response to the auditor's finding that IHS continues to have difficulty reconciling fund balances in agency records with the fund balances at Treasury, IHS has developed and adopted a standard mechanized system for reconciling cash balances and validating general ledger accounts.
The Program Support Center continued to develop enhancements and streamline the manual preparation of financial statements to implement a more efficient process for preparing financial statements.
2002 FMFIA SECTION 4 MATERIAL NON-CONFORMANCE: SCHEDULE OF CORRECTIVE ACTIONS (HHS 00-01)
Major Milestones Department-wide (Long Term):
Scheduled Due Dates
NIH Business and Research Support System (NBRS) Complete deployment (implementation)
FY 2005
UMFS and HIGLAS: FFMIA Compliance Target date for resolving outstanding financial systems and processes material weaknesses and complying with the FFMIA
End of FY 2005
UMFS � Department-wide (Full Implementation)
FY 2007
HIGLAS - Full implementation
2002 FMFIA SECTION 4 MATERIAL NON-CONFORMANCE: SCHEDULE OF CORRECTIVE ACTIONS (CMS 01-01)
Note: This finding is a sub-set of the one Section 4 material non-conformance department-wide (HHS-00-01)
Title and Description of Material Non-Conformance: Financial Systems, Analysis, and Oversight
The auditors reported that the Centers for Medicare & Medicaid Services (CMS) relies on a decentralized organization, complex and antiquated systems, and ad hoc reports to accumulate data for financial reporting due to the lack of an integrated accounting system at the Medicare contractor level. An integrated financial system and a strong oversight are needed to ensure that periodic analyses and reconciliation are completed to detect errors in a timely manner.
Pace of Corrective Action: Continuous Year identified: FY 1997 Original Targeted Correction Date: FY 1999 Correction Date in Last Year's Report: FY 2007 Current Correction Date:
FY 2005 � FFMIA Compliance for UFMS and HIGLAS (the largest Medicare Contractors will be using the new HIGLAS system)1/;
FY 2007 � full HIGLAS implementation Reason for Changes in Dates: 1/ Implementation of UFMS in accordance with approved implementation plan will allow HHS to comply with the FFMIA by the end of FY 2005. OMB, as a result of its review of key UFMS planning documents and discussions with HHS officials, recognized in its first quarter progress report that the Department;'s current financial management "status" could improve when the new accounting system (UFMS) is substantially implemented at the end of FY 2005.
Lead Managerial Contact: Maria C. Montilla, Director, Division of Financial Oversight, Accounting Management Group, Office of Financial Management
Source of Discovery: FY 1997 financial statement audit by OIG and other sources.
For Corrected Items Only
Validation Process Used:
Results Indicators:
2002 FMFIA SECTION 4 MATERIAL NON-CONFORMANCE: SCHEDULE OF CORRECTIVE ACTIONS (CMS 01-01) Note: This finding is a sub-set of the one Section 4 material non-conformance department-wide (HHS-00-01)
Briefly define the corrective action plan that corrects this material non-conformance:
While CMS have made significant improvements in financial reporting, our long-term solution to this material weakness is the Healthcare Integrated General Ledger Accounting System (HIGLAS). Until this system is implemented, CMS will continue projects and activities aimed at compensating for the lack of the modernized system. Until HIGLAS can be fully implemented, CMS will continue to implement short-term corrective actions, as outlined in our Chief Financial Officer (CFO) Comprehensive Plan for Financial Management, to address this material weakness. The plan contains 8 goals and 24 initiatives to achieve our strategic vision. The four key financial management objectives of our plan are to: 1) improve financial reporting, guidance, and oversight by providing timely, reliable, and accurate financial information that will enable CMS managers and other decision makers to make timely and accurate program and administrative decisions, 2) design and implement effective financial management systems that comply with the Federal Financial Management Improvement Act (FFMIA), 3) improve debt collection and internal accounting operations, and 4) validate key financial data to ensure its accuracy and reliability.
Briefly give an overall status of this material non-conformance at the close of FY 2002.
The annual CFO audits have identified financial management and electronic data processing (EDP) weaknesses that limit our ability to effectively manage the Medicare and Medicaid programs. Correcting these deficiencies is essential to demonstrate our commitment to improve financial management and internal controls. Therefore, audit resolution is a top priority at CMS. Medicare contractors, regional offices (ROs), and central office (CO) components are required to prepare a corrective action plan (CAP), which describes specific activities to correct all prior year findings. Quarterly updates to the CAPs are also required. The CAPs and their quarterly updates are reviewed by CMS for adequacy.
During FY 2002, CMS created workgroups comprised of CO and RO consortia staff responsible for addressing four key areas identified by the auditors: 1) follow up on CAPs; 2) 1522 reconciliation of funds expended to paid claims; 3) trend analysis; and 4) internal controls. The objective of each workgroup is to clearly define CO/RO roles and responsibilities, and to develop the national strategic plans that will strengthen CMS' Medicare contractor financial management oversight in these areas:
The CMS created a CAP Workgroup that is responsible for developing policies and procedures for overseeing Medicare contractors' reporting and implementation of CAPs. The workgroup issued final manual instructions that required the submission of a "Universal CAP Report" by Medicare contractors that receive various financial management audits by either the Office of Inspector General (OIG), the General Accounting Office (GAO), external certified public accounting firms, as well as CMS RO and CO staff. The Universal CAP Report standardizes the format of the Medicare contractors' CAPs submissions, and facilitates CMS' monitoring responsibilities of these reports. Training on these new instructions was provided during our annual CFO training conferences. Furthermore, we hired consultants to develop a CAP tracking system that will enable us to monitor the progress at which the Medicare contractors are implementing their CAPs.
We utilized consultants, CO, and RO staff to follow up on contractors' CAPs during the Statement on Auditing Standards No. 70 (SAS 70) internal control reviews and accounts receivable consulting reviews that were performed in FY 2002. Also, RO systems security staff visited Medicare contractors to ensure that EDP problems were corrected.
The CMS created the CMS 1522 Cash Reconciliation Workgroup that is tasked to develop policies and procedures that require Medicare contractors to reconcile, on a monthly basis, total funds expended by CMS to the corresponding Medicare claims that have been submitted and paid. Through a partnership with OIG, CMS provided Medicare contractors a better understanding of these reconciliations by providing training in this area during our annual CFO training conferences. Additionally, the 1522 Reconciliation Workgroup finalized a review protocol to ensure the Medicare contractors perform this reconciliation. During FY 2002, the workgroup provided training to CMS RO and CO staff on the final protocol, and selected and performed reviews at six Medicare contractor locations. We plan to issue final guidance to the Medicare contractors in FY 2003 to require them to perform a reconciliation of the total funds requested, reported on the CMS 1522 Monthly Contractor Report, to detail paid claims data.
The CMS continued to enhance analytical tools to perform more expansive trend analysis procedures of critical financial data, specifically accounts receivable and semiannual financial statements. CMS created the Trend Analysis Workgroup that was tasked with developing policies and procedures for performing trend analysis of key financial data, such as accounts receivable, reported by CMS and the Medicare contractors. These tools provide us the steps necessary to identify unusual variances, potential errors, system weaknesses, or inappropriate patterns of financial data accumulation. Additionally, the tools allow us to perform more extensive data analyses, follow up with Medicare contractors, and determine the need for additional actions to ensure that problems are adequately resolved.
To ensure that accounts receivable balances reported are reasonable, the workgroup issued final manual instructions requiring Medicare contractors to submit, on a quarterly basis, documentation supporting the trend analysis performed.
Training on these new instructions including CMS Form 750, Statement of Financial Position and CMS Form 751, Status of Accounts Receivable was also provided to Medicare contractors and CMS staff during the annual CFO training conferences. Additionally, the workgroup developed and trained CMS CO and RO staff on a review protocol that is used to review the adequacy of Medicare contractors' quarterly trending analysis submissions.
To emphasize the importance of internal controls in FY 2002, CMS created the Certification Package on Internal Controls (CPIC) Workgroup that is responsible for developing, creating and communicating a heightened awareness to a culture of internal controls within the Medicare contractor community. The workgroup developed a protocol that is used to evaluate or assess the Medicare contractors' processes for complying with requirements of the Federal Managers' Financial Integrity Act of 1982.
The workgroup finalized manual instructions that provide guidelines to strengthen internal controls. In the past, we have been criticized for not providing a level of confidence that the Medicare contractors' internal control environment had adequate systems of internal controls that were in place and operating efficiently. We believe the procedures and methods set forth in this manual have been devised to alleviate the problems and weaknesses for which the program has been cited.
CMS continued to contract with certified public accounting firms to conduct SAS 70 internal control reviews, and performed these reviews at 17 Medicare contractor locations. The reviews indicated that all 17 Medicare contractors reviewed had one or more exceptions. To ensure that the exceptions are properly addressed in a timely manner, we have requested that the contractors develop and submit CAPs. Additionally, we require all Medicare contractors to submit an annual CPIC on their Medicare operations. In the CPIC, contractors are required to report their material weaknesses and reportable conditions. We require CAPs for all material weaknesses reported in the CPICs. For FY 2003, we will continue to perform these SAS 70 reviews and monitor contractors' progress for implementing CAPs resulting from these two initiatives.
The CMS has accomplished the following initiatives to effectively implement HIGLAS.
Established a CMS HIGLAS Program Office staffed with 20 FTEs.
Initiated implementation of an approved Joint Financial Management Improvement Program Commercial Off-the-shelf product at two pilot sites.
Established the HIGLAS project baseline and began the design and building of HIGLAS functional specifications/requirements for two Medicare contractor pilot locations.
Finalized the following project management plans: the Business Solution Test Plan, the Communications Plan, and the Configuration Management Plan.
Conducted four Conference Room Pilots to refine business requirements/solutions.
Established the Application Service Provider and technical infrastructure.
Initiated running 11 non-production instances of the Oracle software in a test environment.
Established the HIGLAS Change Control Board with support from the Technical Configuration Committee, Requirements Management Committee, and the Performance Work Group to assure decisions are made accurately and timely.
Established HIGLAS Systems Engineering Portal for project communication.
Created a HIGLAS Web site to provide program status for project stakeholders.
2002 FMFIA SECTION 4 MATERIAL NON-CONFORMANCE: SCHEDULE OF CORRECTIVE ACTIONS (CMS 01-01) Note: This finding is a sub-set of the one Section 4 material non-conformance department-wide (HHS-00-01)
CAP Milestones for FY 2002-2003
Completion Date
Provided financial management training, including trending analysis to contractors.
June 2002
Acquired advisory services to validate receivable balances.
July 2002
Revised financial management Internet manual.
August 2002
Completed advisory reviews.
September 2002
Established CAPs from advisory reviews
October 2002
Contractors implemented CAPs from advisory reviews.
July 2003
CMS 1522 Cash Reconciliation Workgroup provided policy and procedures to ensure contractors reconcile funds expended.
March 2002
Developed review procedures for monitoring the CMS 1522.
June 2002
Provided procedures and trained regional offices to perform reviews.
June 2002
Performed onsite reviews at six contractors.
September 2002
Monitor the monthly CMS 1522 reconciliation submitted by contractors.
Monthly
Issue draft instructions to contractors that require a reconciliation of the CMS 1522 detailed claims data.
January 2003
Issue final instructions that require a reconciliation of the CMS 1522 to detailed claims data.
February 2003
Implement final instructions that require a reconciliation of the CMS 1522 to detailed claims data.
July 2003
Formed Trend Analysis Workgroup to develop and implement trend analysis procedures.
March 2002
Issued contractor trending analysis procedures.
July 2002
Perform trending analysis on receivable balances reported.
November 2002
Quarter ending December 2002.
February 2003
Quarter ending March 2003.
May 2003
Quarter ending June 2003
July 2003
Issue final RO procedures to perform trending analysis and to review contractors trending analysis.
January 2002
Implement procedures for quarterly financial statements.
August 2002
Statements due:
February 2003 May 2003 August 2003
Implement procedures for yearly financial statements.
November 2002
Implement HIGLAS project.
2007
2002 FMFIA SECTION 4 MATERIAL NON-CONFORMANCE: SCHEDULE OF CORRECTIVE ACTIONS (CMS 01-02) Note: This finding is a sub-set of the one Section 4 material non-conformance department-wide (HHS-00-01)
Title and Description of Material Non-Conformance: Medicare Electronic Data Processing (EDP) Controls
Although the review disclosed no exploitation of the vulnerabilities, the auditors reported that electronic data processing (EDP) controls at the Center for Medicare & Medicaid Services (CMS) central office (CO) and the Medicare contractors do not prevent: 1) unauthorized access to and disclosure of sensitive information; 2) malicious changes that could interrupt data processing or destroy files; 3) improper Medicare payments; or 4) disruption of critical operations. Further, the auditors reported that weaknesses continue to exist in the areas of entity-wide security plans, Medicare data file, physical data center access controls, and service continuity. No individual weakness was determined to be material, but in the aggregate, the weaknesses were considered material.
Pace of Corrective Action: Continuous Year identified: FY 1998 Original Targeted Correction Date: FY 1999 Correction Date in Last Year's Report: FY 2002 Current Correction Date: FY 2003 Reason for Changes in Dates: The CMS received $9.7 million in August 2002 for distribution to the Medicare contractors. While the funding enabled CMS to make a start on correction of this material weakness in FY 2002, it was not sufficient to complete the project which is currently estimated for completion in FY 2003.
Lead Managerial Contact: Richard Lyman, Director, Security and Standards Group, Office of Information Services
Source of Discovery: FY 1997 financial statement audit by OIG and other sources. Appropriation/Account #: 75XI501
For Corrected Items Only
Validation Process Used:
Results Indicators:
2002 FMFIA SECTION 4 MATERIAL NON-CONFORMANCE: SCHEDULE OF CORRECTIVE ACTIONS (CMS 01-02) Note: This finding is a sub-set of the one Section 4 material non-conformance department-wide (HHS-00-01)
Briefly define the corrective action plan that corrects this material weakness.
The CMS recognizes the significance of controls and security issues regarding Medicare EDP issues as they relate to the integrity, confidentiality, and availability of sensitive Medicare data. The CMS received $9.7 million in August 2002 for distribution to the Medicare contractors. The funding distribution was $5.3 million to fund system security plans for the contractor claims processing systems and $4.4 million to fund access controls, systems software, segregation of duties, and service continuity. While the funding enabled CMS to make a start on correction of this material weakness in FY 2002, it was not sufficient to complete the project which is currently estimated for completion in FY 2003.
Briefly give an overall status of material weakness at the close of FY 2002.
The CMS continues to make progress in identifying and addressing weaknesses in its automated processing systems by performing vulnerability assessments, Statement of Auditing Standards No. 70 (SAS 70) internal control reviews, and requiring Medicare contractors to perform internal control self assessments. The CMS has moved toward resolving this issue by revising its information systems security requirements. The CMS Core Information Security Requirements adhere to guidelines in the Office of Management and Budget (OMB) Circular A-130 and implement effective control procedures. In FY 2002, CMS completed a prototype of a system security plan methodology for Medicare contractors. Controls were implemented to monitor and evaluate requests for source code changes to the Fiscal Intermediary Standard System (FISS). At central office, CMS developed and implemented new background investigation procedures to strengthen access controls over sensitive Medicare data. The CMS also developed a comprehensive policy for software quality assurance, as well as developed, tested, and implemented a systems software change audit review process. Compliance with the CAP milestones for FY 2003 is dependent on resources.
2002 FMFIA SECTION 4 MATERIAL NON-CONFORMANCE: SCHEDULE OF CORRECTIVE ACTIONS (CMS 01-02) Note: This finding is a sub-set of the one Section 4 material non-conformance department-wide (HHS-00-01)
Corrective Action Plan Milestones for FY 2003
Completion Date
Medicare Contractors
Adhere to OMB A-130 guidelines for entity-wide security plans to ensure appropriate safeguarding of Medicare data.
September 2003
Develop consistent and effective physical and logical access procedures, including administration and monitoring of access by contractor personnel in the course of their job responsibilities.
September 2003
Develop consistent and effective procedures over the implementation, maintenance, access, and documentation of operating systems software products used to process Medicare data.
September 2003
Develop a segregation of duties to ensure accountability and responsibility for access to Medicare applications and data are appropriately assigned.
September 2003
Update and appropriately document service continuity procedures to recover Medicare processing in case of a system outage.
September 2003
CMS Central Office
Complete the CMS master plan and the supporting general support systems (GSS) plans that application plans will refer to.
June 2003
Recertify all personnel with physical access to the CMS Data Center.
November 2002
Implement a three-phased approach to establishing a comprehensive Business Continuity Plan.
October 2003
2002 FMFIA MATERIAL WEAKNESSES: SCHEDULE OF CORRECTIVE ACTIONS (FDA-89-02)Title and Description of Material Weakness: Deficiency in the Enforcement Program for Imported Foods in the Food and Drug Administration (FDA) - (FDA-89-02). The Office of Inspector General reported that FDA did not inspect a large enough sample of imported foods to ensure the safety of the public health.
Pace of Corrective Action Year Identified: FY 1989 Original Targeted Correction Date: FY 1990 Correction Date in Last Year's Report: FY 2001 Current Correction Date: FY 2006 Reason for Change in Dates: FDA is not ready to declare this material weakness resolved until recently authorized staff for food inspections are fully trained and a risk-based approach to the inspections process is fully implemented.
Name of Responsible Program Manager: John Taylor, Associate Commissioner for Regulatory Affairs
Source of Discovery: OIG (Report A-15-90-00001) and internal FDA management reviews.
Appropriation/Account #: 7520600
Validation Process Used: A corrective action review will be completed following correction of the material weakness.
Results Indicators:
FDA determined that a 20 percent minimum inspection rate to assure the safety of the imported foods was unrealistic and that goals could be achieved more cost effectively with science based targeting of inspection resources. As a result, a revised strategy for how the Agency will deal with imported foods has been prepared. FDA's new approach will focus on products and problems, which present a high risk to the American public, or firms and countries of origin that have a history of noncompliance. FDA also anticipates making improvements and an increased presence due to the substantial added FY 2002 resources provided by bioterrorism funding.
2002 FMFIA SECTION 2 MATERIAL WEAKNESSES: SCHEDULE OF CORRECTIVE ACTIONS (FDA-89-02)
Title and Description of Material Weakness: Deficiency in the Enforcement Program for Imported Foods in the FDA
Major Milestones
Milestone Dates
Completed actions/events:
Original Plan
Revised Plan
Actual Date
FDA uses a structural and selective sampling method, based on both the entry level and product intelligence to provide an effective level of examination coverage. This assessment is supported by historical data covering the period of 1972-1992.
FY 1992-93
FDA developed a Revised Imports Strategy, which embodies intelligence based sampling of imports to provide an effective level of coverage, and includes performance indicators. With this new approach, FDA focuses its import activities on products and problems presenting a high health risk to the American public, or firms and countries of origin having a history of non-compliance. Electronic screening, improved strategic alliances and improved premarket and postmarket surveillance are key components of the revised strategy.
FY 1994-95
FDA has expanded the use of an electronic entry processing system (EEPS) for imports using the Custom's Automated Commercial System. EEPS enables FDA to screen import entries and electronically make "May Proceed" decisions on products of low risk and high compliance rates. At this time, EEPS has been implemented at all major ports where electronic entry of imports is available.
FY 1995-96
FDA plans to maintain its pre-market surveillance through a vigorous foreign inspection program designed to identify problems at their source. FDA completed 65 foreign inspections during FY 1995, 40 in FY 1997, 40 in FY 1998, and 87 in FY 1999.
FY 1996-99
FDA will complete the full roll-out of OASIS version 2 to all district offices.
FY 1998
The default "May proceed" rate for all food commodities has been set at 70 percent or greater. However, the "May proceed" rate measured at any particular time may be lower as FDA intensifies a problem with a firm, country or product. These adjustments are considered essential to FDA surveillance activities.
FY 1999
Planned/continuing agency actions:
Prior to the events of September 11, 2001, FDA and U.S. Customs began discussions to update our Memorandum of Understanding (MOU) that will more correctly reflect our relationship. During those discussions, FDA began exploring redefining the agency's import program from one primarily focused upon border activities (e.g., field examinations, and product sampling and analyses) to one that evaluates the entire life cycle of an imported product, beginning with raw materials entering a foreign processing, packing or manufacturing facility all the way to the U.S. consumer. After September 11, 2001 the FDA embarked on a full scale reevaluation and strategic planning process at the request of the agency's Executive Council. FDA established the Import Strategic Planning Steering Committee, with membership from each of the product centers, ORA, and various offices reporting to the Commissioner, including the Office of Planning, Policy and Legislation, the Office of International Programs, the Office of the Chief Counsel and the Chief Information Officer.
Of paramount importance in this reevaluation is the definition of "import coverage." For decades, this has been characterized in terms of agency "output" rather than "outcome." The result has been that programs with tenuous relationships to public health and safety have driven the agency's import operations and the agency has continued to evaluate the import functions in terms of the number of shipments examined and the number of samples analyzed. A simple review of the exponential growth of international trade in FDA regulated commodities argues against continuing this tact.
FY 2001-02
Under Development
Recently, FDA hired over 800 Consumer Safety Officers, many of whom were appropriated with Bioterrorism Supplemental monies. Much of FDA's bioterrorism activities must have a strong relation to import operations and imported products as this represents a considerable threat to the US food and drug supply. By evaluating FDA regulated imports in the context of their entire life cycle, the FDA should be able to identify risks and threats associated with imported products in whatever context they may be found. This requires substantial re-engineering on several levels within FDA's programs and operations as well as increased leveraging with other federal and state regulating partners, foreign governments and industry.
Many activities performed by the agency have not been captured in a manner that reflects their true impact on international trade and imported articles. For instance, and only by way of example, when FDA conducts a foreign inspection and finds no significant processing deviations and confirms registrations, product listings, and approvals, as appropriate, the data is often not used to inform the import screening process. Instead, the next shipments from that manufacturer are screened using the same criteria as a manufacturer that has not been inspected. This is also true when a domestic inspection includes in an evaluation of an imported article that appears to have some deficiency associated with it. The result is that these traditionally non-import regulation activities are producing data that in fact relate to the quality, safety or efficacy of imported articles. However, because the data isn't effectively captured, the benefits of that historical data aren't applied on future entry inspections and screenings.
FY 2001-02
Under Development
Industry also has the ability to provide processing, packing and manufacturing information (as well as security related data) to the agency in advance of the arrival of imported shipments which, under an auditing system, may permit the agency to focus resources on relatively unknown industry participants, allowing for a more efficient targeting of limited agency resources. The benefit to industry participants would be streamlined entry processes, efficiency and stability in trade with the U.S., and less cost in storage of imported goods. This is similar to the US Customs program, the Customs-Trade Partnership Against Terrorism (CTPAT).
Additionally, FDA seeks to place the responsibility of quality and safety in imported goods on the proper parties under the law, i.e., the importers and foreign manufacturers, distributors, shippers, packers and processors. This may permit FDA to use its border operations as a "final checkpoint" for imported articles, rather than the only checkpoint. Office of Regulatory Affairs believes these principles are more in line with Congress' intent to ensure appropriate management of federal programs and are examples of the kinds of activities that should be included in "import coverage", even if they do not equate to increased physical examinations of product sampling.
The Office of Regulatory Affairs expects that the Import Strategic Planning Steering Committee review will result in a substantial action plan for:
Re-engineering of the import regulatory concept and programs;
More effective targeting of FDA examinations, sampling, entry review, and foreign inspections; and
More useful Mutual Recognition Agreements and Problem Solving Agreements with foreign governments.
Resource flow is also critical as the re-engineering process will require significant upgrades and interaction to the agency's Information Technology infrastructure and applications.
FY 2001-02
Under Development
HHS FY 2002 Pending and New Material Weaknesses and Non-Conformances Under FMFIA Reporting
No.
Title and Identification Code
First Year Reported
Target Date for Correction in 2001 FMFIA Report
Current Target Date for Completion
Management Control Material Weaknesses (Section 2)
1.
Weak Enforcement in the Import Food Inspection Program (FDA 89-02)
FY 1989
FY 2002
FY 2006
Financial Management Systems Material Non-Conformances (Section 4)
CMS Financial Systems and Regional and Central Office Oversight (Medicare Accounts Receivable)(CMS 01-01, formerly HCFA 97-02)
FY 1997
FY 2007
FY 2005 HIGLAS FFMIA Compliance FY 2007- HIGLAS full implementation
1b.
Medicare EDP Controls including Application Controls for Medicare Contractors (CMS 01-02, formerly HCFA 98-01a)
FY1998
FY 2002
FY 2003
Note: In FY 2002, NIH completed the milestones intended to implement a new system and resolve the material weakness cited in prior years for Deficiencies in Technology Transfer Activities. We believe sufficient corrective actions have been taken and the desired results achieved.
Number of Management Controls (Section 2) Material Weaknesses
Less number recategorized to Section 4 in 2001 Report
3 (CMS 01-01) (CMS 01-02) (HHS 00-01)
0
3 (CMS 01-01) (CMS 01-02) (HHS 00-01)
Total
7
6
1 (FDA 89-02)
Of the total number corrected how many were corrected in 2002? 1
Note: In FY 2002, NIH completed the milestones intended to implement a new system and resolve the material weakness cited in prior years for Deficiencies in Technology Transfer Activities. We believe sufficient corrective actions have been taken and the desired results achieved.
Number of Financial Management Systems (Section 4) Material Non-Conformances
Number Reported First Time
Number Corrected
Number Still Pending
1997 Report
1 (CMS 01-01)
0
1 (CMS 01-01)
1998 Report
1 (CMS 01-02)
0
1 (CMS 01-02)
1999 Report
1 (HHS 00-01)
0
1 (HHS 00-01)
2000 Report
0
0
0
2001 Report
0
0
0
2002 Report
0
0
0
Subtotal
3
0
3
Less number combined with 1999 finding
2 (CMS 01-01) (CMS 01-02)
0
2 (CMS 01-01) (CMS 01-02)
Total
1
0
1 (HHS 00-01)
Of the total number corrected how many were corrected in 2002? 0
Download Reader 
