Appendix D - FY 2005 Federal Managers' Financial Integrity Act Report on Systems and ControlsThe Federal Managers’ Financial Integrity Act (FMFIA) requires agencies to provide an annual statement of assurance on the effectiveness of their management, administrative, and accounting controls (Section 2 of the Act), and financial management systems (Section 4 of the Act). Significant deficiencies in internal controls are considered material weaknesses; significant deficiencies in financial management systems are considered material nonconformances. The full text of the Secretary’s assurance statement for FY 2005 can be found in the Secretary’s Letter at the beginning of this report; the Sections 2 and 4 results are discussed in the following pages.
HHS reports one new Section 2 material weakness in FY 2005, Managed Care Benefit Expense Cycle. Two Section 2 material weaknesses from the FY 2004 report, Federal Information Security Management Act (FISMA) Significant Deficiency and Departmental Financial Reporting, have been corrected as planned. For the Departmental Payroll System material weakness, the auditors found that substantial progress was made and it is no longer material. FY 2004 Section 2 Material Weaknesses Corrected The following three material weaknesses were corrected in FY 2005. Federal Information Systems Management Act (FISMA) Significant Deficiency (HHS-04-01) The HHS FISMA report for FY 2005 will reflect that this significant deficiency involving contingency planning and disaster recovery for some of HHS systems has been corrected. Based on the level of attention to the contingency plan development and subsequent testing for high impact systems, coupled with the overall attention that has been placed on contingency plans and testing across all HHS FISMA systems, the Inspector General opinion (in the FISMA Report) was that this issue no longer rose to the level of a significant deficiency. Due to FISMA confidentiality requirements, the FISMA report findings are not published and therefore a detailed report on corrective actions taken is not included in this published FMFIA report. However, the HHS Chief Information Office (CIO) has reported that the following actions were taken in FY 2005 at the Departmental level (HHS CIO):
Departmental Payroll System (HHS-04-02) The auditors found that substantial progress was made regarding the finding from last year’s audit and is no longer considered by the auditors to be material. The most significant development in 2005 was the conversion of the central payroll system to DFAS in April 2005. Following are some of the corrective actions taken in FY 2005:
Future actions to be taken include:
The Department is committed to putting any necessary remedial or preventive mechanisms in place to improve its audit standing. HHS fully embraces having solid oversight responsibilities for payroll and personnel and has already implemented procedures and processes that address many of the concerns discovered during its massive data cleanup efforts. HHS believes that its efforts in the HR consolidation, implementation of Department-wide automated HR systems, and the transition to DFAS will enhance the Department’s ability to have a solid payroll system. Departmental Financial Reporting (HHS-04-03) This material weakness was corrected in FY 2005 as planned. In FY 2004, the auditors found that the Department lacked a coordinated process among cross-functional teams of finance, operations, and legal personnel to monitor business activities to identify situations where accounting evaluation or decision making may be necessary. The issue that gave rise to this problem was that HHS had a significant policy issue at the end of FY 2004 that had a material impact on its financial statements. This issue was below the materiality threshold in prior years. In December 2004, at the direction of the Acting HHS Chief Financial Officer (CFO) by memorandum, the Department implemented the following actions to address this material weakness:
With regard to the Special Disability Workload (SDW) issue that gave rise to the finding, CMS reported the following status:
HHS will continue to engage the active participation of OMB officials in the resolution of any significant policy issues that could affect future audits. Following is a discussion of the new Managed Care Benefit Expense Cycle material weakness FY 2005 Section 2 Material Weakness Corrective Action Plan HHS-05-01 Managed Care Benefit Expense Cycle The internal controls over the Medicare Managed Care Program need to be improved. Inadequate internal controls over audit and payment activities for the Medicare Managed Care Program resulted in the following CFO-audit related findings: (1) CMS does not maintain sufficient documentation to support the on-going monitoring of Managed Care organizations by the regional offices in accordance with CMS policies and procedures; (2) inadequate policies, documentation and supervisory controls exist related to the authorization and payment process for the Medicare Managed Care Program; (3) during 2005, CMS underwent a major systems conversion and implemented the Medicare Managed Care System (MMCS) payment system that resulted in erroneous payments for Medicare Managed Care contractors. Inaccurate payments were made throughout the year due to the use of inaccurate information. The CMS failed to establish a systematic method for identifying, documenting, and correcting errors found in the MMCS system; and (4) CMS has not established proper segregation of duties related to authorization and controls around payments made to Medicare Managed Care contractors. Summary of Corrective Action Approach Managed Care (Monitoring) - With regard to the oversight of the Managed Care Program, the CMS Central Office (CO) staff will follow up with all Regional Offices (ROs) to ensure that the ROs follow the Medicare Advantage organization, cost organization, demonstration, and health care pre-payment plans audit protocols and document retention standard protocols. Managed Care (Payment) - The CMS will continue to work with the Division of Enrollment and Payment Operations (DEPO) external contractor to develop standard operating procedures, policies, procedures, and internal controls around payment system functions. The CBC will work to develop systems for better identifying system errors and related payment errors. The CBC will work to strengthen the Agency’s segregation of duties around Managed Care payments. Key Milestones for Corrective ActionFY 2005 Actions: Managed Care (Monitoring) - The CMS has accomplished the following initiatives in FY 2005 to improve the maintenance of documentation to support the ongoing monitoring of Managed Care organizations by the regional offices in accordance with the CMS policies and procedures.
Managed Care (Payment) - The CMS has obtained an external contractor to audit DEPO’s payment systems. Currently the external contractors are preparing a report of audit findings and based on the audit findings, the contractors will develop new and revised policies, procedures and internal controls pertaining to authorization and payment processes. Target Correction Date: FY 2006 FY 2006 Planned Actions:
Section 4 Material Nonconformance Outstanding Financial Systems and Processes (HHS-00-01) Summary At the end of FY 2005, HHS reported one repeat Section 4 nonconformance, Financial Systems and Processes (HHS-00-01). The Managed Care Program, formerly reported as part of the Department-wide Financial Systems and Processes material nonconformance, is being reported as a separate material weakness under Section 2 of the FMFIA. (See HHS-05-01 as reported above.) For one of the two subcomponents of this material nonconformance, Financial Systems Analysis and Oversight, CMS made progress which resulted in the findings in both the Medicare and Health Programs being reduced to a reportable condition or incorporated into the Managed Care Benefit Expense Cycle material weakness. Both CDC and FDA continued to record thousands of nonstandard accounting entries both prior and subsequent to the UFMS conversion. FDA recorded 14 thousand non-standard accounting entries totaling an absolute value of approximately $9.4 billion to create the September 30, 2005 financial statements. FDA noted this was primarily due to the productivity dip and lack of familiarity with the system. To prepare the September 30, 2005 financial statements, CDC indicated it was required to do the following:
For the second subcomponent, Medicare Electronic Data Processing Controls, much of that finding was corrected and the auditors also classified it as a reportable condition. HHS auditors have cited the Department’s lack of an integrated accounting system as a material weakness and a specific impediment in preparing timely financial reports and statements. As part of the “One HHS” approach to managing the Department, HHS is developing and implementing an integrated UFMS to provide for Department-wide financial reporting. UFMS will generate interim and annual financial statements, as well as other required external and internal financial reports. UFMS consists of two primary components: the Health Care Integrated General Ledger System (HIGLAS), dedicated to CMS, and the second dedicated to the rest of HHS. FY 2005 has seen a significant achievement for the UFMS effort. In April, the system was deployed at the Centers for Disease Control and Prevention (CDC) and the Food and Drug Administration (FDA). The National Institutes of Health (NIH) Business and Research Support System (NBRSS) has already been “stood up.” By the end of the year, HIGLAS will have been deployed at four of the largest CMS Medicare contractors. While CMS was unable to implement HIGLAS at Empire (Part A) in June, it achieved an end of July implementation. This level of deployment will not comply with the requirements of the Federal Financial Management Improvement Act (FFMIA). The Department advised OMB that it would not meet this level of materiality of financial operations until the end of FY 2008 as a result of implementing Medicare Contractor Reform, which resulted in the HIGLAS roll-out schedule to contractors being extended to be consistent with the procurement schedule and to minimize roll-out costs However, while implementing HIGLAS is the biggest hurdle to achieving FFMIA compliance, HHS plans to resolve all other non-HIGLAS-related FFMIA noncompliance and the material weaknesses by the end of FY 2006, before completion of HIGLAS. Correction of the overall material weakness is pending full UFMS implementation by FY 2007, even though HIGLAS is not expected to achieve full FFMIA compliance until FY 2008 as stated above. In the short term, account analysis and reconciliations are helping to mitigate systems weaknesses. The OPDIVs have continued to make substantial progress in addressing account analysis and reconciliation problems that contribute to the Department’s FMFIA Section 4 nonconformance. Relative to the subfinding of Financial Statement Preparation, HHS continued during FY 2005 to improve the financial reconciliation and financial reporting improvement processes necessary for preparation of accurate and timely financial statements. UFMS experienced some reconciliation problems at FDA and CDC relative to the go-live in April that are being resolved. PSC also made significant manual efforts in FY 2005 by quarter relative to reconciliations, flux analyses, and quarterly statements. NIH initiated a review to address and resolve the material weakness cited in the audit of the HHS FY 2004 financial statements. The review included NIH and contract audit staff and focused on the methodology and discipline applied to the fiscal year end closing process. As a result of these efforts NIH has implemented numerous additional analyses and reconciliations; a new, more disciplined and controlled process to prepare the trial balances from which financial statements are prepared; and identified additional areas of potential improvement. NIH also plans to validate or change certain internal processes and provide significant training to staff. This effort will result in benefits to accounting operations and to the administrative operations of ICs. In addition, the NIH Center for Information Technology has implemented a new web-based tool that allows staff to analyze online all general ledger accounts individually and by transaction code. This has allowed NIH to correct and compensate for some of the deficiencies noted by auditors. The information is more reliable and available in a timely manner for review and reporting.
Medicare Electronic Data Processing (EDP) Controls The CMS revised its strategy to address CFO EDP audit issues in FY 2005. This strategy was successfully implemented as the prior material weakness has been downgraded to a reportable condition. See Appendix E. The subsequent pages discuss HHS’ corrective action plans for the Section 4 material nonconformance, Financial Systems and Processes
Section 4 Material Nonconformance Outstanding Corrective Action Plan Department-wide Financial Systems and Processes (HHS-00-01) Background This Department-wide material nonconformance was first identified in FY 2000. The Department continues to have serious internal control weaknesses in its financial systems and processes for producing financial statements. The finding was reclassified in FY 2001 under Section 4 of the FMFIA as Financial Systems and Processes (HHS-00-01). Target Correction Date: FY 2008 FFMIA/FMFIA compliance for UFMS and HIGLAS (the largest Medicare contractors will be using HIGLAS): For FFMIA compliance, HHS advised OMB that it will not meet this level of materiality of financial operations until the end of FY 2008 as a result of implementing Medicare Contractor Reform, which resulted in the HIGLAS roll-out schedule to contractors being extended to be consistent with the procurement schedule and to minimize roll-out costs. However, while implementing HIGLAS is the biggest hurdle to achieving FFMIA compliance, HHS expects to resolve all other non-HIGLAS related noncompliance and the material weaknesses under FMFIA by end of FY 2006, before completion of HIGLAS. Correction of the overall material weakness is pending full UFMS implementation by FY 2007. HIGLAS will achieve FFMIA compliance by FY 2008, and full implementation of HIGLAS by FY 2011. Key Milestones for Corrective Action FY 2005 Milestones:
Long-Term UFMS Milestones:
HIGLAS Rollout to Medicare Contractors:
HIGLAS FFMIA Compliance:
Material Nonconformance Subcomponent CMS-01-01 CMS Financial Systems Corrective Action Plan *This finding is a subset of the Section 4 Department-wide Material Nonconformance HHS-00-01* Background First Year Identified: FY 1997 The financial statement auditors reported that CMS relies on a decentralized organization, complex and antiquated systems, and ad hoc reports to accumulate data for financial reporting, due to the lack of an integrated accounting system at the Medicare contractor level. An integrated financial system and a strong oversight strategy are needed to ensure that periodic analyses and reconciliation are completed to detect errors in a timely manner. Also, improvement is called for in the oversight of the Managed Care Program and the Health Programs. Target Correction Date: FY 2008 for FFMIA Compliance As part of implementing Medicare Contractor Reform, the HIGLAS roll-out schedule to contractors was extended to be consistent with the procurement schedule and to minimize roll-out costs. However, while implementing HIGLAS is the biggest hurdle to achieving FFMIA compliance, HHS plans to resolve all other non-HIGLAS related FFMIA noncompliance and the material weaknesses by end of FY 2006, before completion of HIGLAS. A subcomponent of Financial Systems and Processes, Financial Statement Preparation has been reduced to a reportable condition. Correction of the overall material weakness is pending full UFMS implementation by FY 2007. HIGLAS will achieve FFMIA compliance by FY 2008, and full implementation of HIGLAS by FY 2011. Brief Description of Corrective Action Plan Financial Systems (Medicare/Health Programs) - The CMS’ long-term solution to this material weakness is HIGLAS. Until this system is implemented, CMS will continue projects and activities aimed at compensating for the lack of the modernized system. Until HIGLAS can be fully implemented, CMS will continue to implement short-term corrective actions to address this material weakness. For example, CMS: (1) prepares a quarterly trending analysis of Medicare contractor reported accounts receivable balances; and (2) conducts Medicare contractor oversight by using SAS 70 audits and accounts receivable agreed upon procedures reviews. Medicaid:
Implementation of OMB Circular A-123 Appendix A Management’s Responsibility for Internal Control, is effective in FY 2006. A major enhancement of the revised circular is Appendix A, which prescribes a separate assurance statement on the effectiveness of the internal controls over financial reporting. OMB required agencies to submit implementation plans for this new requirement. Approach HHS began its efforts by conducting preliminary benchmarking with other Federal agencies and private sector accounting firms in January 2005. The benchmarking yielded general information on approaches planned by the agencies. HHS is taking a centralized approach to planning for implementing OMB Circular A-123, Appendix A. A guidance manual containing standardized templates is being developed for issuance to the OPDIVs this fall that will expand on an already circulated assessment scope and summary approach that identifies financial reports and selected accounts to be assessed. The document will articulate HHS-specific instructions on implementing Appendix A, to include the topics of materiality, assessment approach, and testing. The document will also provide standard reporting templates. The HHS guidance is being designed to complement internal controls efforts already underway by the OPDIVs. Standard reporting templates will be used Department-wide with OPDIVs conducting the individual assessments. Training to support implementation for A-123 Appendix A will be standardized for delivery throughout the Department. Timeline
|