Appendix D - FY 2005 Federal Managers' Financial Integrity Act Report on Systems and Controls

The Federal Managers’ Financial Integrity Act (FMFIA) requires agencies to provide an annual statement of assurance on the effectiveness of their management, administrative, and accounting controls (Section 2 of the Act), and financial management systems (Section 4 of the Act). Significant deficiencies in internal controls are considered material weaknesses; significant deficiencies in financial management systems are considered material nonconformances. The full text of the Secretary’s assurance statement for FY 2005 can be found in the Secretary’s Letter at the beginning of this report; the Sections 2 and 4 results are discussed in the following pages.

HHS reports one new Section 2 material weakness in FY 2005, Managed Care Benefit Expense Cycle. Two Section 2 material weaknesses from the FY 2004 report, Federal Information Security Management Act (FISMA) Significant Deficiency and Departmental Financial Reporting, have been corrected as planned. For the Departmental Payroll System material weakness, the auditors found that substantial progress was made and it is no longer material.

FY 2004 Section 2 Material Weaknesses Corrected

The following three material weaknesses were corrected in FY 2005.

Federal Information Systems Management Act (FISMA) Significant Deficiency (HHS-04-01)

The HHS FISMA report for FY 2005 will reflect that this significant deficiency involving contingency planning and disaster recovery for some of HHS systems has been corrected. Based on the level of attention to the contingency plan development and subsequent testing for high impact systems, coupled with the overall attention that has been placed on contingency plans and testing across all HHS FISMA systems, the Inspector General opinion (in the FISMA Report) was that this issue no longer rose to the level of a significant deficiency.

Due to FISMA confidentiality requirements, the FISMA report findings are not published and therefore a detailed report on corrective actions taken is not included in this published FMFIA report. However, the HHS Chief Information Office (CIO) has reported that the following actions were taken in FY 2005 at the Departmental level (HHS CIO):

• Completion and testing of contingency plans are monitored by the HHS Security Program, Secure One HHS, on an ongoing basis and resulted in an increased completion percentage from 80 percent to 95 percent for contingency plans and from 29 percent to 81 percent for contingency plan testing of systems overall. Contingency plan and testing completion has been accomplished for 100 percent of high risk impact level systems.
• During FY 2005 each of the OPDIVs was required twice to complete a corrective action plan that documented how and when the deficiencies noted in their individual FISMA reports would be resolved.
• The HHS Security Program, Secure One HHS, is currently reviewing the HHS OPDIV security Programs to ensure that all issues have been addressed and that the security programs themselves have processes in place that allow for security issues to be addressed effectively.
• HHS executive commitment to resolving this issue was articulated and responsibility for that resolution was documented in executive performance plans across HHS.

Departmental Payroll System (HHS-04-02)

The auditors found that substantial progress was made regarding the finding from last year’s audit and is no longer considered by the auditors to be material. The most significant development in 2005 was the conversion of the central payroll system to DFAS in April 2005.

Following are some of the corrective actions taken in FY 2005:

• As stated above, the transition of payroll services to the Defense Finance and Accounting Service (DFAS) was completed in April 2005. Additionally, migration of the Electronic Official Personnel Folders (eOPF) project was completed August 14, 2005.
• Quarterly reviews are being performed on a random sample basis between the Enterprise Human Resources and Payroll System (EHRP) and central payroll to ensure deductions and withholdings in the personnel system coincide with the central payroll system.
• New documentation was posted regarding standard operating procedures based on DFAS.

Future actions to be taken include:

• Continue quarterly reviews of EHRP and central payroll.
• Expand internal review with the HR centers to include documentation such as eOPF/OPF for supporting documentation.
• Document and finalize additional standard operating procedures for DFAS.

The Department is committed to putting any necessary remedial or preventive mechanisms in place to improve its audit standing. HHS fully embraces having solid oversight responsibilities for payroll and personnel and has already implemented procedures and processes that address many of the concerns discovered during its massive data cleanup efforts. HHS believes that its efforts in the HR consolidation, implementation of Department-wide automated HR systems, and the transition to DFAS will enhance the Department’s ability to have a solid payroll system.

Departmental Financial Reporting (HHS-04-03)

This material weakness was corrected in FY 2005 as planned. In FY 2004, the auditors found that the Department lacked a coordinated process among cross-functional teams of finance, operations, and legal personnel to monitor business activities to identify situations where accounting evaluation or decision making may be necessary. The issue that gave rise to this problem was that HHS had a significant policy issue at the end of FY 2004 that had a material impact on its financial statements. This issue was below the materiality threshold in prior years.

In December 2004, at the direction of the Acting HHS Chief Financial Officer (CFO) by memorandum, the Department implemented the following actions to address this material weakness:

• Developed policies and procedures to promptly identify and communicate significant policy issues such as potential loss contingencies in accordance with Statement of Financial Accounting Standards No. 5, Accounting for Contingencies.
• Developed a systematic accountability process to ensure timely resolution of policy, legal, and accounting questions involving loss contingencies. These procedures will include consulting and coordinating with the Assistant Secretary for Budget, Technology, and Finance, Office of the General Counsel, and the Office of Inspector General.
• Strengthened the existing CFO quarterly meetings at the Department level to ensure ongoing coordination among cross-functional teams of operations, legal, and finance personnel to identify significant programmatic activities that may affect the quarterly and annual financial statements.
• In May 2005, a memorandum from the Acting CFO required mandatory Statement of Auditing Standards (SAS) No. 99, Consideration of Fraud in a Financial Statement Audit, training for all management officials who sign the management representation letter. SAS documents are internationally recognized auditing standards developed by the American Institute of Certified Public Accountants. SAS 99 defines fraud as an intentional act that results in a material misstatement in financial statements and requires additional scrutiny from the auditor, who must consider two types of fraud: misstatements arising from fraudulent financial reporting (e.g., falsification of accounting records) and misstatements arising from misappropriation of assets (e.g., theft of assets or fraudulent expenditures). Since then, HHS has been conducting extensive SAS 99 training including interviews for all HHS management officials who sign the management representation letter in coordination with the auditors. The training was completed as scheduled during the fourth quarter FY 2005. Among those interviewed were the Secretary, Deputy Secretary, Chief of Staff, HHS CFO, OPDIV CFOs, and other senior managers at the Department.

With regard to the Special Disability Workload (SDW) issue that gave rise to the finding, CMS reported the following status:

• There have been no changes to the underlying assumptions or methodology developed at September 30, 2004 related to estimation of the contingent liability for the SDW issue.
• For the June 30, 2005 interim financial statements, the September 2004 white paper was updated to include an estimated change of $96 million over the $1.867 billion estimate reported as of September 30, 2005.
• The Social Security Administration’s Office of the Chief Actuary provided updated information in September 2005. The CMS revised the SDW estimate as of September 30, 2005, resulting in a new estimate of $1.638 billion.

HHS will continue to engage the active participation of OMB officials in the resolution of any significant policy issues that could affect future audits.

Following is a discussion of the new Managed Care Benefit Expense Cycle material weakness

FY 2005 Section 2 Material Weakness Corrective Action Plan HHS-05-01 Managed Care Benefit Expense Cycle

The internal controls over the Medicare Managed Care Program need to be improved. Inadequate internal controls over audit and payment activities for the Medicare Managed Care Program resulted in the following CFO-audit related findings: (1) CMS does not maintain sufficient documentation to support the on-going monitoring of Managed Care organizations by the regional offices in accordance with CMS policies and procedures; (2) inadequate policies, documentation and supervisory controls exist related to the authorization and payment process for the Medicare Managed Care Program; (3) during 2005, CMS underwent a major systems conversion and implemented the Medicare Managed Care System (MMCS) payment system that resulted in erroneous payments for Medicare Managed Care contractors. Inaccurate payments were made throughout the year due to the use of inaccurate information. The CMS failed to establish a systematic method for identifying, documenting, and correcting errors found in the MMCS system; and (4) CMS has not established proper segregation of duties related to authorization and controls around payments made to Medicare Managed Care contractors.

Summary of Corrective Action Approach

Managed Care (Monitoring) - With regard to the oversight of the Managed Care Program, the CMS Central Office (CO) staff will follow up with all Regional Offices (ROs) to ensure that the ROs follow the Medicare Advantage organization, cost organization, demonstration, and health care pre-payment plans audit protocols and document retention standard protocols.

Managed Care (Payment) - The CMS will continue to work with the Division of Enrollment and Payment Operations (DEPO) external contractor to develop standard operating procedures, policies, procedures, and internal controls around payment system functions. The CBC will work to develop systems for better identifying system errors and related payment errors. The CBC will work to strengthen the Agency’s segregation of duties around Managed Care payments.

Key Milestones for Corrective Action

FY 2005 Actions:

Managed Care (Monitoring) - The CMS has accomplished the following initiatives in FY 2005 to improve the maintenance of documentation to support the ongoing monitoring of Managed Care organizations by the regional offices in accordance with the CMS policies and procedures.

• Created new Health Plan Management System (HPMS) Monitoring Module functionalities in order assist with proper reporting and maintenance of documentation. The new functionalities included: (1) the removal of the automatic schedule functionality (this will eliminate the problem of creating estimated site visits not being utilized), (2) the creation of a new requirement to create nine and five day e-mail reminders, (3) the creation of a new requirement to remove certain demonstration types from the contracts available for selection in the HPMS Monitoring Module, (4) the creation of a requirement to create a new report, Visit Schedule/History Report, and (5) the creation of a new requirement to remove all plans that are terminated from the selection criteria in the HPMS Monitoring Module.
• Completed CO/RO led internal audits also called Continuous Quality Improvement Visits (CQI) of all but one regional office. The CQI visits assessed whether or not regional offices were conducting Medicare Managed Care audits timely, accurately and in accordance with established procedures and guidelines. The visits also established continuously improving oversight of CMS Medicare Managed Care contractors.

Managed Care (Payment) - The CMS has obtained an external contractor to audit DEPO’s payment systems. Currently the external contractors are preparing a report of audit findings and based on the audit findings, the contractors will develop new and revised policies, procedures and internal controls pertaining to authorization and payment processes.

Target Correction Date: FY 2006

FY 2006 Planned Actions:

• External contractor to audit DEPO payment systems and develop internal control policies and procedures. March 2006
• Conduct CO internal reviews of applications, standard operating procedures, and monitoring documentation. April 2006
• Conduct RO monitoring documentation reviews. May 2006

Section 4 Material Nonconformance Outstanding Financial Systems and Processes (HHS-00-01)

Summary

At the end of FY 2005, HHS reported one repeat Section 4 nonconformance, Financial Systems and Processes (HHS-00-01). The Managed Care Program, formerly reported as part of the Department-wide Financial Systems and Processes material nonconformance, is being reported as a separate material weakness under Section 2 of the FMFIA. (See HHS-05-01 as reported above.) For one of the two subcomponents of this material nonconformance, Financial Systems Analysis and Oversight, CMS made progress which resulted in the findings in both the Medicare and Health Programs being reduced to a reportable condition or incorporated into the Managed Care Benefit Expense Cycle material weakness. Both CDC and FDA continued to record thousands of nonstandard accounting entries both prior and subsequent to the UFMS conversion. FDA recorded 14 thousand non-standard accounting entries totaling an absolute value of approximately $9.4 billion to create the September 30, 2005 financial statements. FDA noted this was primarily due to the productivity dip and lack of familiarity with the system. To prepare the September 30, 2005 financial statements, CDC indicated it was required to do the following:

• Accounting entries totaling an absolute value of $11.3 billion either to adjust its statements or to another HHS operating division.
• Adjustments totaling an absolute value of $24.4 billion with the Automated Desktop Integrator Program. Generally these adjustments related to conversion, data clean up, corrections, account reclassifications, and other adjustments to conform to UFMS processing.
• A $19.1 billion absolute value adjustment to the database to generate financial statements as a result of conversion adjustments made in the UFMS which could not be extracted into the database.

For the second subcomponent, Medicare Electronic Data Processing Controls, much of that finding was corrected and the auditors also classified it as a reportable condition.

HHS auditors have cited the Department’s lack of an integrated accounting system as a material weakness and a specific impediment in preparing timely financial reports and statements.

As part of the “One HHS” approach to managing the Department, HHS is developing and implementing an integrated UFMS to provide for Department-wide financial reporting. UFMS will generate interim and annual financial statements, as well as other required external and internal financial reports. UFMS consists of two primary components: the Health Care Integrated General Ledger System (HIGLAS), dedicated to CMS, and the second dedicated to the rest of HHS.

FY 2005 has seen a significant achievement for the UFMS effort. In April, the system was deployed at the Centers for Disease Control and Prevention (CDC) and the Food and Drug Administration (FDA). The National Institutes of Health (NIH) Business and Research Support System (NBRSS) has already been “stood up.” By the end of the year, HIGLAS will have been deployed at four of the largest CMS Medicare contractors. While CMS was unable to implement HIGLAS at Empire (Part A) in June, it achieved an end of July implementation.

This level of deployment will not comply with the requirements of the Federal Financial Management Improvement Act (FFMIA). The Department advised OMB that it would not meet this level of materiality of financial operations until the end of FY 2008 as a result of implementing Medicare Contractor Reform, which resulted in the HIGLAS roll-out schedule to contractors being extended to be consistent with the procurement schedule and to minimize roll-out costs However, while implementing HIGLAS is the biggest hurdle to achieving FFMIA compliance, HHS plans to resolve all other non-HIGLAS-related FFMIA noncompliance and the material weaknesses by the end of FY 2006, before completion of HIGLAS. Correction of the overall material weakness is pending full UFMS implementation by FY 2007, even though HIGLAS is not expected to achieve full FFMIA compliance until FY 2008 as stated above.

In the short term, account analysis and reconciliations are helping to mitigate systems weaknesses. The OPDIVs have continued to make substantial progress in addressing account analysis and reconciliation problems that contribute to the Department’s FMFIA Section 4 nonconformance. Relative to the subfinding of Financial Statement Preparation, HHS continued during FY 2005 to improve the financial reconciliation and financial reporting improvement processes necessary for preparation of accurate and timely financial statements. UFMS experienced some reconciliation problems at FDA and CDC relative to the go-live in April that are being resolved. PSC also made significant manual efforts in FY 2005 by quarter relative to reconciliations, flux analyses, and quarterly statements.

NIH initiated a review to address and resolve the material weakness cited in the audit of the HHS FY 2004 financial statements. The review included NIH and contract audit staff and focused on the methodology and discipline applied to the fiscal year end closing process. As a result of these efforts NIH has implemented numerous additional analyses and reconciliations; a new, more disciplined and controlled process to prepare the trial balances from which financial statements are prepared; and identified additional areas of potential improvement. NIH also plans to validate or change certain internal processes and provide significant training to staff.  This effort will result in benefits to accounting operations and to the administrative operations of ICs. In addition, the NIH Center for Information Technology has implemented a new web-based tool that allows staff to analyze online all general ledger accounts individually and by transaction code.  This has allowed NIH to correct and compensate for some of the deficiencies noted by auditors.  The information is more reliable and available in a timely manner for review and reporting.

• CDC conducts periodic reviews, as well as monthly and quarterly reconciliations. CDC completed reconciliation of the Strategic National Stockpile (SNS) purchase orders and invoices to verify current inventory valuation. CDC has acknowledged a need to comprehensively evaluate the management and financial controls in this area, and plans to perform a comprehensive evaluation of the Stockpile Program to make recommendations for system changes that will improve management and financial controls.
• PSC is working on improving estimation techniques and correcting CORE transaction to reduce the number of adjustments and evaluating the posting of estimates and accruals to CORE. In addition, the Division of Financial Operations (DFO) will continues to analyze and review data to post corrections and estimates into CORE and will establish as many transactions and journal vouchers (JV) in the CORE Accounting System prior to closeout to reduce the quantity of journal vouchers necessary to prepare statements. This process will be ongoing throughout the year. Finally, DFO will continue to reconcile Federal Agencies’ Centralized Trial-Balance System II to the financial statements through in depth analysis on a quarterly basis. In addition, DFO, with additional contractor staff, will: (1) address the unreconciled differences in the Fund Balance with Treasury; (2) address the outdated accounts payable and undelivered orders on an ongoing basis in an effort to prepare for the conversion to UFMS; and (3) provide copies of quarterly financial statements to the OPDIVs for review and analysis.
• The new UFMS will eliminate this material weakness by generating financial statements without the manually-intensive process.
• Auditors reported in the FY 2004 CMS audit report that, overall, the Medicare contractors continue to significantly improve the maintenance of supporting records for financial activities and year-end balances. However, the lack of an integrated financial management system continues to impair CMS and its Medicare contractors’ abilities to efficiently and effectively support and analyze accounts receivable and other reported financial balances on a timely basis. The CMS long-range plan to address this material weakness is to implement HIGLAS at the Medicare contractor locations.

Medicare Electronic Data Processing (EDP) Controls

The CMS revised its strategy to address CFO EDP audit issues in FY 2005. This strategy was successfully implemented as the prior material weakness has been downgraded to a reportable condition. See Appendix E.

The subsequent pages discuss HHS’ corrective action plans for the Section 4 material nonconformance, Financial Systems and Processes

• Department-wide (HHS-00-01),
• CMS Financial Systems (HIGLAS)

Section 4 Material Nonconformance Outstanding Corrective Action Plan Department-wide Financial Systems and Processes (HHS-00-01)

Background

This Department-wide material nonconformance was first identified in FY 2000.

The Department continues to have serious internal control weaknesses in its financial systems and processes for producing financial statements. The finding was reclassified in FY 2001 under Section 4 of the FMFIA as Financial Systems and Processes (HHS-00-01).

Target Correction Date: FY 2008

FFMIA/FMFIA compliance for UFMS and HIGLAS (the largest Medicare contractors will be using HIGLAS): For FFMIA compliance, HHS advised OMB that it will not meet this level of materiality of financial operations until the end of FY 2008 as a result of implementing Medicare Contractor Reform, which resulted in the HIGLAS roll-out schedule to contractors being extended to be consistent with the procurement schedule and to minimize roll-out costs. However, while implementing HIGLAS is the biggest hurdle to achieving FFMIA compliance, HHS expects to resolve all other non-HIGLAS related noncompliance and the material weaknesses under FMFIA by end of FY 2006, before completion of HIGLAS. Correction of the overall material weakness is pending full UFMS implementation by FY 2007.

HIGLAS will achieve FFMIA compliance by FY 2008, and full implementation of HIGLAS by FY 2011.

Key Milestones for Corrective Action

FY 2005 Milestones:

• CDC and FDA implemented UFMS general ledger and payroll accounting activities. October 2004
• CDC implemented grant accounting. First quarter
• FDA and CDC implemented the full scope of UFMS. April 2005
• CMS/HIGLAS -- Completed implementation of an approved Joint Financial Management Improvement Program commercial-off-the-shelf product for the two pilot contractors and two non-pilot contractors.
• CMS/HIGLAS - Initiated transition and conversion activities for two additional non-pilot contractors who are on schedule for implementation in the second and third quarters of FY 2006.
• Established the Application Service Provider and technical infrastructure, and running 11 non-production instances of the Oracle software in a test environment.

Long-Term UFMS Milestones:

• NIH Business and Research Support System (NBRSS) - complete deployment. FY 2007
• UFMS: Department-wide full implementation. FY 2007

HIGLAS Rollout to Medicare Contractors:

• CMS implemented HIGLAS at Empire Part B (Pilot contractor), Empire Part A, and First Coast Service Options. With the implementation at Palmetto in FY 2005 third quarter, this will bring the total to four HIGLAS contractors implemented in FY 2005.
• By the end of the second quarter of FY 2006, implement HIGLAS at Trailblazer Health Enterprises.
• By the end of the third quarter of FY 2006, implement HIGLAS at Mutual of Omaha Insurance Co.
• By September 30, 2006, CMS expects to implement HIGLAS at CMS’ central office for Medicaid and SCHIP payments as well as for Medicare contractors’ administrative cost payments.

HIGLAS FFMIA Compliance:

• Starting with FY 2007, HIGLAS will leverage the contractor reform strategy that includes transitioning to one new Medicare Administrative Contractor (MAC) for Part A & B (A/B MAC) in FY 2007, seven A/B MACs in FY 2008, and seven A/B MACs in FY 2009. Each A/B MAC consolidates workload from two to six states.
• HIGLAS: Full implementation. FY 2011.

Material Nonconformance Subcomponent CMS-01-01 CMS Financial Systems Corrective Action Plan *This finding is a subset of the Section 4 Department-wide Material Nonconformance HHS-00-01*

Background

First Year Identified: FY 1997

The financial statement auditors reported that CMS relies on a decentralized organization, complex and antiquated systems, and ad hoc reports to accumulate data for financial reporting, due to the lack of an integrated accounting system at the Medicare contractor level. An integrated financial system and a strong oversight strategy are needed to ensure that periodic analyses and reconciliation are completed to detect errors in a timely manner. Also, improvement is called for in the oversight of the Managed Care Program and the Health Programs.

Target Correction Date: FY 2008 for FFMIA Compliance

As part of implementing Medicare Contractor Reform, the HIGLAS roll-out schedule to contractors was extended to be consistent with the procurement schedule and to minimize roll-out costs. However, while implementing HIGLAS is the biggest hurdle to achieving FFMIA compliance, HHS plans to resolve all other non-HIGLAS related FFMIA noncompliance and the material weaknesses by end of FY 2006, before completion of HIGLAS. A subcomponent of Financial Systems and Processes, Financial Statement Preparation has been reduced to a reportable condition. Correction of the overall material weakness is pending full UFMS implementation by FY 2007. HIGLAS will achieve FFMIA compliance by FY 2008, and full implementation of HIGLAS by FY 2011.

Brief Description of Corrective Action Plan

Financial Systems (Medicare/Health Programs) - The CMS’ long-term solution to this material weakness is HIGLAS. Until this system is implemented, CMS will continue projects and activities aimed at compensating for the lack of the modernized system. Until HIGLAS can be fully implemented, CMS will continue to implement short-term corrective actions to address this material weakness. For example, CMS: (1) prepares a quarterly trending analysis of Medicare contractor reported accounts receivable balances; and (2) conducts Medicare contractor oversight by using SAS 70 audits and accounts receivable agreed upon procedures reviews.

Medicaid:

• Enhance policies and procedures related to access controls and the MBES. September 2005
• Continue to implement the pilot project to estimate improper payments. September 2005
• If feasible, develop a methodology to collect the necessary data to estimate the Medicaid entitlement benefits due and payable amount. November 2005
• In January 2005, OMB revised Circular A-123, Management Accountability and Control, to strengthen the internal control requirements over financial reporting in Federal agencies. The new circular, entitled

Implementation of OMB Circular A-123 Appendix A

Management’s Responsibility for Internal Control, is effective in FY 2006. A major enhancement of the revised circular is Appendix A, which prescribes a separate assurance statement on the effectiveness of the internal controls over financial reporting. OMB required agencies to submit implementation plans for this new requirement.

Approach

HHS began its efforts by conducting preliminary benchmarking with other Federal agencies and private sector accounting firms in January 2005. The benchmarking yielded general information on approaches planned by the agencies.

HHS is taking a centralized approach to planning for implementing OMB Circular A-123, Appendix A. A guidance manual containing standardized templates is being developed for issuance to the OPDIVs this fall that will expand on an already circulated assessment scope and summary approach that identifies financial reports and selected accounts to be assessed. The document will articulate HHS-specific instructions on implementing Appendix A, to include the topics of materiality, assessment approach, and testing. The document will also provide standard reporting templates. The HHS guidance is being designed to complement internal controls efforts already underway by the OPDIVs. Standard reporting templates will be used Department-wide with OPDIVs conducting the individual assessments. Training to support implementation for A-123 Appendix A will be standardized for delivery throughout the Department.

Timeline

• HHS submitted it’s A-123 Implementation Plan to OMB on August 31st that HHS believes conforms to the final CFO guidance on implementing Appendix A of OMB Circular A-123 issued in July 2005. The plan included a timeline for implementing A-123, Appendix A. HHS’ goal is to complete the risk assessments by the end of the second quarter and required testing in the third quarter to support the Appendix A assurances as of June 30 and September 30, 2006.
• HHS also created a governance structure and charters for a department-level Risk Management and Financial-Oversight Board and HHS-Department/OPDIV-level Senior Assessment Team. These governance bodies will guide and direct implementation of A-123 within HHS.

HHS Home | Questions? | Contact HHS | Accessibility | Privacy Policy | FOIA | Disclaimers

The White House | USA.gov | HHS Archive | No FEAR Act

U.S. Department of Health & Human Services · 200 Independence Avenue, S.W. · Washington, D.C. 20201