CMS's Internal Controls Did Not Effectively Ensure the Accuracy of Aggregate Financial Assistance Payments Made to Qualified Health Plan Issuers Under the Affordable Care Act

CMS's internal controls did not effectively ensure the accuracy of nearly $2.8 billion in aggregate financial assistance payments made to insurance companies under the Affordable Care Act during the first 4 months that these payments were made.

We determined that CMS's internal controls for calculating and authorizing financial assistance payments were not effective. Specifically, we found that CMS's reliance on issuer attestations did not ensure that advance cost-sharing reduction (CSR) payment rates identified as outliers were appropriate, CMS did not have systems in place to ensure that financial assistance payments were made on behalf of confirmed enrollees and in the correct amounts, CMS did not have systems in place for State marketplaces to submit enrollee eligibility data for financial assistance payments, and CMS did not always follow its guidance for calculating advance CSR payments and does not plan to perform a timely reconciliation of these payments.

The internal control deficiencies that we identified limited CMS's ability to make accurate payments to qualified health plan (QHP) issuers. On the basis of our sample results, we concluded that CMS's system of internal controls could not ensure that CMS correctly made financial assistance payments during the period January through April 2014. Without effective internal controls for ensuring that financial assistance payments are calculated and applied correctly, a significant amount of Federal funds are at risk.

We recommended that CMS correct these internal control deficiencies by requiring its Office of the Actuary to review and validate QHP issuers' actuarial support for index rates that CMS identifies as outliers, implementing computerized systems to maintain confirmed enrollee and payment information so that CMS does not have to rely on QHP issuers' attestations in calculating payments, implementing a computerized system so State marketplaces can submit enrollee eligibility data, following its guidance for calculating estimated advance CSR payments, and developing interim reconciliation procedures to address potentially inappropriate CSR payments.

In written comments on our draft report, CMS concurred with our second, third, and fifth recommendations. CMS generally agreed with our first and fourth recommendations but indicated that the recommendations are no longer applicable because of regulatory action.

After reviewing CMS's comments, we maintain that our findings and recommendations are valid. CMS's regulatory action may appropriately address the findings related to our first and fourth recommendations. However, we have not tested the new advance CSR payment calculation described in the regulation. Therefore, we cannot determine if the new calculation methodology allows for the type of discrepancies we identified during our audit period.