Background The purpose of STEP is to help small businesses develop their export capacity. Congress initially established STEP in the Small Business Jobs Act of 2010, and later reauthorized the program through fiscal year 2020 and renamed it the State Trade Expansion Program in TFTEA. According to SBA officials, the goals of the program include increasing the number of small businesses exporting, the number of small businesses exploring significant new trade opportunities, and the value of exports for small businesses already engaged in international trade. SBA implements STEP and has other key roles in efforts to promote U.S. exports, including providing training, counseling, and export financing for small businesses. Within SBA, OIT has responsibility for managing export promotion programs, including STEP. OGM has responsibility for administering grants across the agency according to SBA’s standard operating procedure for grants management. This responsibility includes oversight of financial and compliance-related aspects of issuing awards, and recording and tracking relevant information in SBA’s grants management system. According to OIT officials, each state that receives a STEP grant submits quarterly reports to OIT that provide information on the amount of the grant expended and progress made toward the performance targets. Program managers within OIT then review the quarterly reports and provide feedback to each state, including with respect to progress toward performance targets. OIT officials and states that we interviewed told us that if a state reports not meeting its performance targets in a particular quarter, OIT program managers then work with the state to establish an action plan to meet targets in future quarters. At the end of each grant performance period, OIT program managers work with OGM to finalize and close the state’s grant file. This procedure includes saving information on final performance data, the total amount expended, and the use rate, which is determined by dividing the amount expended by the amount awarded. Beginning in fiscal year 2011 and through fiscal year 2018, Congress has appropriated a total of $139.4 million for STEP, and SBA has awarded about $139.1 million, or almost 99.8 percent of the appropriated total. Table 1 shows the amounts appropriated and awarded, and the number of awards for each grant cycle from fiscal years 2011 to 2018. Every state government conducts some export promotion activities. State trade offices, which conduct these activities, can be housed in various state entities, including governors’ offices, state departments of commerce, universities, world trade centers, and state departments of economic development. As we have previously reported, state trade offices often offer export promotion services similar to those offered by certain federal agencies; in addition to SBA, these include the Department of Commerce and the Export-Import Bank. State trade offices often have both domestic and international staff; domestic staff are typically state employees. According to data from the 2017 SIDO survey, state trade offices had a median size of six employees, with a minimum of one and a maximum of 18. SBA awards STEP funds annually to state governments through a competitive application process. According to SBA, the annual STEP cycle begins with the funding opportunity announcement that SBA posts on www.grants.gov. This announcement, which usually occurs in the spring, indicates that the grant application is open and provides official information (e.g., objectives, deadlines, eligibility, and reporting requirements) about STEP. Once the announcement is posted, eligible states and territories may apply for a STEP grant during the application period. When a state trade office applies for a STEP grant, its application outlines any intended activities and establishes performance targets within each of the activities for the fiscal year or period of the grant. For example, the performance targets detailed in the application can include the state’s estimate of the number of businesses that will apply for and receive funding to attend various international trade show exhibitions. Currently, all 50 states, the District of Columbia, the Commonwealth of Puerto Rico, the U.S. Virgin Islands, Guam, the Commonwealth of the Northern Mariana Islands, and American Samoa are eligible to apply for STEP grants. Independent technical experts and OIT program managers score states’ applications, generally during late spring and summer. OIT then selects grant recipients and notifies states of their award status in September. If a state receives a STEP grant, its trade office provides the funds to local small businesses through an application process. The funds are intended to support the businesses’ export activities. Figure 1 shows the process for awarding and distributing STEP grant funds. Once small businesses receive the STEP funding, they can use the money for a variety of export-related purposes. These purposes are outlined in TFTEA. Figure 2 shows the allowable uses of STEP grant funds. In fiscal years 2015-2017, SBA awarded a total of about $54.1 million; 40 to 44 states received a STEP grant each year. Over this time period, the median grant amount was $373,000, with a minimum of about $115,000 and a maximum of $900,000. Figure 3 shows the total award amounts by state for fiscal years 2015-2017. The SIDO survey, conducted annually, also asks member states about the STEP grant and how important it is to their export promotion activities. In recent years, most states responding to this question have indicated that the grant plays a key role in supporting such activities, even though the grant does not typically constitute a majority of the budget. In the three surveys conducted between 2015 and 2017, more than 80 percent of responding states, on average, said that the grant was “extremely” or “very” important each year. In these same surveys, about 60 percent of responding states, on average, said that the grant constituted less than half of their budget. SBA’s STEP Grants Management Process Does Not Provide Reasonable Assurance of Compliance with Some Requirements of Applicable Law SBA’s STEP grants management processes do not provide reasonable assurance that STEP grant recipients meet some TFTEA requirements before the grant is closed out. OIT does have a process in place to comply with the “proportion of amounts” clause of STEP’s authorizing statute, which caps at 40 percent the amount of grant funds distributed to the 10 states with the largest numbers of eligible small businesses. However, we found that OIT does not have processes sufficient to ensure that states met TFTEA’s total and cash match requirements. TFTEA contains specific requirements for STEP that SBA is responsible for meeting. These requirements include the following: Proportional distribution requirement. SBA must distribute grant funds in a way that caps the amount of grant funds distributed to the 10 states with the largest numbers of eligible small businesses at 40 percent of the total amount awarded each year. This requirement ensures that states with fewer eligible small businesses receive funding, and is known as the “proportion of amounts” clause in the law. Total match requirement. States must provide a 25 percent or 35 percent non-federal total match to the federal grant amount. Cash match requirement. A state’s match cannot be less than 50 percent cash. SBA’s Process Provides Reasonable Assurance of Compliance with TFTEA’s Proportional Distribution Requirement OIT has established a process for ensuring compliance with the TFTEA requirement outlined in the “proportion of amounts” section of the law. As discussed above, TFTEA requires that OIT determine the 10 states with the highest percentage of eligible small businesses using the most recent data from the Department of Commerce. OIT officials told us they review data from Commerce’s Census Bureau that show the number of exporting small and medium-sized businesses in each state, and then use these data to determine the top 10 states. According to OIT officials, they use the most recent data available, with an approximately 2- to 3-year lag in the data. For example, to assess the top 10 states for the fiscal year 2017 cycle, OIT used data from 2014. Based on these data, the 10 states that SBA identified for the fiscal year 2017 cycle received about 32 percent of the total amount appropriated—which was below the 40 percent threshold and therefore in compliance with the proportional distribution requirement. OIT officials told us that they planned to use available 2016 Census data to determine the top 10 states for the fiscal year 2018 award cycle and then, after receiving applications, determine award amounts that would comply with this requirement. SBA’s Review Process Did Not Document that States Met TFTEA’s Total Match Requirement before Grant Closeout TFTEA requires that states receiving a STEP grant provide matching funds. The total match amount is typically 25 percent of the combined state-federal total amount; as noted above, in a limited number of cases, the state’s total match is 35 percent of this amount. Within either a 25 percent or 35 percent match amount, at least half of the total match must be provided in the form of cash. Matching share requirements are often intended to ensure local interest and involvement through financial participation, and may also serve to hold down federal costs. If SBA determines that a state is not providing sufficient matching funds, it can withhold future reimbursement for expenses incurred under the grant. Figure 4 illustrates the STEP funding proportions described above. OIT’s process for reviewing the quarterly reporting that states provide on STEP grants does not effectively document whether each state has met the total match requirement outlined in TFTEA. To determine whether each state is meeting the total match requirement, OIT program managers monitor state spending over the grant period through quarterly reporting that they require of the state grant recipients. At the end of each grant period, OIT officials told us they review the information collected through the quarterly reporting to determine whether the state met the total match requirement based on the amount of federal dollars expended. According to OIT data and officials, most states provide a greater match than is required; for example, according to OIT calculations, 75 percent of fiscal year 2015 states receiving the grant provided more matching funds than required. However, we identified four instances where, according to OIT’s documentation, one state reported an insufficient total match in fiscal year 2015 and three states reported an insufficient total match in fiscal year 2016. OIT’s documentation showed that these four states failed to meet the required total matching funds by about $76,000 combined over these 2 years of the program. SBA told us they nevertheless closed these grants. OIT officials provided several explanations for their actions. First, OIT officials told us that of these four states, two submitted additional information after the grant had closed, indicating that the states had met the matching requirement. OIT officials stated that they did not verify the accuracy of the total match information before grant closure because of OIT staff error. With respect to the other two states, OIT initially stated that it was working with OGM to verify that the total match requirement had not been met, and how best to recover the funds. Subsequently, OIT reported OGM’s determination that one state had in fact met the match requirement, but that the other had not. In the case of the state that did not meet the requirement, OGM determined that SBA had overpaid federal funds to that state by about $19,600. However, after contacting the state and looking into the matter further, OGM conducted a review of quarterly reporting documentation for this state, and determined that the state had in fact exceeded its required match by about $3,800. Though all four of the states initially identified were eventually determined to have met the total match requirement, SBA did not have an adequate process in place to ensure documentation of a full match before grant closeout. OIT officials stated in July 2018 that, as a result of our review, they planned to implement a new quarterly process to focus on match information specifically, which would ensure documentation of whether a state meets its total match requirement before the grant is closed at the end of each fiscal year program cycle. However, officials were unsure what this process would entail. Standards for Internal Control in the Federal Government states that management should design control activities. By designing and executing appropriate control activities, management helps fulfill its responsibilities and address identified risks in the internal control system. This responsibility applies to the entire process or life cycle of a transaction or event from its initiation and authorization through its final classification in summary records. In addition, management should design control activities so that all transactions are completely and accurately recorded. Such control activities can be preventive for agencies, meaning that the activities prevent an agency from failing to achieve an objective or address a risk. Without a process for effectively documenting that the total match requirement has been met and reviewing this documentation before grant closeout, SBA does not have reasonable assurance that states have complied with TFTEA’s total match requirement, and risks overpayment of federal funds. SBA Does Not Monitor States’ Compliance with TFTEA’s Cash Match Requirement OIT’s processes do not provide reasonable assurance that states have complied with the TFTEA cash match requirement. As previously noted, TFTEA requires that states provide at least half of the total match requirement in the form of cash. TFTEA allows for the remaining half to be any mixture of cash, in-kind contributions, and indirect costs. OIT collects information about the types of expended matching funds, including the proportion provided in cash; however, OIT does not have a process in place to use this information to address risks to the program. As part of their reporting, states submit on a quarterly basis a detailed expenditure worksheet that contains information on the types of expended matching funds, including cash and other types of allowed contributions. OIT documents show that while proposed cash match amounts are recorded, OIT does not track or analyze states’ expended cash matching funds during or at the close of the grant cycle. OIT officials told us that this information is included in the states’ quarterly detailed expenditure worksheets, and therefore can be reviewed for compliance on a case-by-case basis. However, OIT program officials told us that they do not regularly analyze this information to determine what proportion of the total match the cash portion constitutes. As such, SBA cannot consistently determine whether states are meeting the TFTEA cash match requirement, and risk closing out grants for which states have not met the cash match requirement. OIT does not have a process to monitor whether states are misusing federal funds to offset the cash match requirement. The Uniform Guidance defines matching funds as the portion of project costs not paid by federal funds. Matching funds must be accepted when they are not included as contributions for any other federal award, meaning that federal funds cannot generally be used to meet the state match requirement. The program’s authorizing legislation does not define “cash,” and neither does the Uniform Guidance. OIT considers the salaries of state trade office staff who work on administering the grant to be a form of cash and, according to OIT officials, most states use state staff salaries as their total match, including the required cash portion. OIT does not have a process for ensuring that states reporting staff salaries as their required cash match are not also using grant funds from STEP to pay for portions of these same salaries. In our discussions with officials from 12 states that received STEP grants in fiscal year 2015, 2 states reported using the grant to pay for portions of state staff salaries. Both of these states told us that they also reported staff salaries to OIT as their cash matching funds. Using part of the grant to pay for staff salaries in this way could have the effect of reducing the match below the thresholds mandated by TFTEA. When we asked OIT officials what process they had in place to determine whether states were using staff salaries paid for with STEP funds as part of their match amount, OIT officials told us that they were not aware that STEP grantees had engaged in this practice, and therefore did not monitor for it. In order to determine whether this was happening, officials stated that they would need to inspect each state’s grant files on a case-by-case basis. In previous years, OIT has hired a contractor to select samples of and examine individual state grant files, and this contractor worked with states as needed to improve reporting. OIT officials told us that the last grant year reviewed in this way was fiscal year 2015, and they expect to be able to conduct some examinations for the closed fiscal year 2016 grants. SBA’s grants management standard operating procedure states that the agency should monitor grantees for compliance with the terms and conditions of the awards, which includes compliance with applicable federal law. Further, according to Standards for Internal Control in the Federal Government, management should design and execute control activities, and use quality information to achieve the entity’s objectives. Management should process reliable data into quality information to make informed decisions and evaluate the entity’s performance in achieving key objectives and addressing risks. Without processes to review whether states are meeting the cash match requirement, OIT is not implementing its responsibilities under SBA’s standard operating procedure because it cannot consistently determine whether states are meeting this requirement. Without making such a determination, SBA does not have reasonable assurance that states are contributing to the program as required by STEP’s authorizing statute. SBA Made Changes to Enhance STEP in Response to States’ Feedback, but Some States Reported Ongoing Challenges to Using Grant Funds According to agency officials, OIT made some changes to the program in response to feedback from states, including addressing some types of challenges that states say affect their ability to use all their grant funds. However, officials of some states said that continuing challenges with the program impeded their ability to use all awarded grant funds within the permitted time period. While the challenges they described cover a variety of topics, most relate to compressed program timelines, administrative burden, or poor communication with and within OIT. SBA Made Changes in Response to States’ Feedback OIT officials told us that they made some changes to STEP for the fiscal year 2017 program cycle in response to informal feedback from states, including changes to address concerns about use of funds and the administrative burden of the application. Of the 12 states that we interviewed, officials from 11 agreed that SBA’s changes would improve the program. Changes included: Extending funds usage period to 2 years. OIT officials told us that, beginning with the fiscal year 2017 cycle, they converted the program from a 1-year award to a 2-year award. This change allows an additional 4 quarters to conduct program activities, which, in turn, may help enable states to use the full amount of their grant funding and achieve performance targets. Some state officials that we interviewed said that this change improves the program. Eliminating travel preauthorization requirement. OIT officials also told us that, during the fiscal year 2017 cycle, they eliminated a requirement that any travel funded by STEP grants be approved at least 30 days in advance of each trip. Instead, states now report all travel to OIT as part of STEP’s quarterly reporting. According to some officials from the states that we interviewed, this change reduced the administrative burden on state trade office staff and allows greater flexibility to use grant funds when opportunities that require travel arise with limited notice. Reducing page length of technical proposal. For the fiscal year 2017 cycle, OIT reduced the length of the application’s required technical proposal by nearly half, from 18 pages to 10 pages. According to some state officials that we interviewed, this change helped to streamline the program’s application paperwork. Some States Were Unable to Use All STEP Award Funds, Citing Challenges with the Program State officials that we interviewed described a variety of ongoing concerns with STEP, including some challenges that reduced their ability to use all of their grant funds. We developed a nongeneralizable sample of the 12 states that did not use 25 percent or more of their grant funds in fiscal year 2015, and interviewed officials from those states in order to gain insight into their experiences with the program, including the challenges that they faced using the full award amount. These 12 low- use states represent almost 70 percent of funds that remained unused during that cycle. As shown in figure 5, we grouped the most commonly reported challenges into the following categories: (1) timing of the application and award processes, (2) administrative burden, and (3) communication. OIT’s recent changes to STEP could help increase future use rates; however, the effect is yet unknown because the changes were introduced for the fiscal year 2017 cycle. Further, nearly all of the concerns expressed by the 12 low-use states relate to aspects of the program outside the changes made by OIT. Our analysis of data from the program’s fiscal year 2015 and 2016 cycles found nearly 20 percent of grant funds unused each year, despite OIT officials stating that they seek 100 percent use of grant funds, as described below: 2015. Across all 40 recipient states, combined grant use was 81 percent, leaving 19 percent, or nearly $3.4 million, unused. This included one state that left 77 percent, or over $432,000, of its funds unused that year. 2016. Across 41 of the 43 recipient states, combined grant use was 82 percent, leaving 18 percent, or nearly $3.2 million, unused. This included one state that left nearly 95 percent, or nearly $184,000, of its funds unused that year. In addition, although officials from several states told us that they have made changes to their STEP grant applications or activities to increase their ability to use grant funds, use problems have persisted. Our interviews, conducted in March and April 2018, indicated that states continue to face obstacles using the full award amount. Some States Said Challenges Related to Compressed Program Application and Award Time Frames Hinder Fund Use Officials we interviewed from each of the 12 low-use states cited challenges related to the timeline of the application and award processes. These challenges were a variable application period, a short application window, a short application rewrite period, and award announcements occurring close to the start of the grant period. Variable Application Period The exact timing of the STEP application period varies from year to year, which officials from some states that we spoke with cited as a challenge to applying for the grant. In fiscal years 2015, 2016, and 2017, SBA opened the STEP application process at different points between February and May. Officials from five low-use states reported that they had difficulty planning staff resources for completing the application because of the variable time frames. For example, one state official told us that not knowing when the application period would open was one of his office’s biggest planning challenges because spring is a busy time for trade activities and coincides with when his state hosts its largest annual trade event. At some point during this busy season, the application period typically opens. The state official said that, as a result of competing priorities for his office during this season, he might have only 2 weeks to complete the STEP application within the allotted time. He said that if the grant application periods were opened at the same time each year, he would be better able to plan for it. Short Application Window Officials from five low-use states told us that the window for completing the initial STEP application was insufficient because, for instance, of the amount of work the application requires and competing demands on their staff. For fiscal years 2015, 2016, and 2017, SBA announced application windows of between 30 and 42 days. For fiscal year 2016, SBA later extended the window to 50 days. Some state officials said that the variable and short application window creates challenges to writing quality applications. Without quality applications, it may be more difficult for states to develop good plans for using grant funds, which can facilitate the full use of funds. We discussed states’ concerns about when the grant applications opened, and how long they remained open, with SBA officials. These officials said that they were unable to open the application at the same time and for the same length of time each year because of factors beyond their control, such as the federal budgeting process and the involvement of other offices within SBA. In response to states’ concerns regarding the length of time that the STEP application is open, we observed that under OMB’s Uniform Guidance the federal awarding agency must generally make all funding opportunities available for application for at least 60 calendar days; however, the guidance does allow agency officials to make a determination to allow for as few as 30 days. Short Rewrite Period Officials from three of the 12 low-use states told us that the window for rewriting applications is insufficient to adequately consider and implement the changes needed, given that states must rewrite their technical proposals, including updating all supporting financial information as well as proposed performance targets within that time. Once states’ applications have been scored and recipients selected, OIT may require certain states to rewrite their applications to request smaller amounts of federal funds. SBA officials told us that in the fiscal year 2015, 2016, and 2017 cycles, states were given 21 days to rewrite their proposals, but that the rewrite period has been as short as 48 hours. OIT officials told us that they reduce states’ grant requests each year because SBA receives applications for more grant funds than are available. Such rewrites require reducing or removing intended activities and establishing new performance targets within each of the remaining activities. State officials told us that the window for rewriting the grant impacts their ability to write their program proposals, which serve as the basis for states’ performance metrics and measurement of outcomes. Award Announcements Close to Start of Grant Period SBA announces final STEP award amounts in September, just prior to the beginning of the fiscal year. Officials from nine of the 12 low-use states told us that because the award notifications occur so close to the beginning of the fiscal year, using funds during the first quarter is difficult. For instance, most of these officials said that they cannot plan activities until they know whether they will receive an award and, if so, the amount. Furthermore, officials from four states attributed their low grant use to this issue. For example, officials from one state told us that September award announcements do not allow them enough time to recruit companies to participate and use funds in the first quarter of the federal fiscal year, forcing them to compress their activities into the remaining quarters of the program cycle. One state official referred to the first quarter as a “lost” quarter. Officials from two states reported reducing or eliminating programmatic activities in the first quarter to avoid pressure caused by OIT’s award timeline. OIT officials told us that they notify states of their awards before the start of each fiscal year and in compliance with federal government policy. Figure 6 compares the timelines for the application process, notification of awards, recipients’ grant use period, and closeout activities for the fiscal year 2015, 2016, and 2017 program cycles, as well as associated challenges to grant use that states reported. Some States Said Challenges Related to Burdensome Administrative Requirements Hinder Fund Use Challenges related to administrative burden were cited by officials from all 12 of the states that we interviewed. These included challenges related to completing the application, the process for moving funds from one use to another (known as “repurposing”), and the required reporting on the grant. Inflexible Application Requirements Officials from eight low-use states told us that the STEP application requirements are unrealistic or burdensome because, for instance, the level of detail required about performance targets conflicts with the reality of promoting exports in a fluid international business environment. As discussed above, OIT requires states’ STEP applications to detail their projected use of grant funds. For example, when submitting their applications, states project which trade shows they will attend and the number of small businesses they will take to these trade shows. Further required details include projecting the costs and number of companies that will attend events in particular foreign locations, for example. In the past, the application required performance targets that were based on estimates of business interest and export opportunities up to 18 months in advance. Today, with the aforementioned transition to 2-year awards, STEP applications must project such activities and performance targets up to 30 months in advance of their execution. In the event of differences between planned and actual performance during the course of the program cycle, OIT requires states to explain the differences and their plans for aligning their future performance with the targets established in their applications. Difficult Process to Repurpose Funds Officials from eight low-use states said they attributed their low use of grant funds to challenges with program rules or regulations. Difficulty in repurposing funds was the most common example that they cited. Some officials said that OIT’s difficult repurposing process limits states’ ability to move funds from one purpose to another when participating small businesses’ plans change or don’t align with the original program proposal, leaving funds unused. Several state officials described difficulty adapting to changing business plans or opportunities. For instance, one official said that when unanticipated opportunities appear, such as follow- up trade missions, OIT’s restrictive repurposing process limits states’ ability to move funds from one purpose to another. Officials from two states reported applying for smaller grant amounts than in previous years in order to have a more manageable amount to spend, thereby avoiding the need to repurpose funds. In order for states to use STEP funds in ways that differ from the plans in their approved program applications, SBA requires that states request agency permission to repurpose the funds. According to the Uniform Guidance, the federal awarding agency may restrict grant recipients’ repurposing of funds in excess of 10 percent of the total grant amount, and determine the level of detail required for requests to repurpose funds. OIT officials told us that in cases of repurposing more than 10 percent of total funds, the documentation required is determined on a case-by-case basis depending on the amount of funds involved and the degree of difference between the original approved use and the proposed new use. These OIT officials said that in some cases, states may only need to submit a written request via email; in other cases, states may be required to revise and resubmit their STEP applications. To compensate for the difficulty in repurposing funds, officials from two states told us that in subsequent years they had proposed more general programs that allowed for greater flexibility, such as by increasing the use of stipends, which provide small businesses with a predetermined amount of funds for a range of allowed activities. When a state applies for a STEP grant using this approach, the state is typically less specific in its performance targets, such as which trade shows will be attended and by how many small businesses. One state official said that this approach can increase use rates by providing states with more flexibility in distributing the funds. OIT officials agreed that where a state is less prescriptive in its application performance targets it is easier for the state to repurpose funds, such as when federal trade missions are cancelled or small businesses express interest in activities that were not originally proposed. However, the OIT officials noted that the lack of specificity may result in lower grant application scores. Burdensome and Changing Reporting Requirements Officials from 11 of the 12 low-use states described challenges related to burdensome or changing reporting requirements, such as the number of forms required for quarterly reporting, or the level of detail required on certain forms, as well as challenges related to changes that SBA makes to reporting requirements during the grant period. Two state officials told us that, because they often have few people working on the grant, complying with these reporting requirements takes undue amounts of time, and thus have the effect of reducing use. For example, one state official described having to divide the cost of shared taxis and hotel rooms for a trade show, reporting the per-person cost for each company that was part of the state’s delegation. Officials from two states also pointed out that the reporting requirements for STEP were much more detailed and burdensome than grants they administered from other federal agencies, such as the Department of Commerce. In addition, officials from six states expressed concern that OIT occasionally makes changes to program requirements, such as reporting requirements, after the grants have been awarded and the grant cycle has begun. Some state officials said that these mid-year changes increase the administrative burden on their limited staff. During our discussion of states’ concerns with OIT, officials said that they are limited in their ability to address certain concerns described by the states. For example, OIT officials told us that the quantity and type of forms and level of detail required in states’ reporting are imposed by federal guidelines, determined by OGM, or based on agency leadership’s expectations. In addition, OIT officials said that sometimes requirements are changed outside of their office and are beyond their control. The officials stated that, for some changes, they are not in a position to wait until the following program cycle for implementation. They said that they do, however, postpone less urgent changes until the following program cycle rather than making them mid-cycle. Some States Said Challenges Related to Poor Communication Hinder Fund Use Communication between OIT and states was a frequently cited area of concern in our interviews with officials from the 12 low-use states. Officials from nine states raised concerns related to the quality of communication with OIT. For instance, some state officials described issues such as sometimes waiting weeks or months for responses to emails that they had sent to OIT, resulting in administrative delays or preventing states from executing some activities as planned. In one example, state officials said that SBA recently waited months to notify the state of a problem opening its emailed quarterly report file, causing the state to wait months to receive its STEP grant funds. The officials said that such delays bring their program to a halt. Communication within OIT was also cited as an issue that hindered states’ fund use. Officials from 10 states noted that program rules, regulations, or requirements are inconsistently communicated. Further, several state officials described witnessing OIT program managers disagree regarding the interpretation of program rules during discussions with state representatives at a SIDO conference. When we discussed states’ concerns with OIT officials, they told us that they maintain open lines of communication with the states and that STEP program managers are required to retain logs of their communication with the states. The officials described making an effort to listen to states’ concerns, adding that they had modified the program in certain ways as a result of state input, as noted above. States can provide feedback about STEP to their respective OIT program managers, who then discuss states’ comments during weekly meetings with OIT management and other program managers. In addition, OIT officials said that they make themselves available for informal conversations with states at SIDO’s annual conference. According to OIT officials, communication with the states is usually channeled through each program manager, even when the content is pertinent to all grant recipients and could be communicated from one source. SBA Has Not Adequately Assessed Risk to Achieving Program Goals from Some States’ Low Grant Fund Use At the time of our review, OIT had not assessed and fully addressed the risk posed by some states’ low use of funds. OIT officials told us that while they informally collect feedback from states, there is no systematic process to collect states’ perspectives on challenges with the program, including obstacles to their ability to use funds. In addition to the goals of the program outlined earlier, OIT officials told us that one program performance metric is the use rate for STEP funds. Officials said that they seek 100 percent use for each state that receives an award, as well as for the program as a whole. Standards for Internal Control in the Federal Government specify that agency leadership should define program objectives clearly to enable the identification of risks and define risk tolerances in order to meet the goals of the program’s authorizing legislation. These standards for internal control include assessing the risks facing the agency as it seeks to achieve its objectives, with the assessment providing the basis for developing appropriate responses to risks from external and internal sources. Therefore, agency management should set its risk tolerance with regard to STEP at a level that appropriately mitigates risk while enabling the achievement of program objectives. Without assessing and addressing this risk to the program, OIT may continue to fall short of 100 percent grant fund use. Low grant fund use could negatively affect OIT’s ability to achieve program goals in supporting state export promotion activities. SBA Has Not Effectively Shared Best Practices In addition, OIT has no systematic process to share best practices with sufficient detail that states struggling to use their STEP funds might apply those practices to improve their own programs. TFTEA requires SBA to publish an annual report regarding STEP, including the best practices of those states that achieve the highest returns on investment and significant progress in helping eligible small businesses. While 12 states did not use 25 percent or more of their grant funds in the fiscal year 2015 cycle, 19 states used all or almost all of their funds, as shown in appendix I. SBA publishes high-level information on what it deems to be notable state activities in its annual report to Congress. OIT officials told us that, when possible, they share best practices with states that may have difficulty accessing external markets. However, OIT officials told us that they do not formally facilitate the sharing of best practices among the states, saying that best practices for promoting exports in one state might not be transferable to another state because each state is unique in terms of the characteristics of its economy. According to the Uniform Guidance, grant recipients’ performance should be measured in a way that helps the federal awarding agency and other non-federal entities to improve program outcomes, share lessons learned, and spread the adoption of promising practices. Further, under federal standards for internal control, management should externally communicate the necessary quality information so that external parties, such as grant recipients, can help to achieve the entity’s objectives. We have also previously reported on the importance of collecting and sharing best practices, as well as the processes for doing so. By sharing detailed information with all participating states about the approaches that some grant recipients are using to successfully achieve STEP’s goals, SBA could encourage all grant recipients to improve the effectiveness of their state STEP programs, including increasing fund use rates in pursuit of OIT’s stated aim of 100 percent grant fund use. Conclusions The STEP program has provided about $139 million of federal support to assist small businesses in finding export opportunities, and Congress has authorized STEP through 2020. SBA has a process in place to ensure compliance with the program’s legal requirement to cap the total grant amount to the 10 states with the largest number of eligible small businesses at 40 percent—thereby ensuring that states with fewer small businesses benefit from the program. However, SBA has not taken some necessary steps to manage the program’s total and cash matching requirements according to applicable law or federal internal control standards. SBA does not document that states are meeting the total match requirement, and has not developed a process to determine whether states are meeting the cash match requirement. As a result, SBA does not have reasonable assurance that the states are meeting these requirements. Matching requirements directly engage states, augment federal funds, and ensure further support to small businesses that export. As such, meeting the matching requirements is a key aspect of the program’s success. Although not every state has problems using the full federal award amount, about a quarter of the states do, which may hinder the program’s ability to fully achieve its goals of increasing the number of small businesses exporting, increasing the number of small businesses exploring significant new trade opportunities, and increasing the value of exports for small businesses already engaged in international trade. While SBA has taken some steps to improve the program based on feedback from states, it could do more in this regard, including finding ways to assess and address the specific concerns raised by states that have experienced difficulty using grant funds. SBA could also take further steps to collect and disseminate best practices among states to strengthen their ability to fully use grant funds. Higher grant fund use could enhance SBA’s ability to assist as many exporting small businesses as possible, leading to a fuller realization of the program’s goals. Recommendations for Executive Action We are making the following four recommendations to SBA: The SBA Administrator should establish a process that ensures documentation of states’ compliance with the total match requirement before grant closeout. (Recommendation 1) The SBA Administrator should develop a process to determine states’ compliance with the cash match requirement. (Recommendation 2) The SBA Administrator should assess the risk to achieving program goals posed by some states’ low grant fund use rates. Assessing this risk could include examining the challenges that states reported related to the program’s application and award processes, administrative burden, and communication. (Recommendation 3) The SBA Administrator should enhance collection and sharing of best practices among states that receive STEP grant funds. (Recommendation 4) Agency Comments We provided a draft of this report to SBA for review and comment. In written comments (reproduced in appendix II), SBA generally agreed with our findings and concurred with our recommendations. SBA observed that the states we did not interview may have had different experiences with the program than the states in our sample. As we note in the report, our sample is nongeneralizable, and so the experiences these states reported to us may not be common to all states receiving the grant. As we stated in our report, we selected the 12 states that had the lowest grant use rates in fiscal year 2015 in order to understand the challenges they faced. We are sending copies of this report to the Administrator of SBA and other interested parties. In addition, the report will be available at no charge on the GAO website at http://www.gao.gov. If you or your staff have any questions about this report, please contact me at (202) 512-8612 or gianopoulosk@gao.gov. Contact points for our Offices of Congressional Relations and Public Affairs may be found on the last page of this report. Key contributors to this report are listed in appendix III. Appendix I: Objectives, Scope, and Methodology The objectives of this report were to examine the extent to which (1) the Small Business Administration’s (SBA) State Trade Expansion Program (STEP) grants management process provides reasonable assurance of compliance with selected requirements of applicable law, and (2) SBA has taken steps to address challenges states report in using grant funds to achieve program goals. To address these objectives, we did the following: Legal and regulatory review. We reviewed the Small Business Jobs Act of 2010 and the Trade Facilitation and Trade Enforcement Act of 2015 (TFTEA), the statutes that established and reauthorized STEP, respectively. We focused on SBA’s compliance with the proportional distribution, total match, and cash match requirements because these requirements are consistent across both of the program’s laws, and to avoid duplication with ongoing Office of Inspector General (OIG) work on the program. In addition, we reviewed the Office of Management and Budget’s (OMB) federal grant guidance, Uniform Administrative Requirements, Cost Principles, and Audit Requirements for Federal Awards (Uniform Guidance), and Standards for Internal Control in the Federal Government to identify relevant guidance and practices in managing grants to non-federal entities and in designing and executing effective control processes. We also reviewed these documents and previous GAO work for information about the collecting and sharing of best practices. Program data review. We analyzed data on award amounts, matching funds required, and matching funds provided for the fiscal years 2015 and 2016 program cycles, as well as information about the sources of matching funds in selected cases for the fiscal year 2015 program cycle. We focused on these program cycles because these were the most recent years for which the most complete information was available. We also reviewed the data the Office of International Trade (OIT) used to comply with the legal requirement for proportional distribution for the fiscal year 2017 cycle. We assessed the reliability of these data by interviewing OIT officials about the sources of the data, how the data are stored and maintained, and by tracing data from relevant sample documents back to their sources. We found these data sufficiently reliable for the purpose of understanding OIT’s processes for complying with the proportional distribution and matching requirements. Program management review. We reviewed SBA’s standard operating procedure for managing grants and cooperative agreements in order to understand the agency’s requirements for this. We reviewed relevant documentation, including sample grant files, application forms, application scoring forms, grant reporting forms. To examine the relationship that states’ past use rates have on the award process, we reviewed OIT’s forms for scoring the grant applications in fiscal years 2017 and 2018. We interviewed officials from OIT and OGM to understand how SBA monitors STEP grants, including the steps they take to comply with the proportional distribution, total match, and cash match requirements. We examined SBA’s calculations of the total match amounts required for states, and we identified 4 instances in which SBA’s documentation showed an insufficient match in fiscal years 2015 and 2016. We spoke to OIT officials to gain insight into why the scoring procedures for the grants changed for the fiscal year 2018 program cycle. In addition, we reviewed TFTEA, previous GAO work, and the most recent STEP best practices reports for information relating to SBA’s communication to states about best practices in applying for and managing STEP grants. We interviewed officials from OIT to learn about steps they had taken to address concerns raised by states that participate in the program and to facilitate the sharing of best practices among states receiving the grant. Review of grant use rates. We analyzed SBA data on award amounts and amounts used for the fiscal years 2015 and 2016 cycles. We assessed these data by interviewing OIT officials about the sources of the data and how the data are stored and maintained. In discussing the fiscal year 2016 cycle with OIT officials, we learned that South Dakota and Texas had been granted extensions and therefore had not yet completed reporting on their use of these grants. As a result, we dropped these states from our calculation of the fiscal year 2016 cycle use rate. With the exclusions of South Dakota and Texas, we found these data sufficiently reliable for the purpose of calculating use rates for STEP for the fiscal years 2015 and 2016 cycles. In comparing the available grant use data from these years, we found the following: (1) some states that were in the low-use (less than 75 percent utilization) category in fiscal year 2015 were also in this category in fiscal year 2016, (2) some states that were in the low-use category in fiscal year 2015 were not in this category in fiscal year 2016, and (3) some states that were not in the low-use category or did not participate in STEP in fiscal year 2015 were in this category in fiscal year 2016. In our interviews, we asked officials from states in the low-use category in the fiscal year 2015 cycle about their experiences in subsequent years, including whether they intended to apply for the grant in the fiscal year 2018 cycle. Tables 2 and 3 below display data on fund use across participating states in fiscal years 2015-2016, including the percentage of federal award funds unused, amount of federal award funds unused, and percentage of total federal funds unused for each year. We used the data in table 2 to identify our population of low-use states. The 12 states that we interviewed used less than 75 percent of their award funds in the fiscal year 2015 cycle. They represent almost 70 percent of funds that remained unused during that cycle, representing a large proportion of the total unused funds that year. In table 2, the first three rows show data on the 12 states included in our sample. We used the data in table 3 to determine whether our population of low-use states achieved different use rates the following year. Interviews with low-use states. We conducted semi-structured interviews with officials from the 12 states that did not use at least 25 percent of their federal award in the fiscal year 2015 grant cycle. In these interviews, we discussed the states’ practices and reporting with respect to the total and cash match requirements, and inquired about the practice of using the federal award to offset state staff salaries while reporting these salaries as a cash match. These 12 interviews do not constitute a generalizable sample of STEP grantees, because we selected these states on the basis of their low use of grant funds in order to understand challenges faced by those states. As such, the practices reported by states we interviewed may not be common to all states receiving STEP grants. State challenges. In our semi-structured interviews with officials from the 12 states that did not use 25 percent or more of their award in fiscal year 2015, we gathered information about continuing challenges in fully using the grant funds. These states were: Maine We conducted these interviews in March and April 2018. However, our 12 interviews represent a nongeneralizable sample of the population of states that have received the 301 awards made through the STEP grant cycles since fiscal year 2011. As such, challenges reported by these states may not be common to all states receiving this grant. We asked officials from these 12 states questions about their experiences participating in the program, about challenges they had experienced, and about their views on how the program could be improved. To describe the themes that emerged from these 12 interviews with respect to challenges in fully using the funds, we identified categories based on an analysis of the responses that we received. Two GAO analysts independently coded the content of these interviews according to these categories. We conducted further analysis of the results of our coding to identify the three major groupings of challenges that we present in this report: (1) the timing of the application and award periods; (2) administrative burden; and (3) communication. The coders had an initial agreement rate of about 90 percent. Disagreements were resolved through discussion between the coders and, occasionally, through arbitration by a knowledgeable third party. SIDO survey data review. We analyzed 2015, 2016, and 2017 survey data provided by State International Development Organizations (SIDO), a national group that supports state trade offices. We reviewed data from their annual member survey conducted in those years. This survey asks SIDO member states about, among other things, top advocacy priorities, the number of staff in each state’s international trade office, and the location of these trade offices within the state government. The survey also asks states to describe the importance of STEP to each state, and provide the estimated proportion of each state’s export promotion budget that the grant constitutes. To assess these data, we interviewed a SIDO official about the organization’s methods for developing the survey each year, as well as their processes for collecting and storing the data, and reviewed the response rates in each year. We reviewed the survey instrument and data, and conducted testing for missing data, obvious errors, and outliers, and determined that these data were sufficiently reliable for the descriptive purposes for which they are used in this report. However, we noted that the number of respondents by year varied. According to SIDO 36, 38, and 41 states fully or substantially completed the survey in 2015, 2016, and 2017, respectively. We are presenting the results as general proportions or rounded percentages. We did not independently audit the survey results. We conducted this performance audit from September 2017 to March 2019 in accordance with generally accepted government auditing standards. Those standards require that we plan and perform the audit to obtain sufficient, appropriate evidence to provide a reasonable basis for our findings and conclusions based on our audit objectives. We believe that the evidence obtained provides a reasonable basis for our findings and conclusions based on our audit objectives. Appendix II: Comments from the Small Business Administration Appendix III: GAO Contact and Staff Acknowledgments GAO Contact Staff Acknowledgments In addition to the contact named above, Adam Cowles (Assistant Director), Cristina Ruggiero (Analyst in Charge), Jesse Elrod, and Peter Kramer made key contributions to this report. The team also benefitted from contributions made by Martin de Alteriis, Mark Dowling, John Hussey, Jeff Isaacs, Christopher Keblitis, and Kimberly McGatlin.


Background The size and complexity of states’ Medicaid programs have implications for program administration and oversight, including provider screening and enrollment. States have flexibility, within broad federal guidelines, in how they design, administer, and oversee their Medicaid programs. For example, states have the option to pay for care through fee-for-service (FFS) payments to participating providers, contract with managed care organizations (MCO) to deliver services based on a fixed amount per beneficiary, or a combination of both. In fiscal year 2018, total Medicaid spending was $629 billion, about half of which was estimated to be spent for services delivered under managed care. CMS and states each have a role to play in protecting the integrity of the Medicaid program and preventing fraud, waste, and abuse. States administer their Medicaid programs, including implementing federal requirements for screening and enrolling Medicaid providers. CMS has a role overseeing states’ compliance with federal requirements. CMS’s oversight activities include measuring improper payments in the Medicaid program, and conducting focused program integrity and desk reviews. Other federal and state entities also have a role in oversight of the Medicaid program. For example, state auditors—state agencies that typically conduct the annual single state audit of federal programs—may also conduct program integrity reviews and identify Medicaid improper payments. We have previously testified that state auditors are uniquely qualified to partner with CMS in its oversight of Medicaid. In our testimony, we noted that CMS could help improve program integrity by providing state auditors with a substantive and ongoing role in auditing state Medicaid programs. Provider Screening and Enrollment Requirements To limit payments to ineligible providers—such as those convicted of program-related fraud and abuse, or with a suspended or revoked medical license for reasons of bearing on professional competence or performance—federal regulations require states to screen and enroll all providers, whether the provider furnished, ordered, or referred services to an eligible beneficiary or whether the service was paid for under FFS or Medicaid managed care contracts. Providers subject to these requirements include individual practitioners—such as physicians, nurse practitioners, and physical therapists—as well as any physicians and other professionals who may only order or refer beneficiaries to services, but do not render services; for example, providers who only prescribe medications or order imaging services, such as an x-ray. Providers also include provider organizations—such as hospitals, group practices, and skilled nursing facilities—and providers and suppliers of medical equipment or goods. All providers must be screened when they (1) initially apply for and submit an application, and (2) upon reenrollment in a state’s Medicaid program. Further, states must screen all providers at least once every 5 years to revalidate their enrollment. States may rely on the results of providers’ screenings performed by the Medicare program or another state’s Medicaid program. States may also choose to delegate screening activities to vendors that screen providers on the states’ behalf or MCOs. If a state chooses to delegate screening activities, it must ensure that the screenings are conducted in accordance with the Medicaid program requirements. States must also collect certain information from providers to enroll them into their Medicaid programs, such as their Social Security numbers, dates of birth, and National Provider Identifiers, if applicable. States must also collect disclosure information for owners, managing employees, and others with controlling interests in provider organizations meeting certain criteria. For example, states must collect disclosure information for those with direct or indirect ownership totaling 5 percent or more, or who are agents or managing employees of a provider organization. These owners and others with controlling interests who are subject to disclosure requirements must undergo certain required screening activities, such as federal database checks, and states must perform these screening activities to enroll the provider organization. Federal regulations require states to perform several screening activities prior to enrolling providers. The provider’s categorical risk level for fraud, waste, and abuse determine the required screening activities. The screening activities may include conducting checks in federal databases; verifying licensure; and performing site visits and fingerprint-based background checks. In addition to required activities, states may also choose to conduct other screening activities in order to identify providers ineligible for participating in Medicaid. See figure 1 for an overview of Medicaid provider screening activities and appendix II for a full list of provider screening requirements. Risk-based screening. States must screen providers according to the provider’s categorical risk level for fraud, waste, and abuse. The regulations establish screening requirements for three risk levels—limited, moderate, and high risk—and each risk level includes a range of provider types. (See table 1.) In addition, providers’ risk levels can change. For example, limited- or moderate-risk providers may be categorized as high risk if the state Medicaid agency imposes a payment suspension based on a credible allegation of fraud, waste, or abuse. Federal database checks. States must confirm the identity of prospective providers, providers seeking revalidation, and individuals subject to disclosure requirements to determine if they have been excluded from participating in Medicaid by checking four federal databases: 1. the Social Security Administrations’ Death Master File (DMF); 2. the National Plan and Provider Enumeration System (NPPES); 3. the List of Excluded Individuals/Entities (LEIE); and 4. the General Services Administration’s System for Award Management (SAM). In addition, states must conduct at least monthly checks in the LEIE and SAM. States may also check other federal and state databases. For example, states may check CMS’s database containing Medicare provider enrollment data—the Provider Enrollment, Chain and Ownership System (PECOS)—prior to conducting their own database checks to determine if a provider is enrolled in Medicare and was previously screened. For providers enrolled in Medicare, states may choose to rely on the results of the screening conducted for the Medicare program and enroll the provider without conducting any further screening activities. For providers not enrolled in Medicare, states must screen the provider prior to enrolling them. (See table 2.) Licensure verification. States must verify that providers have a current, valid medical license in the states in which they are licensed. Further, states must confirm that the providers’ license does not have any limitations, such as a suspension or probation. Site visits and fingerprint-based criminal background checks. States must conduct on-site visits for moderate- and high-risk providers to verify that the information submitted is accurate and to determine providers’ compliance with federal and state enrollment requirements. Further, states must collect fingerprints from high-risk providers, and these providers must consent to a criminal background check. CMS Oversight of States’ Provider Enrollment CMS developed the PERM to estimate the national Medicaid improper payment rate, including improper payments due to states’ non- compliance with provider screening and enrollment requirements. CMS computes the national improper payment rate as the weighted average of states’ improper payment rate estimates from the PERM using three key components of the Medicaid program: FFS, managed care, and beneficiary eligibility determinations. Each component of the PERM is estimated differently, and only the FFS component is used to oversee states’ compliance with provider screening and enrollment requirements. When calculating the FFS component, CMS measures improper payments in a sample of FFS claims, which record services provided. Specifically, CMS reviews the sample of FFS claims and examines related state documents to identify any errors resulting from a failure to meet federal and state policies, including provider screening and enrollment requirements. For example, CMS verifies the provider was eligible to render and bill for the services by reviewing provider information, including the provider’s name and license, and whether the provider was screened in accordance with risk-based screening requirements. Any FFS claims paid for services furnished, ordered, referred, or prescribed by a provider who was not screened in compliance with requirements or not enrolled with the state is considered an improper payment. The managed care component of the PERM measures any improper payments in the capitated payments that state Medicaid agencies make to MCOs on behalf of enrollees. It does not examine whether providers in managed care were appropriately screened and enrolled within a state. The eligibility component focuses solely on measuring improper payments related to state determinations of whether Medicaid enrollees meet categorical and financial criteria for Medicaid benefits. CMS conducts the PERM across all states on a 17-state, 3-year rotation cycle and computes an annual rolling average of improper payment rates from the 3 years of data. At the conclusion of each PERM cycle, CMS develops reports for each state, which include any findings related to provider screening and enrollment. Following each PERM cycle, states must prepare a corrective action plan to address errors found. CMS also conducts other oversight activities to protect the integrity of the Medicaid program and assess states’ compliance with Medicaid provider screening and enrollment requirements. These activities include the following: Focused program integrity reviews. CMS conducts these reviews to examine specific areas of Medicaid, including provider screening and enrollment and managed care. These reviews may include a full or partial review of states’ compliance with provider screening and enrollment requirements. Desk reviews. CMS conducts these off-site reviews on specific aspects of states’ program integrity activities, such as a state’s progress toward implementing corrective action plans in response to PERM findings and payments made to providers terminated from Medicaid. Selected States Faced Challenges Implementing Provider Screening and Enrollment Requirements; Some States Have Not Implemented Certain Requirements Officials from all seven selected states told us they faced challenges building the capacity and establishing the administrative processes needed to implement the new and expanded provider screening and enrollment requirements under PPACA and the 21st Century Cures Act. These challenges included establishing procedures for risk-based screenings, using federal databases and collecting information from providers, and screening and enrolling an increased volume of providers. Due, in part, to these challenges, officials from five selected states told us they have not yet implemented some of the requirements. Challenges Establishing Procedures for Risk- Based Screenings Officials from all seven selected states described challenges building their capacity to conduct risk-based provider screenings prior to enrollment into their Medicaid programs. To incorporate database checks, site visits, fingerprint-based background checks, and other risk-based screening activities into state screening procedures; state Medicaid officials said they needed financial resources, leadership support, and time. Specifically, officials from the selected states told us they used one of the following three approaches to build capacity to implement the screening and enrollment requirements. 1. Developing new information technology systems. Officials from two of the seven selected states told us they developed new state information technology systems that automated screening and enrollment activities. For example, officials from one state told us they spent $5.9 million from 2015 through 2018 to develop a new provider screening and enrollment system that included an online provider application portal and automated screening activities, such as conducting database checks and flagging high-risk providers for site visits and fingerprint-based background checks. According to state officials, this new system helped the state implement provider screening and enrollment requirements, yielding efficiencies by allowing staff to focus on analyzing provider screening results rather than clarifying data entry errors and manually checking each database. (See fig. 2.) 2. Contracting with vendors. Officials from four other selected states told us they initiated or modified existing contracts with vendors to screen new provider applications and conduct revalidations on their behalf. For example, officials from one state told us their contract with a vendor resulted in screening and enrolling about 10,000 providers in 2018, more than five times the number the state had processed in the previous year. Another state used a vendor to revalidate more than 9,000 providers in 2016; about 12 percent of the state’s enrolled provider population. 3. Modifying existing procedures. Officials from our seventh selected state told us that they modified their existing state information technology system and procedures to manually screen and enroll providers. However, according to state officials, this approach has put pressure on their resources. Officials said that they were working to automate some database checks as much as possible without requiring services from a contractor. Challenges Using Federal Databases and Collecting Required Information for Screening and Enrollment Officials from six of the seven selected states told us they experienced challenges using federal databases, and all seven of the states described challenges collecting required information for screening and enrollment. To mitigate challenges using federal databases, the state Medicaid agencies took actions including accessing data from alternate sources, manually verifying information, and collecting information from providers. (See table 3.) Recent CMS actions could also improve states’ ability to search databases. In April 2019, CMS officials told us they have partnered with the Treasury Department, which is conducting a pilot that will offer states access to its Do Not Pay Business Center services. Do Not Pay is a resource developed by the Treasury Department to detect and prevent improper payments. This resource allows federal agencies to automate screenings by searching for excluded parties using common identification numbers, such as Social Security numbers. Do Not Pay also allows users to search DMF, LEIE, and SAM from a single portal. CMS referred seven states, including two of our selected states, to take part in Treasury’s pilot. Officials from all seven selected states told us that they faced challenges collecting required information from providers for screening and enrollment, such as Social Security numbers or fingerprints. These states took steps—such as educating providers and developing or updating forms, procedures, and statutory provisions—to address some of the challenges associated with collecting the information necessary to screen and enroll providers. For example, one state told us that some providers have been hesitant to disclose Social Security numbers and their date of birth on applications, as well as other information that states are required to collect for enrollment. In response, the state has offered provider education on the requirements to facilitate collecting this information. State Medicaid officials also noted that their agencies worked with CMS, state legislatures, and state law enforcement agencies to implement fingerprint-based background check requirements to, for example, collect fingerprints and check them against Federal Bureau of Investigation records. Officials from two selected states told us their agencies did not have the authority under state law to collect fingerprints from providers or submit them to the Federal Bureau of Investigation prior to PPACA, and officials from one of these states told us changes to state statute were needed before they could implement this requirement. Challenges Screening and Enrolling an Increased Volume of Providers Officials from five of the seven selected states described challenges having sufficient capacity to screen an increased volume of providers and enroll certain provider types. Officials from one state told us that the new requirement to screen managed care providers more than doubled the number of providers the state needed to screen and enroll. Further, officials from three states told us about challenges obtaining information needed to conduct screenings from prescribers and other professionals who only order and refer services. Previously, such providers were not required to enroll in Medicaid and some were not responsive to the state Medicaid agency’s requests for information. Officials from the five selected states that faced these challenges told us they had taken steps to address these challenges. Yet, four of the five selected states that faced these challenges continued to make payments to these types of providers even though they were not enrolled in their Medicaid programs, because they wanted to maintain beneficiary access to the services. Managed care providers. Officials from three of the selected states told us they faced challenges enrolling managed care providers. For example, officials from one state told us that they could not process the large number of applications they needed to screen before enrolling these providers, and attempted to delegate some required database checks for managed care providers to its MCOs. However, officials told us these MCOs do not have state-level access to all required databases; therefore, the managed care providers have not been screened as required and are not all enrolled with the state. The officials told us the state has about 80,000 managed care providers to screen and enroll as part of implementing the 21st Century Cures Act requirements. However, officials said they have chosen to wait until the state launches a new information technology system that automates screenings before screening and enrolling these providers. Prescribers and other professionals who may only order and refer services to beneficiaries. Officials from three selected states told us they had not enrolled all prescribers and other professionals who may only order and refer services, but do not render them. These states have taken steps to address this challenge. Officials from one state told us they took steps to screen and enroll medical residents— hospital providers who are not providing services to Medicaid beneficiaries, but may prescribe medication during a beneficiary’s hospital stay. These officials told us they did not screen and enroll medical residents prior to PPACA, because of differences in licensure. Officials from all three states said they continue to pay for prescriptions written by these providers who are not enrolled in their Medicaid programs. CMS’s Optional Consultations Are Tailored to Support States; Oversight Does Not Provide Comprehensive, Timely Information on States’ Compliance CMS offers optional consultations that are tailored to support states’ implementation of the Medicaid provider screening and enrollment requirements. However, these consultations are optional, regardless of whether states have implemented the federal requirements. CMS also conducts several oversight activities—the PERM, focused program integrity reviews, and other activities—to oversee states’ compliance with provider screening and enrollment requirements. Collectively, these activities do not ensure CMS has comprehensive and timely information on the extent of states’ compliance with the requirements. CMS’s Optional Consultations Are Tailored to Support States’ Implementation of Medicaid Screening and Enrollment Requirements In 2016, CMS began offering optional consultations tailored to support states’ implementation of Medicaid screening and enrollment requirements. Optional consultations include CMS contractor site visits to states that examine the extent to which states have implemented the requirements, and the data compare service to assist states with screening providers. While most states (38) have used one or more of these consultations, 13 states have not used any. Because some states do not avail themselves of the optional consultations, these consultations do not provide CMS with information on all states’ progress in implementing the requirements. Officials from some of the seven selected states reported limitations affecting their use of the consultations. CMS contractor site visits. One-third of states (17), including three of the seven selected states, participated in at least one multi-day CMS contractor site visit, as of June 2019. Officials from CMS and its contractor told us that during the site visit, the state completes a self- assessment, followed by the contractor’s assessment on the implementation status of all provider screening and enrollment requirements to identify requirements that have not been implemented and opportunities for improving the states’ screening and enrollment procedures. (See fig. 3 for a map of states that participated in the CMS contractor site visit.) After the visit, the contractor provided a report that summarizes the state’s status toward implementing each requirement, such as full, partial, nearly complete, and not started. (See fig. 4.) CMS officials consider any requirements that are not fully implemented as “opportunities for improvement.” CMS contractor site visits are not required and are not considered audits; the agency does not track states’ progress on implementing requirements and opportunities for improvement unless the state engages CMS in follow-up. At the time of their contractor site visit, 16 of the 17 states that opted for this service had not fully implemented all provider screening and enrollment requirements. Officials from the three selected states that received a CMS contractor site visit told us that the visit helped (1) accurately identify requirements that their state had not fully implemented, or (2) establish priorities for making changes. Two of these states found it helpful to learn from the contractor about other states’ best practices and requested a return visit. Officials from another state told us they were able to make positive changes to their screening and enrollment procedures immediately after the visit, such as improving documentation of database checks through the use of screenshots to record search results. Data compare service. About half of all states (25), including four of the seven selected states, used the data compare service as of June 2019— a process by which states submit a list of all their active providers, and CMS provides a full report of the state’s providers who were previously screened by Medicare, as well as identify providers the state may need to take action on, because, among other reasons, they were terminated from Medicaid. For the states that have used the data compare service, CMS officials reported being able to screen between 40 to 80 percent of their providers. Officials from the four selected states said it was also useful for testing their provider screening and enrollment procedures to see whether the service would identify any providers they should have excluded in their screening, and three of these states said it was useful for streamlining their provider revalidations. Additionally, officials from one state that had not yet used the service told us they would consider using it in the future for both of these purposes. For example, officials from one state reported that CMS’s data compare service screened half of the approximately 80,000 providers they needed to revalidate. (See fig. 5 for a map of states that opted for the data compare service.) However, officials from all seven selected states identified limitations of the data compare service that led some states to use the service less frequently and three states to not use the service at all. CMS officials acknowledged the three limitations reported by state officials: 1. Time for receiving results. The results from the data compare service were not timely enough to help states with screening newly enrolling providers. Officials from one state explained that some provider information may become outdated by the time the results are received 6 to 8 weeks later, which makes the service less useful than it could be. 2. Different Medicare and Medicaid address entries. The data compare service’s addresses reflected Medicare practice or billing locations that may be different from providers’ Medicaid addresses. Because these addresses do not match, they could not be relied upon for updating the state’s provider records or to help states conduct site visits required for screening and enrolling moderate- and high-risk providers. 3. Additional burden for manual enrollment systems. Officials from two selected states told us that manually extracting provider data from their system—including names, addresses, Social Security numbers, and National Provider Identifiers—and manually re-entering the results from CMS for each provider into their system was burdensome and resource-intensive, leading one of these states to stop using the service. CMS offers guidance and other supports to states on a regular and periodic basis, including monthly calls with states, and assigning states to a CMS contact (see sidebar). These services also assist states with implementing the Medicaid provider screening and enrollment requirements. Officials from all of our selected states told us the guidance and other supports were helpful. According to CMS officials, the extent to which states participate in these other supports varies, because the level of participation is optional. CMS officials also told us that they use these other supports, including monthly calls and ad hoc emails, to discuss progress and keep a record of information provided; however, the agency does not revisit or require corrective actions unless the state initiates it. The PERM and other methods CMS uses to oversee states’ efforts to screen and enroll Medicaid providers do not provide CMS with comprehensive and timely information on states’ compliance with the requirements. Some methods do not fully track whether states have enrolled all types of providers and are in compliance with all the requirements; other program integrity oversight methods have not been conducted on all states. Further, these methods do not ensure timely follow-up to address identified concerns. The PERM’s components—FFS, managed care, and beneficiary eligibility determinations—measure improper payments across all states; as previously noted, the FFS component is the only component CMS uses to assess states’ compliance with provider screening and enrollment requirements. However, using the PERM to oversee states’ compliance with the requirements has limitations, including the following: The PERM does not examine whether providers under contract with MCOs are appropriately screened and enrolled. The PERM assesses states’ compliance with the provider screening and enrollment requirements by reviewing provider information for claims paid under FFS; it does not review such information for services financed under managed care. Currently, the PERM does not examine ownership disclosure and certain other provider screening and enrollment requirements. CMS officials told us the agency plans to assess the feasibility of including ownership disclosure requirements in the PERM over the next 3 years. The PERM does not ensure that CMS identifies areas of non- compliance in a timely manner. CMS conducts the PERM in each state every 3 years, and states develop corrective action plans in response to findings from the PERM; thus, it may be years before CMS identifies—and states resolve—areas of non-compliance with the provider screening and enrollment requirements. (See fig. 6.) Although CMS follows up annually with states regarding their corrective action plans, it does not fully assess states’ progress toward implementing their plans until the next PERM cycle, which is 3 years later. Further, while four of our selected states had implemented all their corrective action plans regarding provider screening and enrollment requirements within 1 year of PERM findings, the other three states had not fully implemented their plans about 2 years after PERM findings. CMS officials emphasized that developing and tracking corrective action plans was a collaborative process and that states may change corrective action plans in response to competing priorities. CMS uses other methods to oversee states’ compliance with the provider screening and enrollment requirements—focused program integrity reviews and desk reviews—that are not optional and have resulted in findings. However, these methods do not provide the agency with comprehensive and timely information on states’ compliance with the requirements. Specifically, these methods have not been conducted in all states, performed in a timely manner, or included a systematic review of states’ compliance with all the provider screening and enrollment requirements. For example: Focused program integrity reviews. CMS has not conducted focused program integrity reviews examining specific areas in Medicaid for all states. Most of the reviews performed did not include a comprehensive or timely examination of states’ compliance with provider screening and enrollment requirements. Overall, CMS has conducted 42 focused program integrity reviews in fiscal years 2014 through 2018 in 39 states. Among these reviews, nine of the 42 focused program integrity reviews examined states’ compliance with provider screening and enrollment requirements, the last of which was completed in fiscal year 2015. CMS also conducted focused program integrity reviews on managed care for 34 of the 41 states with managed care expenditures in fiscal year 2017. However, nearly all of these reviews (33) were conducted prior to January 2018 when states were required to screen and enroll all managed care providers, as required by the 21st Century Cures Act. CMS also conducted seven focused reviews examining personal care services in seven states— which include examining screening and enrollment requirements for providers of these services. Desk reviews. Off-site desk reviews that examine specific aspects of states’ program integrity activities do not include a comprehensive or timely examination of states’ compliance with the provider screening and enrollment requirements. CMS has conducted desk reviews examining activities related to provider screening and enrollment, such as corrective actions states have taken in response to PERM findings. However, desk reviews on corrective action plans are limited to examining findings on provider screening and enrollment identified during the PERM and are not conducted until 3 years after the PERM has occurred. For example, CMS told us that in 2018 the agency conducted desk reviews on the 17 states that underwent the PERM in fiscal year 2015. CMS also conducted 35 desk reviews on potential payments to terminated providers since fiscal year 2014. The PERM and CMS’s other oversight methods do not provide CMS with sufficient or timely information about states’ screening and enrollment procedures for all Medicaid provider types, and most states with managed care expenditures have not undergone a managed care-focused program integrity review since the 21st Century Cures Act screening and enrollment provisions went into effect. The lack of complete information on whether states are screening and enrolling all providers according to requirements is inconsistent with federal internal controls on assessing risk, which note that management should consider the potential for fraud when identifying, analyzing, and responding to risks. Without complete information, CMS cannot ensure that only eligible providers are participating in the Medicaid program, leaving the program vulnerable to improper payments. Further, CMS does not obtain timely information on all states’ actions to address areas of non-compliance or track progress toward addressing these areas. The length of the PERM cycle—3 years—and time for performing corrective actions to address PERM findings, limits CMS’s awareness of states’ progress, or lack thereof, toward implementing requirements. As a result, CMS lacks assurance that states are addressing areas of non-compliance or if such actions are being taken in a timely manner. This is inconsistent with federal internal controls on monitoring, which note that management should remediate deficiencies in the internal control system on a timely basis. Conclusions CMS has a range of activities that provide the agency with some knowledge of states’ implementation of required provider screening and enrollment under PPACA and the 21st Century Cures Act; however, the agency’s oversight activities are not designed to systematically examine compliance with all the requirements for all providers in a timely manner. Notably, the PERM does not examine managed care providers, and CMS’s assessment of compliance and monitoring of corrective actions are not timely, because they are based on the 3-year PERM cycle. Also, focused program integrity reviews—which may examine states’ oversight of MCOs and their compliance with provider screening and enrollment requirements for providers participating in managed care—have not been conducted on all states. The one activity that can provide CMS and states with a complete and timely assessment of states’ implementation with provider screening and enrollment requirements is optional. While CMS does some tracking of state-reported information on the status of states’ implementation of the requirements, this oversight does not include states that have not availed themselves of the support CMS provides. Since states are not required to participate in these optional consultations, the states that may face the greatest challenges with implementing the provider screening and enrollment requirements might not volunteer to participate in the consultations. Without a thorough review of states’ implementation of the provider screening and enrollment requirements, as well as processes to monitor states to ensure timely remediation of deficiencies, the agency lacks assurance that only eligible providers are participating in the Medicaid program, leaving the program at risk for improper payments. Recommendations We are making the following two recommendations to CMS: The Administrator of CMS should expand its review of states’ implementation of the provider screening and enrollment requirements to include states that have not made use of CMS’s optional consultations. Similar to CMS’s contractor site visits, such reviews should include any necessary steps to address areas of noncompliance for all types of enrolled providers, including those under contract with MCOs. (Recommendation 1) The Administrator of CMS should annually monitor progress toward addressing any areas of noncompliance related to the provider screening and enrollment requirements for any state with one or more corrective action plans. (Recommendation 2) Agency Comments We provided a draft of this report to HHS for review and comment. In its written comments, HHS concurred with our recommendations; the full text of which are reproduced in appendix I. Regarding our first recommendation, HHS stated that it will reach out to states that have not yet participated in optional consultations to discuss their progress and outline steps that the states should take to come into full compliance with the provider screening and enrollment requirements. Regarding our second recommendation, HHS stated that it is in the process of instituting more frequent reviews of corrective action plans resulting from one of CMS’s oversight activities—the PERM—stating that such reviews will now be performed quarterly. However, HHS’s comments did not discuss monitoring areas of noncompliance that are identified through other oversight activities, such as focused program integrity reviews, which include reviews of states’ screening and enrollment of providers who are under contract with MCOs. We recommend that CMS annually monitor progress toward addressing any areas of noncompliance related to the provider screening and enrollment requirements, which would include areas of noncompliance identified through the PERM, optional consultations, and other oversight activities. HHS also provided technical comments, which we incorporated as appropriate. As agreed with your offices, unless you publicly announce the contents of this report earlier, we plan no further distribution until 30 days from the report date. At that time, we will send copies to the Secretary of Health and Human Services, the Administrator of CMS, appropriate congressional committees, and other interested parties. In addition, the report will be available at no charge on the GAO website at http://www.gao.gov. If you or your staff members have any questions about this report, please contact me at (202) 512-7114 or at yocomc@gao.gov. Contact points for our Offices of Congressional Relations and Public Affairs may be found on the last page of this report. GAO staff that made key contributions to this report are listed in appendix III. Appendix I: Comments from the Department of Health and Human Services Appendix II: Summary of Medicaid Provider Screening and Enrollment Requirements Appendix II: Summary of Medicaid Provider Screening and Enrollment Requirements Description The state Medicaid agency must require all enrolled providers to be screened in accordance with applicable requirements. The state Medicaid agency must have a method for verifying that a provider is licensed without restrictions in accordance with the laws of that state. The state Medicaid agency must complete revalidation of enrollment for all providers, regardless of provider type, at least every 5 years. The state Medicaid agency must deny enrollment to any provider and disclosing entity that does not successfully pass or comply with the screening process, and the agency must terminate providers who no longer meet the requirements for enrollment. The state Medicaid agency must rescreen a provider who has been deactivated for any reason prior to the provider’s reactivation. The state Medicaid agency must share with providers who are terminated or denied enrollment the process for appealing the decision. The state Medicaid agency must conduct site visits for providers who are designated as moderate or high-risk levels. Fingerprint criminal background checks The state Medicaid agency must complete fingerprint-based criminal background checks for providers and disclosing entities in the high-risk category. The state Medicaid agency must confirm the identity and determine the exclusion status of providers, any person with an ownership or control interest, and any agent or managing employee of the provider. The state Medicaid agency must require all claims for payment for items and services that were ordered or referred to contain the National Provider Identifier of the physician or other professional who ordered or referred such items or services. Screening levels for Medicaid providers The state Medicaid agency must screen all initial applications based on a categorical risk level of “limited,” “moderate,” or “high.” The state Medicaid agency must collect an application fee from institutional providers during a new enrollment or revalidation, unless Medicare or another Medicaid agency has already collected an application fee. Allows CMS and states to implement temporary moratoria pausing the enrollment of new provider types in a given location. Appendix III: GAO Contact and Staff Acknowledgments GAO Contact Staff Acknowledgments In addition to the contact named above, Leslie V. Gordon (Assistant Director), Kristin Ekelund (Analyst-in-Charge), Manuel Buentello, Drew Long, Giao N. Nguyen, and Chris Zakroff made key contributions to this report. Also contributing were Marissa Coloske, Vikki Porter, and Jennifer Whitworth.