Session ID: CON9346 Title: CMS Automates and Strengthens Internal Controls with Oracle Governance, Risk and Compliance (

1. Session ID: CON9346 Title: CMS Automates and Strengthens Internal Controls with Oracle Governance, Risk and Compliance (GRC) Wayne Bobby Vice President, Oracle Public Sector Industry Solutions Scott Beam, CPA, PMP Deputy Director, Division of Financial Application Systems John Stouffer Consultant 1

2. Agenda Introductions Centers for Medicare and Medicaid Services (CMS) Healthcare Integrated General Ledger Accounting System (HIGLAS) GRC Initiative at CMS Project Approach Implementation Summaries Next Steps Questions

3. THE U.S. DEPARTMENT OF HEALTH AND HUMAN SERVICES is the United States government's principal agency for protecting the health of all Americans and providing essential human services, especially for those who are least able to help themselves HHS REPRESENTS APPROXIMATELY ONE FIFTH OF ALL FEDERAL OUTLAYS HHS Budget, FY 2012 -- $819.8 billion The Centers for Medicare and Medicaid Services is one of 13operating divisions within the DHHS Department of Health & Human Services (HHS)

4. Centers for Medicare & Medicaid Services (CMS) CMS works with the health care community to: • improve the quality and efficiency in beneficiaries’ programs, services, and care, and • promote the fiscal soundness of an evolving health care system in the United States. CMS administers the Medicare program and works in partnership with the States to administer Medicaid and the Children’s Health Insurance Program (CHIP).  Along with Health and Human Services (HHS), CMS also has begun to implement the provisions of the Affordable Care Act (ACA).

5. Centers for Medicare & Medicaid Services (CMS) • CMS is part of Department of Health & Human Services • CMS is one of the largest purchasers of health care in the world and represents 35 cents of every dollar spent on health care in the United States • CMS Budget FY 2012 -- $819.8 billion • Administers the Medicare Program and oversees the Medicaid Program • Medicare provides health insurance for more than 51 million beneficiaries • Provides funding to States for Medicaid for 56.6 million beneficiaries

6. Centers for Medicare & Medicaid Services (CMS) • CMS' Mission • To ensure effective, up-to-date health care coverage and to promote quality care for beneficiaries • CMS' Vision • To achieve a transformed and modernized health care system. • CMS will accomplish our mission by continuing to transform and modernize America's health care system. • CMS' Strategic Action Plan Objectives • Skilled, Committed, and Highly-Motivated Workforce • Accurate and Predictable Payments • High-Value Health Care • Confident, Informed Consumers • Collaborative Partnerships

7. HIGLAS= Healthcare Integrated General Ledger Accounting System HIGLAS provides CMS an Oracle Federal Financials based solution to account for over $800+ Billion spent in outlays for healthcare each year $1.77 Trillion Medicare Benefit Payments processed 4.9 Billion Claims processed totaling $1.94 Trillion $291.7 B Medicaid and $9.0 B CHIP federal obligations to States HIGLAS Solution • $57.9 B of AR/AP netted funds to recoup Medicare Benefit claims overpayments and preserve the Trust funds • $314.0 M of Federal tax and non-tax debts recouped under the Federal Payment Levy Program Pre-HIGLAS Post-HIGLAS Customization of Financial Processes Limited Customization One Integrated Accounting System Multiple Accounting System Processes Standardized Financial Processes Inconsistent Financial Processes Manual Reports and Statements Automated Reports and Statements NOTE: Figures quoted above are cumulative through August 2013 which results in a 50TB Production environment.

8. HIGLAS Business Architecture Oracle Enterprise GRC Manager and Intelligence HIGLAS Oracle eBusiness Suite Application Foundation Application Modules Staging Oracle GRC E-Business Suite Transaction Controls Trading Community Architecture (TCA) 835 Remittance Advice 271/274 Provider/ Bene. 837 Adjudicated Claims HIGLAS Oracle GRC E-Business Suite Access Controls Multi-Org Accounts Receivable Application Security Accounts Payable OBIEE Data Mart Audit Trail ETL Oracle GRC E-Business Suite Configuration Controls Concurrent Processing Loans Cash Management Dashboards General Ledger Online Screens & Reporting Oracle Preventive Controls

9. File System Storage/Landing Area HTTP FTP HIGLAS Business Architecture Oracle GRC E-Business Suite Access Controls Oracle GRC E-Business Suite Configuration Controls Oracle Enterprise GRC Manager Oracle GRC E-Business Suite Transaction Controls HIGLAS WebSphere Oracle Federal Financials External Systems HIGLAS HISTORY Accounts Payable • Receive MCS/FISS 271, 274, 810, 811R, 811S, 811VMP and 837 Files • Receive ReMAS 271 and 810 Files • Validate Files • Transformation • Load into Inbound Staging • Format & Generate 835 and 824S Files • Archive • Restore MCS FISS ReMAS • Maintain Payees • Establish Payables • Generate Payments • Process Period-End Accounts Receivable • Maintain Customers • Establish Receivables • Process Collections • Manage Receivables • Process Period-End Manual Oracle Forms BI Data Analytics & Reporting Oracle Preventive Controls Governor General Ledger • Maintain GL • Generate GL • Post Journal Entries • Process Period-End • Data Mining • KPI Dashboards • Mgmt. Reporting • Predictive Modeling (Future) Extensions Production Audit / Error • Customer/Supplier X-Ref API • AR/AP Netting • Letters • 811 Payment Confirmation • 835 Extension • AP: 1099, Holds, Voids, Stale-dated Checks, CPT Interest • AR: AR Status, AR Interest • Payment Batch Set Automation ASP

10. GRC Initiative at CMS • The GRC project was established to address key GRC initiatives in a number of phases to enable the organization to gain immediate value from the investment. • CMS partners with SRA International and Navillus Partners as implementation partners and trusted advisors to achieve these objectives- • Enhance automation of internal controls • Reduce enterprise-wide risk in HIGLAS • Support stronger compliance reporting • Reduce reliance on manual control processes • Eliminate HIGLAS software extensions and customizations, where feasible.

11. Project Approach

12. Application Access Controls Governor (ACG) Introduces an automated Access analysis and reporting Standardized access policies at a more granular level (i.e. function vs. responsibility) Assist with role/responsibility definitions through simulation and analysis Added GRC Intelligence to provide drilldown reporting and management level dashboards

13. Intelligence Dashboards Summarize access data Enable CMS to personalize and create their own dashboards Allows CMS to leverage business intelligence feature to accurately report an distribute information GRC Intelligence (GRCi)

14. Increased Oracle audit trail effectiveness by removing unused tables and data Moved much of the audit trail configuration to CCG for periodic snapshots and change tracking Provides more accurate and timely documentation updates vs. manual documentation Improves release schedule for changes by augmenting the audit trail Eliminates some custom reporting previously used to identify changes and assist during audits Configuration Controls Governor (CCG)

15. CMS leverages CCG for Change Tracking and Periodic Configuration Snapshots to support Payables Receivables General Ledger Purchasing HRMS Cash Management Fixed Assets Security and Administration Federal Financials Loans Configuration Controls Governor (CCG)

16. Just ramping up… Current customization and personalization are a target Previous help desk tickets, data fixes are an obvious priority Review areas with the application where users will benefit from automation Advantages to PCG being an Oracle application…..thus it is not a customization. Quick and easy to configure Preventive Controls Governor (PCG)

17. Focus on Payables Receivables General Ledger System, Security and Administration Reduce internal audit manual testing Increase audit analysis accuracy Eliminate sampling in lieu of 100% analysis Log incidents and remediation systemically to provide a continuous monitoring and compliance system Transaction Controls Governor (TCG)

18. Automate current CMS audit processes into one system Provide audit reporting and Analysis Reduce internal audit manual testing Increase audit analysis accuracy Eliminate sampling in lieu of 100% analysis Log incidents and remediation systemically to provide a continuous monitoring and compliance system Enterprise GRC Manager (eGRCM)

19. Q & Q u e s t i o n s Q u e s t i o n s A A n s w e r s A n s w e r s