Neither VA Nor Medicare Advantage Assessed Its Fraud Risk
Summary
A July 21, 2026 GAO report examined two of the 30 federal programs OMB designates high-priority for improper payments -- the VA's Community Care program and CMS's Medicare Advantage -- and found $608 million and $23.7 billion, respectively, paid in error in fiscal 2025. Both agencies built processes to trace the root causes of those errors, but GAO found neither has completed the comprehensive fraud risk assessment its own Fraud Risk Framework calls for, and CMS's plan for clearing a backlog of Medicare Advantage payment-recovery audits still has no cost estimate, completion date, or way to measure progress.
Same test, three questions, one shared blank
graded both programs against the same three-part test. On the first question -- has the agency built a process to identify and assess the root causes of its improper payments -- both VA and CMS rated "met."⧉ On the second -- has the agency developed, implemented, and monitored corrective action plans that adequately address those root causes -- VA rated "met"⧉ while CMS rated only "partially met."⧉ On the third -- has the agency conducted a comprehensive fraud risk assessment that identifies inherent fraud risks, weighs their likelihood and impact, sets a risk tolerance, evaluates controls, and documents a fraud risk profile -- both VA and CMS rated "not met."⧉ Diagnosing why payments go wrong is one discipline; assessing how a program could be defrauded on purpose is a different one, and it's the one both agencies have skipped.
View data as table
| VA Community Care | 2.4% | $608 million in FY2025 improper payments |
|---|---|---|
| Medicare Advantage | 6.1% | $23.7 billion in FY2025 improper payments |
VA: fraud-risk steps that don't add up to an assessment
credits with taking steps to identify and assess fraud risk⧉ in Community Care -- the department isn't starting from nothing. But those steps, found, don't meet the key elements of a fraud risk assessment and haven't produced a comprehensive one, leaving the program vulnerable to fraud⧉. measures that against its own Fraud Risk Framework, the standard federal agencies are expected to follow: identify risks, weigh them, set a tolerance, evaluate the controls meant to catch them, and write it all down. has pieces of that process. It doesn't have the finished document.
CMS: a steady error rate and a stalled audit backlog
's problem compounds. Its Medicare Advantage improper payment rate hasn't decreased -- it's remained steady⧉, and found its corrective action plans aren't detailed enough to adequately track progress. The sharpest gap: has no detailed plan for expediting Risk Adjustment Data Validation (RADV) audits⧉ -- the agency's primary tool for finding and clawing back improper Medicare Advantage payments. RADV audits check whether the diagnoses insurers report to justify higher payments are actually supported by an enrollee's medical records. CMS's backlog of those audits is causing significant delays in recovering money it's already found was paid in error⧉ -- on top of never having done the fraud risk assessment either.
What GAO wants fixed, and how each agency responded
's three recommendations split cleanly along the gaps it found. To : conduct a comprehensive Community Care fraud risk assessment aligned with the Fraud Risk Framework⧉ -- VA concurred⧉. To : document a detailed plan for expediting RADV audits, including cost estimates, completion dates, and metrics for tracking progress⧉, and separately, conduct the same kind of comprehensive fraud risk assessment for Medicare Advantage⧉. CMS neither agreed nor disagreed with either recommendation, pointing instead to past actions it says already address them⧉; 's response is that new action is still warranted. Both agencies' recommendations remain open as of the report's release.
- Same test, same blank. 's three-part standard rates "met" on root-cause analysis and corrective action plans, "met" on root-cause analysis but only "partially met" on corrective action -- and both "not met" on the one question that measures deliberate fraud, not honest error.
- Scale, not just rate, drives the dollar gap. Medicare Advantage's 6.1% error rate is about 2.5x Community Care's 2.4% -- but its $23.7 billion in errors is about 39x 's $608 million, because Medicare Advantage is a vastly larger program (roughly $388.5 billion in FY2025 outlays, by 's own rate, against roughly $25.3 billion for Community Care).
- 's response leaves the harder problem unresolved. concurred with its recommendation outright; neither agreed nor disagreed with either of its two, citing past actions says still fall short -- including no detailed plan yet for clearing the RADV audit backlog that is Medicare Advantage's main tool for recovering money already known to be paid in error.
All figures come from GAO-26-107946⧉, "Program Integrity: Actions Needed to Reduce Improper Payment and Fraud Risks in Community Care and Medicare Advantage," published and publicly released July 21, 2026 -- the first report in a planned series on this topic. 's analysis covers work from November 2024 through June 2026, drawing on , , and PaymentAccuracy.gov documentation, prior agency reports, and interviews with agency officials, staff, and trade association representatives. The gao.gov host intermittently returned an access error to direct fetches during research; the figures here are drawn from an Artemis-sealed capture of the same gao.gov report page, not a news account or third-party mirror. This piece describes both programs' failures at the office and agency level -- the Under Secretary for Health, the Administrator -- because that is how itself directs its recommendations; no individual employee is named here. The 2.4% and 6.1% rates are each agency's own estimate for a different program with a different population; the combined $24.3 billion figure is a simple sum for scale, not a claim the two problems share a cause.
Sources(1) ▾
- U.S. Government Accountability Office, Program Integrity: Actions Needed to Reduce Improper Payment and Fraud Risks in VA Community Care and Medicare Advantage (GAO-26-107946) (2026-07-21) — 's product page for report -26-107946, published and publicly released July 21, 2026 -- the first in a planned series on improper payment and fraud risk in these two programs. The live gao.gov host returned HTTP 403 to direct fetches at research time (intermittent access, consistent with prior sessions); read via the Artemis-sealed capture of the same gao.gov URL, taken July 21, 2026, which preserves the full landing page: Fast Facts, the 'What Found' section including the three-criterion Met/Partially Met/Not Met comparison table for the two programs, 'Why Did This Study,' both agencies' recommendation responses, and the Recommendations for Executive Action table. The full 61-page report PDF (linked from this page as gao-26-107946.pdf) was not reachable at research time and is not cited here; every fact below comes from the sealed landing-page text, which is issued by on its own domain and states the same headline dollar figures, rates, and findings that the full report summarizes. gao.gov · original document
Comments
Always open. Logged-in readers can annotate paragraphs in place.
flags 30 federal programs each year as high-priority for improper payments -- spending significant, and error-prone, enough that Congress wants dedicated attention on it. Two are health-care programs examined together in a report released July 21, 2026⧉: the VA's Community Care program⧉, which pays private providers when facilities can't meet a veteran's wait-time or drive-time standards, and CMS's Medicare Advantage program⧉, the privately administered alternative that now covers a majority of Medicare enrollees. In fiscal 2025, VA's Community Care improper payments totaled $608 million⧉ -- 2.4 percent of the program's outlays -- while CMS's Medicare Advantage improper payments totaled $23.7 billion⧉, 6.1 percent of that program's outlays. 's finding common to both: neither agency has completed a comprehensive fraud risk assessment for its program⧉.