The federal watchdog that audits how Medicaid dollars are spent has found that the Centers for Medicare & Medicaid Services kept signing off on state plans meant to fix eligibility errors even when those plans skipped requirements written into federal regulation. The finding sits inside a broader review of how CMS oversees the corrective action plans states must file after Medicaid’s error-rate audits flag mistakes. CMS’s own response to the finding was to ask that the underlying recommendation be closed rather than acted on further.
For a program that covers tens of millions of low-income and disabled Americans, including many older adults who rely on Medicaid to cover nursing-home care or wrap-around costs Medicare does not, an eligibility system with unresolved error patterns has a direct money consequence: it can mean coverage wrongly terminated for someone who still qualifies, or payments continuing to someone whose eligibility should have lapsed, either of which a state may later have to claw back or scramble to fix retroactively.
The GAO Report On CMS’s Medicaid Corrective Action Plans
The report, “Medicaid: Improved Oversight Needed of State Eligibility Error Corrective Action Plans” (GAO-26-108017), was publicly released September 17, 2026, and examines the Payment Error Rate Measurement program, the system CMS uses to estimate how much Medicaid spending nationally goes to people who were improperly enrolled or improperly billed. When PERM audits find a state’s error rate too high, federal regulation requires that state to submit a corrective action plan covering five specific elements. GAO’s review found that CMS accepted plans missing those required elements — in the report’s words, plans lacking “required evaluation components across all five mandated elements” — without sending them back for correction.
PERM cycles through states on a rotating schedule, auditing a sample of each state’s Medicaid eligibility determinations and payments and then producing an estimated improper-payment rate for that state. A corrective action plan is the mechanism meant to close the loop: once an audit identifies where a state’s eligibility process broke down, the plan is supposed to lay out specifically how the state will fix it, so the next audit cycle finds a lower error rate rather than a repeat of the same mistakes. GAO’s review of these plans is what surfaced the gap — not a fresh round of PERM audits, but an examination of whether the fix-it paperwork CMS had already approved actually met the regulation’s own bar.
What a GAO finding about CMS does not change locally: The report describes how CMS reviews states’ error-correction paperwork in Washington, but it says nothing about the renewal packet a Medicaid recipient has to return to their own state on their own schedule. Look up the renewal document checklist in The SNAP & Medicaid Renewal Organizer.
Why CMS Asked GAO To Close The Recommendation
GAO’s report carried a recommendation tied to the incomplete-plan finding, and CMS’s formal response was to request that GAO close that recommendation, arguing that its “routine oversight process is sufficient” to catch and correct the gaps on its own. That response puts CMS in the position of saying the process already in place — the same process GAO’s audit found had been accepting incomplete plans — needs no additional structural fix, only continued use. It is a common pattern in federal oversight exchanges: an agency accepts a finding’s facts but argues the existing workflow, applied more consistently, is remedy enough, rather than a new rule or checklist GAO would prefer to see codified.
Asking to close a recommendation is a formal step in GAO’s own process, not a unilateral decision CMS can make on its own. GAO tracks open recommendations across the federal government and periodically checks in on whether an agency has implemented one; a request from the audited agency to close a recommendation is essentially an argument that the underlying problem has already been resolved, which GAO then has to independently evaluate rather than simply accept.
Michelle Rosenberg And What GAO Says Still Needs To Happen
GAO did not accept CMS’s request. The report states plainly that “additional action is needed as CMS has accepted incomplete CAPs,” keeping the recommendation open rather than closing it out on CMS’s say-so. Michelle Rosenberg, GAO’s Director of Health Care, is listed as the report’s contact, and the underlying gap the report identifies is a practical one: without corrective action plans that address every regulation-required element, CMS has less assurance that the errors PERM flagged in a given state — wrong eligibility determinations, incorrect payment amounts, or both — actually get fixed before the next audit cycle comes around. Money erroneously paid out, or wrongly withheld from an eligible person, is the downstream version of the paperwork gap GAO is describing.
The report also flagged a related gap: GAO found that CMS does not systematically compare corrective action plans across states and years to judge which approaches actually lower a state’s error rate over time, meaning a plan that looked complete on paper could still be repeating a fix that has not worked elsewhere. Until CMS closes that analytical gap, Rosenberg’s report leaves the open recommendation as the record’s last word on whether the corrective-action process is doing what the regulation intends.
Open GAO recommendations of this kind do not carry a deadline the way a court order or a statutory mandate might; CMS can, in theory, leave the corrective action process exactly as it stands, and GAO’s continued oversight consists mainly of tracking the recommendation until CMS eventually implements it or provides evidence the underlying process has changed. That leaves the September 17 report as the current official record on the state of CMS’s Medicaid eligibility-error oversight, with GAO’s own assessment — that CMS’s acceptance of incomplete plans is an unresolved problem — standing as the last word from the agency Congress asked to check CMS’s work.
Getting A Medicaid Renewal Packet Right, Regardless Of How CMS Audits States
GAO’s finding is about the corrective action plans states file with CMS after an error-rate audit, not about any individual person’s Medicaid case, and it does not add or remove a form for a renewal that’s already coming due. What it underscores is that eligibility paperwork errors are a documented, ongoing weak point in the system on both the state and federal sides, which makes getting an individual renewal packet complete on the first try worth the extra care.
The SNAP & Medicaid Renewal Organizer includes the 51 state packs and the 90-day window after coverage is dropped, for keeping a state’s Medicaid renewal packet organized from submission through any follow-up.
Open the 90-day coverage-loss window in The SNAP & Medicaid Renewal Organizer.
This article was produced with AI assistance and checked against the primary source linked above.
Warren Cohen is a finance writer based in Phoenix, Arizona, covering personal finance topics including credit, banking, and beginner investing. He earned his degree in business administration from Arizona State University and began his career working in consumer finance, where he gained direct experience with lending and credit systems. He now writes for personal finance websites and fintech platforms, focusing on clear, practical content that helps readers make informed financial decisions.
