$11.2 Billion in Contracts Closed Without Verification

Federal contracts define an exchange: the government pays, the contractor delivers, and the terms of the exchange are specified in advance. Contract closeout is the administrative process by which the government confirms, at the conclusion of a contract, that the terms were met — that deliverables were received, that payments were accurate, that any unspent funds were recovered, and that the contractor's performance obligations were satisfied. Federal acquisition regulations establish closeout requirements precisely because closeout is the last point in the contract lifecycle at which the government can detect and correct improper payments.

CMS administers the federal government's largest health programs — Medicare and Medicaid — and contracts extensively with private entities for administrative services, data systems, program integrity functions, and operational support. In Fiscal Year 2023 alone, CMS accounted for nearly one in five dollars of HHS contracting activity. The scale of CMS contracting means that failures in contract administration propagate across a correspondingly large financial base.

The HHS Office of Inspector General audited 50 CMS contracts totaling $11.2 billion that were eligible for closeout between October 2018 and September 2023. Every contract in the sample — all 50 — failed to meet one or more administrative closeout requirements. At the time the audit concluded, 12 contracts totaling $2.1 billion remained overdue for closeout entirely. The OIG characterized the full $11.2 billion as having been put at risk of fraud, waste, and abuse by the failure to close contracts in accordance with federal requirements.

The audit found that CMS lacked clearly defined documentation requirements, that roles and responsibilities for closeout were not adequately specified, and that no alternative procedures existed to ensure timely closeout when standard processes were not followed. The finding was not an isolated compliance gap. It was a systemic absence of the administrative controls that make contract payment verification possible.

A contract is a credential. It encodes, at issuance, what was authorized — the payment amount, the deliverable, the conditions under which the payment is earned. Closeout is the mechanism by which that credential is evaluated at the point of completion: was the encoded condition met? The payment was made because the contract authorized it. The contract's evidentiary boundary — what was actually delivered against what was authorized — is only evaluated at closeout. When closeout does not occur, that evaluation never happens. The credential authorized the transfer. The transfer occurred. The correspondence between the two was never confirmed.

Across all 50 contracts in the sample, the closeout process that would have performed that evaluation was either incomplete or entirely absent. The government paid. The contracts closed, or remained open past their eligibility date, without verification that what was paid for was received. Improper payments — overpayments, unearned amounts, unrecovered balances — that would have been detectable at closeout remained undetected. The OIG identified this condition not as a series of individual contracting errors but as the consequence of CMS having no adequate policies, procedures, or defined responsibilities to ensure closeout occurred at all.

The structural condition this case documents is not unique to CMS or to this audit period. Federal contract closeout has been an identified weakness across HHS for years, as prior OIG work had established. What the 2025 audit makes precise is the scale at which an absent verification mechanism translates into financial exposure: $11.2 billion in contracts where the last available control was never exercised.

The OIG issued two recommendations: that CMS complete closeout for the 12 contracts totaling $2.1 billion that remained overdue, and that CMS develop policies and procedures clearly defining documentation requirements, roles and responsibilities, and alternative closeout procedures. CMS concurred with both recommendations and described corrective actions planned and underway. Both recommendations remained open and unimplemented as of the report date, with updates expected by May 2026. The OIG noted that the absence of adequate policies and procedures was itself the condition that allowed the failure to persist across a five-year audit window covering billions of dollars in contracting activity.