GAO’s analysis is based on work completed from November 2024 through June 2026, and it concludes that neither program has a comprehensive fraud-risk assessment that GAO says is needed for stronger, ongoing program integrity.

What GAO says was measured: large FY 2025 improper-payment estimates

GAO reports that for fiscal year 2025:

• VA Community Care: $608 million in estimated improper payments (2.4% of program outlays).
• Medicare Advantage: $23.7 billion in estimated improper payments (6.1% of program outlays).

GAO and CMS also emphasize an important distinction: improper-payment measurement identifies payments that do not meet program requirements, and it is not the same thing as proving fraud in every case.

Key finding #1: VA Community Care’s fraud-risk work still isn’t comprehensive

GAO says VA has taken steps to identify and assess fraud risks. But GAO concludes those efforts do not include key elements needed for a comprehensive fraud-risk assessment “for the program,” leaving the Community Care program vulnerable to fraud.

Key finding #2: CMS Medicare Advantage controls haven’t caught up—especially for RADV

GAO reports that CMS developed and implemented processes to identify and assess root causes of improper payments in Medicare Advantage, but it says several integrity components have not worked effectively:

• Improper-payment rate: GAO says CMS’s estimated improper payment rate has not decreased and has remained steady.
• Corrective action plans: GAO says they are not sufficiently detailed and do not adequately monitor progress.
• RADV audits: GAO says CMS does not have a detailed plan for expediting Risk Adjustment Data Validation (RADV) audits, which GAO describes as CMS’s primary corrective action for identifying and recovering improper payments. GAO also points to a RADV backlog contributing to significant recovery delays.
• Fraud-risk assessment: GAO says CMS has not conducted a comprehensive fraud-risk assessment for the Medicare Advantage program.

What GAO recommends next (and what “Open” means here)

GAO’s recommendations target the specific gaps it identified rather than declaring either program “fixed.”

• VA recommendation (Recommendation 1): GAO recommends a comprehensive fraud risk assessment for the Community Care program aligned with GAO’s Fraud Risk Framework. GAO says VA concurred. GAO lists this recommendation as Open.
• CMS recommendations (Recommendations 2 and 3): GAO recommends (1) a detailed, documented plan for expediting RADV audits—including cost estimates, planned completion dates, and metrics—and (2) a comprehensive fraud risk assessment for Medicare Advantage aligned with the Fraud Risk Framework. GAO says CMS neither agreed nor disagreed, and GAO lists these recommendations as Open.

Bottom line for beneficiaries and taxpayers

GAO’s report is not an allegation that every improper payment is fraud. Instead, GAO’s core message is governance-focused: without comprehensive fraud-risk assessments and fully monitored corrective actions, agencies may miss or under-prioritize the fraud risks most likely to drive improper payments.

For beneficiaries, the practical concern is payment accuracy and program integrity. For taxpayers, the issue is whether federal oversight can convert known weaknesses into measurable improvements—especially around RADV audit acceleration for Medicare Advantage.

Sources

• GAO report (GAO-26-107946): published July 21, 2026
• CMS Fact Sheet: FY 2025 Improper Payments (Medicare Part C / Medicare Advantage)