Who Is Troubleshooting the Future? — Full Analysis

As Medicaid leaders gather in National Harbor, Maryland, one question deserves a place in the conversation: who is actively finding the processes that may fail under Medicaid’s next operating requirements?

Somewhere in a Medicaid operation, a spreadsheet reconciles records that two systems cannot reconcile themselves. A technician knows which exception needs another look. A vendor resolves a mismatch through a process the agency cannot readily inspect. The work gets done. But can the organization prove that the decision was right—and will that process hold when requirements, transaction volume, or personnel change?

The problem is familiar. A temporary workaround becomes permanent. A reconciliation becomes somebody’s monthly assignment. A known vulnerability acquires a project number, while the operation continues to depend on it.

Troubleshooting the future means searching for those dependencies deliberately. It also means acting quickly enough that discovery produces protection, rather than another entry in an unresolved findings register.

A workaround is not automatically a control failure. Manual review can be the right response to a complex case, and a documented reconciliation can be an effective control. The question is whether the process has an owner, a defined purpose, reliable inputs, observable results, and retained evidence.

Consider an illustrative reconciliation between eligibility and enrollment records. A staff member receives two extracts, removes apparent duplicates, resolves exceptions, and sends a corrected file downstream. A manager sees a completed task. An auditor may need to know much more: which records were compared, what rules governed a correction, who approved it, whether the downstream system accepted it, and whether unresolved exceptions remained.

If those answers exist only in the staff member’s memory, continuity is at risk. If the comparison cannot be reproduced, assurance is weak. If a later extract replaces the evidence of what happened, reconstruction may be impossible.

These are management questions before they become audit questions. Leaders should ask where the organization depends on personal knowledge to compensate for missing system logic, missing documentation, or unclear accountability.

The Missouri State Auditor’s September 23, 2026 statewide single-audit release documents eight Medicaid and CHIP findings. Among them: 9,834 people appeared in both eligibility systems as of May 2025; the MEDES vital-records death match had not operated during the audited year; and approximately 85,000 MAGI-related redeterminations were backlogged as of December 31, 2025. The report also identified 19 of 120 sampled eligibility determinations completed 7 to 115 days late. These are audit findings about specific controls and time periods, not a PERM error rate or proof that all dual enrollments caused improper payments. [1]

Those findings do not establish a national ranking, quantify another state’s exposure, or substitute for a PERM result. Their relevance is the persistence of control weaknesses while operations continue.

The leadership inference is straightforward: an unresolved finding needs more than a future completion date. It needs an answer to what is protecting current decisions while the permanent correction remains unfinished.

That answer may involve targeted review, additional reconciliation, a validated exception report, or another lawful interim control. The appropriate response depends on the defect. Leadership should be able to explain the protection, its limitations, and how long the organization intends to rely on it.

Utah’s Legislative Auditor General published a Medicaid Office of Inspector General performance audit in September 2025. It found that the office had not consistently prioritized high-impact audits, lacked annual planning, and provided insufficient oversight of accountable care organizations. The report identified governance and performance weaknesses and presented options for improvement. The relevant lesson is to select oversight work according to risk, rather than assuming the completion of an audit calendar proves coverage of the most consequential vulnerabilities. [2]

These are findings and recommendations from a 2025 audit, not evidence that Utah has already implemented a successful prospective-risk model. Nor do they measure Utah’s future eligibility PERM performance.

The broader management question is whether the audit and quality agenda follows the most consequential vulnerabilities. A busy oversight function may still miss a fragile interface, a poorly understood exception pathway, or a recurring reconciliation that nobody has tested end to end.

Leaders should ask how review priorities are selected, what risks have not been examined, and who can challenge the selection. A calendar full of completed reviews is useful only if the work addresses the operation’s material vulnerabilities.

Indiana FSSA’s HIP toolkit provides member notices, a Benefits Portal, exemption materials, and a quick anonymous pre-screening tool. On October 5, FSSA estimated that more than 58,000 HIP members were not currently in compliance with the pending January 2027 requirements. That is a preliminary readiness signal, not a count of final eligibility denials, terminations, or PERM errors. The public material does not establish how many members in that estimate may ultimately demonstrate qualifying activity, meet an exemption, or correct incomplete evidence. [3, 4]

The outreach and pre-screening pathway is useful, but it is not the adjudication pathway. Indiana’s public guidance describes quarterly compliance checks and six-month renewals, while also stating that medical-frailty requirements are being worked through with CMS. Leaders therefore need to distinguish an initial automated flag from verified noncompliance, an evaluated exclusion, an adequate notice-and-response opportunity, and the final eligibility action.

That distinction matters nationally. A state may have successfully reached members and still lack complete evidence for a sampled month. Conversely, a pre-screening flag may be resolved through a qualifying exemption or previously available administrative data. For management, the test is the full decision chain: source data, applicable rule, exclusion determination, notice, response, effective date, enrollment update, and evidence retained for later review.

Before describing a pathway as ready, leadership should follow at least three deidentified cases through the entire process: a person whose activity is verified automatically; a person whose exemption is identified only after additional evidence; and a person whose data do not match and who must respond to a notice. Count which steps are automated, which require manual judgment, how long resolution takes, and whether the final determination can be reconstructed. Indiana’s 58,000-member estimate makes this a measurable readiness question, not a prediction of 58,000 coverage losses.

CMS’s community-engagement implementation materials establish a new eligibility requirement for certain adults, including qualifying activities, exclusions, and implementation responsibilities. [5] The operational implications extend across policy interpretation, systems, evidence collection, member communications, and case processing.

Our recommendation is to map each new requirement to the controls it relies on. A policy instruction may require a configuration change. That change may depend on a data interface. An interface exception may require manual review. The review may generate a notice and update enrollment records.

On October 1, the governors of Oregon, California, Maine, New Mexico, and Virginia asked HHS for additional time to implement the new Medicaid requirements and avoid preventable coverage disruptions. [7] Their request makes the readiness question concrete: can the operation verify qualifying activity and exclusions, issue accurate notices, resolve conflicting or incomplete information, and retain evidence supporting the final decision?

Our recommendation is to tie any additional preparation time to demonstrated readiness milestones. At NAMD, leaders can compare unresolved pathways and identify what requires federal clarification, a system change, or a tested interim control. Before calling a pathway ready, follow an ordinary case, an exclusion case, and a disputed-data case through the complete workflow—and confirm that another reviewer can retrieve and reconstruct the decision. The governors’ implementation-time request is distinct from relief from PERM financial consequences.

Testing each component separately can miss the failure between them. Leadership needs evidence that the complete pathway works, including exceptions and recovery from a failed transaction.

The question is not simply whether the new rule has been programmed. It is whether the operation can make, explain, and support the resulting decision without creating a new defect downstream.

Our companion article, Stop the Error Clock, examines a separate but connected proposition: a valid, documented correction may shorten the period during which an unresolved eligibility defect affects later payments. It does not erase the history of earlier payments.

CMS’s PERM state resources provide the governing review materials, including the PERM Manual and eligibility-review resources. [6] The duration framework here is PERM Insights analysis, not a CMS formula or a promised reduction in an error rate.

For leadership, two clocks deserve attention. The first runs from discovery to effective containment: when did the agency put a reliable interim protection in place? The second runs from discovery to a verified correction: when did the defect cease to govern the affected pathway, with evidence that the repair worked?

The clocks can differ. A system repair may take time, while a targeted quality control can be established sooner. Conversely, a rapidly deployed patch may leave affected cases, notices, enrollment files, or payments uncorrected.

Containment must respect applicable eligibility, notice, and hearing requirements. It should not mean suspending lawful coverage merely to improve a financial metric. Nor should a completed project ticket be treated as proof that the affected population has been addressed.

A legally effective correction requires the right action, supporting evidence, appropriate effective dates, and downstream consistency. Speed matters because unresolved defects remain in the operation. Accuracy matters because a rushed intervention can introduce another failure.

The supporting graphic identifies nine places to look: policy change, system configuration, interface handoffs, notices, manual review, spreadsheets, local knowledge, vendor dependency, and audit reconstruction. These are prompts for investigation, not scored risk categories or findings about particular states.

Start with one consequential pathway. Ask what enters it, what decision is made, what leaves it, and where evidence is retained. Then examine the dependencies: which steps require a manual repair, which depend on one person, which cannot be independently inspected, and which are not reconciled downstream?

Bring eligibility, systems, quality, and program-integrity leaders into the same examination. Include the people who perform the work. They often know where the formal workflow and the actual workflow diverge.

A useful test includes an ordinary case, an exception, and a failed handoff. Follow each through the decision, notice, enrollment update, and relevant payment record. Preserve what the test showed, including unresolved defects. The graphic’s purpose is to organize that conversation and move it toward action.

Identify. Describe the vulnerable process precisely enough that another person can locate it. Separate a demonstrated defect from an untested concern. Name the accountable owner and establish the affected scope as far as the evidence permits.

Contain. Determine what protects decisions while the permanent correction is developed. Explain the interim control, who operates it, how exceptions are escalated, and what risk remains. Record when the protection becomes effective.

Correct. Repair the cause and address affected cases and downstream records as applicable. Assign a deadline and dependencies. A system change, a training session, and a case correction solve different problems; the action plan should specify which ones are needed.

Verify. Have a person with appropriate independence test whether the correction works. Check normal and exception pathways, supporting evidence, effective dates, and downstream consistency. Document residual risk and reopen the issue if testing fails.

This sequence is an editorial management framework. It does not impose a federal deadline or replace CMS guidance. Its value is that it makes ownership, immediate protection, correction, and proof visible together.

Before the next meeting, select one recurring reconciliation, manual exception, or fragile handoff. Ask the process owner to bring a short account of the vulnerability, evidence of its scope, current protection, proposed correction, and the test that will justify closure.

At the meeting, make five decisions: name the accountable end-to-end owner; authorize a lawful interim containment control; set a dated correction milestone; assign an independent effectiveness test; and identify the escalation point if the control fails. Record the evidence that will be accepted for closure. Ask for a follow-up report showing elapsed time to containment, time to validated correction, and the number of unresolved exceptions—not simply the percentage of tasks marked complete.

There is no universal number of days appropriate to every defect. A material failure affecting current decisions may require immediate escalation. A less consequential concern may justify a measured investigation. The discipline is to make urgency proportionate to evidence and consequence, rather than allowing the project calendar to decide it by default.

Ask peers which vulnerabilities they are finding and how they are testing corrections. Share control methods and lessons that can be discussed publicly. Do not assume that another state’s solution fits the local architecture without validation.

Track discovery, effective containment, valid correction, and verification as distinct events. Where feasible, examine recurrence, unresolved exceptions, affected cases, downstream mismatches, administrative effort, and coverage consequences.

Payment-related analysis should distinguish fee-for-service from managed care and use the eligibility and payment history relevant to the question. A decline in one error category is not enough if duplicate records, processing delays, or erroneous terminations increase.

Do not report a projected benefit as a realized saving. Do not infer that a completed review prevented every possible error. Measure the intervention’s results, retain the limitations, and revise the control when the evidence warrants it.

The goal is a repeatable process that another person can inspect and that leadership can defend. A reliable correction should survive a staff departure, a vendor change, and the selection of a case the organization did not choose for demonstration.

Troubleshooting the future is an operating responsibility. Somebody must actively search for the old process that will not survive the next requirement. Somebody must decide what protects the operation while the repair is unfinished. Somebody must verify that the correction worked.

Bring one vulnerable process into the conversation at National Harbor—and bring back a named owner, a defensible interim control, and a date for independent verification. In the next leadership meeting, require one real case to be traced from incoming evidence through eligibility decision, notice, enrollment transaction, and payment treatment. If the team cannot reconstruct it, the work is not finished.

Find the vulnerability. Act on it promptly. Preserve the history. Protect the next decision and the next payment.

This Perspective uses selected public government materials to support a national leadership discussion. It is not a comparative state-performance study, legal advice, or a new CMS standard. State audit findings are not interchangeable with PERM findings. The state examples support distinct questions; they do not establish a causal relationship between a particular administrative structure and an error rate. Workarounds and manual review can be effective when properly controlled. The proposed response sequence and elapsed-time measures are recommendations to test locally.

[1] Missouri State Auditor, FY2025 Statewide Single Audit release, September 23, 2026: https://auditor.mo.gov/news/item/auditor-fitzpatrick-issues-report-on-state-agencies-use-of-federal-dollars-09-23-2026

[2] Utah Office of the Legislative Auditor General, Report 2025-20, A Performance Audit of the Office of Inspector General of Medicaid Services, September 2025: https://le.utah.gov/interim/2025/pdf/00003918.pdf

[3] Indiana FSSA, HIP Work Requirements, October 5 estimate and implementation baseline: https://www.in.gov/fssa/hip/hip-work-requirements/ ; Partner Toolkit: https://www.in.gov/fssa/hip/hip-work-requirements/hwr-partner-toolkit/

[4] Indiana FSSA, Information for HIP Members and medical-frailty implementation caveat: https://secure.in.gov/fssa/hip/hip-work-requirements/info-for-hip-members ; Pre-Screening Tool flyer: https://www.in.gov/fssa/hip/files/HWRPreScreeningFlyer.pdf

[5] CMS / Medicaid.gov, Community Engagement implementation resources, Section 71119, interim final rule and medical-frailty guidance: https://www.medicaid.gov/resources-for-states/working-families-tax-cut-legislation/community-engagement

[6] CMS / Medicaid.gov, Payment Error Rate Measurement, State Resources and PERM Manual: CMS PERM State Resources

[7] Oregon Governor’s Office, Governor Kotek Pushes for More Time to Protect Medicaid Coverage, October 1, 2026.

Download the full article PDF and supporting sources

Ralph Choate | Founder, Editor & Principal Author