As a result of internal control deficiencies discussed in GAO's 2007 report on certain contracts at the Centers for Medicare and Medicaid Services (CMS), GAO was asked to identify the extent to which CMS (1) implemented effective control procedures over contract actions, and (2) established a strong control environment for contract management. GAO used a statistical random sample of 2008 CMS contract actions (including contract awards and modifications) to assess CMS internal control procedures. The results were projected to the population of 2008 CMS contract actions. GAO also determined the extent to which CMS implemented recommendations GAO made in 2007 to improve internal control over contracting and payments to contractors. GAO reviewed contract file documentation and interviewed senior acquisition management officials. GAO makes 10 recommendations for developing policies to improve oversight and strengthen CMS's control environment. It also reaffirms 7 prior recommendations that CMS has not fully implemented. CMS concurred with the new recommendations, but generally disagreed with GAO's assessment of progress on the prior recommendations. GAO's analysis confirmed the need for additional efforts on these recommendations.