States are required by the Medicaid law to identify and investigate cases of suspected Medicaid abuse by reviewing recipients' and providers' use of Medicaid services. The General Accounting Office (GAO) conducted an assessment of programs to control recipient abuse in six states and to control provider abuse in four states to determine whether states were effectively identifying Medicaid abuse and to assess the extent of states' actions to apply sanctions against Medicaid abusers. The results revealed that some states were not effectively using their computerized management information systems to identify potential Medicaid abuse, some were reviewing only a small portion of the potentially abusive recipients identified, and most states had applied sanctions against few abusive Medicaid recipients. This document discusses actions needed to assure that state Medicaid agencies operate effective postpayment utilization review programs to identify and prevent abuse of Medicaid services. It includes a series of recommendations designed to: (1) assess the extent of provider and recipient abuse in each state; (2) establish minimum review requirements based on the results of the assessment; and (3) improve the states' use of their management information systems to identify potential abuse. Eight appendices describe methodology used to identify recipient abusers in California and provide comments from the Department of Health and Human Services and six of the states investigated. (NB)