This is the accessible text file for GAO report number GAO-07-92 entitled 'Improper Payments: Agencies' Fiscal year 2005 Reporting under the Improper Payments Information Act Remains Incomplete' which was released on November 14, 2006. This text file was formatted by the U.S. Government Accountability Office (GAO) to be accessible to users with visual impairments, as part of a longer term project to improve GAO products' accessibility. Every attempt has been made to maintain the structural and data integrity of the original printed product. Accessibility features, such as text descriptions of tables, consecutively numbered footnotes placed at the end of the file, and the text of agency comment letters, are provided but may not exactly duplicate the presentation or format of the printed version. The portable document format (PDF) file is an exact electronic replica of the printed version. We welcome your feedback. Please E-mail your comments regarding the contents or accessibility features of this document to Webmaster@gao.gov. This is a work of the U.S. government and is not subject to copyright protection in the United States. It may be reproduced and distributed in its entirety without further permission from GAO. Because this work may contain copyrighted images or other material, permission from the copyright holder may be necessary if you wish to reproduce this material separately. Report to Congressional Requesters: November 2006: Improper Payments: Agencies' Fiscal Year 2005 Reporting under the Improper Payments Information Act Remains Incomplete: GAO-07-92: GAO Highlights: Highlights of GAO-07-92, a report to congressional requesters Why GAO Did This Study: Fiscal year 2005 marked the second year that executive agencies were required to report improper payment information under the Improper Payments Information Act of 2002 (IPIA). As a steward of taxpayer dollars, the federal government is accountable for how its agencies and grantees spend billions of taxpayer dollars and is responsible for safeguarding those funds against improper payments. GAO was asked to determine the progress agencies have made in their improper payment reporting and the total amount of improper payments recouped through recovery auditing. To accomplish this, GAO reviewed improper payment information reported by 35 agencies in their fiscal year 2005 performance and accountability or annual reports. What GAO Found: While making progress, agencies’ fiscal year 2005 reporting under IPIA does not yet reflect the full scope of improper payments across executive branch agencies. Major challenges remain in meeting the goals of the act and ultimately improving the integrity of payments. GAO found that these challenges continue to hinder full reporting of improper payment information because of the following three factors: * Existing reporting incomplete. Although 18 agencies collectively identified and estimated improper payments for 57 programs and activities totaling $38 billion, some agencies still had not instituted systematic methods of reviewing all programs, resulting in their identification of none or only a few programs as susceptible to significant improper payments. In many cases, these same agencies had well-known and documented financial management weaknesses as well as fraudulent, improper, and questionable payments. Further, improper payment estimates totaling about $389 million for 9 programs were not based on a valid statistical sampling methodology as required. Higher estimates would have been expected had the correct methods been used, given that total outlays for these 9 programs exceeded $58.2 billion. * Large programs still not included. Improper payment estimates for 10 risk-susceptible programs with outlays totaling over $234 billion still have not been provided. Most of these programs were subject to OMB reporting requirements that preceded IPIA. * Threshold criteria limit reporting. The act includes broad criteria to identify risk-susceptible programs. OMB’s implementing guidance includes more specific criteria that limit the disclosure and transparency of agencies’ improper payments. With regard to agencies’ recovery audit efforts, GAO found that the data reported may present an overly optimistic view of these efforts. While 21 agencies were required to report on their recovery audit efforts, GAO identified discrepancies in several agencies’ information and found limited reviews over contract payments. For example, for fiscal year 2005, the National Aeronautics and Space Administration (NASA) reported that it had identified and recovered $617,442 in contract payments, a 100 percent recovery rate. Yet, the NASA Office of Inspector General reported it had identified over $515 million in questioned contract costs during fiscal year 2005, of which NASA management decided to pursue recovery of $51 million. Had this amount been compared to the $617,442 NASA actually recovered, its recovery rate would drop from the reported 100 percent to 1.2 percent. In addition, we noted that 5 of the 21 agencies did not review all of their agency components as part of their recovery audit efforts while 2 agencies reported that recovery auditing was not cost beneficial without reporting any details to support this determination. What GAO Recommends: GAO suggests that the Congress consider amending IPIA provisions to define specific criteria agencies should use to ensure that the full extent of improper payments is being captured. GAO also makes four recommendations to the Office of Management and Budget (OMB) to facilitate agencies’ progress in ensuring accurate and complete improper payments and recovery auditing reporting. OMB generally agreed with GAO’s recommendations and outlined actions planned and under way for continued progress. [Hyperlink, http://www.gao.gov/cgi-bin/getrpt?GAO-07-92]. To view the full product, including the scope and methodology, click on the link above. For more information, contact McCoy Williams at (202) 512-9095 or williamsm1@gao.gov. [End of Section] Contents: Letter: Results in Brief: Background: Improvements Needed in Agencies' Reporting of Improper Payment Information: Improper Payments Estimate Is Understated: IPIA May Need to Be Amended to Ensure Agencies Fully Meet Its Objectives: Agencies' Reporting of Recovery Auditing Information Questionable: Conclusions: Matter for Congressional Consideration: Recommendations for Executive Action: Agency Comments and Our Evaluation: Appendixes: Appendix I: Objectives, Scope, and Methodology: Appendix II: Improper Payment Estimates Reported in Agency Fiscal Year 2004 and 2005 PARs or Annual Reports: Appendix III: Outlays, Improper Payment Estimates, and Error Rates Reported in Agency Fiscal Year 2005 PARs or Annual Reports: Appendix IV: Comments from the Office of Management and Budget: Appendix V: GAO Contact and Staff Acknowledgments: Related GAO Products: Tables: Table 1: Agency Reporting of Risk Assessments Performed for All Programs and Activities: Table 2: Agency Improper Payment Estimate Reporting in Fiscal Year 2005: Table 3: Agency Reporting of Certain Reporting Requirements for One or More of Its Programs: Table 4: Agency-Reported Statutory Barriers to Reducing Improper Payments: Table 5: Susceptible Programs That Did Not Report Improper Payment Estimates and Target Dates for Estimates: Table 6: Examples of Programs or Activities with Major Management Challenges but Not Identified as Susceptible to Significant Improper Payments: Table 7: Agency Improper Payment Estimates Included in the Governmentwide Total That Met One of the Two OMB Reporting Criteria: Table 8: Improper Payment Amounts Recovered in Fiscal Year 2005: Figures: Figure 1: Required Steps to Identify, Estimate, Reduce, and Report Improper Payment Information: Figure 2: Improper Payments--Step 1: Figure 3: Improper Payments--Step 2: Figure 4: Improper Payments--Step 3: Figure 5: Improper Payments--Step 4: Abbreviations: CDBG: Community Development Block Grant: CMS: Centers for Medicare and Medicaid Services: DHS: Department of Homeland Security: DOD: Department of Defense: DOJ: Department of Justice: DOT: Department of Transportation: EITC: Earned Income Tax Credit: FECA: Federal Employees' Compensation Act: FEMA: Federal Emergency Management Agency: FERS: Federal Employees Retirement System: FSA: Federal Student Aid: FUTA: Federal Unemployment Tax Act: GSA: General Services Administration: HHS: Department of Health and Human Services: HUD: Department of Housing and Urban Development: IHP: Individuals and Households Program: IPIA: Improper Payments Information Act of 2002: IRS: Internal Revenue Service: NASA: National Aeronautics and Space Administration: NDNH: National Directory of New Hires: OCFO: Office of Chief Financial Officer: OIG: Office of Inspector General: OMB: Office of Management and Budget: OPM: Office of Personnel Management: PBM: pharmaceutical benefits manager: PMA: President's Management Agenda: RRB: Railroad Retirement Board: SBA: Small Business Administration: SSA: Social Security Administration: SSI: Supplemental Security Income: UI: Unemployment Insurance: USDA: Department of Agriculture: VA: Department of Veterans Affairs: November 14, 2006: Congressional Requesters: Fiscal year 2005 marked the second year that federal executive branch agencies were required to report improper payment information under the Improper Payments Information Act of 2002 (IPIA).[Footnote 1] IPIA has increased visibility over improper payments by requiring executive agency heads, based on guidance from the Office of Management and Budget (OMB),[Footnote 2] to identify programs and activities susceptible to significant improper payments,[Footnote 3] estimate amounts improperly paid, and report on the amounts of improper payments and their actions to reduce them. As the steward of taxpayer dollars, the federal government is accountable for how its agencies and grantees spend hundreds of billions of taxpayer dollars and is responsible for safeguarding those funds against improper payments. Our work over the past several years has demonstrated that improper payments are a long-standing, widespread, and significant problem in the federal government.[Footnote 4] Yet, the extent of the problem initially had been masked because only a limited number of agencies reported their annual payment accuracy rates and estimated improper payment amounts prior to the passage of IPIA. As we reported in March 2005,[Footnote 5] regarding the first year reporting under IPIA, the improper payment estimate of $45 billion did not include any amounts for some of the highest risk programs, such as Medicaid with outlays in excess of $175 billion for fiscal year 2004. Further, we noted that some agencies still had not instituted systematic methods of reviewing all programs and activities or had not identified all programs susceptible to significant improper payments. We concluded that the magnitude of the governmentwide improper payments problem is still unknown because agencies have not yet prepared improper payment estimates for all of their programs. In that report, we made three recommendations to OMB to help ensure successful implementation of IPIA requirements. Because of the continued interest in addressing the governmentwide improper payments issue, you asked us to determine (1) the extent to which agencies have included required improper payment information in their performance and accountability reports (PAR), (2) the annual improper payment estimate reported by agencies for fiscal year 2005, (3) whether the definition and types of improper payments included in IPIA and OMB's implementing guidance provide adequate disclosure of the extent of improper payments at the agencies, and (4) the reported amount of improper payments recouped through recovery audits. The scope of our review included the 35 federal agencies that the Department of the Treasury (Treasury) determined to be significant to the U.S. government's consolidated financial statements. We reviewed improper payment information reported by the 35 agencies in their fiscal year 2005 PARs or annual reports. We also reviewed OMB guidance on implementation of IPIA and its report[Footnote 6] on the results of agency-specific reports, significant findings, agency accomplishments, and remaining challenges. We did not independently validate the data that agencies reported in their PARs or annual reports or the data that OMB reported. However, we are providing this agency-reported data as descriptive information that will inform interested parties about the magnitude of governmentwide improper payments and other improper payments-related information. We believe the data to be sufficiently reliable for this purpose. We conducted our work from April 2006 through September 2006 in accordance with generally accepted government auditing standards. See appendix I for more details on our scope and methodology. Results in Brief: Our review of agencies' reporting of selected improper payment information identified that improvements are still needed to fully address improper payments reporting requirements. For example, we found agencies' reporting of improper payment information was incomplete and the extent and level of detail of agencies' improper payment information varied. Furthermore, the total improper payment estimate does not include several large, risk-susceptible federal programs, while other program estimates included in the total are not statistically valid. In addition, we found that OMB's existing threshold criteria to assess program susceptibility to significant improper payments affect how agencies identify these programs, thus limiting the disclosure and transparency of governmentwide improper payments. Generally, agencies must perform four key steps to address the improper payment reporting requirements--perform a risk assessment, estimate improper payments for risk-susceptible programs and activities, implement a plan to reduce improper payments for programs with estimates exceeding $10 million, and annually report improper payment estimates and actions to reduce them. Of the 35 agencies in our review, 23 reported that they had performed risk assessments of all of their programs and activities, while 12 had not. In addition, the adequacy of some of these risk assessments was questionable. For example, the auditors for the Departments of Justice (DOJ) and Homeland Security (DHS) cited agency noncompliance with IPIA in their fiscal year 2005 annual audit reports, primarily caused by inadequate risk assessments. A lack of detailed guidance may be a contributing factor to agencies' inability to adequately assess their programs for risks. Specifically, we found that OMB's implementing guidance does not include a description of the common types of risk factors agencies should consider when annually reviewing their programs, such as program complexity, operational changes, findings from investigative reports, and financial statement and performance audit reports. Agencies have developed their own processes for conducting risk assessments, which may not satisfactorily identify programs susceptible to improper payments. For example, at the Department of Agriculture (USDA), its auditors reported that the agency's risk assessments were not adequate to estimate the agency's susceptibility to improper payments because the Office of Chief Financial Officer's (OCFO) guidance was not prescriptive and detailed enough to translate into meaningful results. For fiscal year 2005, 18 agencies reported improper payment estimates for 57 programs totaling in excess of $38 billion,[Footnote 7] which is $7 billion less than the $45 billion reported for fiscal year 2004.[Footnote 8] Of the 18 agencies reporting improper payment estimates, 14 agencies had one or more programs with improper payment estimates exceeding $10 million, and thus were required to prepare and implement a plan to reduce improper payments and report on actions taken. Key elements that agencies are required to report on include causes of improper payments and corrective actions, manager accountability, and statutory barriers.[Footnote 9] Generally, agencies reported this information for one or more of their programs in their PARs. However, the extent and details of reporting varied. For example, 1 agency addressed the manager accountability reporting element in one sentence while 2 other agencies provided information on how each program manager was held accountable for each of their high- risk programs identified. Although the federal government continues to make progress in meeting the requirements of IPIA, agencies' fiscal year 2005 reporting does not yet reflect the full scope of improper payments across government. Specifically, the $7 billion reported decrease in the total improper payment estimate represents a reduction of 16 percent reported by agencies in fiscal year 2004. On the surface, this would suggest that significant progress has been made. Yet, we found that the reduced estimate for improper payments for fiscal year 2005 may not represent actual improvements in this area. In fact, all indications are that the estimate should be markedly higher because the total improper payment estimate does not include certain factors that if included, would increase the estimate. For example, agencies have not estimated improper payments for 10 risk- susceptible programs with outlays totaling over $234 billion, even though most of these programs had such reporting requirements predating IPIA.[Footnote 10] In addition, we found that improper payment estimates totaling about $389 million for 9 programs were not based on a statistical sampling methodology.[Footnote 11] Given that total outlays for these 9 programs exceeded $58.2 billion in fiscal year 2005, estimates for these programs would likely have been much greater had statistically valid methods been used. Also, agency auditors have reported major management challenges that highlight internal control weaknesses that continue to plague programs susceptible to significant improper payments. In some cases, agencies reported that their programs were not susceptible to significant improper payments, despite the fact that the auditor's reports in the same PARs identified major program management challenges, including significant internal control weaknesses. Further, OMB's implementation[Footnote 12] of the act's broad criteria to identify risk-susceptible programs limits the disclosure and transparency of governmentwide improper payments. This limitation does not further the objectives of IPIA, as programs that do not meet OMB's criteria are excluded from agencies' improper payment reporting. For example, one agency identified three programs with estimated improper payments exceeding $10 million, but because the estimates did not exceed 2.5 percent of program outlays, they were not included in the governmentwide improper payment total. In addition, we note that the definition of improper payments under IPIA excludes certain types of payments required to be made under constitutional, statutory, or judicial requirements, even though those payments are subsequently determined to be incorrect. This includes payments that an agency must make pursuant to a statute or court order that later are determined to be overpayments. Yet, because agencies are not required to track, monitor, and report on these types of overpayments, the governmentwide magnitude of this issue is unknown. Lastly, with regard to agencies' recovery audit efforts, the data reported may not present an accurate view of the extent of these efforts. While 21 agencies were required to report on their recovery audit efforts, we identified discrepancies in several agencies' information and found limited reviews over contract payments. For example, for fiscal year 2005, the National Aeronautics and Space Administration (NASA) reported that it had identified and recovered $617,442 in contract payments, a reported 100 percent recovery rate. Yet, the NASA Office of Inspector General (OIG) reported it had identified over $515 million in questioned contract costs during fiscal year 2005, of which NASA management decided to pursue recovery of $51 million. Had the $51 million amount been compared to the $617,442 NASA actually recovered, its recovery rate would drop from the reported 100 percent to 1.2 percent. In addition, we noted that 5 of the 21 agencies did not review all of their agency components as part of their recovery audit efforts while 2 agencies reported that recovery auditing was not cost beneficial without reporting any details to support this determination. This report includes one matter for congressional consideration and four recommendations for executive action. Specifically, to ensure that the full extent of improper payments is being captured, the Congress should consider whether existing IPIA provisions should be amended to define specific criteria, such as a dollar threshold, agencies should use to identify which programs and activities are susceptible to significant improper payments, thereby triggering improper payment estimating and reporting requirements. In addition, to facilitate agencies' progress in ensuring accurate and complete improper payments and recovery auditing reporting, we recommend that OMB take several actions regarding (1) risk assessment methodologies and the level of detail necessary to meet the annual improper payment reporting requirements, (2) statistically valid estimates, (3) extent of payments agencies make under statute or judicial determinations that later are determined to be overpayments, and (4) agencies' rationale that recovery auditing is not cost beneficial. In commenting on a draft of this report, OMB generally agreed with our recommendations and highlighted progress made in the second year of governmentwide improper payments reporting, as well as initiatives under way to measure improper payments in selected programs susceptible to significant improper payments. For example, OMB reported that for fiscal year 2005, agencies estimated improper payments for 17 additional programs and that this number will increase again by 10 programs for fiscal year 2006. OMB also stated that beginning in fiscal year 2007, the Department of Health and Human Services (HHS) will begin reporting component error rates for its Medicaid, Temporary Assistance for Needy Families, and State Children's Health Insurance programs. OMB's written comments are reprinted in appendix IV. Background: IPIA was passed in November 2002 with the major objective of enhancing the accuracy and integrity of federal payments. IPIA requires executive branch agency heads to review their programs and activities annually and identify those that may be susceptible to significant improper payments. For each program and activity agencies identify as susceptible, the act requires them to estimate the annual amount of improper payments and to submit those estimates to the Congress. The act further requires that for programs for which estimated improper payments exceed $10 million, agencies are to report annually to the Congress on the actions they are taking to reduce those payments. The act requires the Director of OMB to prescribe guidance for agencies to use in implementing IPIA. OMB issued implementing guidance in May 2003, which requires the use of a systematic method for the annual review and identification of programs and activities that are susceptible to significant improper payments. The guidance defines significant improper payments as those in any particular program that exceed both 2.5 percent of program payments and $10 million annually.[Footnote 13] It requires agencies to estimate improper payments annually using statistically valid techniques for each susceptible program or activity. For those agency programs determined to be susceptible to significant improper payments and with estimated annual improper payments greater than $10 million, IPIA and related OMB guidance require each agency to annually report the results of its efforts to reduce improper payments. In addition, applicable agencies are required to report their efforts to recoup contract-related improper payments under section 831 of the National Defense Authorization Act for Fiscal Year 2002.[Footnote 14] This legislation contains a provision that requires all executive branch agencies entering into contracts with a cumulative total value exceeding $500 million in a fiscal year to have cost-effective programs for identifying errors in paying contractors and for recovering amounts erroneously paid. The act further states that a required element of such a program is the use of recovery audits and recovery activities. The law authorizes federal agencies to retain recovered funds to cover in-house administrative costs as well as to pay other contractors, such as collection agencies. Agencies that are required to undertake recovery audit programs were directed by OMB to provide annual reports on their recovery audit efforts, along with improper payment reporting details in an appendix to their PARs. In August 2006, OMB revised its IPIA implementing guidance. The revision consolidates into Appendix C of OMB Circular No. A-123, Management's Responsibility for Internal Control,[Footnote 15] all guidance for improper payments and recovery auditing reporting.[Footnote 16] The revised guidance includes authorization for risk assessments to be conducted less often than annually for programs where improper payment baselines are already established, are in the process of being measured, or are scheduled to be measured by an established date. Although OMB kept its criteria for defining significant improper payments as those exceeding both 2.5 percent of program payments and $10 million, OMB added that it may determine on a case-by-case basis that certain programs that do not meet the threshold may be subject to the annual reporting requirement. Additionally, the revised guidance allows agencies to use alternative sampling methodologies[Footnote 17] and requires agencies to report on and provide a justification for using these methodologies in their PARs. This revised guidance is effective for agencies' fiscal year 2006 improper payment estimating and reporting in the PARs or annual reports. For the purposes of evaluating agency reporting in this report, we used the requirements from the OMB implementing guidance effective for fiscal year 2005. OMB has also established Eliminating Improper Payments as a new program- specific initiative under the President's Management Agenda (PMA). This separate PMA program initiative began in the first quarter of fiscal year 2005. Previously, agency efforts related to improper payments were tracked along with other financial management activities as part of the Improving Financial Performance initiative of the PMA. The objective of establishing a separate initiative for improper payments was to ensure that agency managers are held accountable for meeting the goals of IPIA and are therefore dedicating the necessary attention and resources to meeting IPIA requirements. With this new initiative, 15 agencies[Footnote 18] are to measure their improper payments annually, develop improvement targets and corrective actions, and track the results annually to ensure the corrective actions are effective. The fiscal year 2005 PARs, the second set of annual reports representing the results of improper payments assessments for federal executive branch agency programs, were due November 15, 2005. In our December 2005 report[Footnote 19] on the U.S. government's consolidated financial statements for the fiscal years ended September 30, 2005, and 2004, which includes our associated opinion on internal control, we reported improper payments as a material weakness in internal control. Specifically, we reported progress in implementing processes and controls to identify, estimate, and reduce improper payments, but that significant challenges remain to effectively achieve the goals of IPIA. Improvements Needed in Agencies' Reporting of Improper Payment Information: Our review of agencies' reporting of select improper payment information identified that improvements are still needed to fully address improper payment reporting requirements. Of the 35 fiscal year 2005 agency PARs or annual reports included in our review, 23 agencies reported they had performed risk assessments of all of their programs and activities. However, the results of certain agencies' risk assessments appear questionable. For example, agency management at DOJ and DHS reported that based on their risk assessments, no risk- susceptible programs were identified. Yet, these agencies' auditors cited agency noncompliance with IPIA in their fiscal year 2005 annual audit reports, primarily caused by inadequate risk assessments. Eighteen of the 35 agencies reported improper payment estimates totaling in excess of $38 billion for some or all of their high-risk programs in fiscal year 2005. Of the 18 agencies, 14 reported having one or more programs with improper payment estimates that exceeded $10 million, and thus were required to implement plans to reduce improper payments and report on actions taken.[Footnote 20] Based on our review of these key improper payment reporting requirements, we generally found that the applicable agencies reported this information for one or more of their programs in their PARs as required. However, the extent and details of reporting varied among the agencies. For example, the Office of Personnel Management (OPM) addressed the manager accountability reporting requirement in one sentence for its risk- susceptible programs, while USDA and the Department of Veterans Affairs (VA) provided information on how each program manager was held accountable for each high-risk program identified. Six different agencies reported that the responsibility for improper payments is included in management's performance plans; however, specific details were not discussed. IPIA and OMB's implementing guidance require agencies to annually review and identify programs susceptible to significant improper payments, estimate the amount of their improper payments, and report on the amount of their improper payments and their actions to reduce improper payments. OMB requires the results of these steps to be reported in the agencies' PARs, in the Management Discussion and Analysis section and as a separate appendix for each fiscal year ending on or after September 30, 2004. Figure 1 provides an overview of the four key steps OMB requires agencies to perform in meeting the improper payment reporting requirements. Figure 1: Required Steps to Identify, Estimate, Reduce, and Report Improper Payment Information: [See PDF for image] - graphic text: Source: GAO. [End of figure] - graphic text: Agencies must estimate improper payments for each susceptible program identified during the risk assessment process. In addition, agency programs that were included in former section 57 of OMB Circular No. A- 11 must estimate improper payments even if the estimate does not exceed $10 million and 2.5 percent of program payments. Further, some agency programs voluntarily reported an improper payment estimate or other improper payment information. When the program improper payment estimates exceed $10 million, agencies are required to report on various actions they are taking to reduce improper payments, such as determining causes of improper payments and taking corrective actions and ensuring manager accountability, and statutory barriers that limit corrective actions to reduce improper payments. To address these three reporting requirements, OMB requires agencies to report the following information in their PARs: * Causes of improper payments and corrective action. A discussion of the causes of the improper payments identified, actions taken to correct those causes, and results of the actions taken to address those causes. * Manager accountability. A description of the steps (including timeline) the agency has taken and plans to take to ensure that agency managers (including the agency head) are held accountable for reducing and recovering erroneous payments. * Statutory barriers. A description of any statutory or regulatory barriers that may limit the agency's corrective actions in reducing erroneous payments. Results of Selected Agencies' Risk Assessments Appear Questionable: Figure 2: Improper Payments--Step 1: [See PDF for image] Source: GAO. [End of figure] Of the 35 fiscal year 2005 agency PARs or annual reports included in our review, 23, the same number of agencies that reported having risk assessments in our prior year review, reported they had performed risk assessments of all of their programs and activities. The remaining 12 agencies either did not report this information in their PARs or annual reports, or included some improper payment details in their PARs, but did not report assessing for the risk of improper payments for all of their programs and activities. Table 1 indicates for each of the 35 whether the agency reported having assessed all programs and activities. Table 1: Agency Reporting of Risk Assessments Performed for All Programs and Activities: 1; Department or agency: Agency for International Development; Agency reported it had assessed all programs and activities: [Empty]. 2; Department or agency: Department of Agriculture; Agency reported it had assessed all programs and activities: X. 3; Department or agency: Department of Commerce; Agency reported it had assessed all programs and activities: X. 4; Department or agency: Department of Defense; Agency reported it had assessed all programs and activities: X. 5; Department or agency: Department of Education; Agency reported it had assessed all programs and activities: X. 6; Department or agency: Department of Energy; Agency reported it had assessed all programs and activities: X. 7; Department or agency: Environmental Protection Agency Agency reported it had assessed all programs and activities: [Empty]. 8; Department or agency: Export-Import Bank of the United States; Agency reported it had assessed all programs and activities: [Empty]. 9; Department or agency: Farm Credit System Insurance Corporation; Agency reported it had assessed all programs and activities: [Empty]. 10; Department or agency: Federal Communications Commission; Agency reported it had assessed all programs and activities: X. 11; Department or agency: Federal Deposit Insurance Corporation; Agency reported it had assessed all programs and activities: [Empty]. 12; Department or agency: General Services Administration; Agency reported it had assessed all programs and activities: X. 13; Department or agency: Department of Health and Human Services; Agency reported it had assessed all programs and activities: X. 14; Department or agency: Department of Homeland Security; Agency reported it had assessed all programs and activities: X. 15; Department or agency: Department of Housing and Urban Development; Agency reported it had assessed all programs and activities: X. 16; Department or agency: Department of the Interior; Agency reported it had assessed all programs and activities: X. 17; Department or agency: Department of Justice; Agency reported it had assessed all programs and activities: [Empty]. 18; Department or agency: Department of Labor; Agency reported it had assessed all programs and activities: X. 19; Department or agency: National Aeronautics and Space Administration; Agency reported it had assessed all programs and activities: X. 20; Department or agency: National Credit Union Administration; Agency reported it had assessed all programs and activities: [Empty]. 21; Department or agency: National Science Foundation; Agency reported it had assessed all programs and activities: X. 22; Department or agency: Nuclear Regulatory Commission; Agency reported it had assessed all programs and activities: X. 23; Department or agency: Office of Personnel Management; Agency reported it had assessed all programs and activities: X. 24; Department or agency: Pension Benefit Guaranty Corporation; Agency reported it had assessed all programs and activities: [Empty]. 25; Department or agency: U.S. Postal Service; Agency reported it had assessed all programs and activities: [Empty]. 26; Department or agency: Railroad Retirement Board; Agency reported it had assessed all programs and activities: X. 27; Department or agency: Securities and Exchange Commission; Agency reported it had assessed all programs and activities: [Empty]. 28; Department or agency: Small Business Administration; Agency reported it had assessed all programs and activities: X. 29; Department or agency: Smithsonian Institution; Agency reported it had assessed all programs and activities: [Empty]. 30; Department or agency: Social Security Administration; Agency reported it had assessed all programs and activities: X. 31; Department or agency: Department of State; Agency reported it had assessed all programs and activities: X. 32; Department or agency: Tennessee Valley Authority; Agency reported it had assessed all programs and activities: [Empty]. 33; Department or agency: Department of Transportation; Agency reported it had assessed all programs and activities: X. 34; Department or agency: Department of the Treasury; Agency reported it had assessed all programs and activities: X. 35; Department or agency: Department of Veterans Affairs; Agency reported it had assessed all programs and activities: X. Total; Agency reported it had assessed all programs and activities: 23. Source: GAO analysis of cited agencies' fiscal year 2005 PARs and annual reports. [End of table] The first step in OMB's implementing guidance requires agencies' use of a systematic method, also known as a risk assessment, to annually review and identify those programs and activities that are susceptible to significant improper payments. Although OMB's guidance identifies the scope of payments agencies are to review, such as federal awards made by recipients and subrecipients subject to the Single Audit Act, as amended,[Footnote 21] it does not provide agencies detailed information on how to conduct a risk assessment in order to adequately carry out their responsibilities to meet the requirements of the act. Specifically, we found that OMB's guidance lacks a description of the common types of risk factors agencies should consider when annually reviewing their programs, such as program complexity; operational changes; and findings from investigative, financial statement, and performance audit reports. Developing such a framework would begin the process to effectively identify and target high-risk areas within a program and better position agencies as they determine which control activities to implement to reduce risks and ultimately reduce fraud and errors. Risk assessment is a key step in gaining assurance that programs are operating as intended and that they are achieving their expected outcomes. Done properly, it entails a comprehensive review and analysis of program operations to determine if risks exist, what those risks are, and the potential or actual impact of those risks on program operations. The information developed during a risk assessment forms the foundation or basis upon which management can determine the nature and type of corrective actions needed. It also gives management baseline information for measuring progress in reducing improper payments. In performing a risk assessment, management should consider all significant interactions between the entity and other parties as well as internal factors at both the entitywide and program levels. The specific risk assessment methodology used can vary by organization because of differences in missions and the methods used in assigning risk levels. Risk identification methods often include qualitative and quantitative ranking activities, management conferences, forecasting and strategic planning, and consideration of findings from audits and other assessments. Because governmental, economic, and operating conditions continually change, risk assessments should be periodically updated to identify and deal with any special risks prompted by such changes. Although 23 agencies reported meeting this requirement for all of their programs and activities, other readily available information suggests to us that the adequacy of agencies' risk assessments was questionable. For example, auditors for DOJ and DHS cited agency noncompliance with IPIA in their fiscal year 2005 annual audit reports, primarily caused by inadequate risk assessments. The DOJ auditor stated that one agency component had not established a program to assess, identify, and track improper payments. The DHS auditors reported that the department did not institute a systematic method of reviewing all programs and identifying those it believed were susceptible to significant erroneous payments. This was the second consecutive year that the auditor reported IPIA noncompliance for DHS. Although the auditors identified the agency's risk assessment methodology as inadequate, DHS again reported in its PAR that it had assessed all of its programs for risk and found none susceptible to significant improper payments. However, existing significant financial management weaknesses at these agencies highlight visible, well-known risks for improper payments. For example, DHS continues to face significant financial management weaknesses as illustrated by previous reviews of the Federal Emergency Management Agency's (FEMA)--a DHS component--Individuals and Households Program (IHP). In November 2005, DHS received a disclaimer of opinion on its fiscal year 2005 balance sheet and its fiscal year 2004 consolidated financial statements,[Footnote 22] primarily because of financial reporting problems. DHS's auditors cited 10 material weaknesses;[Footnote 23] 2 other reportable conditions in internal controls; and 7 instances of noncompliance with applicable laws and regulations, 1 of those being noncompliance with IPIA, as mentioned previously. The DHS OIG cited disaster response and recovery as one of DHS's major management challenges for that year. In May 2005, the DHS OIG reported[Footnote 24] weaknesses in DHS's IHP program, including inspection and verification of losses reported by individuals related to the 2004 hurricane season as well as eligibility issues. Subsequently, in July 2005, the Senate Committee on Homeland Security and Governmental Affairs released its investigation results of FEMA's response to the 2004 Florida hurricanes, in particular, Hurricane Frances, and found similar weaknesses in FEMA's IHP program. In discussing its risk assessment methodology, DHS reported that FEMA's IHP might be at high risk for issuing improper payments as a result of the weaknesses identified in the DHS OIG report and performed a second round of testing of its fiscal year 2004 disbursements. From its test results, DHS concluded that its estimate of improper payments for the IHP did not meet OMB's criteria of exceeding $10 million and 2.5 percent of program payments. DHS reported that IHP would receive closer scrutiny and undergo an independent payment review in fiscal year 2006, but that its sample payment testing did not show the program to be at high risk for improper payments. Our recent review of FEMA's IHP shows a dramatically different result. In our June 2006 report,[Footnote 25] we estimated improper payments related to FEMA's IHP of about $1 billion as of February 2006, related to individual assistance payments in response to hurricanes Katrina and Rita that occurred in 2005. This amount represents 16 percent of the IHP payments. For example, we determined that millions of dollars in expedited and housing assistance payments went to registrants who provided the names and Social Security numbers of individuals incarcerated in federal and state prisons during the hurricanes. In addition, FEMA improperly paid individuals twice for their lodging-- paying both hotels and rental assistance. Also, FEMA could not establish that 750 debit cards worth $1.5 million went to Hurricane Katrina victims. We noted risk assessment deficiencies at other agencies as well. The USDA OIG reported[Footnote 26] that the agency's risk assessments were not adequate to estimate the agencies' susceptibility to improper payments because the guidance from the USDA's OCFO was not sufficiently prescriptive and detailed to translate into meaningful results. As such, the OIG recommended that USDA OCFO strengthen guidance over its IPIA risk assessments to provide reasonable assurance that the requirements of the act are met. Further, the OIG stated that USDA should identify risk factors that are discrete to the program being assessed and consider information from all sources, such as audit reports. In another example, Treasury's OIG reported[Footnote 27] that it planned to evaluate whether the agency's current process is effectively identifying and reducing erroneous payments, which further validates our concern that agencies' risk assessments may not be appropriately identifying a complete universe of programs and activities that are susceptible to significant improper payments. In our previous report[Footnote 28] on agencies' fiscal year 2004 improper payment reporting, we recommended that OMB require those agencies that did not address the IPIA requirements or did not perform risk assessments of all of their programs and activities to establish time frames and identify resources needed to perform risk assessments and satisfy reporting requirements. We also recommended that OMB develop a plan to address the resource needs of those agencies that did not perform risk assessments or satisfy reporting requirements. In response to our recommendations, OMB stated that pursuant to the PMA initiative--Eliminating Improper Payments--federal agencies were already required to submit relevant time frames and account for the resources necessary to complete planned actions. Furthermore, OMB stated that the remaining risk assessments to be completed, not covered by the PMA initiative, correlated to programs with relatively small outlays. As we stated in our March 2005 report, while we view the PMA initiative as a positive action, it applies to only 15 agencies--the 14 agencies that were previously required to report improper payments information under OMB Circular No. A-11 and DHS. However, this is not a comprehensive list because it does not include the remaining executive branch agencies covered under IPIA that are, to some extent, required to address improper payments for their programs and activities. Thus, agencies not included in the PMA initiative would not be required to establish time frames and account for needed resources under that effort. Therefore, we reaffirm our previous recommendations that OMB require those agencies that did not address the IPIA requirements or did not perform risk assessments for all of their programs and activities to establish time frames and identify resources needed to perform risk assessments and satisfy reporting requirements and that OMB develop a plan to address the resource needs of those agencies that did not perform risk assessments or satisfy reporting requirements. Only a Limited Number of Agencies Are Estimating Improper Payments: Figure 3: Improper Payments--Step 2: [See PDF for image] Source: GAO. [End of figure] Agencies must estimate improper payments for each risk-susceptible program identified during the risk assessment process. Of the 35 agencies, 18 agencies accounting for 57 programs reported improper payment estimates totaling in excess of $38 billion for some or all of their high-risk programs. (See app. II for further details.) Included in this estimate were 17 newly reported programs in 10 agencies, totaling about $1.2 billion for fiscal year 2005. The total improper payment estimate of $38 billion represents approximately 2 percent of the total fiscal year 2005 government outlays of $2.5 trillion. For the remaining 17 agencies that did not report estimates, 8 said they did not have any programs susceptible to significant improper payments, 8 were silent about whether they had programs susceptible to significant improper payments, and the remaining agency identified programs susceptible to significant improper payments and said it planned to report an estimate by fiscal year 2007. Further details are included in table 2. Table 2: Agency Improper Payment Estimate Reporting in Fiscal Year 2005: 1; Department or agency: Agency for International Development; Agency reported estimate for one or more programs: [Empty]; Agency did not report estimate: Agency reported that no programs were susceptible to significant improper payments: [Empty]; Agency did not report estimate: Agency silent as to whether it had programs susceptible to significant improper payments: X; Agency did not report estimate: Agency reported future date to report estimate: [Empty]. 2; Department or agency: Department of Agriculture; Agency reported estimate for one or more programs: X; Agency did not report estimate: Agency reported that no programs were susceptible to significant improper payments: [Empty]; Agency did not report estimate: Agency silent as to whether it had programs susceptible to significant improper payments: [Empty]; Agency did not report estimate: Agency reported future date to report estimate: [Empty]. 3; Department or agency: Department of Commerce; Agency reported estimate for one or more programs: [Empty]; Agency did not report estimate: Agency reported that no programs were susceptible to significant improper payments: X; Agency did not report estimate: Agency silent as to whether it had programs susceptible to significant improper payments: [Empty]; Agency did not report estimate: Agency reported future date to report estimate: [Empty]. 4; Department or agency: Department of Defense; Agency reported estimate for one or more programs: X; Agency did not report estimate: Agency reported that no programs were susceptible to significant improper payments: [Empty]; Agency did not report estimate: Agency silent as to whether it had programs susceptible to significant improper payments: [Empty]; Agency did not report estimate: Agency reported future date to report estimate: [Empty]. 5; Department or agency: Department of Education; Agency reported estimate for one or more programs: X; Agency did not report estimate: Agency reported that no programs were susceptible to significant improper payments: [Empty]; Agency did not report estimate: Agency silent as to whether it had programs susceptible to significant improper payments: [Empty]; Agency did not report estimate: Agency reported future date to report estimate: [Empty]. 6; Department or agency: Department of Energy; Agency reported estimate for one or more programs: X; Agency did not report estimate: Agency reported that no programs were susceptible to significant improper payments: [Empty]; Agency did not report estimate: Agency silent as to whether it had programs susceptible to significant improper payments: [Empty]; Agency did not report estimate: Agency reported future date to report estimate: [Empty]. 7; Department or agency: Environmental Protection Agency; Agency reported estimate for one or more programs: X; Agency did not report estimate: Agency reported that no programs were susceptible to significant improper payments: [Empty]; Agency did not report estimate: Agency silent as to whether it had programs susceptible to significant improper payments: [Empty]; Agency did not report estimate: Agency reported future date to report estimate: [Empty]. 8; Department or agency: Export-Import Bank of the United States; Agency reported estimate for one or more programs: [Empty]; Agency did not report estimate: Agency reported that no programs were susceptible to significant improper payments: [Empty]; Agency did not report estimate: Agency silent as to whether it had programs susceptible to significant improper payments: X; Agency did not report estimate: Agency reported future date to report estimate: [Empty]. 9; Department or agency: Farm Credit System Insurance Corporation; Agency reported estimate for one or more programs: [Empty]; Agency did not report estimate: Agency reported that no programs were susceptible to significant improper payments: [Empty]; Agency did not report estimate: Agency silent as to whether it had programs susceptible to significant improper payments: X; Agency did not report estimate: Agency reported future date to report estimate: [Empty]. 10; Department or agency: Federal Communications Commission; Agency reported estimate for one or more programs: [Empty]; Agency did not report estimate: Agency reported that no programs were susceptible to significant improper payments: [Empty]; Agency did not report estimate: Agency silent as to whether it had programs susceptible to significant improper payments: [Empty]; Agency did not report estimate: Agency reported future date to report estimate: X. 11; Department or agency: Federal Deposit Insurance Corporation; Agency reported estimate for one or more programs: [Empty]; Agency did not report estimate: Agency reported that no programs were susceptible to significant improper payments: [Empty]; Agency did not report estimate: Agency silent as to whether it had programs susceptible to significant improper payments: X; Agency did not report estimate: Agency reported future date to report estimate: [Empty]. 12; Department or agency: General Services Administration; Agency reported estimate for one or more programs: [Empty]; Agency did not report estimate: Agency reported that no programs were susceptible to significant improper payments: X; Agency did not report estimate: Agency silent as to whether it had programs susceptible to significant improper payments: [Empty]; Agency did not report estimate: Agency reported future date to report estimate: [Empty]. 13; Department or agency: Department of Health and Human Services; Agency reported estimate for one or more programs: X; Agency did not report estimate: Agency reported that no programs were susceptible to significant improper payments: [Empty]; Agency did not report estimate: Agency silent as to whether it had programs susceptible to significant improper payments: [Empty]; Agency did not report estimate: Agency reported future date to report estimate: [Empty]. 14; Department or agency: Department of Homeland Security; Agency reported estimate for one or more programs: [Empty]; Agency did not report estimate: Agency reported that no programs were susceptible to significant improper payments: X; Agency did not report estimate: Agency silent as to whether it had programs susceptible to significant improper payments: [Empty]; Agency did not report estimate: Agency reported future date to report estimate: [Empty]. 15; Department or agency: Department of Housing and Urban Development; Agency reported estimate for one or more programs: X; Agency did not report estimate: Agency reported that no programs were susceptible to significant improper payments: [Empty]; Agency did not report estimate: Agency silent as to whether it had programs susceptible to significant improper payments: [Empty]; Agency did not report estimate: Agency reported future date to report estimate: [Empty]. 16; Department or agency: Department of the Interior; Agency reported estimate for one or more programs: [Empty]; Agency did not report estimate: Agency reported that no programs were susceptible to significant improper payments: X; Agency did not report estimate: Agency silent as to whether it had programs susceptible to significant improper payments: [Empty]; Agency did not report estimate: Agency reported future date to report estimate: [Empty]. 17; Department or agency: Department of Justice; Agency reported estimate for one or more programs: [Empty]; Agency did not report estimate: Agency reported that no programs were susceptible to significant improper payments: X; Agency did not report estimate: Agency silent as to whether it had programs susceptible to significant improper payments: [Empty]; Agency did not report estimate: Agency reported future date to report estimate: [Empty]. 18; Department or agency: Department of Labor; Agency reported estimate for one or more programs: X; Agency did not report estimate: Agency reported that no programs were susceptible to significant improper payments: [Empty]; Agency did not report estimate: Agency silent as to whether it had programs susceptible to significant improper payments: [Empty]; Agency did not report estimate: Agency reported future date to report estimate: [Empty]. 19; Department or agency: National Aeronautics and Space Administration; Agency reported estimate for one or more programs: [Empty]; Agency did not report estimate: Agency reported that no programs were susceptible to significant improper payments: X; Agency did not report estimate: Agency silent as to whether it had programs susceptible to significant improper payments: [Empty]; Agency did not report estimate: Agency reported future date to report estimate: [Empty]. 20; Department or agency: National Credit Union Administration; Agency reported estimate for one or more programs: [Empty]; Agency did not report estimate: Agency reported that no programs were susceptible to significant improper payments: [Empty]; Agency did not report estimate: Agency silent as to whether it had programs susceptible to significant improper payments: X; Agency did not report estimate: Agency reported future date to report estimate: [Empty]. 21; Department or agency: National Science Foundation; Agency reported estimate for one or more programs: X; Agency did not report estimate: Agency reported that no programs were susceptible to significant improper payments: [Empty]; Agency did not report estimate: Agency silent as to whether it had programs susceptible to significant improper payments: [Empty]; Agency did not report estimate: Agency reported future date to report estimate: [Empty]. 22; Department or agency: Nuclear Regulatory Commission; Agency reported estimate for one or more programs: [Empty]; Agency did not report estimate: Agency reported that no programs were susceptible to significant improper payments: X; Agency did not report estimate: Agency silent as to whether it had programs susceptible to significant improper payments: [Empty]; Agency did not report estimate: Agency reported future date to report estimate: [Empty]. 23; Department or agency: Office of Personnel Management; Agency reported estimate for one or more programs: X; Agency did not report estimate: Agency reported that no programs were susceptible to significant improper payments: [Empty]; Agency did not report estimate: Agency silent as to whether it had programs susceptible to significant improper payments: [Empty]; Agency did not report estimate: Agency reported future date to report estimate: [Empty]. 24; Department or agency: Pension Benefit Guaranty Corporation; Agency reported estimate for one or more programs: [Empty]; Agency did not report estimate: Agency reported that no programs were susceptible to significant improper payments: [Empty]; Agency did not report estimate: Agency silent as to whether it had programs susceptible to significant improper payments: X; Agency did not report estimate: Agency reported future date to report estimate: [Empty]. 25; Department or agency: U.S. Postal Service; Agency reported estimate for one or more programs: [Empty]; Agency did not report estimate: Agency reported that no programs were susceptible to significant improper payments: [Empty]; Agency did not report estimate: Agency silent as to whether it had programs susceptible to significant improper payments: X; Agency did not report estimate: Agency reported future date to report estimate: [Empty]. 26; Department or agency: Railroad Retirement Board; Agency reported estimate for one or more programs: X; Agency did not report estimate: Agency reported that no programs were susceptible to significant improper payments: [Empty]; Agency did not report estimate: Agency silent as to whether it had programs susceptible to significant improper payments: [Empty]; Agency did not report estimate: Agency reported future date to report estimate: [Empty]. 27; Department or agency: Securities and Exchange Commission; Agency reported estimate for one or more programs: [Empty]; Agency did not report estimate: Agency reported that no programs were susceptible to significant improper payments: X; Agency did not report estimate: Agency silent as to whether it had programs susceptible to significant improper payments: [Empty]; Agency did not report estimate: Agency reported future date to report estimate: [Empty]. 28; Department or agency: Small Business Administration; Agency reported estimate for one or more programs: X; Agency did not report estimate: Agency reported that no programs were susceptible to significant improper payments: [Empty]; Agency did not report estimate: Agency silent as to whether it had programs susceptible to significant improper payments: [Empty]; Agency did not report estimate: Agency reported future date to report estimate: [Empty]. 29; Department or agency: Smithsonian Institution; Agency reported estimate for one or more programs: [Empty]; Agency did not report estimate: Agency reported that no programs were susceptible to significant improper payments: [Empty]; Agency did not report estimate: Agency silent as to whether it had programs susceptible to significant improper payments: X; Agency did not report estimate: Agency reported future date to report estimate: [Empty]. 30; Department or agency: Social Security Administration; Agency reported estimate for one or more programs: X; Agency did not report estimate: Agency reported that no programs were susceptible to significant improper payments: [Empty]; Agency did not report estimate: Agency silent as to whether it had programs susceptible to significant improper payments: [Empty]; Agency did not report estimate: Agency reported future date to report estimate: [Empty]. 31; Department or agency: Department of State; Agency reported estimate for one or more programs: X; Agency did not report estimate: Agency reported that no programs were susceptible to significant improper payments: [Empty]; Agency did not report estimate: Agency silent as to whether it had programs susceptible to significant improper payments: [Empty]; Agency did not report estimate: Agency reported future date to report estimate: [Empty]. 32; Department or agency: Tennessee Valley Authority; Agency reported estimate for one or more programs: X; Agency did not report estimate: Agency reported that no programs were susceptible to significant improper payments: [Empty]; Agency did not report estimate: Agency silent as to whether it had programs susceptible to significant improper payments: [Empty]; Agency did not report estimate: Agency reported future date to report estimate: [Empty]. 33; Department or agency: Department of Transportation; Agency reported estimate for one or more programs: X; Agency did not report estimate: Agency reported that no programs were susceptible to significant improper payments: [Empty]; Agency did not report estimate: Agency silent as to whether it had programs susceptible to significant improper payments: [Empty]; Agency did not report estimate: Agency reported future date to report estimate: [Empty]. 34; Department or agency: Department of the Treasury; Agency reported estimate for one or more programs: X; Agency did not report estimate: Agency reported that no programs were susceptible to significant improper payments: [Empty]; Agency did not report estimate: Agency silent as to whether it had programs susceptible to significant improper payments: [Empty]; Agency did not report estimate: Agency reported future date to report estimate: [Empty]. 35; Department or agency: Department of Veterans Affairs; Agency reported estimate for one or more programs: X; Agency did not report estimate: Agency reported that no programs were susceptible to significant improper payments: [Empty]; Agency did not report estimate: Agency silent as to whether it had programs susceptible to significant improper payments: [Empty]; Agency did not report estimate: Agency reported future date to report estimate: [Empty]. Total; Agency reported estimate for one or more programs: 18; Agency did not report estimate: Agency reported that no programs were susceptible to significant improper payments: 8; Agency did not report estimate: Agency silent as to whether it had programs susceptible to significant improper payments: 8; Agency did not report estimate: Agency reported future date to report estimate: 1. Source: GAO analysis of cited agencies' fiscal year 2005 PARs and annual reports. [End of table] Step 2 of OMB's guidance requires agencies to estimate the annual amount of improper payments for those programs susceptible to significant improper payments. Unless previously approved by OMB, this estimate must be based on a statistically valid sampling methodology[Footnote 29] and should include a gross total of both over- and underpayments. In its Circular No. A-136, OMB encourages agencies to break out over-and underpayments as part of its improper payment reporting, if available. Of the 57 programs for which an estimate was reported for fiscal year 2005, a breakout between over-and underpayments was provided for 20 programs. This included 6 of the 7 largest programs that according to OMB, make up 95 percent of the current total improper payment estimate.[Footnote 30] Treasury's Earned Income Tax Credit (EITC) program, the second largest program constituting the reported improper payment total, is the only program of the 7 largest that did not do so. Of the 20 programs, 3 attributed all their improper payments to overpayments. For example, the USDA's Marketing Assistance Loan Program reported an improper payment estimate of about $45 million. USDA reported that the entire estimate resulted from overpayments made. For more details related to over-and underpayment estimates, see appendix III. We also found that agencies' auditors identified challenges with certain program's improper payment estimates. USDA's OIG reported that it considers USDA's efforts to develop supportable methodologies to detect and estimate the extent of improper payments as a major challenge because of the number and complexity of USDA programs and activities that are subject to IPIA. In another example, agency auditors for the Department of Education (Education) raised concerns about the methodology Education used to estimate improper payments for its Federal Student Aid (FSA) program. The auditors reported that the methodology used did not provide a true reflection of the magnitude of improper payments in the student loan programs. Specifically, FSA's estimate is primarily based on actual questioned costs from OIG audits, does not extrapolate questioned costs associated with compliance violations identified through OIG audits, and does not take into account restitutions and penalties resulting from OIG investigations. To address improper payment estimating challenges, it will be critical that agencies follow existing OMB guidance to use a statistically valid sampling methodology. The Extent and Level of Detail Related to Selected Reporting Requirements Varied: Figure 4: Improper Payments--Step 3: [See PDF for image] Source: GAO. [End of figure] As previously mentioned, 18 of the 35 agencies reported over $38 billion of improper payments. Of the 18 agencies, 14 reported improper payment estimates that exceeded $10 million[Footnote 31] for one or more programs, and therefore were required to implement plans to reduce improper payments under step 3 of OMB's guidance. Figure 5: Improper Payments--Step 4: [See PDF for image] - graphic text: Source: GAO. [End of figure] - graphic text: Based on these plans, under step 4 of OMB's implementing guidance agencies are required to report on various elements, such as a description of (1) the steps (including time line) the agency has taken and plans to take to ensure that agency managers (including the agency head) are held accountable for reducing and recovering erroneous payments and (2) any statutory or regulatory barriers that may limit the agency's corrective actions in reducing improper payments and any statutory or regulatory barriers that may limit the agencies' corrective actions in reducing improper payments. In addition, the 14 agencies with estimated improper payments greater than $10 million were required to report in their PARs or annual reports on the above elements as well as other areas, such as the causes of the improper payments, actions taken to correct those causes, and the results of those actions and additional reporting requirements. Generally, these agencies reported on their actions to address the additional reporting requirements in their PARs; however, the extent and details of reporting varied among agencies. Although not all of the agencies in table 3 provided meaningful descriptions for each of the additional reporting requirements, our table acknowledges all agencies that at least mentioned these reporting elements as part of their improper payment reporting. The results of agencies' reporting on these key elements are discussed in more detail in the following sections. Table 3: Agency Reporting of Certain Reporting Requirements for One or More of Its Programs: 1; Department or agency: Department of Agriculture; Agency reported on causes and corrective actions: X; Agency reported on manager accountability: X; Agency reported on statutory barriers: X. 2; Department or agency: Department of Defense; Agency reported on causes and corrective actions: X; Agency reported on manager accountability: X; Agency reported on statutory barriers: X. 3; Department or agency: Department of Education; Agency reported on causes and corrective actions: X; Agency reported on manager accountability: X; Agency reported on statutory barriers: X. 4; Department or agency: Department of Energy; Agency reported on causes and corrective actions: [Empty]; Agency reported on manager accountability: [Empty]; Agency reported on statutory barriers: [Empty]. 5; Department or agency: Department of Health and Human Services; Agency reported on causes and corrective actions: X; Agency reported on manager accountability: X; Agency reported on statutory barriers: X. 6; Department or agency: Department of Housing and Urban Development; Agency reported on causes and corrective actions: X; Agency reported on manager accountability: X; Agency reported on statutory barriers: [Empty]. 7; Department or agency: Department of Labor; Agency reported on causes and corrective actions: X; Agency reported on manager accountability: X; Agency reported on statutory barriers: X. 8; Department or agency: Office of Personnel Management; Agency reported on causes and corrective actions: X; Agency reported on manager accountability: X; Agency reported on statutory barriers: X. 9; Department or agency: Railroad Retirement Board; Agency reported on causes and corrective actions: X; Agency reported on manager accountability: X; Agency reported on statutory barriers: [Empty]. 10; Department or agency: Small Business Administration; Agency reported on causes and corrective actions: X; Agency reported on manager accountability: X; Agency reported on statutory barriers: [Empty]. 11; Department or agency: Social Security Administration; Agency reported on causes and corrective actions: X; Agency reported on manager accountability: X; Agency reported on statutory barriers: X. 12; Department or agency: Tennessee Valley Authority; Agency reported on causes and corrective actions: X; Agency reported on manager accountability: X; Agency reported on statutory barriers: [Empty]. 13; Department or agency: Department of the Treasury; Agency reported on causes and corrective actions: X; Agency reported on manager accountability: X; Agency reported on statutory barriers: X. 14; Department or agency: Department of Veterans Affairs; Agency reported on causes and corrective actions: X; Agency reported on manager accountability: X; Agency reported on statutory barriers: X. Total; Agency reported on causes and corrective actions: 13; Agency reported on manager accountability: 13; Agency reported on statutory barriers: 9. Source: GAO analysis of cited agencies' fiscal year 2005 PARs or annual reports. [End of table] Causes of Improper Payments and Corrective Action Plans: Table 3 shows that 13 of the 14 agencies required to report on the causes of program improper payments and any associated corrective actions did so. Looking at this from a qualitative perspective, we noted that some agencies provided few details on the causes and corrective actions taken, while others provided detailed descriptions at the program level. For example, the Department of Labor (Labor) reported that the causes of improper payments for its Unemployment Insurance program resulted from claimants who continue to claim benefits despite having returned to work as well as coding errors that identify why the claimant separated from work. In contrast, the Small Business Administration (SBA) reported that it was planning to identify and track reasons for improper payments for one of its high-risk programs, but had not yet done so. Similarly, HHS did not list causes of improper payments for several of its risk-susceptible programs, although it provided detailed corrective actions for reducing improper payments. When no causes are reported, they sometimes can be inferred based on the descriptions of the corrective actions. However, without fully knowing what causes improper payments, it may be difficult for the agency to determine what types of internal control need to be implemented or changed and if the corrective actions in place will be effective in reducing improper payments. As agencies identify causes of improper payments, they can implement control activities to address identified risk areas and help ensure that management's decisions and plans are carried out and program objectives are met. Manager Accountability: All but 1 of the 14 agencies also reported on efforts related to assigning and holding managers accountable for reducing improper payments. The remaining agency did not address this reporting requirement in its PAR. Generally, improper payments result from a lack of or inadequate system of internal control, but some result from program design issues. A key component of internal control is the control environment. A strong control environment is fundamental in creating a culture of accountability by establishing a positive and supportive attitude toward improvement and the achievement of established program outcomes, including protecting taxpayer interests in program integrity. Similar to agencies' reporting on causes and corrections, we also found that agencies' reporting on the manager accountability requirement varied. For example, OPM addressed the manager accountability reporting requirement in one sentence for its risk-susceptible programs while USDA and VA provided information on how each program manager was held accountable for the high-risk programs identified. Furthermore, six different agencies reported that the responsibility for improper payments is included in management's performance plans; however, specific details were not disclosed. For example, the Railroad Retirement Board (RRB) reported that agency managers' performance plans are linked to RRB's strategic goals of paying benefits accurately and timely and providing prudent stewardship over the trust funds. Statutory or Regulatory Barriers: Of the 14 agencies required to report on any statutory or regulatory[Footnote 32] barriers, 9 agencies identified such barriers that may limit corrective actions to reduce improper payments. The remaining 5 agencies[Footnote 33] were silent as to whether any statutory or regulatory barriers existed or reported that no barriers had been identified. Agencies cited various barriers that restrict their ability to better manage their programs against improper payments. We classified the reported barriers into five categories: (1) data matching, (2) contractual requirements, (3) state-administered program structure, (4) recovery auditing, and (5) other. We also identified agencies that reported barriers that were not related to a statute or regulation. Table 4 summarizes the statutory barriers agencies reported and, when provided, the legislation or regulation citation related to the barriers. Table 4: Agency-Reported Statutory Barriers to Reducing Improper Payments: Agency: Department of Agriculture; Type of barrier(s): Data matching, state-administered program structure, recovery auditing; Agency reported law or regulation related to barrier(s): Finality Rule- Department of Agriculture Reorganization Act of 1994, Section 281, generally precludes the use of recovery auditing techniques to recover payments considered final pursuant to 7 U.S.C. 7001(a).[A]; Farm Security and Rural Investment Act of 2002, Section 1502(d)(2), requires the agency to use standards applied under an earlier law, thereby limiting the agency from developing a definition for a particular type of dairy producers.[A]. Agency: Department of Defense; Type of barrier(s): Contractual requirements; Agency reported law or regulation related to barrier(s): The Department of Defense's Retired and Annuitant Pay Service Contract, when awarded, did not include the goals or mandates of IPIA. Any additional work or changes to meet the goals of IPIA would need a contract modification and be subject to Subpart 43.1 of the Federal Acquisition Regulation.[B]. Agency: Department of Education; Type of barrier(s): Data matching; Agency reported law or regulation related to barrier(s): Section 6103 of the Internal Revenue Code concerning confidentiality of the tax return information precludes data matching.[C]. Agency: Department of Health and Human Services; Type of barrier(s): State-administered program structure, other; Agency reported law or regulation related to barrier(s): Temporary Assistance for Needy Families legislation, including funding for Child Care Programs, specifically prohibits HHS from regulating the conduct of states, unless expressly provided. Requiring states to identify and report improper payments is not expressly required.[D]. Agency: Department of Labor; Type of barrier(s): Data matching, state- administered program structure, recovery auditing; Agency reported law or regulation related to barrier(s): Section 3304(a)(4) of the Federal Unemployment Tax Act (FUTA) requires that moneys in the unemployment fund only be withdrawn for benefit payments, precluding the availability of money in the fund to be used for recovery auditing techniques.[ A]. Agency: Office of Personnel Management; Type of barrier(s): Contractual requirements, recovery auditing, other; Agency reported law or regulation related to barrier(s): 5 U.S.C. § 8452 and 5 C.F.R. 844 Subpart C contain the Federal Employees Retirement System (FERS) disability offset provision which mandates that FERS benefits be reduced if the annuitant also receives Social Security benefits. However, the FERS benefits cannot be reduced until Social Security Administration starts paying the disability benefits so that OPM can reduce the FERS benefits to their proper level.[C]; Generally, the Right to Financial Privacy Act (12 U.S.C. §. 3401-3422) requires financial institutions to obtain permission from their customers to disclose financial information. This requirement in effect bars OPM from obtaining posthumous payments information, preventing recovery of improper payments.[C]; OIG lacks statutory or regulatory audit rights and only has limited audit rights in contracts entered into with pharmaceutical benefits managers.[B]. Agency: Social Security Administration; Type of barrier(s): Other; Agency reported law or regulation related to barrier(s): Not cited.[B]. Agency: Department of the Treasury; Type of barrier(s): Other; Agency reported law or regulation related to barrier(s): IRS Tax Code.[E]. Agency: Department of Veterans Affairs; Type of barrier(s): Other; Agency reported law or regulation related to barrier(s): 38 U.S.C. 5112(b)(4)(A)[C] prohibits adjustments to benefit payments until the first of the month after the change in a beneficiary's income. Thus, this creates an overpayment until the benefit payment is adjusted for the change in income; 38 U.S.C. 501(a) and 38 C.F.R. 3.103[C] preclude VA from changing benefit payments when it determines that an adjustment or termination of benefits is needed. VA must continue to make benefit payments based on existing information until a claimant's due process has taken place, which requires giving the claimant 60 days to submit evidence for a claim. This, therefore, usually means VA must continue payment for approximately 90 days after discovery because any adjustments occur the first of the next month. Sources: GAO analysis of cited agencies' fiscal year 2005 PARs or annual reports and OMB. Note: We did not verify whether the legal citation reported actually results in a barrier. [A] Agency provided specific legislative citation in its PAR. [B] Agency did not provide a legislative citation in its PAR or to OMB. [C] Specific legal citation provided by OMB. [D] General legal citation provided by OMB. [E] Agency only provided a general citation in its PAR. [End of table] Only two of the nine agencies mentioning statutory barriers cited the specific law or regulation related to a corresponding barrier in their PARs. The remaining seven agencies described the barrier but did not provide a specific law or regulation in their PARs. For three of these seven agencies, we were able to obtain specific legislative citations for some of the agency-reported barriers from OMB, and included these in table 4. The remaining four agencies did not provide specific legislative citations in their PARs, nor did the agencies provide them when we followed up with OMB. The lack of transparency in agencies' reporting of specific legislative or regulatory barriers impedes the Congress's ability to use its authorization, appropriation, and oversight responsibility to help agencies meet performance goals. The Congress can review the actions taken and regulations formulated by departments and agencies to make certain that program officials appropriately execute the laws. If agencies provide the required information, the Congress can determine whether the public's needs are adequately served by federal programs, and thus take corrective action through legislative changes. As we previously reported,[Footnote 34] it should be recognized that many of these barriers exist as a result of decisions to ensure beneficiary privacy and other data safeguards and the inherent nature of some federal programs. As a result, it may be difficult to eliminate or mitigate these barriers to the point where they no longer restrict agency actions in certain areas to better manage their improper payment problems. Accordingly, federal agencies, the administration, the Congress, and the public must recognize that some level of improper payments will occur because of these public policy decisions. Data matching. Three agencies reported barriers that prevented data matching with other agencies' computer databases to reduce improper payments. For example, Education reported that requirements in the Internal Revenue Code precluded data matching, but that a database match with the Internal Revenue Service (IRS) would likely improve the accuracy of Pell Grant awards. In addition, it would eliminate the need for schools to rely on paper copies of tax returns submitted by applicants, which are used to verify applicants' adjusted gross income and taxes paid. Currently, the schools have limited assurance that the tax returns submitted by the applicants contain the same information that is filed with IRS. However, Education's proposal to amend the Internal Revenue Code to permit a 100 percent database match has not yet been enacted, and Education is uncertain whether or when such legislation may be enacted. As a further illustration, Labor reported that for its Federal Employees' Compensation Act (FECA) program,[Footnote 35] legislation does not currently permit FECA to verify employment earnings with the Social Security Administration (SSA) without the claimant's written permission. Compensation benefits may be overpaid if an employee has unreported earnings and does not grant Labor permission to verify earnings with SSA. Contractual requirements. Two agencies reported contractual requirements as a barrier to reducing improper payments. For example, OPM reported that its OIG has begun an initiative to audit pharmaceutical benefits managers (PBM). However, in some cases, the OIG has only limited audit rights based on the carrier's contracts with the PBMs. To mitigate this, OPM is in the process of revising the Federal Employees Health Benefits Acquisition Regulations to require carriers to provide the OIG complete audit rights in all contracts entered into with PBMs. State-administered program structure. Three agencies reported barriers resulting from the state-administered structure of their programs. For example, Labor reported that by statute, states administer the Unemployment Insurance (UI) program and set operational priorities. Therefore, the agency reported it has limited ability to ensure that the states pursue improper payment reduction activities. In another example, HHS stated that for Medicaid and the State Children's Health Insurance Program, its ability to minimize improper payments was limited in the absence of statutory authority to hold states accountable for meeting targets for the reduction and recovery of improper payments. State-administered programs are particularly vulnerable to improper payments. Generally, the federal government provides broad statutory and regulatory guidelines as well as all or a part of the program funding, while the other entities manage the day-to-day program operations. As such, federal agencies must depend on state, county, and local officials and other entities to ensure that eligibility requirements are met and that benefit amounts are determined correctly. Further, states may have little incentive to ensure that the right amounts go to the right individuals. Recovery auditing. Three agencies reported that their ability to reduce improper payments through recovery auditing techniques was barred by statute. For example, USDA reported that Section 281 of the Department of Agriculture Reorganization Act of 1994 precluded the use of recovery auditing techniques because Section 281 provides that 90 days after the decision of a state, county, or an area committee is final, no action may be taken to recover the amounts found to have been disbursed as a result of the decision in error unless the participant had reason to believe that the decision was erroneous. In another example, Labor stated that Section 3304(a)(4) of the FUTA, which states that moneys in the fund can only be used for benefit payments, precludes using the funding for recovery auditing techniques. Other. Five agencies reported statutory or regulatory barriers that we categorized as other. For example, VA reported that under current legislation, adjustments to payments are effective the first of the month following the month of the change in income or net worth. Additionally, benefits are paid on a prospective basis based on the beneficiary's estimate of anticipated income. Thus, VA stated that an award adjustment because of changes in income is always after the fact and creates an overpayment. Despite this, VA believes this legislation should not be changed since the program meets the requirement to provide income support for current needs. As a second example, OPM stated that if an applicant receives FERS and Social Security disability benefits, then the FERS benefits are statutorily required to be reduced.[Footnote 36] However, OPM cannot reduce the applicant's FERS benefits until it knows the amount of Social Security disability benefits that the applicant receives from SSA. Typically, the applicant receives FERS benefits first and does not start receiving SSA disability benefits until several months later. As a result, OPM makes FERS benefit overpayments to the applicant knowing that it will have to subsequently reduce the FERS benefits to the proper level when SSA starts paying the disability benefits. During our analysis, we also identified two additional agencies that reported barriers in their improper payment information, but these barriers did not result from existing statutory requirements. For example, USDA reported that its program administration of the Food and Nutrition Service is highly decentralized and can involve a myriad of governmental and nongovernmental organizations. This decentralization is a hindrance to the development of robust accountability processes. As another example, Treasury reported several barriers to reducing overpayments in the EITC program, including high program turnover and unscrupulous tax preparers. For the nine agencies that reported statutory or regulatory barriers, five agencies discussed in their PARs actions that they were taking to mitigate the effects of the barriers identified. For example, USDA reported that its Rural Housing Service agency is seeking to overcome a data-matching barrier through legislation that would permit access to HHS's National Directory of New Hires (NDNH) data to allow management agents to use the data to collect and verify the tenant's income documentation. As a second example, Labor reported that Section 3304(a)(4) of FUTA and Section 303(a)(4) of the Social Security Act require that moneys deposited into the UI program must be used for benefits and are precluded from being used for prevention, detection, and recovery of improper payments. Labor has proposed legislation with its fiscal year 2006 budget that would relax the "withdrawal standard" barrier to provide additional funding for recovery initiatives. We also noted that according to OMB's annual improper payments report that six agencies requested legislative intervention in their fiscal year 2007 budget submissions to facilitate better measurement, detection, and elimination of improper payments. For five of these agencies, the legislative intervention addressed some barrier reported in their PARs. For example, Labor proposed a legislative change related to overpayment recoveries in its UI program. According to OMB, the legislative changes provide financial incentives to states to more aggressively pursue benefit overpayments, enlist debt collection agencies, impose penalties for fraud, charge employers when their actions lead to overpayments, and collect delinquent overpayments through garnishment of tax refunds. OMB also noted that these proposed legislative changes would further improve the accuracy of the hiring data in the NDNH by including the actual start work date, thereby improving the detection of potential improper payments. OMB reported that this proposal is projected to save $1.2 billion over 10 years. Improper Payments Estimate Is Understated: The total improper payment estimate of about $38 billion represents almost a $7 billion, or 16 percent, decrease from the $45 billion of improper payments reported by agencies in fiscal year 2004.[Footnote 37] On the surface, this would suggest that significant progress has been made. However, this is not the case because the reported $7 billion reduction in the total improper payments estimate may not reflect improved accountability or strengthened internal controls. As we previously reported in March and April 2006,[Footnote 38] this estimate reduction is primarily attributable to a decrease in HHS's Medicare program improper payment estimate. This decrease mainly resulted from a change to Medicare's estimating methodology rather than from improved payment controls. Regardless of whether prior year estimates were reliable, the reported reduction is unlikely to represent a measurable improvement in internal control and accountability given that HHS's OIG continued to cite the integrity of Medicare payments as a top management challenge in HHS's fiscal year 2005 PAR. As discussed previously, other agency auditors have reported major management challenges that highlight internal control weaknesses that continue to plague programs susceptible to significant improper payments. In some cases, agencies reported that their programs were not susceptible to significant improper payments, despite the fact that the auditor's reports in the same PARs identified major management challenges, including significant internal control weaknesses, for some of the agencies' programs. Also, the total improper payment estimate does not include certain factors that if resolved, would materially increase reports of estimated improper payments. For example, 10 risk-susceptible programs with outlays totaling over $234 billion for fiscal year 2005 did not estimate improper payments, even though OMB required most of these programs to report selected improper payment information several years before IPIA became effective. In addition, we found six agencies that did not use statistical sampling for 9 programs to estimate improper payment amounts. Because nonstatistical sampling methods were used, such as results from Single Audit Act[Footnote 39] reports and internal performance reviews, the $389 million reported represents only the known improper payment amounts reported by agencies. Given that total outlays for these 9 programs exceeded $58.2 billion in fiscal year 2005, the improper payment estimate for these programs would likely have been much greater had statistically valid methods been used. We also found instances where agencies estimated improper payments for only one component of the risk-susceptible program. Using these types of methodologies results in estimates that may be significantly understated. Some Agencies Continue to Lack Improper Payment Estimates for Susceptible Programs: The fiscal year 2005 governmentwide improper payments estimate of $38 billion did not include any amounts for 10 programs, with fiscal year 2005 outlays totaling over $234 billion. OMB had specifically required 7 of these programs to report selected improper payment information for several years before IPIA reporting requirements became effective. After passage of IPIA, OMB's implementing guidance required that these programs continue to report improper payment information under IPIA. The remaining 3 risk-susceptible programs, with no previous reporting requirement, provided target dates for estimating improper payments. As shown in table 5, the fiscal year 2005 improper payment estimate does not include one of the largest federal programs determined to be susceptible to risk, HHS's Medicaid program, with outlays exceeding $181 billion annually. Table 5: Susceptible Programs That Did Not Report Improper Payment Estimates and Target Dates for Estimates: Dollars in billions. Agency/program: Department of Agriculture--School Programs; Fiscal year 2005: outlays: $8.2; Target date for improper payment estimates: 2007; Previously required to estimate: X. Agency/program: Federal Communications Commission--Universal Service Fund's Schools and Libraries; Fiscal year 2005: outlays: 1.7; Target date for improper payment estimates: 2007; Previously required to estimate: [Empty]. Agency/program: Federal Communications Commission--High Cost Support Program; Fiscal year 2005: outlays: 3.8; Target date for improper payment estimates: 2007; Previously required to estimate: [Empty]. Agency/program: Department of Health and Human Services--State Children's Insurance Program; Fiscal year 2005: outlays: 5.1; Target date for improper payment estimates: 2008; Previously required to estimate: X. Agency/program: Department of Agriculture--Women, Infants, and Children; Fiscal year 2005: outlays: 4.8; Target date for improper payment estimates: 2008; Previously required to estimate: X. Agency/program: Department of Health and Human Services--Medicaid; Fiscal year 2005: outlays: 181.7; [Empty]; Target date for improper payment estimates: 2008; Previously required to estimate: X. Department of Agriculture--Child and Adult Care Food Program; Fiscal year 2005: outlays: 2.1; Target date for improper payment estimates: 2010; Previously required to estimate: [Empty]. Agency/program: Department of Health and Human Services--Child Care and Development Fund; Fiscal year 2005: outlays: 4.9; Target date for improper payment estimates: Did not report target date; Previously required to estimate: X. Agency/program: Department of Health and Human Services--Temporary Assistance for Needy Families; Fiscal year 2005: outlays: 17.4; Target date for improper payment estimates: Did not report target date; Previously required to estimate: X. Agency/program: Department of Housing and Urban Development--Community Development Block Grant; Fiscal year 2005: outlays: 5.0; Target date for improper payment estimates: Did not report target date; Previously required to estimate: X. Total; Fiscal year 2005: outlays: $234.7; Target date for improper payment estimates: [Empty]; Previously required to estimate: 7. Sources: OMB and cited agencies' fiscal year 2005 PARs. [End of table] Of these 10 programs, 7 reported that they would be able to estimate and report on improper payments sometime within the next 3 fiscal years, but could not do so for fiscal year 2005. For the remaining 3 programs, the agencies did not estimate improper payment amounts in their fiscal year 2005 PARs and were silent about whether they would report estimates in the future. As a result, improper payments for these programs susceptible to risk will not be known for at least several years, even though 7 of these programs had been required to report this information since 2002, with their fiscal year 2003 budget submissions under previous OMB Circular No. A-11 requirements. OMB reported that some of the agencies were unable to determine the rate or amount of improper payments because of measurement challenges or time and resource constraints, which OMB expects to be resolved in future reporting years. For example, since fiscal year 2002, HHS has conducted pilots at the state level to further its progress toward reporting a national improper payments estimate for its Medicaid program. Each state is responsible for designing and overseeing its own Medicaid program within the federal government structure. This type of program structure presents challenges for implementing a methodology to estimate improper payments as HHS must work with states to obtain applicable documentation used in the calculation. An additional challenge HHS and other agencies with state-administered programs face is the ability to hold states accountable for meeting targets to reduce and recover improper payments in the absence of specific statutory authority. Of the three programs that did not report a target date for estimating, the Department of Housing and Urban Development's (HUD) Community Development Block Grant (CDBG) program was the only one that did not report any actions under way to begin estimating improper payments. In its fiscal year 2005 PAR, HUD reported that based on completed testing of fiscal year 2003 payments, this program is below OMB's threshold criteria--exceeding $10 million and 2.5 percent of program payments-- for significant improper payments and, therefore, was removed from HUD's at-risk inventory. HUD stated that this program was not subject to retesting unless there was a significant change in the nature of activity or internal control structure. We have several problems with HUD's position. The CDBG program was subject to the previous OMB Circular No. A-11 requirements and thus was required by OMB's guidance to continue to report improper payment information under IPIA, regardless of the agency-determined risk level, which based on other known information may not reflect actual risk. During a June 2006 hearing[Footnote 40] on the CDBG program, HUD's OIG reported on numerous instances of fraudulent, improper, and abusive use of program funds identified over a 2-˝-year period based on 35 audits. The HUD OIG reported that its office has recovered over $120 million in program funds, identified over $100 million in questioned costs, indicted 159 individuals, initiated administrative actions against 143 individuals, and took 5 civil actions and 39 personnel actions. As evidenced by the HUD OIG reviews, the CDBG program may be at risk of significant improper payments. Certain Methodologies Used to Estimate Improper Payments Do Not Result in Accurate Estimates: The total executive branch-wide improper payment estimate may also be understated because of nonstatistical sampling methodologies agencies used to estimate improper payments in its programs. OMB's implementing guidance requires that agencies use a statistical sample to estimate improper payments. With statistical sampling, sample results can be generalized to the entire population from which the sample was taken. From our review, we found six agencies that did not use statistical sampling to estimate improper payments totaling approximately $389 million for nine programs with outlays exceeding $58 billion. For example, Labor analyzed fiscal year 2003 single audits to identify questioned costs for its Workforce Investment Act[Footnote 41] program, which, in turn, were used as a proxy for reporting its improper payment estimate. Specifically, the improper payment rate was determined by calculating the projected questioned costs and dividing this total amount by the corresponding outlays. We do not believe this is a reasonable proxy for improper payment levels because single audits, by themselves, may lack the level of detail necessary for achieving IPIA compliance. Specifically, single audits generally focus on the largest dollars in an auditee's portfolio. Thus, all programs identified as susceptible to improper payments at the federal level may not receive extensive coverage under a single audit. Consequently, both the depth and level of detail of single audit results are, generally, insufficient to identify improper payments, estimate improper payments, or both. We also found instances where agencies estimated improper payments for only one component of the risk-susceptible program. For example, HHS's Medicare program is the largest program constituting the total improper payment estimate, with an estimate of $12.1 billion for fiscal year 2005. However, this estimate represents payment errors only for its fee- for-service program component. HHS has not yet begun to estimate improper payments for its managed care component, with outlays totaling about $52 billion, or 15 percent of Medicare program outlays. In its fiscal year 2005 financial report, HHS's Centers for Medicare and Medicaid Services (CMS) identified bringing the Medicare managed care component into compliance with IPIA as a key challenge in the coming years. In addition, CMS's external auditors identified Medicare's managed care benefits payment cycle as a material weakness in its report on internal controls. Specifically, the auditor found that existing CMS policies and procedures are not sufficient to adequately reduce the risk of material benefit payment errors from occurring or not being detected and corrected in a timely manner. In addition, the Department of Transportation (DOT) reported zero improper payments based on its testing of four state-administered grant programs with outlays totaling $42.1 billion in fiscal year 2005. (See app. II.) DOT stated that none of these programs exceeded OMB's reporting criteria. However, DOT's test procedures only applied to payments made by DOT to grantee entities. Test procedures did not address subsequent "flow down" payments made at the grantee level, where the risk of improper payments is at its greatest. As such, the DOT OIG reported in the agency's fiscal year 2005 PAR that detecting improper payments and stopping wasteful spending by grantees is a top management challenge for the agency. DOT stated that it had actions under way to implement an improper payment methodology for its grant programs and plans to implement nationwide testing beginning in fiscal year 2007. Reduction in Improper Payment Estimate May Not Be a Result of Improved Accountability and Enhanced Internal Controls: The reported $7 billion decrease in the governmentwide estimate is primarily attributable to a decrease in Medicare's estimate.[Footnote 42] However, we found that this decrease was mainly a result of an improvement made to Medicare's estimating methodology rather than to improved payment controls. When providers do not submit documentation to justify payments received, these payments were counted by HHS as erroneous for purposes of calculating an annual improper payment estimate for the Medicare program. However, the decreased error rates achieved this year because of increased efforts to obtain provider documentation are not directly comparable to those reported in prior years before the new procedures were implemented. Based on our review, the Medicare improper payment estimate decrease was principally caused by increased efforts to educate health care providers about its Medicare error rate testing program and the importance of responding to its requests for medical records to perform detailed statistical reviews of Medicare payments. HHS reported that these more intensive efforts had dramatically reduced the number of "no documentation" errors in its medical reviews. HHS reported marked reductions in its error rate attributable to fewer cases of (1) nonresponses to requests for medical records and (2) insufficient documentation submitted by the provider. We noted that these improvements partially resulted from HHS extending the time that providers have for responding to documentation requests from 55 days to 90 days. These changes primarily affected HHS's processes related to its efforts to perform detailed statistical reviews for the purposes of calculating an annual improper payment estimate for the Medicare program. While this may represent a refinement in the program's improper payment estimate, the reported reduction may not reflect improved accountability over program dollars. Therefore, the federal government's progress in reducing improper payments may be exaggerated because the reported improper payments decrease in the Medicare program accounts for the bulk of the overall reduction in the governmentwide improper payments estimate. Our work did not include an overall assessment of HHS's estimating methodology. However, we noted that the changes made for the fiscal year 2005 estimate were not related to improvements in prepayment validation processes, and we did not find any evidence that HHS had significantly enhanced its preventive controls in the Medicare payment process to prevent future improper payments. Further, we also found that HHS's OIG continues to cite the integrity of Medicare payments as a top management challenge. In addition, health care fraud schemes continue to hamper HHS's efforts to improve accountability. For example, in May 2006, DOJ reported[Footnote 43] that a businessman pleaded guilty to conspiracy to defraud Medicare of $40 million in fraudulent billings over a 16-month period. The fraud scheme included billing Medicare for motorized wheelchairs that were either not required by the Medicare beneficiary, not delivered, or both. Other agency auditors have also reported major management challenges related to agencies' internal control weaknesses that continue to plague programs susceptible to significant improper payments. For example, SBA's auditors reported that for the 7(a) Business Loan program, SBA did not consistently identify instances of noncompliance with its own requirements, resulting in improper payments. In some cases, agencies reported that they had determined that programs were not susceptible to significant improper payments despite the fact that the auditor's reports in the same PARs identified management challenges, or material weaknesses within the programs. For example, the Department of the Interior's OIG reported that the agency's grant programs lacked proper management, creating accountability and stewardship deficiencies, as well problems related to data reliability, training, and ensuring that funds were spent appropriately. Likewise, the General Services Administration's (GSA) OIG reported several issues related to the agency's contract management practices, such as unauthorized personnel issuing task orders, not inspecting completed work projects prior to payment, not ensuring services were rendered prior to payment, and paying invoices that often lacked supporting documentation. Table 6 provides four other examples of agencies' major management challenges, as reported in the fiscal year 2005 PARs, in specific agency programs or activities. None of the programs listed in table 6 have been identified by agencies as susceptible to significant improper payments, and thus are not included in the total improper payment estimate. These examples raise further questions about the adequacy of agencies' risk assessments to identify susceptible programs, and whether agencies considered major management challenges identified by the OIG as part of their risk assessment process. Table 6: Examples of Programs or Activities with Major Management Challenges but Not Identified as Susceptible to Significant Improper Payments: Department or agency: Department of the Interior; Program or activity: Workers' Compensation; Description of major management challenge identified by the OIG: * Inefficient and ineffective management led to increases in annual costs. At best, program is managed inconsistently, and at worst, is subject to abuse by managers seeking an easy way to deal with problem employees; * Program is understaffed, employees lack training, and there is no uniform process for ensuring that costs are accurate. Also, there is an overwhelming lack of awareness that workers' compensation fraud exists. Department or agency: General Services Administration; Program or activity: Contract Management; Description of major management challenge identified by the OIG: * GSA disbursed almost $19 billion in contract payments for fiscal year 2005. Certain trends identified in recent years that cause concern related to contract management include; * limited project oversight and, at times, completed work projects not inspected prior to payment; * payments made for services not provided; and; * invoices approved for payment, but lacked supporting documentation. Department or agency: Department of Justice; Program or activity: Grant Programs; Description of major management challenge identified by the OIG: * Long-standing challenge to effectively manage grant programs, which totaled more than $3.5 billion in fiscal year 2005. Grantees have received unclear, untimely, and ambiguous guidance to carry out program objectives; * The myriad of policy guidance is often confusing and contradictory, increasing the risk that grantees will be less likely to satisfy their fiduciary responsibility to safeguard grant funds and ensure funds are used solely for the purposes for which they were awarded. Department or agency: Social Security Administration; Program or activity: School Attendance; Description of major management challenge identified by the OIG: * Agency disbursed about $70 million in incorrect payments to 32,839 students. The OIG recommended, and SSA agreed, to ensure that the overpayments are established and that subsequent collection activities are initiated for those payments. Source: GAO analysis of agencies' fiscal year 2005 PARs. [End of table] IPIA May Need to Be Amended to Ensure Agencies Fully Meet Its Objectives: IPIA includes broad criteria that agencies should use to annually assess what programs and activities are at risk of having improper payments. However, OMB has prescribed more specific criteria in its implementing guidance that in practice have the effect of limiting the disclosure and transparency of governmentwide improper payments. This limitation appears contrary to the objective of IPIA, which, among other things, was created to facilitate the Congress's understanding of the nature and extent of the governmentwide improper payment problem and hold agencies accountable for improved management over federal funds. An amendment to the act could clarify the criteria that agencies should use to identify which programs and activities are susceptible to significant improper payments to ensure agencies meet the intent of the act. In addition, we note that the definition of improper payments under IPIA excludes certain types of payments that are required to be made under constitutional, statutory, or judicial requirements, even though those payments are subsequently determined to be incorrect. This includes payments that an agency is required to make under statute or court order that later are determined to be overpayments. Because agencies are not required to track, monitor, and report on a governmentwide basis these types of overpayments, the magnitude of this issue is unknown. Identification Threshold Limits Agency Reporting on Susceptible Programs: For purposes of assessing what programs and activities are at risk of improper payments, IPIA states that agency heads must review their agencies' programs and activities to determine those that are susceptible to significant improper payments. The law does not define susceptibility. In its implementing guidance, OMB directed that a program or activity is susceptible to significant improper payments if it meets two criteria--potential improper payments exceeding $10 million and 2.5 percent of program payments. Therefore, both criteria must be met for an agency to subject the program to the later steps requiring the agency to estimate improper payments and address the various improper payment reporting requirements. As stated earlier in this report, the information developed during a risk assessment forms the foundation upon which management can determine the nature and type of corrective actions needed. It also gives management baseline information for measuring progress in reducing improper payments. Thus, these assessment criteria affect how agencies identify, estimate, report on, and reduce those programs susceptible to significant improper payments. For example, of the 23 agencies that reported assessing all programs and activities, we found that 6 agencies limited their risk assessment reviews to only those programs that would likely meet OMB's definition of programs susceptible to significant improper payments. Two of these 6 agencies reported that they did not perform a comprehensive risk assessment for those programs with outlays of less than $10 million because the programs would not have exceeded both of OMB's threshold criteria. The remaining 4 agencies did not perform a comprehensive risk assessment of programs with outlays ranging from $40 million to $200 million, generally citing the threshold criteria as the reason for their exclusion. We also noted instances where agencies with large program outlays reported that their programs or activities were not susceptible to significant improper payments because the improper payment estimates only exceeded one of OMB's criteria for reporting improper payment information, another example of how OMB's criteria could materially affect the extent to which agencies report improper payment information in their PARs. From our review of the 57 agency programs and activities that were included in the total $38 billion improper payment estimate, we identified 20 programs or activities that reported improper payment estimates exceeding $10 million, but not 2.5 percent of program outlays. We also identified 1 program that reported an error rate exceeding 2.5 percent of program outlays, but not $10 million. See table 7 for additional details. Table 7: Agency Improper Payment Estimates Included in the Governmentwide Total That Met One of the Two OMB Reporting Criteria: 1; Department or agency: Department of Agriculture; Program or activity: Marketing Assistance Loan Program (previously Commodity Loan Programs); Program outlays (in millions): $6,400.0; Fiscal year 2005 improper payment estimate (in millions): $45; Fiscal year 2005 improper payment error rate (percentage): 0.70; Previous OMB Circular No. A-11 reporting requirements: X. 2; Department or agency: Department of Agriculture; Program or activity: Federal Crop Insurance Corporation; Program outlays (in millions): 3,170.0; Fiscal year 2005 improper payment estimate (in millions): 28; Fiscal year 2005 improper payment error rate (percentage): 0.89; Previous OMB Circular No. A-11 reporting requirements: [Empty]. 3; Department or agency: Department of Agriculture; Program or activity: Farm Security and Rural Investment; Program outlays (in millions): 1,027.0; Fiscal year 2005 improper payment estimate (in millions): 16; Fiscal year 2005 improper payment error rate (percentage): 1.55; Previous OMB Circular No. A-11 reporting requirements: [Empty]. 4; Department or agency: Department of Defense; Program or activity: Military Retirement Fund; Program outlays (in millions): 35,700.0; Fiscal year 2005 improper payment estimate (in millions): 49.3; Fiscal year 2005 improper payment error rate (percentage): 0.14; Previous OMB Circular No. A-11 reporting requirements: ; X. 5; Department or agency: Department of Defense; Program or activity: Military Health Benefits; Program outlays (in millions): 7,500.0; Fiscal year 2005 improper payment estimate (in millions): 150; Fiscal year 2005 improper payment error rate (percentage): 2.00; Previous OMB Circular No. A-11 reporting requirements: X. 6; Department or agency: Department of Defense; Program or activity: Military Pay; Program outlays (in millions): 69,100.0; Fiscal year 2005 improper payment estimate (in millions): 432; Fiscal year 2005 improper payment error rate (percentage): 0.63; Previous OMB Circular No. A-11 reporting requirements: [Empty]. 7; Department or agency: Department of Education; Program or activity: Student Financial Assistance--Federal Family Education Loan; Program outlays (in millions): 10,085.0; Fiscal year 2005 improper payment estimate (in millions): 16; Fiscal year 2005 improper payment error rate (percentage): 0.16; Previous OMB Circular No. A-11 reporting requirements: [Empty]. 8; Department or agency: Department of Education; Program or activity: Title I; Program outlays (in millions): 12,520.0; Fiscal year 2005 improper payment estimate (in millions): 149; Fiscal year 2005 improper payment error rate (percentage): 1.19; Previous OMB Circular No. A-11 reporting requirements: X. 9; Department or agency: Department of Energy; Program or activity: Payment programs; Program outlays (in millions): 24,114.0; Fiscal year 2005 improper payment estimate (in millions): 14.5; Fiscal year 2005 improper payment error rate (percentage): 0.06; Previous OMB Circular No. A-11 reporting requirements: [Empty]. 10; Department or agency: Department of Health and Human Services; Program or activity: Head Start; Program outlays (in millions): 6,865.0; Fiscal year 2005 improper payment estimate (in millions): 110; Fiscal year 2005 improper payment error rate (percentage): 1.60; Previous OMB Circular No. A-11 reporting requirements: X. 11; Department or agency: Office of Personnel Management; Program or activity: Retirement Program (Civil Service Retirement System and Federal Employees Retirement System); Program outlays (in millions): 54,800.0; Fiscal year 2005 improper payment estimate (in millions): 152.2; Fiscal year 2005 improper payment error rate (percentage): 0.28; Previous OMB Circular No. A-11 reporting requirements: X. 12; Department or agency: Office of Personnel Management; Program or activity: Federal Employees Health Benefits Program; Program outlays (in millions): 29,400.0; Fiscal year 2005 improper payment estimate (in millions): 196.5; Fiscal year 2005 improper payment error rate (percentage): 0.67; Previous OMB Circular No. A-11 reporting requirements: X. 13; Department or agency: Railroad Retirement Board; Program or activity: Retirement and Survivors Benefits; Program outlays (in millions): 9,185.4; Fiscal year 2005 improper payment estimate (in millions): 150.6; Fiscal year 2005 improper payment error rate (percentage): 1.64; Previous OMB Circular No. A-11 reporting requirements: X. 14; Department or agency: Small Business Administration; Program or activity: Small Business Investment Companies; Program outlays (in millions): 1,568.2; Fiscal year 2005 improper payment estimate (in millions): 10.5; Fiscal year 2005 improper payment error rate (percentage): 0.67; Previous OMB Circular No. A-11 reporting requirements: X. 15; Department or agency: Social Security Administration; Program or activity: Old Age and Survivors' Insurance; Program outlays (in millions): 493,300.0; Fiscal year 2005 improper payment estimate (in millions): 3,681.0; Fiscal year 2005 improper payment error rate (percentage): 0.74; Previous OMB Circular No. A-11 reporting requirements: X. 16; Department or agency: Social Security Administration; Program or activity: Disability Insurance[A]; Program outlays (in millions): [Empty]; Fiscal year 2005 improper payment estimate (in millions): [Empty]; Fiscal year 2005 improper payment error rate (percentage): [Empty]; Previous OMB Circular No. A-11 reporting requirements: X. 17; Department or agency: Department of State; Program or activity: International Information Program-U.S. Speaker and Specialist Program; Program outlays (in millions): 41.0; Fiscal year 2005 improper payment estimate (in millions): 1.9; Fiscal year 2005 improper payment error rate (percentage): 4.63; Previous OMB Circular No. A-11 reporting requirements: [Empty]. 18; Department or agency: Tennessee Valley Authority; Program or activity: Payment programs; Program outlays (in millions): 7,080.0; Fiscal year 2005 improper payment estimate (in millions): 36.3; Fiscal year 2005 improper payment error rate (percentage): 0.05; Previous OMB Circular No. A-11 reporting requirements: [Empty]. 19; Department or agency: Department of Veterans Affairs; Program or activity: Compensation; Program outlays (in millions): 28,960.0; Fiscal year 2005 improper payment estimate (in millions): 322.9; Fiscal year 2005 improper payment error rate (percentage): 1.12; Previous OMB Circular No. A-11 reporting requirements: ; X. 20; Department or agency: Department of Veterans Affairs; Program or activity: Dependency and Indemnity Compensation[A]; Program outlays (in millions): [Empty]; Fiscal year 2005 improper payment estimate (in millions): [Empty]; Fiscal year 2005 improper payment error rate (percentage): [Empty]; Previous OMB Circular No. A-11 reporting requirements: X. 21; Department or agency: Department of Veterans Affairs; Program or activity: Education programs; Program outlays (in millions): 2,661.0; Fiscal year 2005 improper payment estimate (in millions): 64; Fiscal year 2005 improper payment error rate (percentage): 2.40; Previous OMB Circular No. A-11 reporting requirements: [Empty]. Total; Program or activity: [Empty]; Program outlays (in millions): $803,476.6; Fiscal year 2005 improper payment estimate (in millions): $5,625.7; Fiscal year 2005 improper payment error rate (percentage): [Empty]; Previous OMB Circular No. A-11 reporting requirements: 13. Source: GAO analysis of fiscal year 2005 PARs and annual reports. [A] Agency combined with the above program. [End of table] As table 7 shows, we identified, in total, 21 programs or activities with improper payment estimates exceeding $5.6 billion that meet only one of OMB's reporting criteria. Most of these program estimates greatly exceeded $10 million and, without certain stipulations, could have avoided reporting improper payment information under OMB's reporting criteria. However, OMB has required that 13 of these 21 programs estimate improper payments regardless of dollar amount or error rate, because they had previous reporting requirements under OMB Circular No. A-11.[Footnote 44] Nonetheless, if the Circular No. A-11 requirements did not apply or agencies decided not to voluntarily report on their improper payment estimates that were under OMB's reporting threshold, OMB's definition of significant improper payments could potentially mask the full scope of improper payments. In addition to our analytical reviews above, we also found specific instances where OMB's definition of significant improper payments limits agencies' reporting. Although we do not know the extent of improper payments that are not reported, a limited number of agencies voluntarily provided information in their PARs that allowed us to determine the amount of improper payments for certain programs and activities that were excluded from the total improper payments estimate of $38 billion for fiscal year 2005. For example, Education identified three programs with estimated improper payments exceeding $10 million for each program, which totaled about $155 million in improper payments. In light of OMB's criteria, because these estimates did not exceed 2.5 percent of program outlays, they were not included in the agency's total improper payment estimate. In another example, the Department of Defense (DOD) OIG reported[Footnote 45] it had identified about $23 million in improper payments related to the procurement of fuel at the Defense Energy Support Center during fiscal year 2005. DOD did not report this information in its PAR since the improper fuel payments did not exceed 2.5 percent of program payments. As these examples illustrate, OMB's current criteria for identifying risk-susceptible programs limit the disclosure of valuable information that the Congress, the public, and others with oversight and monitoring interests need to hold agencies accountable for reporting and reducing improper payments. Thus, amending existing IPIA provisions to define risk-susceptible programs and activities, such as the use of a specific dollar threshold, would allow for more complete disclosure and transparency of govermentwide improper payment reporting and, in turn, would require OMB to revise its implementing guidance to reflect such amendments as well as align existing guidance with the intent of the act. IPIA Definition of Improper Payments Excludes Certain Payments from Reporting: IPIA defines an improper payment as a payment that should not have been made or that was made in an incorrect amount (including overpayments and underpayments) under statutory, contractual, administrative