Summary
Agencies are required to report improper payment information under the Improper Payments Information Act of 2002 (IPIA) and recovery auditing information under section 831 of the National Defense Authorization Act for Fiscal Year 2002, commonly known as the Recovery Auditing Act. Since the first year of implementation, fiscal year 2004, limited improper payments reporting by the United States Agency for International Development (USAID) and the National Aeronautics and Space Administration (NASA) and concerns raised by NASA's auditors about its risk assessment process prompted scrutiny from the Senate Subcommittee on Federal Financial Management, Government Information, Federal Services, and International Security, during several oversight hearings. Because the subcommittee noted that USAID's and NASA's performance and accountability report (PAR) reporting on improper payments and recovery auditing was minimal, GAO was asked to review both agencies' IPIA risk assessment methodologies, recovery auditing procedures, and actions under way to improve their IPIA and recovery audit reporting.
For the first 3 years of IPIA implementation, fiscal years 2004 through 2006, USAID and NASA performed various procedures to conduct their risk assessments. Many of these procedures are positive steps to address the requirements of IPIA. At the same time, GAO identified numerous deficiencies in the procedures that warrant further improvement. For example, neither USAID nor NASA had developed a systematic process to (1) identify risks that exist in their payment activities or (2) evaluate the results of their payment stream reviews, such as weighting and scoring the effectiveness of existing internal control over payments made and results from external audits. Furthermore, risk assessment documentation maintained by USAID and NASA was lacking or insufficient to support their conclusions that no programs or activities were susceptible to significant improper payments. A lack of detailed written guidance for both agencies may have contributed to the deficiencies identified. Due to inadequacies in their risk assessment process, USAID and NASA cannot be certain that they had no programs or activities susceptible to significant improper payments, and ultimately, had effectively implemented IPIA. Although USAID and NASA have reported on steps taken to recoup improper contract payments, GAO found several weaknesses in their recovery auditing procedures for fiscal years 2004 through 2006. In particular, USAID and NASA did not report recovery auditing information for each fiscal year, documentation was lacking or not adequately supported, and neither agency adhered to all of the reporting requirements outlined in Office of Management and Budget's (OMB's) implementing guidance. Other weaknesses noted were agency-specific. For example, USAID recovery auditing procedures were comprised of reviews of certain Office of Inspector General and external audit reports over USAID grant and contract programs. However, the methodology used for conducting those audits may not have constituted a recovery auditing program as defined by OMB guidance, and thus may be insufficient for this purpose. NASA, on the other hand, used IPIA contract payment review results to report amounts recovered for fiscal year 2005. However, the payment reviews were limited in scope and did not provide an adequate representation of the extent of contract overpayments. Due to a lack of, or insufficient, documentation, along with identified weaknesses, the validity and accuracy of the reported recovery amounts are questionable. While USAID and NASA have experienced significant challenges in their first 3 years of IPIA implementation, both agencies have taken steps to strengthen their risk assessment process and, ultimately, IPIA reporting. For example, USAID has developed an agencywide payment database that will be used to research and data mine for potential improper payments. NASA hired two different contractors to develop a methodology for conducting a risk assessment and testing of payment transactions. Actions are also under way to improve recovery auditing efforts. However, improvements are still needed to address some of the weaknesses identified related to conducting risk assessments and performing recovery auditing procedures.
Recommendations
Our recommendations from this work are listed below with a Contact for more information. Status will change from "In process" to "Open," "Closed - implemented," or "Closed - not implemented" based on our follow up work.
Director:
Team:
Phone:
McCoy Williams
Government Accountability Office: Financial Management and Assurance
(202) 516-6906
Recommendations for Executive Action
Recommendation: To help improve efforts to implement IPIA and the Recovery Auditing Act by focusing on performance risk assessments and reporting on efforts to recover improper payments, the Administrator, USAID, should expand existing IPIA guidance to include detailed procedures for addressing the four key steps--perform risk assessment, estimate improper payments, implement a corrective action plan, annually report--that OMB requires agencies to perform in meeting the improper payment reporting requirements.
Agency Affected: United States Agency for International Development
Status: In process
Comments: When we confirm what actions the agency has taken in response to this recommendation, we will provide updated information.
Recommendation: To help improve efforts to implement IPIA and the Recovery Auditing Act by focusing on performance risk assessments and reporting on efforts to recover improper payments, the Administrator, USAID, should develop a risk assessment tool, such as a risk assessment matrix, to determine if risks exist, what those risks are, and the potential or actual impact of those risks on program operations.
Agency Affected: United States Agency for International Development
Status: In process
Comments: When we confirm what actions the agency has taken in response to this recommendation, we will provide updated information.
Recommendation: To help improve efforts to implement IPIA and the Recovery Auditing Act by focusing on performance risk assessments and reporting on efforts to recover improper payments, the Administrator, USAID, should use the risk assessment tool to institute a systematic approach to identify programs and activities susceptible to significant improper payments under IPIA.
Agency Affected: United States Agency for International Development
Status: In process
Comments: When we confirm what actions the agency has taken in response to this recommendation, we will provide updated information.
Recommendation: To help improve efforts to implement IPIA and the Recovery Auditing Act by focusing on performance risk assessments and reporting on efforts to recover improper payments, the Administrator, USAID, should maintain documentation of actions performed to address IPIA and the Recovery Auditing Act requirements.
Agency Affected: United States Agency for International Development
Status: In process
Comments: When we confirm what actions the agency has taken in response to this recommendation, we will provide updated information.
Recommendation: To help improve efforts to implement IPIA and the Recovery Auditing Act by focusing on performance risk assessments and reporting on efforts to recover improper payments, the Administrator, USAID, should develop a comprehensive recovery auditing program that is specifically designed to identify overpayments to contractors that are due to payment errors.
Agency Affected: United States Agency for International Development
Status: In process
Comments: When we confirm what actions the agency has taken in response to this recommendation, we will provide updated information.
Recommendation: To help improve efforts to implement IPIA and the Recovery Auditing Act by focusing on performance risk assessments and reporting on efforts to recover improper payments, the Administrator, USAID, should adhere to OMB's guidance for reporting recovery auditing information in the annual PAR.
Agency Affected: United States Agency for International Development
Status: In process
Comments: When we confirm what actions the agency has taken in response to this recommendation, we will provide updated information.
Recommendation: To help improve efforts to implement IPIA and the Recovery Auditing Act by focusing on performance risk assessments and reporting on efforts to recover improper payments, the Administrator, NASA, should develop IPIA guidance to include detailed procedures for addressing the four key steps--perform risk assessment, estimate improper payments, implement a corrective action plan, annually report--that OMB requires agencies to perform in meeting the improper payment reporting requirements.
Agency Affected: National Aeronautics and Space Administration
Status: In process
Comments: When we confirm what actions the agency has taken in response to this recommendation, we will provide updated information.
Recommendation: To help improve efforts to implement IPIA and the Recovery Auditing Act by focusing on performance risk assessments and reporting on efforts to recover improper payments, the Administrator, NASA, should as part of guidance, incorporate the risk assessment methodology developed by NASA's consulting firm to determine if risks exist, what those risks are, and the potential or actual impact of those risks on program operations.
Agency Affected: National Aeronautics and Space Administration
Status: In process
Comments: When we confirm what actions the agency has taken in response to this recommendation, we will provide updated information.
Recommendation: To help improve efforts to implement IPIA and the Recovery Auditing Act by focusing on performance risk assessments and reporting on efforts to recover improper payments, the Administrator, NASA, should maintain documentation of actions performed to address IPIA and Recovery Auditing Act requirements.
Agency Affected: National Aeronautics and Space Administration
Status: In process
Comments: When we confirm what actions the agency has taken in response to this recommendation, we will provide updated information.
Recommendation: To help improve efforts to implement IPIA and the Recovery Auditing Act by focusing on performance risk assessments and reporting on efforts to recover improper payments, the Administrator, NASA, should adhere to OMB's guidance for reporting recovery auditing information in its annual PAR.
Agency Affected: National Aeronautics and Space Administration
Status: In process
Comments: When we confirm what actions the agency has taken in response to this recommendation, we will provide updated information.
