This is the accessible text file for GAO report number GAO-10-66 
entitled 'Financial Management: Improvements Needed in National Flood 
Insurance Program's Financial Controls and Oversight' which was 
released on January 21, 2009. 

This text file was formatted by the U.S. Government Accountability 
Office (GAO) to be accessible to users with visual impairments, as part 
of a longer term project to improve GAO products' accessibility. Every 
attempt has been made to maintain the structural and data integrity of 
the original printed product. Accessibility features, such as text 
descriptions of tables, consecutively numbered footnotes placed at the 
end of the file, and the text of agency comment letters, are provided 
but may not exactly duplicate the presentation or format of the printed 
version. The portable document format (PDF) file is an exact electronic 
replica of the printed version. We welcome your feedback. Please E-mail 
your comments regarding the contents or accessibility features of this 
document to Webmaster@gao.gov. 

This is a work of the U.S. government and is not subject to copyright 
protection in the United States. It may be reproduced and distributed 
in its entirety without further permission from GAO. Because this work 
may contain copyrighted images or other material, permission from the 
copyright holder may be necessary if you wish to reproduce this 
material separately. 

Report to the Ranking Member, Committee on Banking, Housing, and Urban 
Affairs, U.S. Senate: 

United States Government Accountability Office: 
GAO: 

December 2009: 

Financial Management: 

Improvements Needed in National Flood Insurance Program's Financial 
Controls and Oversight: 

GAO-10-66: 

GAO Highlights: 

Highlights of GAO-10-66, a report to the Ranking Member, Committee on 
Banking, Housing, and Urban Affairs, U.S. Senate. 

Why GAO Did This Study: 

Due to the federal government’s role as guarantor, floods impose an 
enormous potential financial burden on the federal government. 
Consequently, decision makers at the Department of Homeland Security 
(DHS), the Federal Emergency Management Agency (FEMA), and the Congress 
need accurate and timely financial information to assess the 
effectiveness of the National Flood Insurance Program (NFIP). This 
report assesses (1) whether controls in place during the 2005 to 2007 
time frame were effective in providing accountability and reliable 
financial reporting for NFIP transactions; (2) whether effective 
oversight structures were in place during this time frame to monitor 
NFIP financial activity; and (3) whether recent and planned actions to 
improve controls are likely to address identified financial control 
weaknesses. GAO reviewed NFIP guidance and financial reports, reviewed 
prior audit reports, interviewed FEMA officials and contractors, 
analyzed FEMA and NFIP financial data, and selected a sample of claim 
losses paid to determine whether claim files contained key documents. 

What GAO Found: 

Weaknesses in internal controls impaired FEMA’s ability to maintain 
effective transaction-level accountability. These weaknesses limited 
FEMA’s ability to assure accurate NFIP financial data during the 3-year 
period from fiscal year 2005 through 2007, which included the financial 
activity related to the 2005 Gulf Coast hurricanes. FEMA relies heavily 
on Write Your Own (WYO) insurance companies to carry out NFIP financial 
activities such as documenting and maintaining claim files. FEMA’s 
Bureau and Statistical Agent (BSA) serves as a liaison between the 
government and WYO insurance companies. GAO identified weaknesses at 
three levels of the NFIP transaction accountability and financial 
reporting process. First, at the WYO level, our internal control 
testing of a statistical sample determined that almost 71 percent of 
WYO company claims loss files did not have the necessary documents to 
support the claims, or reports were filed late. Second, incomplete BSA-
level premium data files (lacking key information such as insureds’ 
names and addresses) prevented an assessment of the reliability of 
reported NFIP premium amounts. Further, BSA-level internal control 
activities were ineffective in verifying the accuracy of WYO-submitted 
data. Lastly, FEMA’s financial reporting process uses summary data that 
is overly reliant on error-prone manual data entry. 

GAO found that FEMA’s broader oversight structures were also of limited 
effectiveness. Specifically, GAO found weaknesses in three key 
structures FEMA relies on to provide oversight over NFIP and monitor 
financial activity: (1) WYO company audits—specifically, we found that 
FEMA did not collect the results of state insurance department audits 
related to flood insurance activity and did not perform any audits for 
cause; (2) triennial operational reviews of WYO insurance companies—we 
found that FEMA did not perform operational reviews at almost one third 
of all WYO companies over the 3-year period; and (3) FEMA’s claims 
reinspection program—we found that FEMA used flawed sampling procedures 
in the claims reinspection program. These findings are consistent with 
weaknesses GAO has previously identified. These oversight weaknesses 
limited FEMA’s ability to identify and address financial transaction 
control breakdowns resulting from the 2005 hurricanes. 

FEMA’s initiatives to improve specific internal control weaknesses and 
the overall NFIP control environment since the 2005 Gulf Coast 
hurricanes have done little to address many of the NFIP financial data 
deficiencies highlighted by these catastrophic events. FEMA has made 
improvements such as revising its claim reinspection selection 
methodology to provide for review of a random selection of a 
statistically representative sample of claim files. However, the 
modified reinspection methodology still does not include all claims. 
FEMA has also implemented a tracking system to monitor the number of 
WYO biennial audits obtained and reviewed. Further, FEMA has a system 
modernization development and implementation effort underway. It is too 
soon to determine the extent to which these efforts will achieve 
program efficiencies. 

What GAO Recommends: 

GAO makes seven recommendations to FEMA to improve NFIP financial 
management controls and oversight. They include modifying the financial 
reporting process to reduce the risk of errors and improving procedures 
to strengthen oversight. 

View GAO-10-66 or key components. For more information, contact Susan 
Ragland at (202) 512-9095 or raglands@gao.gov. 

[End of section] 

Contents: 

Letter: 

Background: 

Weaknesses in NFIP Transaction Controls and Processing Limited 
Accountability and Financial Reporting: 

Weaknesses in FEMA's Oversight Structures Limited Effectiveness in 
Monitoring NFIP Financial Activity: 

Recent and Planned Initiatives Do Little to Address Identified 
Weaknesses: 

Conclusions: 

Recommendations for Executive Action: 

Agency Comments and Our Evaluation: 

Appendix I: Scope and Methodology: 

Appendix II: Comments from the Department of Homeland Security: 

Appendix III: GAO Contact and Staff Acknowledgments: 

Related GAO Products: 

Table: 

Table 1: Description of Claims Populations and Related Statistical 
Samples: 

Figures: 

Figure 1: Key Participants in the NFIP WYO Program: 

Figure 2: NFIP Financial Reporting Process for Fiscal Years 2005 to 
2007: 

Figure 3: WYO Companies with Operational Reviews Completed by FEMA in 
Fiscal Years 2005 through 2007: 

Figure 4: Companies That Had Biennial Financial Audits Completed or Not 
Completed for Fiscal Years 2005 through 2007: 

Abbreviations: 

BSA: Bureau and Statistical Agent: 

DHS: Department of Homeland Security: 

FEMA: Federal Emergency Management Agency: 

FFMIA: Federal Financial Management Improvement Act of 1996: 

Financial Control Plan: NFIP WYO Program Financial Control Plan 
Requirements and Procedures: 

HHS: Department of Health and Human Services: 

IFMIS: Integrated Financial Management Information System: 

NFIP: National Flood Insurance Program: 

OCFO: Office of the Chief Financial Officer: 

OIG: Office of Inspector General: 

TIER: Treasury Information Executive Repository: 

TRRP: Transaction Record Reporting and Processing: 

WYO: Write Your Own: 

[End of section] 

United States Government Accountability Office: 
Washington, DC 20548: 

December 22, 2009: 

The Honorable Richard C. Shelby: 
Ranking Member: 
Committee on Banking, Housing, and Urban Affairs: 
United States Senate: 

Dear Senator Shelby: 

The Federal Emergency Management Agency (FEMA), a component of the 
Department of Homeland Security (DHS), is charged with administering 
the National Flood Insurance Program (NFIP). NFIP, established in 1968, 
is primarily implemented through private insurance companies that 
participate in FEMA's Write Your Own (WYO) program. Through the WYO 
program, insurance companies sell and service flood insurance policies 
and adjust claims after flood losses. The federal government acts as a 
guarantor of flood insurance coverage for WYO policies issued under the 
WYO Arrangement. As a guarantor, the federal government is liable for 
paying NFIP claim losses should premiums collected be insufficient to 
cover these payments. To the extent possible, the program is designed 
to pay operating expenses and flood insurance claims with premiums 
collected on flood insurance policies rather than by tax dollars. 

Flood losses have imposed an enormous financial burden on the federal 
government. Until 2004, NFIP was able to cover most of its losses. 
However, in order to pay claims arising from the 2005 hurricanes 
(Katrina, Rita, and Wilma), the Congress authorized loans to NFIP of 
about $16.8 billion from the Treasury that the program used to cover 
the enormous number of claims.[Footnote 1] Given this large debt and 
ongoing complex financial challenges created by the 2005 Gulf Coast 
hurricanes, the fiscal sustainability of the flood insurance program 
has come under scrutiny. 

In March 2006, we designated NFIP as a high-risk program in part 
because of the program's financial condition and inability to repay 
borrowed funds. Since then, we have made recommendations[Footnote 2] to 
improve rate-setting methods and program oversight. The program remains 
on our January 2009 list of high-risk federal programs. 

This report provides the results of our review of NFIP financial 
transactions related to Hurricane Katrina and other hurricanes of the 
2005 season. Specifically, this report, 

* assesses whether controls were effective in providing accountability 
and reliable financial reporting for NFIP transactions during the 2005 
to 2007 time frame, 

* evaluates oversight structures in place to monitor NFIP financial 
activity for that 3-year period, and: 

* assesses whether recent and planned actions to improve NFIP controls 
and the overall control environment are likely to address identified 
financial control weaknesses. 

To assess whether controls were effective in providing accountability 
and reliable financial reporting for NFIP transactions during the 2005 
to 2007 time frame, we obtained and reviewed available transaction data 
and financial reports for NFIP for fiscal years 2005 through 2007. We 
reviewed the WYO Financial Control Plan, WYO Accounting Procedures 
Manual, and other relevant NFIP policy guidance documents to determine 
the design of NFIP financial reporting processes and related internal 
controls. We reviewed NFIP transaction accountability in accordance 
with the guidelines of the Federal Financial Management Improvement Act 
of 1996 (FFMIA).[Footnote 3] We conducted interviews and walkthroughs 
of reporting processes with officials from FEMA, FEMA contractors, and 
the DHS Office of Inspector General (OIG) to document and obtain an 
understanding of the financial reporting process and related internal 
controls for NFIP transactions. We obtained NFIP's databases of claim 
losses paid for fiscal years 2005 through 2007 and selected a 
statistical sample from the insurance claim losses paid databases for 
testing of data fields such as coverage and deductible amounts, claim 
payment amounts, and policy effective dates against source documents. 

To evaluate oversight structures in place to monitor NFIP financial 
activity for the 3-year period covering 2005 to 2007, we reviewed prior 
GAO and DHS OIG reports to identify and follow up on any previously 
reported weaknesses or concerns. Previously reported weaknesses 
included the sample selection process for claims reinspections and the 
lack of tracking results of biennial financial audits. We also 
identified and assessed significant oversight structures outlined in 
the WYO Financial Control Plan. 

To assess whether recent and planned actions to improve NFIP controls 
and the overall control environment are likely to address identified 
financial control weaknesses, we met with key program officials to 
discuss the NextGen system-development effort. We also discussed recent 
and planned NFIP program changes to address the internal control 
weaknesses and oversight issues previously identified by us and the DHS 
OIG. Appendix I provides more details on our scope and methodology. 

We conducted this performance audit from February 2008 to December 2009 
in accordance with generally accepted government auditing standards. 
Those standards require that we plan and perform the audit to obtain 
sufficient, appropriate evidence to provide a reasonable basis for our 
findings and conclusions based on our audit objectives. Our audit 
objectives were not designed to detect fraud. We believe that the 
evidence obtained provides a reasonable basis for our findings and 
conclusions based on our audit objectives. 

Background: 

Congress established NFIP in the National Flood Insurance Act of 1968 
to provide an alternative to disaster assistance that would reduce the 
escalating costs to the federal government of repairing flood damage. 
[Footnote 4] FEMA, within DHS, administers NFIP and is responsible for 
its management and oversight. Under NFIP's WYO program, FEMA enters 
into an arrangement with individual private-sector insurance companies 
licensed by states to provide property insurance. The arrangement 
allows these companies--using their customary business practices--to 
offer flood insurance coverage to eligible property owners. Figure 1 
provides an overview of the WYO companies and other key participants in 
NFIP. 

Figure 1: Key Participants in the NFIP WYO Program: 

[Refer to PDF for image: illustration] 

Homeowner: 
* Purchases NFIP policy; 
* Seeks information on coverage; 
* Files claim after flood event. 

Insurance agent: 
* Under contract to sell NFIP policies in the name of one or more WYO 
insurance companies. 

WYO company: 
* Underwrites policy; 
* Collects premiums; 
* Processes claims; 
* Sends in flood adjuster. 

Flood adjuster: 
* Assesses damage; 
* Estimates losses; 
* Submits required reports to insurance companies. 

FEMA and its Bureau and Statistical Agent (BSA): 
* Manages National Flood Insurance Fund; 
* Pays WYO providers based on schedule of operating costs; 
* Receives premium deposits; 
* Manages and regulates NFIP. 

Source: GAO analysis of FEMA data. 

[End of figure] 

WYO Companies: 

A private insurance company becomes a WYO company[Footnote 5] by 
entering into an agreement with FEMA known as the Financial Assistance/ 
Subsidy Arrangement. Under the arrangement, private insurance companies 
agree to issue flood policies in their own name. The WYO companies 
adjust flood claims as well as settle, pay, and defend all claims 
arising from the flood policies. Participating WYO companies are to 
comply with FEMA's NFIP WYO Program Financial Control Plan Requirements 
and Procedures (Financial Control Plan), which outlines WYO insurance 
companies' responsibilities for underwriting, claims adjustments, cash 
management, and financial reporting. 

Selling policies. NFIP coverage is available to all owners of insurable 
property (a building or its contents, or both) in a community 
participating in NFIP. Builders of buildings in the course of 
construction, condominium associations, and owners of residential 
condominium units in participating communities may also purchase flood 
insurance. Insurance agents under contract to one or more WYO insurance 
companies are the main point of contact for approximately 97 percent of 
policyholders. Based on information the insurance agents submit, the 
WYO insurance companies issue policies, collect premiums from 
policyholders, deduct an allowance for expenses from the premium, and 
remit the balance to the National Flood Insurance Fund. The remaining 3 
percent of policies are written directly by the federal government 
through a FEMA contractor known as the Direct Servicing Agent.[Footnote 
6] The Direct Servicing Agent provides an alternative, for example, 
when a WYO company is unable or unwilling to write a flood insurance 
policy. 

Adjusting claims. Insurance companies employ certified[Footnote 7] 
flood adjusters to settle NFIP claims. When flood losses occur, 
policyholders report them to their insurance agent, who notifies the 
WYO insurance company. The WYO insurance company assigns a flood 
adjuster who is responsible for assessing damage, estimating losses, 
and submitting required reports, work sheets, and photographs to the 
WYO insurance company, where the claim is reviewed and, if approved, 
processed for payment. NFIP's claims payment policy states that FEMA 
will pay only that part of the loss that exceeds the deductible amount, 
subject to the applicable limit of liability (i.e., the amount of 
insurance coverage). FEMA provides funds to the WYO insurance companies 
from the National Flood Insurance Fund for the amounts paid for 
approved claims and related expenses. As of December 2008 the fund was 
over $18 billion in debt. 

FEMA Management and Oversight: 

About 68 FEMA Mitigation Directorate employees, assisted by 
approximately 105 to 110 Bureau and Statistical Agent[Footnote 8] (BSA) 
contractor employees, are responsible for managing and overseeing NFIP 
and the National Flood Insurance Fund into which premiums are deposited 
and claims and expenses paid. FEMA and its contractor (the BSA) are 
responsible for monitoring and overseeing the quality of the 
performance of the approximately 90 WYO insurance companies to assure 
that NFIP is administered properly. Their management responsibilities 
include establishing and updating NFIP regulations and flood insurance 
rates, offering training to WYO company insurance agents and adjusters, 
and implementing the Financial Control Plan. 

NFIP's Financial Reporting Process: 

The NFIP financial reporting process begins at the WYO company level 
when the companies provide summary-level financial data and transaction-
level statistical data to the BSA.[Footnote 9] The WYO Financial 
Control Plan requires the WYO companies to submit a monthly financial 
statement reporting package to the BSA, which is to include financial, 
reconciliation, and certification statements, and statistical 
transactions.[Footnote 10] The BSA uses the detailed transaction-level 
data in the reporting package for statistical purposes that include 
information on claims, losses, and premiums (such as claim payment and 
coverage amounts, data on buildings and contents, and policy effective 
dates). The BSA uploads the summary-level financial information to its 
financial system which is used for financial reporting purposes. 

After the BSA receives the reporting package,[Footnote 11] it performs 
front-end balancing--a process intended to ensure the WYO company data 
are consistent with the WYO companies' reconciliation statements. After 
BSA personnel complete the front-end balancing process they use manual 
processes to upload financial data into the Focus system from a 
spreadsheet.[Footnote 12] The consolidated financial data in Focus is 
then downloaded to a database to prepare journal entries that are then 
uploaded into the Traverse financial reporting system. The BSA uses the 
Traverse system to prepare the financial statement booklets and 
ultimately produce four financial statements--for the Direct Servicing 
Agent, WYO companies, BSA, and a consolidated report that includes all 
three entities. 

The BSA sends the financial statement booklets consisting of these four 
sets of consolidated--but unaudited--financial statements to FEMA's 
Office of the Chief Financial Officer (OCFO) monthly. The OCFO prepares 
journal vouchers based on line items from the NFIP consolidated 
financial statements that the BSA provides. OCFO personnel enter these 
journal vouchers into the Integrated Financial Management and 
Information System (IFMIS), which is FEMA/NFIP's official accounting 
system of record. After the journal voucher entries are loaded into 
IFMIS, OCFO personnel produce trial balance data and load it into the 
Treasury Information Executive Repository (TIER), which is a data 
warehouse for DHS' components' data. 

See figure 2, which depicts NFIP's financial reporting processes. 

Figure 2: NFIP Financial Reporting Process for Fiscal Years 2005 to 
2007: 

[Refer to PDF for image: illustration] 

WYO insurance companies: 
Provide documentation to the BSA on a monthly basis. 

WYO documentation: 
Certification statements, TRRP data, and financial exhibits. 

Bureau and Statistical Agent (BSA): 
Consolidates claims, underwriting, financial, and statistical data from 
WYO insurance companies. 

Front-end balancing: 
BSA reviews WYO submitted data. 

Focus mainframe system: 
Houses financial statement information from WYO companies and provides 
the basis for journal entries. 

Data are reentered: 
BSA personnel enter data from Focus into database to prepare journal 
entries for Traverse. 

Traverse system: 
Processes general ledger and produces financial statement booklet 
including statements for WYO companies, BSA, and direct servicing 
agent. 

Financial statement booklet: 
Financial statement booklet is 1 of 11 FEMA status reports. 

FEMA OCFO: 
Receives hardcopy financial statement booklet on monthly basis and uses 
data to prepare journal vouchers. 

Data are reentered: 
OCFO personnel rekey data from the financial statement booklets into 
IFMIS through journal vouchers. 

IFMIS-FEMA: 
System for financial management of both appropriated funds and 
reimbursable funds. 

Treasury Information Executive Repository (TIER)-DHS: 
Warehouses FEMA trial balance data extracted by DHS. 

Source: GAO. 

[End of figure] 

Weaknesses in NFIP Transaction Controls and Processing Limited 
Accountability and Financial Reporting: 

Control weaknesses impaired FEMA's ability to maintain effective 
transaction-level accountability. Consequently, NFIP had limited 
assurance that its financial data for fiscal years 2005 to 2007 were 
accurate. This impaired data reliability resulted from weaknesses at 
all three levels of the NFIP transaction accountability and financial 
reporting process: at the WYO companies, BSA, and FEMA. At the WYO 
level, WYO companies did not adhere to policies and procedures 
regarding required claims file documentation, and therefore almost one 
third of the claims loss files we reviewed were missing supporting 
documents. This deficiency undermined assurances regarding the 
reliability of the claims loss financial data the WYO companies 
reported. Further, incomplete BSA premium data files, such as missing 
insureds' names and addresses, prevented our assessment of the 
reliability of reported premium amounts. BSA-level controls were 
ineffective in verifying the accuracy of WYO-submitted data. At the 
FEMA level, financial reporting process controls were not based on 
transaction-level data--instead FEMA relied primarily on summary data 
compiled using error-prone manual data entry. 

WYO Companies Did Not Provide Complete Documentation to FEMA for Claims 
Transactions: 

The WYO companies did not provide complete documentation to FEMA for 
claims paid to insureds during fiscal years 2005 to 2007. According to 
NFIP policies and procedures, claim loss files are to contain adequate 
documentation relevant to the adjustment of a claim to support claim 
payments. Our detailed testing of claim losses paid during fiscal years 
2005 through 2007 showed that 20 percent (36 out of 177) of the claim 
files reviewed were missing adjuster-prepared preliminary reports 
[Footnote 13] and 20 percent (36 out of 177) did not contain adjuster-
prepared final reports[Footnote 14] required by the NFIP Adjuster 
Claims Manual.[Footnote 15] In addition, for the claim files we 
reviewed, WYO companies did not file 42 percent (74 out of 177) of the 
preliminary and 34 percent (61 out of 177) final reports within the 
required 15 and 45 days, respectively, from the date of loss in 
accordance with NFIP policy. Our findings are consistent with prior 
audit findings. Specifically, DHS' auditor for its financial statement 
audit for fiscal year 2006 reported that preliminary and final reports 
were not filed within the required time frames. Similarly, almost 71 
percent (125 out of 177) of the statistically sampled claim losses paid 
files we reviewed failed at least one internal control test. These 
included tests such as determining whether claim file documents were 
missing and whether adjusters filed required reports on time or late. 
Although FEMA officials pointed to the unprecedented severity, 
frequency, and complexity of flood claims during this period, these 
internal control issues identified raise concerns that the claim 
payment amounts were not adequately supported. 

The BSA's Premium Database Was Incomplete: 

Over 50 percent of the transactions in the NFIP databases for the 
insurance premium policies for fiscal years 2006 and 2007 that the BSA 
extracted for our testing either lacked or had incomplete insured 
names, addresses, or policy effective dates. Consequently, we were 
unable to test the accuracy of reported insurance premium amounts or 
whether policy premium information was complete. Officials from the BSA 
attributed the missing or incomplete insurance premium information to 
their extraction process and difficulties they encountered (programming 
errors) when extracting the data into a separate database specifically 
for our use. Furthermore, the fact that BSA officials could not readily 
produce reliable or complete data poses questions regarding their 
capacity to analyze data and the NFIP program officials' ability to 
identify appropriate managerial actions based on what is reported to 
them by WYO companies through their own BSA contractor. 

We developed alternative procedures that we planned to use to make 
conclusions about the reliability of reported insurance premiums 
written amounts. These alternative procedures involved testing the 
premium and policy information from the sample we selected for claims 
losses paid. However, we were unable to verify information in the 
premiums database for many sample items because of the missing 
information described previously and because of limitations in the 
quality of the data. 

BSA-Level Internal Controls Do Not Verify Accuracy of WYO Company Data: 

We found weaknesses in two key controls outlined in the Financial 
Control Plan for the BSA to ensure the accuracy of WYO company- 
submitted data. These controls include front-end balancing, which is a 
process intended to ensure the WYO company data are consistent with the 
WYO companies' reconciliation statements, and variance reporting, which 
analyzes WYO-submitted transaction-level (statistical) data in 
comparison with summary-level financial data submitted by WYO 
companies. These features do offer some assurances regarding the 
consistency of data provided by WYO companies and recorded by the BSA. 
However, neither offers any assurances that the WYO company-provided 
information accurately reflects actual transactions. Consistent with 
Standards for Internal Control,[Footnote 16] an agency must have 
sufficient controls in place to provide reliable information to run and 
control its operations. Such controls generally include procedures to 
verify the validity and accuracy of the recorded transactions or 
events. 

Every month, after receiving summary financial and transaction-level 
statistical data[Footnote 17] from WYO companies, the BSA performs 
front-end balancing. As provided by the Financial Control Plan, front- 
end balancing is a process intended to ensure the WYO company data are 
consistent with the WYO companies' reconciliation statements that 
compare the statistical transaction data to selected financial exhibit 
entries. This process is intended to validate that the BSA has recorded 
the same information that individual WYO companies have transmitted. 
The BSA's front-end balancing, while helping to verify that the number 
of records and dollar amounts agree to the reconciliation documents and 
the timeliness of the WYO-submitted data, does not verify or validate 
the data's accuracy. Although WYO companies submit statistical 
transaction-level data for claims losses paid and premiums written, 
which are the primary sources of financial activity for NFIP, the BSA 
does not base its financial reporting on this transaction-level data, 
but instead compiles the financial exhibits submitted by the WYO 
companies, and therefore reduces assurances that activity reported to 
FEMA represents actual transactions between WYO companies and 
policyholders. 

The BSA's monthly variance reporting[Footnote 18] was also not designed 
to ensure WYO company data accuracy. The Financial Control Plan 
requires the BSA to analyze WYO-submitted transaction-level 
(statistical) data in comparison with summary-level financial data 
submitted by WYO companies and produce a report identifying any 
differences. BSA personnel told us that various parties, such as the 
Standards Committee,[Footnote 19] use the Consolidated Variance Report 
to monitor the statistical data and financial information reported by 
the WYO companies. However--much like front-end balancing--the 
usefulness of the variance reporting process was limited because the 
BSA review was not designed to check the underlying NFIP transaction 
data submitted by WYO companies against an independent source for 
accuracy or completeness. 

The Design of FEMA's Financial Reporting for NFIP Activity Increases 
Risk: 

Along with the internal control weaknesses discussed previously, the 
design of FEMA's NFIP financial reporting process increased the risk of 
inaccurate or incomplete data because it did not include a process of 
analyzing the detailed data for accuracy or analyzing the financial 
reports in relation to the transaction-level data currently submitted 
by WYO companies for statistical purposes. Finally, the process places 
an overreliance on manual procedures for processing and entering data. 
The design weaknesses increase the likelihood of incomplete or 
inaccurate NFIP financial information. 

As FEMA's NFIP financial reporting process was designed, approximately 
90 WYO insurance companies submit summary financial information in e- 
mails to the BSA for consolidation and submission to FEMA. Throughout 
the entire process, the BSA captures and processes key financial 
information such as net written premiums on the financial statements 
prepared by the WYO companies. By presenting the net written premium 
amount, a WYO company does not show how much of its earned premiums 
went to pay premium refunds. This process limits management and audit 
visibility into identifying and resolving any underlying transaction 
reliability issues because it does not show different components of 
transactions. Furthermore, even when detailed transaction-level 
financial data were available, we found that supporting documentation 
was missing. Absent supporting transaction information, it was not 
practical for FEMA to reconstruct or validate NFIP amounts reported. 

FEMA's reliance on unverified WYO data and manual processing as 
described in the background section of this report greatly increases 
the chances of errors or misstatements. Similarly, a reliance on net 
(aggregated) data increases the risk of undetected data errors at the 
FEMA level. As a result, in fiscal year 2006, for example, FEMA OCFO 
officials had to correct over 100 journal vouchers totaling an 
estimated $260 billion. These errors occurred because FEMA OCFO 
officials erroneously recorded NFIP financial activity during fiscal 
year 2006. According to Standards for Internal Control implementation 
guidance, excessive adjustments to numbers or account classifications 
should not be necessary prior to finalization of financial reports. 
Proper classification and recording of transactions or events should 
take place throughout the entire life cycle of each transaction or 
event, including authorization, initiation, processing, and reporting. 

Weaknesses in FEMA's Oversight Structures Limited Effectiveness in 
Monitoring NFIP Financial Activity: 

Weaknesses in the broad oversight structures that FEMA relies on to 
monitor NFIP financial activity in three key areas limited the 
effectiveness of FEMA's oversight: (1) FEMA did not have processes to 
monitor WYO company audits by independent public accountants and other 
parties, including required biennial audits, state insurance department 
audits, and audits for cause; (2) FEMA did not perform triennial 
operational reviews of all WYO insurance companies; and (3) FEMA's 
claims reinspection program used flawed sampling procedures. These 
weaknesses are consistent with issues identified in our prior reports. 
As a result of these oversight deficiencies, FEMA's ability to identify 
and address NFIP financial transaction control breakdowns when 
processing transactions related to the 2005 Gulf Coast hurricanes was 
limited. 

FEMA Did Not Monitor Completion or Results of WYO Company Audits: 

FEMA did not have any mechanism for tracking completion and reviewing 
the results of required biennial financial statement audits of WYO 
companies, did not collect results of state insurance department audits 
related to flood insurance activity, or conduct audits for cause. 
According to the Financial Control Plan, biennial audits are FEMA's 
primary oversight mechanism for obtaining assurance that it receives 
complete and accurate financial management information from WYO 
insurance companies. The plan provides that such audits are intended to 
reduce or eliminate the need for FEMA auditors to conduct on-site 
visits to WYO insurance companies to oversee their financial 
activities; specifies that biennial financial statement audits are a 
required condition of an insurance company's participation in the WYO 
program; and states that they must be conducted by an independent 
Certified Public Accountant.[Footnote 20] According to the Financial 
Control Plan, these audits are to include an opinion on the fairness of 
the financial statements, the adequacy of the internal controls, and 
the extent of compliance with laws and regulations. In 2007, we 
reported that 5 out of 94 (about 5 percent) WYO companies had biennial 
audits completed for the 2-year period covering fiscal years 2005 and 
2006.[Footnote 21] In response to findings that FEMA had failed to 
consistently enforce the biennial audit requirement, FEMA officials 
told us that they had exempted from this requirement companies that 
said that they were overwhelmed with administering flood claims after 
the 2005 hurricane season. 

The Financial Control Plan also requires FEMA to consider the results 
of other audits of the WYO companies such as state insurance department 
audits, as appropriate. Based on our testing of FEMA's compliance with 
the Financial Control Plan, we reported in August 2009[Footnote 22] 
that FEMA rarely or never reviewed state insurance department audits. 
FEMA officials clarified that state departments of insurance audits 
require a "trigger." For such audits, a financial officer of the 
insurer is to "trigger" an alert to FEMA of any state audit involving 
NFIP activities. A more independent way for FEMA to learn of these 
audits would be to have contact directly with the states. According to 
FEMA, during our review period, FEMA did not receive any such notices. 
These audits are typically in response to company-specific concerns-- 
they are not routine. 

The Financial Control Plan outlines criteria that, in combination or 
independently, may prompt FEMA to perform an audit for cause. Based on 
our testing of FEMA's compliance with the Financial Control Plan, we 
reported in August 2009[Footnote 23] that FEMA rarely or never 
implemented audits for cause. According to FEMA officials, the last 
audits for cause were done in the late 1990s. Because FEMA did not 
systematically track and centrally store all required evaluations, 
inspections, audits, or reviews, FEMA management had no basis for 
timely access to them or effectively overseeing the 90-plus 
participating insurance companies, and therefore had no reasonable 
basis for determining whether any audits for cause were necessary. FEMA 
told us that based on our August 2009 recommendations, it now plans to 
implement such a system. It will be important for FEMA to maintain 
ongoing awareness of state audit initiatives identified through an 
independent information source. 

Operational Reviews Are Ineffective: 

FEMA did not perform operational reviews for all WYO companies on a 
triennial basis as required and used a flawed sampling methodology to 
select underwriting files at the WYO companies that it did review. 
[Footnote 24] The Financial Control Plan calls for conducting the 
following types of operational reviews: underwriting/policy 
administration; claims; marketing; customer services; and litigation. 
[Footnote 25] These reviews are intended to provide FEMA with an 
effective mechanism to monitor, identify, and resolve problems related 
to how WYO companies sell and renew NFIP policies and adjust claims. 
According to Standards for Internal Control implementation guidance, 
[Footnote 26] information should be available on a timely basis to 
allow effective monitoring of events, activities, and transactions and 
to allow prompt action. Given that operational reviews are FEMA's 
primary method to monitor the WYO insurance companies for the two most 
significant areas of the program--underwriting and claims processing--
it is important for FEMA to conduct these reviews on a regular basis. 

Without the timely information regarding how WYO companies sell and 
adjust claims gained through operation reviews, FEMA cannot be certain 
that the WYO companies provide appropriate financial information to 
NFIP program managers. Policies and procedures specify that all WYO 
companies are to be reviewed at a minimum every 3 years. Therefore, we 
expected that FEMA would have done an operational review of all the WYO 
companies during the 3-year period covering 2005 to 2007. However, as 
shown in figure 3, we found that FEMA had completed operational reviews 
on only 71 percent (82 out of 116) of WYO companies during this period. 

Figure 3: WYO Companies with Operational Reviews Completed by FEMA in 
Fiscal Years 2005 through 2007: 

[Refer to PDF for image: pie-chart] 

WYO companies that had operational reviews completed: 71%; 
WYO companies that did not have operational reviews completed: 29%. 

Source: GAO analysis of data provided by FEMA. 

[End of figure] 

Further, as previously reported,[Footnote 27] FEMA did not use a 
statistical sampling methodology to select files for operational 
reviews--instead it uses nonprobability sampling processes. In 
nonprobability sampling, staff are to select a sample based on their 
knowledge of the population's characteristics. The major limitation of 
this type of sampling is that the results cannot be generalized to a 
larger population. A nonprobability sample is therefore not appropriate 
to use if the objective is to generalize about the population from 
which the sample is taken.[Footnote 28] 

FEMA's Flawed Sampling Procedures Hamper Its Claims Reinspection 
Program: 

According to FEMA's Financial Control Plan, the claims reinspection 
program is to serve as a mechanism supporting FEMA's oversight of WYO 
insurance companies. The objectives of the claims reinspection program 
were to (1) keep FEMA and the BSA informed, (2) assist in the overall 
claims operation, and (3) provide necessary assurances and 
documentation for dealing with external parties. The BSA is to conduct 
all reinspections and prepare a report documenting the appropriateness 
of the original claims adjuster's work. However, we found that FEMA did 
not use a statistical sampling basis for selecting claims for 
reinspection. Specifically, adjusters selected claims to reinspect 
based upon judgmental criteria including, among other items, the size 
and location of loss and complexity of claims. Further, FEMA only 
required testing for a selection of claims for flood events with over 
400 claims per a single flood event for a particular WYO company. Also, 
the actual number of claim losses selected for reinspection only 
represents a very small percentage of the total number of claim losses 
processed. Using this flawed methodology for selecting samples for 
claims reinspections, the percentage of claims reinspected by flood 
event for fiscal years 2005 and 2006 was 1.8 percent for Katrina, 3.6 
percent for Rita, and 5.0 percent for Wilma. By using a statistical 
sampling methodology for selecting claim reinspections, FEMA would be 
able to use this oversight mechanism to make conclusions about the 
accuracy of the total amount of claims losses paid, with a similar 
level of effort. 

These findings are consistent with findings from previous audits. 
Specifically, we previously reported in October 2005[Footnote 29] that 
neither FEMA nor its program contractor used a statistically valid 
method for selecting files for reinspections of claims adjusted after 
each flood event because FEMA guidance did not include procedures on 
the sample selection process. Without a statistically valid sampling 
methodology that represents the population, the agency cannot project 
the results of these reinspection oversight activities to confidently 
determine the overall accuracy of claims settled for specific flood 
events or assess the overall performance of insurance companies and 
their adjusters in fulfilling their NFIP responsibilities. In December 
2006, we again reported[Footnote 30] that FEMA neither used a random 
sample of claims for its reinspections nor analyzed the overall results 
of those reinspections to determine the total number of payment errors 
and their potential causes. 

Recent and Planned Initiatives Do Little to Address Identified 
Weaknesses: 

FEMA has revised its draft Financial Control Plan (dated August 2009) 
to require selection of a statistically representative sample of claim 
files for its reinspection reviews. However, the modified policy 
continues to cover only those claims associated with single flood 
events with over 400 claims per WYO company. Substantial claims 
activity may still be excluded from reinspection. For fiscal years 2005 
and 2006, almost $1.5 billion of the $16.5 billion in claims filed 
would not have been considered for reinspection under this criterion. 
Until processes are modified to make all cases eligible for 
reinspection, FEMA will not be able to effectively determine whether 
the case population is complete as well as whether the total amount of 
claims losses paid is reasonable. 

Available data indicate that the number of biennial financial audits 
has increased since FEMA began tracking the results in fiscal year 
2008. Figure 4 shows that few audits were conducted for fiscal years 
2005 and 2006, but that there was considerable improvement for fiscal 
years 2006 and 2007. 

Figure 4: Companies That Had Biennial Financial Audits Completed or Not 
Completed for Fiscal Years 2005 through 2007: 

[Refer to PDF for image: stacked vertical bar graph] 

Fiscal year: 2005-2006; 
WYO companies that did not have financial audits completed: 89; 
WYO companies that had financial audits completed: 5; 
Total: 94. 

Fiscal year: 2006-2007; 
WYO companies that did not have financial audits completed: 49; 
WYO companies that had financial audits completed: 46; 
Total: 95. 

Source: GAO analysis of data provided by FEMA. 

Note: As the biennial audits cover a 2-year period, the fiscal year 
2005 to 2006 audits were completed in fiscal year 2007 and the fiscal 
year 2006 to 2007 audits were completed in fiscal year 2008. 

[End of figure] 

Prior to fiscal year 2008, FEMA had not tracked and reviewed these 
audit results because FEMA did not follow NFIP policies and procedures 
requiring it to receive and analyze such information. Accordingly, FEMA 
could not determine whether it received and reviewed all required audit 
reports, nor have a basis for monitoring implementation of necessary 
corrective actions. In response to our previous recommendation 
regarding this long-standing concern, FEMA is now using a tracking 
mechanism to document audit reports received and those reviewed by FEMA 
staff.[Footnote 31] According to FEMA, once the financial audit reports 
are received, staff and management now review the audit reports and 
document the results of their review on the tracking schedule. While 
improvements have been made with regard to tracking and reviewing the 
results of biennial audits, this is only one component of FEMA's 
oversight structure and, as discussed in this report, we continue to 
note weaknesses in the other areas. 

FEMA has a system development and implementation effort, referred to as 
NextGen,[Footnote 32] under way. This effort has experienced delays and 
it is too soon to determine whether planned program efficiencies--such 
as confirmation of insured's property address--will be achieved under 
the new system. According to FEMA, the NextGen system implementation 
effort is designed to be an insurance system that links key data 
elements like claims and policies through shared processes. Under the 
current system, the BSA maintains claim losses paid and premium 
policies data in separate databases. FEMA officials have expressed 
concern about the readiness of the NextGen system to support NFIP 
program operations. 

Conclusions: 

As currently designed and implemented, FEMA's internal controls over 
NFIP offer limited transaction-level accountability and assurances that 
financial reporting is accurate or that insurance company operations 
conform to program requirements. Transaction-level accountability and 
reporting to administer NFIP are fundamental to attaining 
accountability over program resources. Internal controls are also 
critical to ensure that claim payments are adequately supported, and 
FEMA was missing key documentation to support claims. Given the 
involvement of multiple private entities participating in this 
insurance program, establishing and implementing effective policies and 
procedures to thoroughly implement required audits and overall 
operational and targeted reviews will be critical for FEMA to exercise 
its managerial responsibilities. FEMA has taken some steps to 
strengthen NFIP internal controls such as overseeing WYO companies by 
tracking and reviewing the results of their required biennial financial 
audits. The enormous potential financial burden on the federal 
government that flood events pose, coupled with the risks of inaccurate 
and incomplete NFIP financial information described in this report, 
serve to underscore that effective NFIP controls are critical. As such, 
it will be important to take immediate actions to improve these 
controls over NFIP transactions, financial reporting, and oversight. 

Recommendations for Executive Action: 

To improve the financial reporting process and strengthen internal 
controls, we recommend that the Secretary of Homeland Security direct 
the Acting Assistant Administrator, FEMA Mitigation Directorate, to 
take the following seven actions: 

* Augment NFIP policies to require the BSA to develop procedures to 
analyze financial reports in relation to the transaction-level 
information that WYO companies submit for statistical purposes. 

* Revise required internal control activities for the BSA to provide 
for verifying and validating the reliability of WYO-reported financial 
information based upon a review of a sample of the underlying 
transactions or events, or obtain verification that these objectives 
have been met through independent audits of the WYO companies. 

* Determine the feasibility of integrating and streamlining numerous 
existing NFIP financial reporting processes to reduce the risk of 
errors inherent in the manual recording of accounting transactions into 
multiple systems. 

* Establish and implement procedures to require reviewing available 
information such as the results of biennial audits, operational 
reviews, and claim reinspections to determine whether the targeted 
audits for cause managerial tool should be used. 

* Establish and implement procedures to require maintaining and 
considering current information from an independent source regarding 
state audit results to gather pertinent information such as customer 
service issues and inform determinations about when to conduct audits 
for cause. 

* Establish and implement procedures to schedule and conduct all 
required operational reviews within the prescribed 3-year period. 

* Establish and implement procedures to select statistically 
representative samples of all claims as a basis for conducting 
reinspections of claims by general adjusters. 

Agency Comments and Our Evaluation: 

We requested comments on a draft of this report from the Secretary of 
Homeland Security. Comments received from the DHS Departmental GAO/OIG 
Liaison Office on behalf of FEMA are reprinted in appendix II. In its 
comments, FEMA concurred with two of our recommendations, stated that 
two recommendations were unnecessary in that the recommended procedures 
were already in place, and disagreed with the remaining three 
recommendations. We reaffirm all seven recommendations. 

With respect to the recommendations for which FEMA concurred regarding 
(1) streamlining financial reporting processes and (2) conducting 
operational reviews, FEMA noted it has actions under way to integrate 
and streamline numerous existing financial reporting processes in the 
design of a new NFIP system, and stated that its new operational review 
process will address our recommendation to schedule and conduct all 
required operational reviews within the prescribed 3-year period. 

Regarding our recommendation for establishing and implementing 
procedures for reviewing all available audit and other reports, FEMA 
stated that it already had a process in place to review WYO company 
performance and trigger audits for cause. FEMA further commented that 
the Standards Committee considers the results of biennial audits, 
operational reviews, and claims reinspections when it reviews company 
performance and considers whether to recommend audits for cause. We 
disagree that the process FEMA has in place is sufficient to address 
our recommendation. As discussed in our draft report, during the period 
of our review, FEMA management, including the Standards Committee, 
lacked timely access to all audit and other reports because FEMA did 
not systematically track and centrally store all required evaluations, 
inspections, audits, or reviews. Therefore, without further action to 
establish additional procedures directed at ensuring access and a 
systematic review of WYO company performance, FEMA will continue to be 
unable to effectively oversee the 90-plus participating insurance 
companies or determine whether any audits for cause are necessary. 

Also, regarding our recommendation concerning selecting statistically 
representative samples of claims for reinspections, FEMA stated that 
the reinspections are not intended to be a definitive audit of the 
NFIP's claims handling process, and cited the random sample of claims 
it currently has in place. We disagree. As discussed in our draft 
report, adjusters selected claims to reinspect based upon judgmental 
criteria, not on a random sample. Further, FEMA only required 
reinspection when there were more than 400 claims per flood event for a 
particular WYO company. Because reinspections are conducted principally 
on open claims files to document the appropriateness of the original 
claims adjuster's work, the lack of a statistically representative 
sample not only precludes FEMA from projecting the results of these 
reinspections to determine the overall accuracy of claims, it also 
limits FEMA's ability to continuously assess the overall performance of 
insurance companies and adjusters in fulfilling their NFIP 
responsibilities. FEMA also noted that claims operational reviews are 
designed to provide feedback on claims settlements and ascertain 
compliance by WYO companies. The claims operational reviews that FEMA 
cited, while an important oversight mechanism, do not allow for 
continuous feedback concerning the overall insurance company 
performance. 

We also continue to reaffirm our three recommendations for which FEMA 
disagreed in its comments on our draft report. First, with respect to 
our recommendations that FEMA develop financial reports using the 
transaction-level information that WYO companies currently submit for 
statistical purposes, FEMA stated that implementing our recommendation 
would be onerous and burdensome because of the number of transactions 
involved. We subsequently adjusted our recommendation to have NFIP 
augment its policies to require the BSA to develop procedures to 
analyze financial reports in relation to the transaction-level 
information that WYO companies submit for statistical purposes. Such a 
procedure would help compensate for the risks introduced by the current 
approach of entering summary-level information to its financial 
reporting system. Because WYO companies already submit transaction- 
level data on claims losses paid and premiums written and FEMA uses 
this information for statistical purposes, using these transaction- 
level financial data to increase the reliability of FEMA's financial 
reporting should impose minimal additional burden. 

Also, with respect to FEMA's nonconcurrence with our recommendation to 
verify and validate WYO-reported financial information, FEMA maintained 
that the form and structure of the transaction-level detail is audited 
at the source, including consideration of the relevance, reliability, 
and accuracy of the transaction-level detail. However, as discussed in 
our report, during the period of our review, we were not provided any 
evidence showing that FEMA obtained any assurances concerning the 
accuracy or validity of WYO company transaction-level financial data. 
Specifically, FEMA did not demonstrate that it had mechanisms in place 
during fiscal years 2005 through 2007 for receiving and reviewing the 
results of the required biennial financial statement audits of WYO 
companies, or for tracking completion of these audits. FEMA was unable 
to provide evidence of whether all WYO companies had completed biennial 
audits and had not reviewed the results of these WYO company biennial 
audits. Further, as discussed in our report, FEMA officials exempted 
certain WYO companies from the biennial audit requirement after the 
2005 hurricane season. Therefore, FEMA had no assurance as to the 
accuracy or validity of WYO company transaction-level financial data. 
We reaffirm our recommendation that FEMA revise required internal 
control activities for the BSA to provide required procedures for 
verifying and validating the reliability of WYO-reported financial 
information based upon a review of a sample of the underlying 
transactions or events. We also adjusted our recommendation to include 
the option for FEMA to obtain assurance of the reliability of WYO 
company-reported financial data by verifying that those objectives were 
met through the independent audits of WYO companies. 

Finally, FEMA did not concur with our recommendation to maintain and 
consider information from an independent source regarding state audit 
results in determining whether to conduct audits for cause. FEMA 
contended that such sources do not focus on federal programs, such as 
NFIP. However, FEMA's Financial Control Plan states that it is expected 
that audits of WYO companies by state insurance departments will 
include flood insurance activity. Further, FEMA acknowledges receiving 
information from a source independent of the WYO companies. 
Specifically, it acknowledged receiving correspondence from state 
insurance departments regarding issues of customer service with the WYO 
companies. It is important for FEMA to establish and implement 
procedures to require maintaining and considering all current 
information available from an independent source regarding state audit 
results. We found that FEMA rarely received or reviewed information 
from state insurance department audits. Consequently, we continue to 
reaffirm our recommendation to obtain and consider independent 
information on state audits of the WYO companies, rather than 
continuing to rely solely on the WYO company that underwrites policies 
and processes claims to alert FEMA of any state issues. 

FEMA also expressed concern over several points in our draft report's 
narrative. We continue to affirm the process descriptions and the 
findings in our draft report but made several changes in the report to 
clarify the narrative. Our responses to other FEMA concerns with our 
draft's narrative are provided following FEMA's comments in appendix 
II. 

As agreed with your office, unless you publicly announce the contents 
of this report earlier, we plan no further distribution until 30 days 
from the report date. At that time, we will send copies to the 
Secretary of Homeland Security, relevant congressional committees, and 
other interested parties. The report will also be available at no 
charge on our Web site at [hyperlink, http://www.gao.gov]. 

If you or your staff have any questions about this report, please 
contact me at (202) 512-9095 or raglands@gao.gov. Contact points for 
our Offices of Congressional Relations and Public Affairs may be found 
on the last page of this report. GAO contact and staff acknowledgments 
are listed in appendix III. 

Sincerely yours, 

Signed by: 

Susan Ragland: 
Director, Financial Management and Assurance: 

[End of section] 

Appendix I: Scope and Methodology: 

To assess whether controls were effective in providing accountability 
and reliable financial reporting for National Flood Insurance Program 
(NFIP) transactions during the 2005 to 2007 time frame, we obtained and 
reviewed available transaction data and financial reports for NFIP for 
fiscal years 2005 through 2007. We selected these years to identify 
transactions relevant to the 2005 Gulf Coast hurricanes and to capture 
more current financial information. We reviewed the Write Your Own 
(WYO) Financial Control Plan, WYO Accounting Procedures Manual, and 
other relevant NFIP policy guidance documents to determine the design 
of NFIP financial reporting processes and related internal controls. We 
reviewed NFIP transaction accountability in accordance with the 
guidelines of the Federal Financial Management Improvement Act of 1996 
(FFMIA).[Footnote 33] We also interviewed Federal Emergency Management 
Agency (FEMA), FEMA contractors, and Department of Homeland Security 
(DHS) Office of Inspector General (OIG) officials to document and 
obtain an understanding of the financial reporting process and related 
internal controls for NFIP transactions. We conducted walkthroughs to 
understand the reporting process for financial transactions including 
the review of related evidentiary supporting documentation, including 
journal vouchers and adjusting journal entries. Further, to determine 
how the financial transactions were recorded, specifically insurance 
premiums written and claim losses paid, we reviewed NFIP financial 
reports and met with NFIP program and FEMA officials to obtain an 
understanding of the processing cycles for premiums written and claim 
losses paid. We interviewed FEMA personnel and contractors responsible 
for collecting and maintaining NFIP financial data to understand the 
available data. In addition, we obtained requested extracts of NFIP 
databases of the insurance premiums written and claim losses paid for 
these fiscal years to identify the total population including the 
number of transactions, and planned to select statistical samples of 
claims and policies to test from these databases. We reconciled the 
Bureau and Statistical Agent (BSA) extracts of net premiums written and 
claim losses paid databases to the BSA prepared financial statements 
based on the data provided to FEMA. Once we were able to successfully 
complete our reconciliation,[Footnote 34] but before selecting samples, 
we performed data reliability tests on the databases and determined 
that the claims losses paid database was sufficiently reliable for our 
purposes. We did not audit the data that WYO companies submit to FEMA's 
contractor, CSC, nor did we audit the data produced by CSC or the 
information included by FEMA in DHS' annual reports. We used the 
statistical samples of insurance claim losses paid as outlined below to 
perform detailed testing through verification of data fields such as 
coverage and deductible amounts, claim payment amounts, and policy 
effective dates against source documents. We also used these samples to 
further test internal controls over NFIP financial reporting. Results 
from the statistical samples were projected by fiscal year both 
individually and combined. See table 1 below for details related to the 
statistical samples. 

Table 1: Description of Claims Populations and Related Statistical 
Samples: 

Fiscal year: 2005; 
Type of sample: Classical probability proportionate to size sample; 
Sample size: 59; 
Total dollar value of claim losses selected in the sample (in 
millions): $16.0; 
Total number of claim losses in the sample population: 104,517; 
Total dollar value of claim losses in the sample population (in 
millions): $2,694.5. 

Fiscal year: 2006; 
Type of sample: Classical probability proportionate to size sample; 
Sample size: 59; 
Total dollar value of claim losses selected in the sample (in 
millions): $10.3; 
Total number of claim losses in the sample population: 189,776; 
Total dollar value of claim losses in the sample population (in 
millions): $16,179.7. 

Fiscal year: 2007; 
Type of sample: Classical probability proportionate to size sample; 
Sample size: 59; 
Total dollar value of claim losses selected in the sample (in 
millions): $6.3; 
Total number of claim losses in the sample population: 38,409; 
Total dollar value of claim losses in the sample population (in 
millions): $885.4. 

Source: GAO. 

[End of table] 

Using the above statistical samples, we also tested other NFIP program- 
oversight controls as deemed necessary and in accordance with our 
engagement objectives. In order to ensure efficient detailed testing, 
we conducted dual-purpose testing, which includes reviewing dollar 
amounts as well as the related internal controls. We found information 
in the premiums written database was not sufficiently reliable for our 
purposes. We were unable to perform detailed testing of the premiums 
written database due to a significant number of data-reliability issues 
that we discovered. 

To evaluate oversight structures in place to monitor NFIP financial 
activity for the 3-year period covering 2005 to 2007, we reviewed prior 
GAO and DHS OIG reports to identify and follow up on any previously 
reported weaknesses or concerns, including sample selection for claims 
reinspections and tracking results of biennial financial audits. We 
also interviewed FEMA personnel and contractors regarding the oversight 
structures in place. In addition, we identified and assessed 
significant oversight structures as outlined in the WYO Financial 
Control Plan, and analyzed the results of these controls. 

To assess whether recent and planned actions to improve NFIP controls 
and the overall control environment are likely to address identified 
financial control weaknesses, we reviewed NFIP policy and procedural 
guidance that has been issued subsequent to the 2005 Gulf Coast 
hurricanes. We also met with key program officials to discuss the 
NextGen system development effort. We also discussed recent and planned 
NFIP program changes to address the internal control weaknesses and 
oversight issues previously identified by GAO and the DHS OIG. 

[End of section] 

Appendix II: Comments from the Department of Homeland Security: 

Note: GAO comments supplementing those in the report text appear at the 
end of this appendix. 

U.S. Department of Homeland Security: 
Washington, DC 20528: 

December 4, 2009: 
	
Ms. Susan Ragland: 
Director: 
Financial Management and Assurance: 
U.S. Government Accountability Office: 
441 G Street, NW: 
Washington, DC 20548: 

Dear Ms. Ragland: 

Re: Draft Report GAO-10-66, Financial Management: Improvements Needed 
in National Flood Insurance Program's Financial Controls and Oversight
(GAO Job Code 195135): 

The Department of Homeland Security (Department) appreciates the 
opportunity to review and comment on the U.S. Government Accountability 
Office's (GAO's) draft report referenced above. The Department, 
specifically the Federal Emergency Management Agency (FEMA), disagrees 
with three of the seven recommendations and has concerns about the 
draft report narrative. 

To improve the financial reporting process and strengthen internal 
controls, GAO recommended that the Secretary of Homeland Security 
direct the acting assistant administrator, FEMA Mitigation Directorate, 
to take seven actions. 

GAO Recommendation 1: Augment National Flood Insurance Program (NFIP) 
policies and procedures to require the Bureau and Statistical Agent 
(BSA) to use the transaction-level information that Write Your Own 
(WYO) companies submit to develop financial reports, in addition to the 
current practice of using transaction-level information solely for 
statistical purposes. 

FEMA's Response: FEMA disagrees with the recommendation. The NFIP' s 
financial statements have been audited for over 20 years and internal 
controls have been in place since the WYO program's inception. During 
that time, independent auditors, the Inspector General or the GAO have 
not suggested that the design of FEMA's financial reporting procedures 
is flawed. Implementing this recommendation would be onerous and 
burdensome because of the number of transactions involved. 

GAO Recommendation 2: Revise required internal control activities for 
the BSA to provide for verifying and validating the reliability of WYO-
reported financial information based upon a review of a sample of the 
underlying transactions or events. 

FEMA's Response: FEMA disagrees with the recommendation. The form and 
structure of the transaction level detail is audited at the source, 
including consideration of the relevance, reliability and accuracy of 
the transaction level detail. 

GAO Recommendation 3: Determine the feasibility of integrating and 
streamlining numerous existing NFIP financial reporting processes to 
reduce the risk of errors inherent in the manual recording of 
accounting transactions into multiple systems. 

FEMA's Response: FEMA agrees with the recommendation and is addressing 
it in the design of the new NFIP system. 

GAO Recommendation 4: Establish and implement procedures to require 
reviewing available information such as the results of biennial audits, 
operational reviews, and claim re-inspections to determine whether the 
targeted Audits for Cause managerial tool should be used. 

FEMA's Response: FEMA does not believe the recommendation is necessary. 
The NFIP has always had a process in place to review company 
performance and trigger Audits for Cause. The WYO Standards Committee 
considers the results of biennial audits, operation reviews and claims 
re-inspections when it reviews company performance and considers 
whether to recommend Audits for Cause. 

GAO Recommendation 5: Establish and implement procedures to require 
maintaining and considering current information from an independent 
source regarding state audit results to gather pertinent information 
such as customer service issues and inform determinations about when to 
conduct Audits for Cause. 

FEMA's Response: FEMA disagrees with the recommendation since State 
Departments of Insurance audits typically do not focus on the NFIP 
because it is a Federal insurance program. FEMA does receive 
correspondence from State Insurance Departments regarding issues of 
customer service with a Write-Your-Own Company. 

GAO Recommendation 6: Establish and implement procedures to schedule 
and conduct all required operational reviews within the prescribed 3-
year period. 

FEMA's Response: FEMA agrees with this recommendation. The new 
Operation Review process will begin to address this recommendation in 
2010. 

GAO Recommendation 7: Establish and implement procedures to select 
statistically representative samples of all claims as a basis for 
conducting re-inspections of claims by general adjusters. 

FEMA's Response: FEMA does not believe the recommendation is necessary. 
The NFIP selects a random sample for claims re-inspections and a 
statistically representative sample for Claims Operation Reviews. 

FEMA Comments: 

Background: 

WYO Companies: Adjusting Claims: 

GAO mistakenly asserts that the NFIP overpaid at least $113.6 million 
by not taking the deductible from total losses despite FEMA's numerous 
attempts to explain the flood insurance deductible. [See comment 1] In 
wording that is comparable to that used throughout the property and 
casualty insurance industry, the Standard Flood Insurance Policy says 
it best. Section VI. A. of the Dwelling Form reads: 

When a loss is covered under this policy, we will pay only that part of 
the loss that exceeds your [the policyholder] deductible amount, 
subject to the limit of liability that applies. 

The value of the deductible is in small losses that are not payable 
until the covered loss exceeds the deductible amount. This is why 
deductible credits are given. For instance, if the policyholder 
purchases $250,000 of building coverage, the maximum NFIP limits 
available, with a $1,000 deductible, then no loss is payable until the 
covered loss exceeds $1,000, the deductible amount. When the covered 
loss is exactly $250,000, the deductible is taken from the covered loss 
and $249,000 is paid. However, if the covered loss is $251,000, the 
$1,000 deductible is also taken from the covered loss and $250,000 is 
paid. If otherwise, a policyholder purchasing a $250,000 building limit 
of liability would rightfully be disappointed to learn that only 
$249,000 of the purchased limit could be paid regardless of the covered 
loss amount. If the covered loss is $252,000, the $1,000 deductible is 
taken from the covered loss, but — as the policy states - the payment 
is subject to the limit of liability that applies and only $250,000 is 
paid. 

The payment of the $250,000 policy limit does not necessarily indicate 
a total loss. A building's value could be more than the $250,000 policy 
limit and, as the example above demonstrates, the covered loss could be 
in excess of the $250,000 limits. The key is the payment is subject to 
the policy limits and no more than $250,000 may be paid. This treatment 
of the deductible has been used since the inception of the NFIP and is 
consistent with practices used by the property and casualty industry. 
Moreover, audits by the GAO, the Inspector General, and independent CPA 
firms have not indicated that there was a problem with the NFIP's 
application of the flood insurance deductible. 

NFIP's Financial Reporting Process: 

GAO notes that the financial data received from the WYO companies is 
consolidated into a single file. However, this file is uploaded into 
Focus, not manually loaded or re-keyed. The Focus data is then 
automatically downloaded into the Traverse financial reporting system. 
The BSA personnel do not enter the data again as noted in the report 
and process flow chart. This misunderstanding of the financial 
reporting process was the basis for several inaccurate conclusions. 
[Report incorporates additional detail on pages 6, 7, 11, and 12 
clarifying FEMA's use of manual processes] 

Weaknesses in NFIP Transaction Controls and Processing Limited 
Accountability and Financial Reporting: 

WYO Companies Did Not Provide Complete Documentation to FEMA for Claims 
Transactions: 

The 2005 to 2007 period that GAO reviewed was unprecedented in NFIP 
history. In 2005, many of the 55,000 losses from four Florida 
hurricanes in 2004 and much of the associated $2 billion in losses were 
paid. Losses from Hurricanes Katrina, Rita and Wilma were also paid 
primarily in 2005 and 2006. Hence, the $17.6 billion in paid losses for 
2005 exceed the combined total losses for all years since the NFIP's 
inception in 1978. These unprecedented times required unprecedented 
solutions. Because of the frequency (209,000 losses), complexity, and 
severity of the 2005 Hurricane Katrina losses, certain expedited claims 
procedures were put in place. Hence, the requirement to file the 
preliminary report and the final report was waived. [See comment 2] 

GAO correctly describes the working of the Financial Assistance/Subsidy 
Arrangement. Companies are required to process NFIP losses in 
accordance with all the companies insurance policies. Over the years 
the Operation Reviews have determined that the information included in 
the NFIP forms are also provided by company proprietary forms. The 
particular company referred to in the report is among the three largest 
WYO companies; therefore the random sample reviewed by GAO may have 
produced a larger number of claims files for this company, which could 
have overstated the number of missing preliminary and final reports. 
[See comment 3] 

BSA-level Internal Controls Do Not Verify Accuracy of WYO Company Data: 

The internal controls for the front end balancing process include 
reconciliations, automated statistical edits, financial 
reconciliations, balanced exhibits, signed certifications by executives 
at the WYO companies, and policy, premium, and loss data detail edits 
in the information system. These controls have been in place and 
audited for over 20 years. Independent auditors, the Inspector General 
and the GAO have not suggested that the design of the internal controls 
governing FEMA's financial reporting procedures is flawed. The form and 
structure of the transaction level detail is audited at the source, 
including consideration of the relevance, reliability, and accuracy of 
the transaction level detail and this does not limit assurance or 
create material weaknesses in internal control. These recurring 
internal control reviews and external audits are not mentioned as 
mitigating consideration in the text of the report. [See comment 4] 

The Design of FEMA's Financial Reporting for NFIP Activity is Flawed: 
[Report addresses on pages 11 and 12] 

There appears to be a philosophical difference between GAO and FEMA 
regarding where the transaction level detail should reside. The design 
of NFIP' s processing system is based on distributed accountability at 
the WYO site with auditable compliance and oversight control at the 
Bureau and Statistical Agent and FEMA. Distributed accountability is 
not an internal control weakness and the design of FEMA's financial 
reporting for the NFIP is not flawed. FEMA does not rely on unverified 
WYO data and manual processing. GAO does not acknowledge this in the 
report and does not sufficiently take into account the assurances 
provided by reconciliation controls and independent audits. FEMA 
officials believe the NFIP reports complete and accurate financial 
information that withstands audit scrutiny. 

Weaknesses in FEMA's Oversight Structure Limited Effectiveness in 
Monitoring NFIP Financial Activity: 

FEMA Did Not Monitor Completion or Results of WYO Company Audits: 

In 2008, FEMA implemented a new process to track completion and review 
of the results of the required biennial audits. FEMA received all 
audits due in 2009 and, as necessary, followed-up with the WYO 
companies. 

GAO's suggestion that FEMA does not systematically monitor the WYO 
companies is incorrect. The WYO Standards Committee regularly reviews 
company performance including financial and statistical data 
submissions, claims and underwriting operational review results, 
biennial audit reports, and other material relating to company 
performance. Should performance fall below an acceptable level, the 
Committee can request an Audit for Cause. The Standards Committee's 
vigilant monitoring of the WYO companies has reduced if not eliminated 
the need for Audits for Cause, which GAO notes have not been done since 
the 1990s. Regarding State Departments of Insurance audits, these 
audits typically do not focus on the NFIP because it is a Federal 
insurance program. FEMA does receive correspondence from State 
Insurance Departments regarding issues of customer service with a Write-
Your-Own Company. FEMA officials know of no independent source that 
could provide this information. 

Operational Reviews Are Ineffective: 

FEMA has revised its Operation Review process, which will be phased in 
beginning in 2010, to address GAO's concerns. WYO companies are on a 
three-year cycle for Operation Reviews. If a company fails a review, a 
follow-up review is scheduled within 12 months. The recently revised 
draft Financial Control Plan provides for a new process that addresses 
the vendor's small, medium, medium-large, and large client WYO 
companies. The large companies, those with more than 100,000 policies 
in force, are independently reviewed every three years. Small and 
medium sized companies can be part of a combined review and are also on 
a three-year schedule. In addition, the new review process allows 30 
additional randomly selected claims to be reviewed - 10 Increased Cost 
of Compliance claims, 10 Residential Condominium Building Association 
Policy claims, and 10 Post-FIRM (Flood Insurance Rate Map) elevated 
building claims. 

With regard to Litigation Operation Reviews, FEMA explained to GAO that 
the litigation process is generally reviewed when a claim in litigation 
is selected randomly, however, FEMA insurance examiners also review all 
litigation claim expenses once the total fee exceeds a threshold 
amount. In this way, FEMA insurance examiners review the substance of a 
much greater number of litigation files than operation reviews would 
allow. 

FEMA's Flawed Sampling Procedures Hamper its Claims Reinspection 
Program: 

The purpose of the claims reinspection program is to identify and 
mitigate procedural problems early in the claims adjustment process. 
FEMA has used a random sample of claims for reinspections since 2007. 
Reinspections are conducted as flood claims are occurring to minimize 
errors in the settlement of claims. Reinspections are not intended to 
be a definitive audit of the NFIP's claims handling process and hence, 
GAO's conclusion that "the agency cannot project the results of these 
reinspection oversight activities to confidently determine the overall 
accuracy of claims settled for specific flood events or assess the 
overall performance of insurance companies and their adjusters in 
fulfilling their NFIP responsibilities" is erroneous. 

Claims operation reviews are designed to provide feedback on claims 
settlements and ascertain compliance by WYO companies. In response to a 
previous GAO audit, FEMA began using a statistically representative 
sample for Claims Operation Reviews. GAO's misunderstanding of the two 
processes lead to incorrect conclusions regarding the efficacy of the 
claims reinspection program. 

Thank you again for the opportunity to comment on this draft report and 
we look forward to working with you on future homeland security issues. 

Sincerely, 

Signed by: 

Jerald E. Levine: 
Director: 
Departmental GAO/OIG Liaison Office: 

The following section provides GAO's comments on DHS' letter dated 
December 4, 2009. 

GAO Comments: 

1. We deleted the footnote containing this estimate, although the draft 
report did not characterize it as an overpayment. We revised the text 
on page 5 in the Background section to clarify our description of 
FEMA's claims adjustment process. 

2. Our report recognizes the unprecedented losses, but nevertheless the 
internal control issues we identified raise concerns that the amounts 
of the claims NFIP paid were not adequately supported even considering 
the expedited procedures in place at the time. 

3. Because we used a statistical sample from the insurance claim losses 
paid databases, our sample allows us to make generalizations about the 
population. The larger WYO companies that processed more claims would 
constitute a larger number of claims in our statistical sample. 

4. FEMA was unable to provide evidence of whether all WYO companies had 
completed biennial audits and had not reviewed the results of any 
biennial audits. Further, as discussed in our draft report, FEMA 
officials exempted certain WYO companies from the biennial audit 
requirement after the 2005 hurricane season. Therefore, FEMA had no 
assurance as to the accuracy or validity of WYO company transaction- 
level financial data. 

[End of section] 

Appendix III: GAO Contact and Staff Acknowledgments: 

GAO Contact: 

Susan Ragland, (202) 512-9095 or raglands@gao.gov: 

Acknowledgments: 

In addition to the contact named above, Chanetta Reed, Assistant 
Director; Sharon Byrd, Assistant Director--Audit Sampling; Kwabena 
Ansong; Gabrielle Fagan; Patrick Frey; Elizabeth Isom; Jason Kirwan; 
Jason Kelly; Chelsea Lounsbury; Mary Osorno; and Gabrielle Perret made 
significant contributions to this report. 

[End of section] 

Related GAO Products: 

High-Risk Series: An Update. [hyperlink, 
http://www.gao.gov/products/GAO-09-271]. Washington, D.C.: January 
2009. 

Flood Insurance: Options for Addressing the Financial Impact of 
Subsidized Premium Rates on the National Flood Insurance Program. 
[hyperlink, http://www.gao.gov/products/GAO-09-20]. Washington, D.C.: 
November 14, 2008. 

Flood Insurance: FEMA's Rate-Setting Process Warrants Attention. 
[hyperlink, http://www.gao.gov/products/GAO-09-12]. Washington, D.C.: 
October 31, 2008. 

Information Technology: Management Improvements Needed on The 
Department of Homeland Security's Next Generation Information Sharing 
System. [hyperlink, http://www.gao.gov/products/GAO-09-40]. Washington, 
D.C.: October 8, 2008. 

National Flood Insurance Program: Financial Challenges Underscore Need 
for Improved Oversight of Mitigation Programs and Key Contracts. 
[hyperlink, http://www.gao.gov/products/GAO-08-437]. Washington, D.C.: 
June 16, 2008. 

National Flood Insurance Program: Greater Transparency and Oversight of 
Wind and Flood Damage Determinations Are Needed. [hyperlink, 
http://www.gao.gov/products/GAO-08-28]. Washington, D.C.: December 28, 
2007. 

Federal Emergency Management Agency: Ongoing Challenges Facing the 
National Flood Insurance Program. [hyperlink, 
http://www.gao.gov/products/GAO-08-118T]. Washington, D.C.: October 2, 
2007. 

National Disasters: Public Policy Options for Changing the Federal Role 
in Natural Catastrophe Insurance. [hyperlink, 
http://www.gao.gov/products/GAO-08-7]. Washington, D.C.: November 26, 
2007. 

Financial Management: Persistent Financial Management Systems Issues 
Remain for Many CFO Act Agencies. [hyperlink, 
http://www.gao.gov/products/GAO-08-1018]. Washington, D.C.: September 
30, 2008. 

National Flood Insurance Program: FEMA's Management and Oversight of 
Payments for Insurance Company Services Should Be Improved. [hyperlink, 
http://www.gao.gov/products/GAO-07-1078]. Washington, D.C.: September 
5, 2007. 

National Flood Insurance Program: Preliminary Views on FEMA's Ability 
to Ensure Accurate Payments on Hurricane-Damaged Properties. 
[hyperlink, http://www.gao.gov/products/GAO-07-991T]. Washington, D.C.: 
June 12, 2007. 

National Flood Insurance Program: New Processes Aided Hurricane Katrina 
Claims Handling, but FEMA's Oversight Should Be Improved. [hyperlink, 
http://www.gao.gov/products/GAO-07-169]. Washington, D.C.: December 15, 
2006. 

GAO's High-Risk Program. [hyperlink, 
http://www.gao.gov/products/GAO-06-497T]. Washington, D.C.: March 15, 
2006. 

Federal Emergency Management Agency: Challenges for the National Flood 
Insurance Program. [hyperlink, http://www.gao.gov/products/GAO-06-
335T]. Washington, D.C.: January 25, 2006. 

Federal Emergency Management Agency: Improvements Needed to Enhance 
Oversight and Management of the National Flood Insurance Program. 
[hyperlink, http://www.gao.gov/products/GAO-06-119]. Washington, D.C.: 
October 18, 2005. 

National Flood Insurance Program: Oversight of Policy Issuance and 
Claims. [hyperlink, http://www.gao.gov/products/GAO-05-532T]. 
Washington, D.C.: April 14, 2005. 

[End of section] 

Footnotes: 

[1] As of December 2008, NFIP owed over $18 billion to the Treasury. 

[2] See GAO, Flood Insurance: FEMA's Rate-Setting Process Warrants 
Attention, [hyperlink, http://www.gao.gov/products/GAO-09-12] 
(Washington, D.C.: Oct. 31, 2008); National Flood Insurance Program: 
FEMA's Management and Oversight of Payments for Insurance Company 
Services Should Be Improved, [hyperlink, 
http://www.gao.gov/products/GAO-07-1078] (Washington, D.C.: Sept. 5, 
2007). 

[3] Federal Financial Management Improvement Act of 1996, Pub. L. No. 
104-208, div. A., § 101(f), title VIII, 110 Stat. 3009, 3009-389 (Sept. 
30, 1996). FFMIA was directed at ensuring that federal financial 
management systems provide accurate, reliable, and timely financial 
management information to government managers. FFMIA requires DHS and 
23 other major departments and agencies to implement and maintain 
financial management systems that comply substantially with (1) federal 
financial management systems requirements, (2) federal accounting 
standards, and (3) the U.S. Government Standard General Ledger at the 
transaction level. 

[4] The National Flood Insurance Act of 1968, as amended, is codified 
at 42 U.S.C. §§ 4001 to 4129. 

[5] There were approximately 90 WYO companies operating during 2008. 

[6] The Direct Servicing Agent was outside the scope of our review. 

[7] According to the NFIP Adjuster Claims Manual, the Bureau and 
Statistical Agent (BSA) maintains a database of independent adjusters 
who qualify to adjust flood claims. This database reflects whether the 
adjuster has attended FEMA-recognized flood workshops. 

[8] FEMA awards a contract for a BSA, which is responsible for 
conducting financial and statistical reporting based upon data 
submissions from the WYO companies, developing forms and information 
related to NFIP, and providing various data analyses. The BSA serves as 
the liaison between the government and insurance companies that issue 
federally guaranteed NFIP policies. 

[9] In addition, WYO companies house premium and claim files and 
related records. 

[10] The Transaction Record Reporting and Processing (TRRP) Plan 
defines the reporting requirements applicable to the writing and 
servicing of policies issued by the WYO companies. The plan contains 
detailed specifications for recording and compiling data. 

[11] The WYO Accounting Procedures Manual provides templates called 
"Financial Exhibits" for the WYO companies to use in submitting 
financial data. For purposes of our report, we use the term "financial 
exhibit" when describing the financial statements submitted to the BSA 
by the WYO companies. 

[12] BSA personnel upload financial data from spreadsheets the WYO 
companies submit into the Focus mainframe system. These spreadsheets 
consist of the WYO companies' financial statement exhibits in a 
standard format required by FEMA's WYO Accounting Procedures Manual. 

[13] Preliminary reports are to be completed by adjusters for all flood 
losses and must be submitted within 15 days after receipt of the loss 
assignment. The preliminary report documents information on the 
insurance policy, the risk, and the cause of the loss. 

[14] Final reports are also to be completed by adjusters for all flood 
losses and are due 30 days after the preliminary report is submitted. 
The final report documents information on the history of the premises 
such as date constructed, any alterations, and any prior losses, as 
well as information on the mortgagee, a summary of the claim, and any 
excluded damages. 

[15] We noted that 35 of these claim files missing preliminary and 
final reports are for claims adjusted by one particular WYO company. 
According to FEMA, this WYO company has historically taken the position 
that they will provide the information required but will do so in 
accordance with the processing of all its insurance policies as allowed 
by the Financial Assistance/Subsidy Arrangement. In other words, it 
will use its own forms that contain the information in the NFIP 
preliminary and final reports. While complying with the Financial 
Assistance/Subsidy Arrangement, based on our review of the information 
in the claim files as compared to the standard preliminary and final 
reports, we noted that the company's forms in the files do not contain 
certain information such as any salvage amount and the prior condition 
of the building and contents. In addition, the forms are not 
consistently signed by the adjuster and it is not clear whether the 
reports were prepared timely. 

[16] GAO, Internal Control Management and Evaluation Tool, [hyperlink, 
http://www.gao.gov/products/GAO-01-1008G] (Washington, D.C.: August 
2001). 

[17] The WYO Financial Control Plan requires WYO companies to submit a 
monthly financial statement reporting package to the BSA. This package 
is to include financial statements, reconciliation statements, 
certification statements, and statistical transactions. The WYO 
Accounting Procedures Manual provides templates called "Financial 
Exhibits" for the WYO companies to use in submitting financial data. 
For purposes of our report, we use the term "financial exhibit" when 
describing the financial statements submitted to the BSA by the WYO 
companies. 

[18] Variance reporting is the preparation of a report--by the BSA 
using spreadsheet software--that shows variances or differences between 
financial information and statistical information. This report also 
tracks year-to-date and historical financial and statistical 
information. 

[19] The Standards Committee meets three times a year (and is alerted 
to WYO company activity by the BSA and FEMA officials throughout the 
year) to discuss the status of NFIP on such topics as WYO company 
performance issues and material variances between statistical and 
financial data in excess of 1 percent or $50,000 for Net Written 
Premium or Net Paid Losses or $5,000 for Federal Policy Fees. 

[20] According to GAO's previous report, National Flood Insurance 
Program: FEMA's Management and Oversight of Payments for Insurance 
Company Services Should Be Improved [hyperlink, 
http://www.gao.gov/products/GAO-07-1078], biennial audits were not 
performed consistently as required by regulation. 

[21] See [hyperlink, http://www.gao.gov/products/GAO-07-1078]. We did 
not evaluate the quality of the biennial audits conducted. 

[22] See GAO, Flood Insurance: Opportunities Exist to Improve Oversight 
of the WYO Program, [hyperlink, http://www.gao.gov/products/GAO-09-455] 
(Washington, D.C.: Aug. 21, 2009). 

[23] See [hyperlink, http://www.gao.gov/products/GAO-09-455]. 

[24] According to GAO's previous report, Federal Emergency Management 
Agency: Improvements Needed to Enhance Oversight and Management of the 
National Flood Insurance Program, [hyperlink, 
http://www.gao.gov/products/GAO-06-119] (Washington, D.C.: Oct. 18, 
2005), the process FEMA used to select a sample of claims files for 
operational reviews and the process its program contractor used to 
select a sample of adjustments for reinspections did not produce a 
sample that was randomly chosen or statistically representative of all 
claims. 

[25] FEMA officials told us that they are revising the Financial 
Control Plan and no longer perform marketing, customer services, and 
litigation operational reviews. There were no reviews of this type 
performed during the period of our review (fiscal years 2005 to 2007). 
The FEMA officials said each of these functions were being reviewed by 
other methods; however, we reported that the draft Financial Control 
Plan did not incorporate these other methods. 

[26] GAO, Internal Control Management and Evaluation Tool, [hyperlink, 
http://www.gao.gov/products/GAO-01-1008G] (Washington, D.C.: August 
2001). 

[27] See [hyperlink, http://www.gao.gov/products/GAO-06-119]. 

[28] GAO, Policy Manual (Washington, D.C.: Jan. 1, 2004). 

[29] See [hyperlink, http://www.gao.gov/products/GAO-06-119]. 

[30] See GAO, National Flood Insurance Program: New Processes Aided 
Hurricane Katrina Claims Handling, but FEMA's Oversight Should Be 
Improved, [hyperlink, http://www.gao.gov/products/GAO-07-169] 
(Washington, D.C.: Dec. 15, 2006). 

[31] See [hyperlink, http://www.gao.gov/products/GAO-07-1078]. 

[32] According to FEMA, NextGen is intended to be a full life-cycle 
NFIP technology-modernization effort focused on providing business- 
driven solutions for the NFIP BSA using state-of-the-art, industry- 
proven technologies. The principal NextGen project goals are to improve 
BSA and WYO company processes to benefit all NFIP stakeholders, while 
achieving more efficient and effective program operations. We currently 
have work under way looking at this system. 

[33] Federal Financial Management Improvement Act of 1996, Pub. L. No. 
104-208, div. A., § 101(f), title VIII, 110 Stat. 3009, 3009-389 (Sept. 
30, 1996). FFMIA was directed at ensuring that federal financial 
management systems provide accurate, reliable, and timely financial 
management information to government managers. FFMIA requires DHS and 
23 other major departments and agencies to implement and maintain 
financial management systems that comply substantially with (1) federal 
financial management systems requirements, (2) federal accounting 
standards, and (3) the U.S. Government Standard General Ledger at the 
transaction level. 

[34] We were able to successfully reconcile the second set of premium 
data we requested and received for fiscal years 2006 and 2007; a third 
set of premium data was requested for fiscal year 2005 and then we were 
able to reconcile this set. We performed this reconciliation between 
the financial statements and the database financial information. 

[End of section] 

GAO's Mission: 

The Government Accountability Office, the audit, evaluation and 
investigative arm of Congress, exists to support Congress in meeting 
its constitutional responsibilities and to help improve the performance 
and accountability of the federal government for the American people. 
GAO examines the use of public funds; evaluates federal programs and 
policies; and provides analyses, recommendations, and other assistance 
to help Congress make informed oversight, policy, and funding 
decisions. GAO's commitment to good government is reflected in its core 
values of accountability, integrity, and reliability. 

Obtaining Copies of GAO Reports and Testimony: 

The fastest and easiest way to obtain copies of GAO documents at no 
cost is through GAO's Web site [hyperlink, http://www.gao.gov]. Each 
weekday, GAO posts newly released reports, testimony, and 
correspondence on its Web site. To have GAO e-mail you a list of newly 
posted products every afternoon, go to [hyperlink, http://www.gao.gov] 
and select "E-mail Updates." 

Order by Phone: 

The price of each GAO publication reflects GAO’s actual cost of
production and distribution and depends on the number of pages in the
publication and whether the publication is printed in color or black and
white. Pricing and ordering information is posted on GAO’s Web site, 
[hyperlink, http://www.gao.gov/ordering.htm]. 

Place orders by calling (202) 512-6000, toll free (866) 801-7077, or
TDD (202) 512-2537. 

Orders may be paid for using American Express, Discover Card,
MasterCard, Visa, check, or money order. Call for additional 
information. 

To Report Fraud, Waste, and Abuse in Federal Programs: 

Contact: 

Web site: [hyperlink, http://www.gao.gov/fraudnet/fraudnet.htm]: 
E-mail: fraudnet@gao.gov: 
Automated answering system: (800) 424-5454 or (202) 512-7470: 

Congressional Relations: 

Ralph Dawn, Managing Director, dawnr@gao.gov: 
(202) 512-4400: 
U.S. Government Accountability Office: 
441 G Street NW, Room 7125: 
Washington, D.C. 20548: 

Public Affairs: 

Chuck Young, Managing Director, youngc1@gao.gov: 
(202) 512-4800: 
U.S. Government Accountability Office: 
441 G Street NW, Room 7149: 
Washington, D.C. 20548: