Improper Payments: Weaknesses in USAID's and NASA's Implementation of the Improper Payments Information Act and Recovery Auditing

On July 9, 2010, USAID updated its improper payment guidance, Performance Procedures for Reviewing Program Activities, Identifying and Reporting Improper Payments and included this guidance as a mandatory reference in its agencywide payable management guidance, Automated Directive System (ADS) Chapter 630 Payables Management, Section 630. 3.4.2 Improper Payments Act Reporting. USAID's improper payment guidance provides detailed procedures to address the four key steps of the Improper Payments Information Act (IPIA): (1) perform risk assessment, (2) estimate improper payments, (3) implement a corrective action plan, and (4) annually report improper payment estimates and actions to reduce them. These actions sufficiently address our recommendation.

In its fiscal year 2009 agency financial report (AFR), USAID reported on establishing a risk assessment tool that considered probability and impact of risk; and provided for assessing risks as low, medium, or high. USAID identified the following six risk factors were to be considered in assessing risks for each its programs: (1) total value of disbursements, (2) total number of disbursement transactions, (3) total number of unique contractors and vendors, (4) total value of cancelled and return payments, (5) total value of interest payments, and (6) degree of maturity or stability. In addition, USAID developed a Risk Assessment Questionnaire for its overseas mission offices to complete. The questionnaire focused on the responsibility and identification of program areas; the tracking and recovery of improper payments; and implementation of corrective action plans and controls in place to eliminate or minimize improper payments. These actions sufficiently address our recommendation.

In its fiscal year 2009 agency financial report (AFR), USAID reported on its implementation of a risk assessment methodology. Specifically, USAID reported on its implementation of a risk assessment methodology that consisted of weighting and scoring each of USAID's 27 program areas based on risk factors; probability and impact of risk; and by assigning a rating of low, medium, or high. USAID reported it populated a risk matrix that captured the risk condition of each of its programs. Under this process, USAID assigned a score to each risk condition and applied weighting formulas to determine an overall risk score for each of its programs. USAID used this information to identify each programs' susceptibility to improper payments. These actions to provide a systematic approach to identify programs and activities susceptible to significant improper payments sufficiently address our recommendation.

On July 9, 2010, USAID updated its Performance Procedures for Reviewing Program Activities, Identifying and Reporting Improper Payments. This updated guidance was included as a mandatory reference in its agencywide payable management guidance, Automated Directive System (ADS) Chapter 630 Payables Management, Section 630. 3.4.2 Improper Payments Act Reporting. Both sets of guidance provide that the Cash Management and Payments division within the Chief Financial Office is to maintain documentation related to the review, examination, and estimating of improper payments. USAID's improper payment guidance also provides that documentation should be maintained in accordance with the ADS Chapter 502, the USAID Records Management Program. USAID officials also informed us that documentation to support IPIA and recover audit activities was to be maintained on the agency's shared drive. Our review of USAID documentation related to its improper payment and recovery auditing testing confirmed that USAID's actions sufficiently address our recommendation.

In fiscal year 2009 USAID engaged a team of external contractors to establish a cost-effective recovery audit program for identifying errors made in paying contractors in compliance with the revised OMB Circular A-123, Appendix C Part II Recovery Auditing Act. As part of this process, USAID's contractor team developed a methodology to carry out its required recovery auditing activities, FY 2009 Recovery Auditing Sample Methodology, dated as of September 30, 2009. USAID's Recovery audit program calls for an extensive, agency-wide post-payment test and review process for identifying overpayments to contractors, including quarterly assessments, and a 4-tier review process to identify potential contract overpayments resulting from duplicate payments; errors on invoices or financing requests; failure to reduce payments by applicable sales discounts, cash discounts, rebates, or other allowances; payments for items not received; mathematical or other errors in determining payment amounts and executing payments; and the failure to obtain credit for return merchandise. The review process also called for grouping the results into 4 tiers: potential duplicate payments; interest payments; cancelled payments; and payments made to contractors during the reporting period.

In its fiscal year 2009 agency financial report, USAID reported on its recovery auditing program activities consistent with the reporting requirements contained in OMB Circular No. A-136, revised June 10, 2009. Specifically, its reporting included information on its recovery auditing efforts and identification of amounts reviewed, amounts identified for recovery, and amounts recovered for current and prior years. These actions sufficiently address our recommendation.

NASA's Procedural Requirements for Improper Payments and Loss of Funds (NPR 9050.4) Chapter 3, dated 09/30/2008, contains requirements for compliance with the Improper Payments Information Act (IPIA). This chapter also addresses accountable officials' responsibilities for ensuring payments are proper and their liability for improper payments. Further, NASA issued Procedural Guidance for IPIA, dated December 2009, which contains procedures for addressing the four key IPIA steps-perform risk assessment, estimate improper payments, implement a corrective action plan, and annually report.These actions sufficiently address our recommendation.

NASA issued Procedural Guidance for the Improper Payments Information Act (IPIA), dated December 2009 which incorporated a risk assessment methodology. The guidance included steps to (1) determine scope of programs subject to a risk assessment, (2) develop the risk matrix elements, (3) evaluate the risk condition, and (4) populate the risk matrix. Further, NASA reported that in fiscal year 2009 it developed a web-based questionnaire to capture and measure risk conditions in its programs. Based on the results of the questionnaire, interviews with process owners, and financial management reports, NASA reported that it populated the risk matrix with qualitative data for each program and risk condition to determine the level of susceptibility to improper payments. The established guidance and reported actions taken address the key elements of a risk assessment methodology for improper payments and sufficiently address our recommendation.

NASA issued its Procedural Guidance for IPIA and OMB Circular A-123, Appendix C, dated December 2009, that incorporate procedures for maintaining documentation related to Improper Payments Information Act (IPIA) testing. This includes maintaining management reports detailing significant issues identified during testing, recommendations for improvement, and a corrective to develop remediation activities. For recovery auditing, NASA issued its Recovery Audit Program Administrative Guidance, dated February 19, 2008, that incorporate procedures for maintaining documentation related to the payment errors and recovered funds at the NASA Shared Service Center (NSSC). The NSSC is required to provide a monthly accounting of all identified debts, amounts collected, and disposition of those funds. In addition, a corrective action plan must be maintained detailing various elements related to the overpayments identified including the (1) payment error identified, (2) root cause of error, (3) planned actions to address deficiency, (4) responsible official, (5) target completion date, and (6) actual completed date. In addition, NASA told us that it maintains centralized documentation that address IPIA and recovery auditing requirements at NASA headquarters in the Office of the Chief Financial Officer (OCFO)/Quality Assurance Division. NASA provided documentation related to its improper payment and recovery auditing testing. Our review of the documentation provided showed that NASA's actions sufficiently addressed our recommendation.

NASA reported on its recovery auditing program in its fiscal year 2009 agency financial report (AFR). NASA's recovery auditing reporting was consistent with the reporting requirements contained in OMB Circular No. A-136, Revised June 10, 2009. NASA's reporting included information on recovery auditing efforts, including data on amounts reviewed, amounts identified for recovery, and amounts recovered for current and prior years. These actions sufficiently address our recommendation.