Improper Payments:

Selected Agencies Need Improvements in Their Assessments to Better Determine and Document Risk Susceptibility

GAO-19-112: Published: Jan 10, 2019. Publicly Released: Jan 10, 2019.

Additional Materials:

Contact:

Beryl H. Davis
(202) 512-2623
davisbh@gao.gov

 

Office of Public Affairs
(202) 512-4800
youngc1@gao.gov

What GAO Found

The Improper Payments Information Act of 2002, as amended (IPIA), defines “significant” improper payments as improper payments in the preceding fiscal year that may have exceeded either (1) 1.5 percent of program outlays and $10 million or (2) $100 million (regardless of the improper payment rate). GAO found that the Departments of Health and Human Services (HHS), the Treasury (Treasury), Justice (DOJ), and Agriculture (USDA) assessed the five programs GAO selected for review as at low risk for susceptibility to significant improper payments; however, HHS, Treasury, and DOJ lacked sufficient documentation to assess the extent to which their risk assessments provided a reasonable basis for their risk determinations. On the other hand, USDA's quantitative risk assessment of its program's susceptibility to significant improper payments provided a reasonable basis for its low-risk determination.

Although HHS, Treasury, and DOJ considered, among other factors, the nine risk factors from IPIA and Office of Management and Budget guidance, they did not document or effectively demonstrate how these factors affected their programs' susceptibility to significant improper payments. These programs' risk assessments did not contain sufficient documentation to determine how the agencies arrived at their risk determinations for each risk factor, or how the total scores for all risk factors led to low-risk determinations. For example, HHS determined that its Head Start program was at high risk for several risk factors—including complexity per transaction and volume of payments—but did not document how these high-risk ratings informed its overall determination that Head Start was not susceptible to significant improper payments.

Further, the agencies did not have documentation to demonstrate how they determined the weighting of each risk factor or the risk level ranges from the risk assessment templates as they relate to the programs' susceptibility to significant improper payments. For example, based on GAO's analysis of Treasury's risk assessment template, the agency could identify areas of risk related to each of the nine risk factors. But because of the assigned weights given to each risk factor, Treasury's final risk calculation would still not determine the program to be at high risk of susceptibility to significant improper payments. Without documenting the basis for the assigned weights, Treasury cannot demonstrate, and GAO cannot determine, that its process for determining its programs' susceptibility to significant improper payments was reasonable. Until HHS, Treasury, and DOJ revise their risk assessment processes to help ensure that they result in reliable assessments, they cannot be certain whether their programs are susceptible to significant improper payments and therefore whether they are required to estimate the amount of improper payments.

GAO also found that HHS did not assess many of its programs and activities at least once during the 3-year period from fiscal years 2015 through 2017, as required by IPIA. Based on the analysis of HHS information, GAO identified at least 140 programs or activities that were not assessed during the 3-year period. When not all eligible programs are reviewed as required, there is an increased risk that the agency may not identify all risk-susceptible programs and activities, resulting in incomplete improper payment estimates.

Why GAO Did This Study

Improper payments are a long-standing problem in the federal government, estimated at almost $141 billion for fiscal year 2017. Agencies are required to perform risk assessments to identify programs that may be susceptible to significant improper payments.

GAO was asked to review federal agencies' improper payment risk assessments. This report examines the extent to which certain agencies' improper payment risk assessments for selected programs provided a reasonable basis for determining their susceptibility to significant improper payments. GAO analyzed the most recent risk assessments, from 2015 through 2017, for the following five programs: USDA's Agriculture Risk Coverage and Price Loss Coverage programs; HHS's Head Start; DOJ's Law Enforcement; and Treasury's Interest on the Public Debt and Home Affordable Modification Program. GAO selected these programs, focusing on programs that recently underwent a risk assessment and size of programs' gross outlays—which totaled about $330 billion in fiscal year 2017 for the five programs GAO selected.

What GAO Recommends

GAO recommends that Treasury, DOJ, and HHS revise their improper payment risk assessment processes, and that HHS revise its procedures to help ensure that all programs are assessed at least once every 3 years. In their responses, Treasury and HHS agreed with the recommendations, and DOJ disagreed with GAO's recommendation. GAO continues to believe that the recommendation is valid, as discussed in the report.

For more information, contact Beryl H. Davis at (202) 512-2623 or davisbh@gao.gov.

Recommendations for Executive Action

  1. Status: Open

    Priority recommendation

    Comments: The Department of Health and Human Services (HHS) concurred with this recommendation. In fiscal year 2019, HHS reported that it utilized Microsoft SharePoint to facilitate and begin to automate the Improper Payment Risk Assessment process. According to HHS, the SharePoint risk assessment form included the added ability to track the status of submissions and collect any applicable supporting documentation. Also, HHS stated that the Assistant Secretary for Financial Resources staff discussed the importance of maintaining supporting documentation during the fiscal year 2019 Improper Payment Risk Assessment Kick-Off meeting with HHS's operating divisions, and also built this feature into the SharePoint form. In fiscal year 2020, HHS reported that the implementation of the long-term solution to conducting improper payment risk assessments, the Risk Assessment Portal (previously called the Automated Improper Payment Framework), is underway and went into production in March 2020. Additionally, HHS indicated that it has revised its improper payment questionnaire and scoring process to ensure HHS performs a reliable assessment of susceptibility to significant improper payments. Also, HHS stated that it will leverage the Risk Assessment Portal, new questionnaire, and revised scoring process in the fiscal year 2020 risk assessment reporting period. Further, HHS stated that it is reviewing GAO reports and resources, capturing best practices from other agencies, and soliciting feedback from HHS's operating divisions to further improve its processes. Last, HHS stated that it will continue to develop policies, procedures, and supporting tools throughout calendar year 2020. We will continue to monitor the agency's actions to address this recommendation.

    Recommendation: The Secretary of Health and Human Services should revise HHS's process for conducting improper payment risk assessments for Head Start to help ensure that it results in a reliable assessment of whether the program is susceptible to significant improper payments. This should include preparing sufficient documentation to support its risk assessments. (Recommendation 1)

    Agency Affected: Department of Health and Human Services

  2. Status: Open

    Priority recommendation

    Comments: The Department of Health and Human Services (HHS) concurred with this recommendation. In fiscal year 2019, HHS reported that it utilized DATA Act information to create an inventory of programs and activities that could potentially be subject to improper payment risk assessment requirements. According to HHS, it developed a risk-based methodology for selecting programs and activities for review using the DATA Act files. Data fields within the DATA Act files allow HHS to further analyze the program and activity inventory. For example, the object class data enabled HHS to categorize the program's spending to provide insight into each program's unique risks. HHS stated that this methodology was used and documented in fiscal year 2019 but HHS plans to further refine and finalize this approach. In fiscal year 2020, HHS reported that its Office of the Inspector General (OIG) is currently reviewing the methodology as part of the Annual Inspector General review of HHS's improper payment reporting under the Improper Payments Elimination and Recovery Act of 2020. HHS stated that it will implement any feedback from the OIG, as well as lessons learned from the fiscal year 2019 and fiscal year 2020 risk assessment reporting period, in fiscal year 2021. We will continue to monitor the agency's actions to address this recommendation.

    Recommendation: The Secretary of Health and Human Services should revise HHS's procedures for conducting improper payment risk assessments to help ensure that all programs and activities are assessed for susceptibility to significant improper payments at least once every 3 years, as required by IPIA. (Recommendation 2)

    Agency Affected: Department of Health and Human Services

  3. Status: Closed - Implemented

    Comments: The Department of the Treasury (Treasury) concurred with this recommendation. In fiscal year 2020, Treasury provided us support to show that Treasury revised its processes for conducting improper payment risk assessments. Specifically, we verified that, in fiscal year 2019, Treasury implemented a quantitative assessment for programs with outlays greater than $5 billion, which we believe provides a sufficient basis to determine the susceptibility of improper payments. In addition, Treasury has made improvements in the qualitative assessment process, such as conclude "Susceptible" or "Not-susceptible" and requiring all bureaus provide rationale or supporting documentation for each risk assessment answer. Given that our recommendation was specific to Interest on the Public Debt and Home Affordable Modification Program (which is expiring), we believe that the new risk assessment process will help ensure that the processes result in reliable assessments of whether the programs are susceptible to significant improper payments. Therefore, we believe Treasury's actions address our recommendation.

    Recommendation: The Secretary of the Treasury should revise Treasury's processes for conducting improper payment risk assessments for Interest on the Public Debt and Home Affordable Modification Program to help ensure that the processes result in reliable assessments of whether the programs are susceptible to significant improper payments. This should include preparing sufficient documentation to support its risk assessments. (Recommendation 3)

    Agency Affected: Department of the Treasury

  4. Status: Open

    Priority recommendation

    Comments: The Department of Justice (DOJ) did not concur with this recommendation. In January 2020, DOJ reiterated that it continues to not concur with the recommendation. DOJ stated that its risk assessment methodology provides DOJ management with a reasonable basis for determining whether the law enforcement program, as well as DOJ's other four mission-aligned programs, are susceptible to significant improper payments. In addition, DOJ reiterated that it continues to not concur with GAO's conclusion that DOJ's risk assessment documentation is not adequate. DOJ stated that its documentation meets all of the requirements in the Improper Payments Information Act of 2002 (IPIA), as amended, and the Office of Management and Budget's (OMB) implementing guidance. Therefore, DOJ stated that it does not believe it would be a prudent use of limited resources to expand on the documentation that already exists. DOJ stated that notwithstanding its differences from GAO on the recommendation, it will continue to examine its risk assessment methodology. Finally, DOJ stated that its goal has been, and continues to be, meeting the requirements of IPIA, as amended, and OMB's implementing guidance in a cost effective manner. We continue to believe this recommendation is appropriate because DOJ's risk assessment documentation did not adequately demonstrate how DOJ determined the weighting of the risk factors or the numerical risk level ranges or whether a program is or is not susceptible to significant improper payments. We will continue to monitor the agency's actions to address the recommendation.

    Recommendation: The Attorney General should revise DOJ's process for conducting improper payment risk assessments for Law Enforcement to help ensure that it results in a reliable assessment of whether the program is susceptible to significant improper payments. This should include preparing sufficient documentation to support DOJ's risk assessments. (Recommendation 4)

    Agency Affected: Department of Justice

 

Explore the full database of GAO's Open Recommendations »

Aug 6, 2020

Jun 17, 2020

Jun 10, 2020

Jun 8, 2020

May 21, 2020

Mar 31, 2020

Mar 26, 2020

Mar 12, 2020

Looking for more? Browse all our products here