Recommendation: The Office of the Chief Financial Officer should require payment reporting sites to document their procedures for identifying, tracking, and reporting improper payments to ensure they provide consistent and comparable information about their improper payments over time. (Recommendation 1)

Agency: Department of Energy
Status: Open

Comments: DOE agreed with the recommendation and said that it plans to clarify and adjust its current and future guidance to its payment reporting sites to require that the sites (1) develop and maintain procedures to support implementation of its payment integrity requirements for identifying, tracking, and reporting improper payments, and (2) require payment reporting sites to certify that the procedures have been developed and implemented. We will monitor and report on DOE's progress in implementing these planned actions.

Recommendation: The Office of the Chief Financial Officer should develop a monitoring process to ensure that payment reporting sites document and implement procedures that will enable them to correctly identify and report improper payments to the OCFO. (Recommendation 2)

Agency: Department of Energy
Status: Open

Comments: DOE agreed with the recommendation and said that it will (1) take measures to strengthen and enhance the existing payment integrity monitoring and quality assurance program by conducting period payment reporting site visits and (2) establish a payment integrity working group to identify best practices for incorporation into DOE processes. We will monitor and report on DOE's progress in implementing these planned actions.

Recommendation: The Office of the Chief Financial Officer should require payment reporting sites to document policies for tracking questioned costs to resolution. (Recommendation 3)

Agency: Department of Energy
Status: Open

Comments: DOE agreed with the recommendation and said they plan to develop and implement processes and procedures for tracking questioned costs to resolution. We will monitor and report on DOE's progress in implementing these planned actions.

Recommendation: The Office of the Chief Financial Officer should track information on the year the payment occurred for all improper payments, regardless of when they are identified, and determine and disclose in DOE's AFR whether the department's total annual improper payments exceeded $100 million in any given year. (Recommendation 4)

Agency: Department of Energy
Status: Open

Comments: DOE agreed with the recommendation and said it will conduct annual look-back analyses to the extent possible to determine if prior year reporting exceeded the $100 million threshold, and therefore could be subject to additional reporting requirements. We will monitor and report on DOE's progress in implementing these planned actions.

Recommendation: The Office of the Chief Financial Officer should clarify guidance to (1) define the factors for assessing adequacy of payment reporting sites' justifications that conducting recapture audits would not be cost-effective, and (2) require that the Office of the Chief Financial Officer review the sufficiency of these justifications against the criteria defined. (Recommendation 5)

Agency: Department of Energy
Status: Open

Comments: DOE agreed with the recommendation and said it will revise and enhance procedures defining the OCFO quality assurance process to (1) define the criteria for assessing the adequacy of payment reporting sites' justifications, and (2) review the payment reporting sites' justifications against the criteria defined. We will monitor and report on DOE's progress in implementing these planned actions.

Recommendation: The Office of the Chief Financial Officer should evaluate whether payment reporting sites could identify enough additional improper payments through payment recapture audits to make those audits cost-effective, such as by performing audits at selected sites. (Recommendation 6)

Agency: Department of Energy
Status: Open

Comments: DOE disagreed with the recommendation, stating in its comments that it has an ongoing Fraud Risk Management Working Group and that officials have developed a Fraud Risk Management and Data Analytics Implementation Plan to strengthen DOE's capability to prevent, identify, and recover improper payments and fraud. However, DOE's plan is still in draft form and, according to DOE's technical comments, they will not begin using data analytics until fiscal year 2021. In addition, DOE said that existing payment recapture activities to identify and recover improper payments are sufficient. However, as we discuss in the report, DOE determined that it does not need to conduct payment recapture audits based on justifications submitted by the reporting sites. We continue to believe that by evaluating whether it could identify enough additional improper payments to make payment recapture audits cost-effective, such as by performing audits at a limited number of sites, DOE would have an opportunity to identify and recover additional improper payments or have better information to justify that payment recapture audits are not cost-effective. We plan to monitor DOE actions related to this recommendation.

Recommendation: The Office of the Chief Financial Officer should revise DOE's department-level process for conducting improper payment risk assessments to include (1) developing and documenting the rationale for the variable scale used to score risk factors and weighting of the payment reporting sites; and (2) documenting DOE's consideration of the inherent risk associated with the lag in identifying certain improper payments subsequent to the fiscal year they occurred to ensure that the process results in a reliable assessment of whether the department is susceptible to significant improper payments. (Recommendation 7)

Agency: Department of Energy
Status: Open

Comments: DOE did not agree with the recommendation to develop and document the rationale for the scale used to score risk factors and weighting of payment sites, stating that its risk assessment evaluates the volume and dollar amount of payments by payment category, payments subject to manual controls, and fluctuations in volume and dollar amounts. However, we are recommending that the OCFO document the weighting of all its risk factors, including its decision to consider as equal the risks identified by all sites-regardless of the dollar amount of outlays. We continue to believe that, because DOE did not properly document how it developed and considered risk factors during its fiscal year 2018 risk assessment, it cannot ensure that the process produces a reliable assessment of whether DOE is susceptible to significant improper payments. Regarding the consideration of inherent risk, DOE said that the Payment Integrity Risk Assessment directs payment reporting sites to consider inherent risk as part of DOE's Internal Control Program. However, even if none of the sites identifies the known lag in identifying improper payments as a risk, based on our review of DOE's Agency Financial Reports, this lag is a risk to DOE as a whole. Therefore, we continue to believe that DOE should document in its risk assessment process its consideration of the known lag in identifying improper payments. We plan to monitor DOE actions related to this recommendation.

Recommendation: The Office of the Chief Financial Officer should revise DOE's department-level policies and procedures for reviewing risk assessments submitted by payment reporting sites to require a review and approval of the documentation supporting these assessments to help ensure the accuracy of the sites' assessments. (Recommendation 8)

Agency: Department of Energy
Status: Open

Comments: DOE did not agree with the recommendation, stating that sufficient processes are in place for ensuring the accuracy of payment reporting sites' risk assessments. DOE also stated that OCFO's Payment Integrity Guidance instructs payment reporting sites to maintain detailed information supporting risk assessments. However, as we discuss in the report, 5 of the 10 sites we reviewed did not provide sufficient explanation or documentation supporting their ratings for several of the risk factors. We continue to believe that by developing, documenting, and implementing policies and procedures to require the OCFO to review documentation supporting payment site risk assessments, DOE would enhance its ability to adequately monitor its decentralized improper payment risk assessment process and help ensure that individual payment reporting sites accurately score their risk factors, leading DOE to obtain a more accurate and reliable assessment of its overall risk of susceptibility to improper payments. We plan to monitor DOE actions related to this recommendation.

Recommendation: The Office of the Chief Financial Officer should revise DOE's department-level policies and procedures for conducting improper payment risk assessments to define the process for overriding a payment reporting site's risk determination, when appropriate. (Recommendation 9)

Agency: Department of Energy
Status: Open

Comments: DOE agreed with the recommendation and said that itwill clarify the quality assurance process for the payment reporting sites' ratings; however, DOE will not override the individual payment sites' risk determinations. Instead, DOE plans to work as needed with payment reporting site officials to determine the appropriate risk ratings. We will monitor and report on DOE's progress in implementing these actions.

Recommendation: The Secretary of Defense should ensure that the Director of DSCA implements the planned initiative to routinely examine annual case reviews performed by DOD components to help ensure that fees collected into the FMS transportation accounts are accurate. (Recommendation 1)

Agency: Department of Defense
Status: Open

Comments: When we confirm what actions the agency has taken in response to this recommendation, we will provide updated information.

Recommendation: The Secretary of Defense should ensure that the Director of DSCA works with DFAS and DOD components to establish a written process to monitor the timeliness of components' delivery reporting to help ensure that fees collected into the FMS transportation accounts are accurate. (Recommendation 2)

Agency: Department of Defense
Status: Open

Comments: When we confirm what actions the agency has taken in response to this recommendation, we will provide updated information.

Recommendation: The Secretary of Defense should ensure that the Director of DSCA finalizes and implements internal guidance on how to conduct and document DSCA's monthly review of expenditures from the FMS transportation accounts, including what information should be reviewed and how to identify and follow up on discrepancies. (Recommendation 3)

Agency: Department of Defense
Status: Open

Comments: When we confirm what actions the agency has taken in response to this recommendation, we will provide updated information.

Recommendation: The Secretary of Defense should ensure that the Director of DSCA works with DFAS to finalize written guidance to DFAS on how to generate the reports needed for DSCA's monthly review of expenditures from the FMS transportation accounts, including the type of analysis needed. (Recommendation 4)

Agency: Department of Defense
Status: Open

Comments: When we confirm what actions the agency has taken in response to this recommendation, we will provide updated information.

Recommendation: The Secretary of Defense should ensure that the Director of DSCA works with DFAS and other DOD components to finalize the planned guidance to DFAS for the review and realignment of expenditures from the FMS transportation accounts to ensure reviews are consistent and include all expenditures. (Recommendation 5)

Agency: Department of Defense
Status: Open

Comments: When we confirm what actions the agency has taken in response to this recommendation, we will provide updated information.

Recommendation: The Administrator of CMS should consider and take steps to mitigate the program risks that are not measured in the PERM, such as overpayments and unallowable costs; such an effort could include actions such as revising the PERM methodology or focusing additional audit resources on managed care. (Recommendation 1)

Agency: Department of Health and Human Services: Centers for Medicare and Medicaid Services
Status: Open
Priority recommendation

Comments: CMS concurred with this recommendation. In October 2018, it reported that it was developing a plan to address the recommendation. CMS also reported that it has published several guidance documents and is in the process of finalizing others. In addition, it reported that it continues to develop educational strategies (such as a recent course managed care offered by CMS' Medicaid Integrity Institute) and oversight and audit strategies and mechanisms related to managed care. CMS communicated that it initiated 32 audits involving Medicaid managed care network providers in 6 states and an audit of a managed care plan in another state in FY 2018. For FY 2019, CMS stated that it will be establishing a medical loss ratio examination process and initiating such audits of managed care organizations in California. CMS also stated that it will be developing guidance for states and managed care plans on managed care delivery and oversight to develop program integrity capacity and reduce program risks. As of December 2019, CMS has not taken any additional steps; we will continue to monitor CMS's progress to mitigate the managed care program risks not measured in the PERM.

Recommendation: The Under Secretary of Defense for Acquisition, Technology and Logistics should identify the specific types of information that would best meet the department's needs and, based on that determination, collect and analyze relevant data after contract performance is sufficiently complete to determine the extent to which contracts with incentives achieved their desired outcomes.

Agency: Department of Defense: Office of the Secretary of Defense: Office of the Under Secretary of Defense for Acquisition, Technology, and Logistics
Status: Open

Comments: DOD concurred with our recommendation and has taken steps to address it. For example, in April 2018, the department developed a template for the military departments to use to identify specific types of information to collect. Since then, each of the military departments has initiated or planned to initiate efforts to collect and analyze information about outcomes of incentive contracts. In addition, in July 2020 DOD provided examples of selected DOD, Army, and Navy incentive contracts documented in the template previously noted. The department did not provide additional information about the Air Force's efforts, or about how DOD is analyzing the information to determine whether incentives can achieve desired outcomes. GAO has ongoing work to review DOD's use of fixed-price type contracts--including fixed-price incentive contracts--for major DOD systems, which may provide additional insights related to this recommendation.

Recommendation: As NIH-DFAS begins formalizing its internal guidance, the Director of NIH-DFAS should establish a mechanism for tracking key milestones in the indirect cost rate-setting process, such as when indirect cost rate proposals are due.

Agency: Department of Health and Human Services: Public Health Service: National Institutes of Health: Office of Management: Office of Acquisition and Logistics Management: Office of Acquisition Management and Policy: Division of Financial Advisory Services
Status: Open

Comments: HHS concurred with this recommendations. In response, HHS stated that National Institute of Health's Division of Financial Advisory Services (DFAS) will establish a mechanism for tracking key milestones in the indirect cost rate-setting process. NIH-DFAS has initiatives underway that include moving from paper to electronic submissions of indirect cost proposals and developing a replacement to its Commercial Rate Agreement Distribution Services website. DFAS is looking into the feasibility of incorporating key milestones into these two major initiatives. NIH-DFAS is currently working with a contractor to develop a web based system that will establish a tracking system to account for when indirect cost proposal are due from organizations. The original initiative to enable the electronic submission of indirect cost proposals was modified to incorporate this new requirement. NIH-DFAS anticipates the planned date for implementation of this system to be October 1, 2017. As of February 4, 2020, this recommendation is still open because DFAS does not have the "proposal due date" and "extension due date" data fields activated in eFLow. DFAS is looking into adding those enhancements and hope to have these updates implemented by June 30, 2020. On July 8th, 2020, NIH-DFAS notified us that they plan to update us with the status of this recommendation by October 2020. We will continue to monitor the status of this recommendation.

Recommendation: To help address the uncertainty NIH faces, related to the potential impact of increasing indirect costs on its funding of future research, the Director of NIH should assess the impact of growth in indirect costs on its research mission, including, as necessary, planning for how to deal with potential future increases in indirect costs that could limit the amount of funding available for total research, including the direct costs of research projects.

Agency: Department of Health and Human Services: Public Health Service: National Institutes of Health
Status: Open

Comments: As of July 7, 2015, NIH provided some information indicating that it had taken action to address our recommendation by tracking the size of indirect costs as a proportion of NIH's overall budget as part of the agency's annual budget planning process and risk assessment program. However, we determined that the actions did not fully address the recommendation because they focus on the agency's overall budget and do not assess the potential ongoing impact of indirect costs for universities on its mission. As of September 2018, NIH officials have not informed us of any additional actions taken to implement this recommendation. We will update the status of this recommendation when we receive additional information.