Recommendation: The Chairman of FCC should direct and coordinate with the Chief Executive Officer of USAC to comprehensively assess fraud risks to the E-rate program, including implementing their respective plans for developing periodic fraud risk assessments, examining the suitability of existing fraud controls, and compiling fraud risk profiles following the timelines described in this report. The assessments should be informed by the key fraud risks identified in this report from closed court cases, prior risk assessments, and OIG reports, among other sources. (Recommendation 1)

Agency: Federal Communications Commission
Status: Open

Comments: When we confirm what actions the agency has taken in response to this recommendation, we will provide updated information.

Recommendation: The Chairman of FCC should ensure that FCC and USAC follow the leading practices in GAO's Fraud Risk Framework when designing and implementing data-analytics activities to prevent and detect fraud as part of their respective antifraud strategies for the E-rate program. (Recommendation 2)

Agency: Federal Communications Commission
Status: Open

Comments: When we confirm what actions the agency has taken in response to this recommendation, we will provide updated information.

Recommendation: The Chairman of FCC should direct the Chief Executive Officer of USAC to clearly define and fully document the data fields in all relevant E-rate program computer systems to help improve FCC's ability to understand and use data to manage fraud risks. (Recommendation 3)

Agency: Federal Communications Commission
Status: Open

Comments: When we confirm what actions the agency has taken in response to this recommendation, we will provide updated information.

Recommendation: Congress should consider legislation to require each CFO at a CFO Act agency to oversee and provide leadership for all of the responsibilities necessary to effectively carry out federal financial management activities, including the formulation and financial execution of the budget, planning and performance, risk management, internal control, financial systems, and accounting. (Matter for Consideration 1)

Agency: Congress
Status: Open

Comments: A bill (S. 3287) introduced in February 2020 proposed changes to the CFO Act. Among the proposed changes was language to clarify the duties and responsibilities of the CFO, including the formulation and financial execution of the budget, planning and performance, risk management, internal control, financial systems, and accounting. We will continue to monitor the status of this bill.

Recommendation: Congress should consider legislation to require deputy CFOs in CFO Act agencies to have defined responsibilities consistent with the breadth of those of the agency CFOs. (Matter for Consideration 2)

Agency: Congress
Status: Open

Comments: A bill (S. 3287) introduced in February 2020 proposed changes to the CFO Act. Among the proposed changes was language to specify that the deputy CFO shall assist the agency CFO in the performance of each of the duties of the agency CFO. We will continue to monitor the status of this bill.

Recommendation: Congress should consider legislation to require the Director of OMB to prepare and submit to the appropriate committees of Congress a government-wide 4-year financial management plan (with timing to match the GPRA reporting requirements) and an annual financial management status report.

a. The plan should include actions for improving financial management systems, strengthening the federal financial management workforce, and better linking performance and cost information for decision-making.

b. The plan should be developed in consultation with the CFO Council, the Chief Information Officers Council, the Chief Data Officer Council, the Chief Acquisition Officers Council, CIGIE, GAO, and other appropriate financial management experts. (Matter for Consideration 3)

Agency: Congress
Status: Open

Comments: A bill (S. 3287) introduced in February 2020 proposed changes to the CFO Act. Among the proposed changes was language that calls for a government-wide 4-year financial management plan and an annual financial management status report. The plan is to address actions for improving financial management systems, strengthening the federal financial management workforce, and better linking performance and cost information for decision-making. The plan is to be developed in consultation with the CFO Council, the Chief Information Officers Council, the Chief Data Officer Council, the Chief Acquisition Officers Council, CIGIE, GAO, and other appropriate financial management experts. We will continue to monitor the status of this bill.

Recommendation: Congress should consider legislation to require each CFO at a CFO Act agency, in consultation with financial management and other appropriate experts, to prepare an agency plan to implement the 4-year government-wide financial management plan prepared by OMB. (Matter for Consideration 4)

Agency: Congress
Status: Open

Comments: A bill (S. 3287) introduced in February 2020 proposed changes to the CFO Act. Among the proposed changes was language that calls for the CFO of each CFO Act agency to prepare, in consultation with financial management and other appropriate experts, an agency plan to implement the 4-year financial management plan prepared by the Director of the Office of Management and Budget and to achieve and sustain effective financial management in the agency. We will continue to monitor the status of this bill.

Recommendation: Congress should consider legislation to require the Director of OMB to prepare comprehensive financial management performance-based metrics and use these metrics to evaluate the financial management performance of executive agencies. The metrics should be included in the government-wide and agency-level financial management plans, and agencies' performance against the metrics should be reported in the annual financial management status reports. (Matter for Consideration 5)

Agency: Congress
Status: Open

Comments: A bill (S. 3287) introduced in February 2020 proposed changes to the CFO Act. Among the proposed changes was language that calls for the Director of OMB to prepare comprehensive financial management performance-based metrics, which are to be used to evaluate the financial management performance of executive agencies. These metrics are to be included in the government-wide and agency-level financial management plans, and agencies' performance against the metrics are to be reported in annual financial management status reports. We will continue to monitor the status of this bill.

Recommendation: Congress should consider legislation to require the head of each executive agency to identify, and if necessary develop, the key financial management information, in addition to financial statements, needed for effective financial management and decision-making. (Matter for Consideration 6)

Agency: Congress
Status: Open

Comments: A bill (S. 3287) introduced in February 2020 proposed changes to the CFO Act. Among the proposed changes was language that calls for the head of each CFO Act agency to identify key financial management information needed for effective financial management decision-making. We will continue to monitor the status of this bill.

Recommendation: Congress should consider legislation to require the head of each executive agency to annually assess and separately report their conclusion on the effectiveness of internal controls of the agency over financial reporting and other key financial management information. (Matter for Consideration 7)

Agency: Congress
Status: Open

Comments: A bill (S. 3287) introduced in February 2020 proposed changes to the CFO Act. Among the proposed changes was language that calls for the head of each CFO Act agency to annually assess and separately report on the effectiveness of internal controls of the agency over financial reporting and other key financial management information. We will continue to monitor the status of this bill.

Recommendation: Congress should consider legislation to require auditors, as part of each financial statement audit of an executive agency, to test and report on internal control over financial reporting and other key financial management information. (Matter for Consideration 8)

Agency: Congress
Status: Open

Comments: A bill (S. 3287) introduced in February 2020 proposed changes to the CFO Act. Among the proposed changes was language that calls for the financial statement auditors of each CFO Act agency to report on their evaluation of internal control over financial reporting and other key financial management information. We will continue to monitor the status of this bill.

Recommendation: The Office of the Chief Financial Officer should require payment reporting sites to document their procedures for identifying, tracking, and reporting improper payments to ensure they provide consistent and comparable information about their improper payments over time. (Recommendation 1)

Agency: Department of Energy
Status: Open

Comments: DOE agreed with the recommendation and said that it plans to clarify and adjust its current and future guidance to its payment reporting sites to require that the sites (1) develop and maintain procedures to support implementation of its payment integrity requirements for identifying, tracking, and reporting improper payments, and (2) require payment reporting sites to certify that the procedures have been developed and implemented. We will monitor and report on DOE's progress in implementing these planned actions.

Recommendation: The Office of the Chief Financial Officer should develop a monitoring process to ensure that payment reporting sites document and implement procedures that will enable them to correctly identify and report improper payments to the OCFO. (Recommendation 2)

Agency: Department of Energy
Status: Open

Comments: DOE agreed with the recommendation and said that it will (1) take measures to strengthen and enhance the existing payment integrity monitoring and quality assurance program by conducting period payment reporting site visits and (2) establish a payment integrity working group to identify best practices for incorporation into DOE processes. We will monitor and report on DOE's progress in implementing these planned actions.

Recommendation: The Office of the Chief Financial Officer should require payment reporting sites to document policies for tracking questioned costs to resolution. (Recommendation 3)

Agency: Department of Energy
Status: Open

Comments: DOE agreed with the recommendation and said they plan to develop and implement processes and procedures for tracking questioned costs to resolution. We will monitor and report on DOE's progress in implementing these planned actions.

Recommendation: The Office of the Chief Financial Officer should track information on the year the payment occurred for all improper payments, regardless of when they are identified, and determine and disclose in DOE's AFR whether the department's total annual improper payments exceeded $100 million in any given year. (Recommendation 4)

Agency: Department of Energy
Status: Open

Comments: DOE agreed with the recommendation and said it will conduct annual look-back analyses to the extent possible to determine if prior year reporting exceeded the $100 million threshold, and therefore could be subject to additional reporting requirements. We will monitor and report on DOE's progress in implementing these planned actions.

Recommendation: The Office of the Chief Financial Officer should clarify guidance to (1) define the factors for assessing adequacy of payment reporting sites' justifications that conducting recapture audits would not be cost-effective, and (2) require that the Office of the Chief Financial Officer review the sufficiency of these justifications against the criteria defined. (Recommendation 5)

Agency: Department of Energy
Status: Open

Comments: DOE agreed with the recommendation and said it will revise and enhance procedures defining the OCFO quality assurance process to (1) define the criteria for assessing the adequacy of payment reporting sites' justifications, and (2) review the payment reporting sites' justifications against the criteria defined. We will monitor and report on DOE's progress in implementing these planned actions.

Recommendation: The Office of the Chief Financial Officer should evaluate whether payment reporting sites could identify enough additional improper payments through payment recapture audits to make those audits cost-effective, such as by performing audits at selected sites. (Recommendation 6)

Agency: Department of Energy
Status: Open

Comments: DOE disagreed with the recommendation, stating in its comments that it has an ongoing Fraud Risk Management Working Group and that officials have developed a Fraud Risk Management and Data Analytics Implementation Plan to strengthen DOE's capability to prevent, identify, and recover improper payments and fraud. However, DOE's plan is still in draft form and, according to DOE's technical comments, they will not begin using data analytics until fiscal year 2021. In addition, DOE said that existing payment recapture activities to identify and recover improper payments are sufficient. However, as we discuss in the report, DOE determined that it does not need to conduct payment recapture audits based on justifications submitted by the reporting sites. We continue to believe that by evaluating whether it could identify enough additional improper payments to make payment recapture audits cost-effective, such as by performing audits at a limited number of sites, DOE would have an opportunity to identify and recover additional improper payments or have better information to justify that payment recapture audits are not cost-effective. We plan to monitor DOE actions related to this recommendation.

Recommendation: The Office of the Chief Financial Officer should revise DOE's department-level process for conducting improper payment risk assessments to include (1) developing and documenting the rationale for the variable scale used to score risk factors and weighting of the payment reporting sites; and (2) documenting DOE's consideration of the inherent risk associated with the lag in identifying certain improper payments subsequent to the fiscal year they occurred to ensure that the process results in a reliable assessment of whether the department is susceptible to significant improper payments. (Recommendation 7)

Agency: Department of Energy
Status: Open

Comments: DOE did not agree with the recommendation to develop and document the rationale for the scale used to score risk factors and weighting of payment sites, stating that its risk assessment evaluates the volume and dollar amount of payments by payment category, payments subject to manual controls, and fluctuations in volume and dollar amounts. However, we are recommending that the OCFO document the weighting of all its risk factors, including its decision to consider as equal the risks identified by all sites-regardless of the dollar amount of outlays. We continue to believe that, because DOE did not properly document how it developed and considered risk factors during its fiscal year 2018 risk assessment, it cannot ensure that the process produces a reliable assessment of whether DOE is susceptible to significant improper payments. Regarding the consideration of inherent risk, DOE said that the Payment Integrity Risk Assessment directs payment reporting sites to consider inherent risk as part of DOE's Internal Control Program. However, even if none of the sites identifies the known lag in identifying improper payments as a risk, based on our review of DOE's Agency Financial Reports, this lag is a risk to DOE as a whole. Therefore, we continue to believe that DOE should document in its risk assessment process its consideration of the known lag in identifying improper payments. We plan to monitor DOE actions related to this recommendation.

Recommendation: The Office of the Chief Financial Officer should revise DOE's department-level policies and procedures for reviewing risk assessments submitted by payment reporting sites to require a review and approval of the documentation supporting these assessments to help ensure the accuracy of the sites' assessments. (Recommendation 8)

Agency: Department of Energy
Status: Open

Comments: DOE did not agree with the recommendation, stating that sufficient processes are in place for ensuring the accuracy of payment reporting sites' risk assessments. DOE also stated that OCFO's Payment Integrity Guidance instructs payment reporting sites to maintain detailed information supporting risk assessments. However, as we discuss in the report, 5 of the 10 sites we reviewed did not provide sufficient explanation or documentation supporting their ratings for several of the risk factors. We continue to believe that by developing, documenting, and implementing policies and procedures to require the OCFO to review documentation supporting payment site risk assessments, DOE would enhance its ability to adequately monitor its decentralized improper payment risk assessment process and help ensure that individual payment reporting sites accurately score their risk factors, leading DOE to obtain a more accurate and reliable assessment of its overall risk of susceptibility to improper payments. We plan to monitor DOE actions related to this recommendation.

Recommendation: The Office of the Chief Financial Officer should revise DOE's department-level policies and procedures for conducting improper payment risk assessments to define the process for overriding a payment reporting site's risk determination, when appropriate. (Recommendation 9)

Agency: Department of Energy
Status: Open

Comments: DOE agreed with the recommendation and said that itwill clarify the quality assurance process for the payment reporting sites' ratings; however, DOE will not override the individual payment sites' risk determinations. Instead, DOE plans to work as needed with payment reporting site officials to determine the appropriate risk ratings. We will monitor and report on DOE's progress in implementing these actions.

Recommendation: The Administrator of FNS should develop and implement a process, documented in policies and procedures, to analyze SNAP state-level root causes to identify potential similarities among the states and develop and implement SNAP agency-level corrective actions, if appropriate, to help address them. (Recommendation 1)

Agency: Department of Agriculture: Office of the Secretary: Food, Nutrition and Consumer Services: Food and Nutrition Service
Status: Open

Comments: In commenting on our draft report, USDA stated that the Food and Nutrition Service should formalize its existing processes into a standard operating procedure to analyze the Supplemental Nutrition Assistance Programs (SNAP) state-level root causes to identify potential similarities among states, in order to improve development and implementation of SNAP agency-level corrective actions, if appropriate.

Recommendation: The Secretary of Agriculture should revise USDA's procedures to include processes for monitoring the progress and measuring the effectiveness of improper payment corrective actions. The process for measuring the effectiveness of corrective actions should clearly demonstrate the effect USDA's corrective actions have on reducing improper payments. (Recommendation 2)

Agency: Department of Agriculture
Status: Open

Comments: In commenting on our draft report, USDA stated that a proposed action plan will be developed to revise USDA's procedures for monitoring the progress and measuring the effectiveness of improper payment corrective actions. Processes will focus on the impact corrective actions have on the root causes of improper payments.

Recommendation: The Secretary of Education should revise and document Education's process for measuring the effectiveness of its corrective actions based on its new statistical estimation methodology for Direct Loan and Pell Grant improper payments. This process should clearly demonstrate the effect Education's corrective actions have on reducing improper payments. (Recommendation 3)

Agency: Department of Education: Office of the Secretary
Status: Open

Comments: In commenting on our draft report, Education stated that Federal Student Aid (FSA) will continue to evaluate and refine its processes to measure corrective actions and the effectiveness of these actions. Further, Education stated that FSA's measurement of corrective action effectiveness and root cause identification will gain additional precision as FSA collects annual improper payment data and builds upon the new baseline of statistically valid improper payment estimates. Education stated that FSA annually measures the overall effectiveness of its corrective action plans collectively against the improper payment reduction targets, rather than measuring the effectiveness of each individual corrective action. However, OMB guidance directs agencies to measure the effectiveness of each individual corrective action annually.

Recommendation: The Secretary of Health and Human Services should document in policies and procedures HHS's improper payment corrective action plan process. As part of these procedures, HHS should include processes for (1) establishing planned completion dates, (2) monitoring the progress of implementing corrective actions, and (3) measuring the effectiveness of improper payment corrective actions. The process for measuring the effectiveness of corrective actions should clearly demonstrate the effect HHS's corrective actions have on reducing improper payments. (Recommendation 4)

Agency: Department of Health and Human Services: Office of the Secretary
Status: Open

Comments: In commenting on our draft report, HHS elaborated on the improper payment corrective action plan process that is called for in OMB guidance. HHS stated that OMB guidance provides agencies the flexibility to measure the effectiveness of corrective actions and believes that this flexibility is vital to its oversight processes to reduce improper payments.

Recommendation: The Secretary of the Treasury should determine whether Treasury's current improper payment root cause analysis provides sufficiently relevant information that can be used as a basis for proposed corrective actions in reducing EITC improper payments and, if not, update the analysis using more timely data to ensure their reliability for identifying root causes of EITC improper payments. (Recommendation 5)

Agency: Department of the Treasury: Office of the Secretary
Status: Open

Comments: In commenting on our draft report, Treasury stated that each year it indicates in its corrective action plan that IRS will continue to work with Treasury to develop legislative proposals that will improve refundable credit compliance and reduce erroneous payments.

Recommendation: The Secretary of the Treasury should update Treasury's strategy for addressing the root causes of EITC improper payments to include (1) coordinating with other agencies to identify potential strategies and data sources that may help in determining EITC eligibility and (2) determining whether legislative changes are needed, and developing proposals as appropriate, to help reduce EITC improper payments, such as those related to the inability to authenticate taxpayer eligibility. (Recommendation 6)

Agency: Department of the Treasury: Office of the Secretary
Status: Open

Comments: In commenting on our draft report, Treasury stated that each year it indicates in its corrective action plan that IRS will continue to work with Treasury to develop legislative proposals that will improve refundable credit compliance and reduce erroneous payments. Although Treasury has made certain legislative proposals, it has not made proposals to specifically help address EITC eligibility criteria issues. Additionally, Treasury's strategy does not include identifying and proposing additional legislative changes needed to help reduce EITC improper payments.

Recommendation: The Commissioner of SSA should develop and implement a process, documented in policies and procedures, to measure the effectiveness of SSA's corrective actions for OASDI and SSI improper payments. This process should clearly demonstrate the effect SSA's corrective actions have on reducing improper payments. (Recommendation 7)

Agency: Social Security Administration
Status: Open

Comments: In commenting on our draft report, SSA stated that it will determine the most cost-effective strategies to remediate the underlying causes of payment errors and monitor, measure, and revise the strategies as needed.

Recommendation: The Director of OCC should establish internal written policies to effectively implement and document the State Plan review and approval process for future review and approval periods. (Recommendation 1)

Agency: Department of Health and Human Services: Administration for Children and Families: Office of the Child Care Bureau
Status: Open

Comments: In September 2020, OCC told us it has been working on establishing written policies (e.g., internal guidance documents and checklists) to implement and document the State Plan review and approval process. OCC expects to complete this work for the FY2022-2024 Plan period. We will continue to monitor OCC's efforts to implement this recommendation.

Recommendation: The Director of OCC should define the informational needs related to the results of program-integrity activities. (Recommendation 2)

Agency: Department of Health and Human Services: Administration for Children and Families: Office of the Child Care Bureau
Status: Open

Comments: In September 2020, OCC told us that it is developing the next CCDF State/Territory Plan Preprint due for submission by states and territories July 1, 2021. According to OCC, it plans to incorporate its information needs regarding the results of program integrity into the Preprint document as it develops the document. We will continue to monitor OCC's progress in implementing this recommendation.

Recommendation: The Director of OCC should communicate externally to the states its informational needs related to the results of states' program-integrity activities. (Recommendation 3)

Agency: Department of Health and Human Services: Administration for Children and Families: Office of the Child Care Bureau
Status: Open

Comments: In September 2020, OCC told us that it is developing the next CCDF State/Territory Plan Preprint due for submission by states and territories July 1, 2021. According to OCC, it plans to communicate its information needs regarding the results of program integrity activities to states and territories as part of the Preprint Training activities - including webinars and peer-to-peer virtual meetings - so Lead Agencies understand what is expected for them to address in the CCDF Plan. We will continue to monitor OCC's progress in implementing this recommendation.

Recommendation: The Director of OCC should communicate internally to staff its informational needs related to the results of states' program-integrity activities. (Recommendation 4)

Agency: Department of Health and Human Services: Administration for Children and Families: Office of the Child Care Bureau
Status: Open

Comments: In September 2020, OCC told us that it is developing the next CCDF State/Territory Plan Preprint due for submission by states and territories July 1, 2021. According to OCC, it plans to communicate its information needs regarding the results of program integrity activities to staff in both regional and central offices as part of the Preprint Training activities so staff understand what is expected for Lead Agencies to address in the CCDF Plan. We will continue to monitor OCC's progress in implementing this recommendation.

Recommendation: The Director of OCC should develop documented criteria to guide the review of CAPs submitted by states to ensure that proposed corrective actions are aimed at root causes of improper payments and are effectively implemented. (Recommendation 5)

Agency: Department of Health and Human Services: Administration for Children and Families: Office of the Child Care Bureau
Status: Open

Comments: In September 2020, OCC told us it revised the CAP Review Tool to in response to our recommendation. OCC also told us that it plans to implement the revised CAP Review Tool beginning September 2020 to document the review of CAPs submitted for the most recent ACF-404 reporting cycle (June 2020). We asked OCC to provide documentation showing the revised CAP Review Tool is responsive to our recommendation. We will update this recommendation status after reviewing the documentation OCC provides.

Recommendation: The Director of OCC should timely complete its effort to develop established written policies for the CAP follow-up process to ensure that OCC's oversight and monitoring of CAPs is carried out consistently. (Recommendation 6)

Agency: Department of Health and Human Services: Administration for Children and Families: Office of the Child Care Bureau
Status: Open

Comments: In September 2020, OCC told us it developed draft written policies for the CAP follow-up process to ensure that OCC's oversight and monitoring of CAPs is carried out consistently. However, due to the impact of the COVID-19 on staffing capacity, OCC has not presented the draft policies to regional offices for feedback. OCC told us it plans to finalize the written policies for the CAP follow-up process by December 2020. We will continue to monitor OCC's progress in implementing this recommendation.

Recommendation: The Director of OCC should develop and document criteria to assess the effectiveness of states' program-integrity control activities. (Recommendation 7)

Agency: Department of Health and Human Services: Administration for Children and Families: Office of the Child Care Bureau
Status: Open

Comments: In September 2020, OCC told us it analyzed information gathered from federal and state resources to develop and document criteria to be used to assess the effectiveness of states' program integrity control activities. We asked OCC to provide us the document showing all criteria to be used to assess the effectiveness of states' program integrity control activities. We will update this recommendation status after reviewing the documentation OCC provides.

Recommendation: The Director of OCC should evaluate the feasibility of collecting information from the Grantee Internal Controls Self-Assessment Instrument (Self-Assessment Instrument) and Fraud Toolkit, such as during its Monitoring System process, to monitor the effectiveness of states' program-integrity control activities. (Recommendation 8)

Agency: Department of Health and Human Services: Administration for Children and Families: Office of the Child Care Bureau
Status: Open

Comments: In September 2020, OCC told us it is working to make the Self-Assessment Instrument and Fraud Toolkit more user-friendly to encourage increased use within the state CCDF program. With increased usage, OCC believes it will be in a better position to assess how the collection of data from these two instruments can be incorporated into the Onsite Monitoring System or other oversight activity. OCC told us it anticipates completing work to implement this recommendation by December 2020. We will continue to monitor OCC's progress in implementing this recommendation.

Recommendation: The Assistant Secretary for ACF should ensure that ACF conducts a fraud risk assessment to provide a basis for the documentation and development of an antifraud strategy that describes the CCDF program's approach to address prioritizing fraud risks identified. (Recommendation 9)

Agency: Department of Health and Human Services: Administration for Children and Families
Status: Open

Comments: In September 2020, HHS told us it anticipates completing the initial fraud risk assessment for the CCDF program by December 2020. We will continue to monitor HHS's efforts to implement this recommendation.

Recommendation: The Commissioner of CBP should ensure that the Office of Field Operations, in consultation with the Office of Trade, develops a plan for managing its increased workload. (Recommendation 1)

Agency: Department of Homeland Security: United States Customs and Border Protection: Office of the Commissioner
Status: Open

Comments: CBP concurred with this recommendation. According to CBP, the new ACE drawback module provides the capability to extract data for workload management. Further enhanced reporting capabilities for drawback claims are under development. CBP's Office of Field Operations and Office of Trade continue to collaborate on a plan to employ risk management principles and automation to resolve the drawback claims backlog and lay the foundation for processing current drawback claims workload. They estimate the completion of this workload management system by October 31, 2020.

Recommendation: The Commissioner of CBP should ensure that the Office of Trade assesses the feasibility of flagging excessive export submissions across multiple claims and takes cost-effective steps, based on the assessment, to prevent over claiming. (Recommendation 2)

Agency: Department of Homeland Security: United States Customs and Border Protection: Office of the Commissioner
Status: Open

Comments: CBP concurred with this recommendation. According to CBP, the Office of Trade is exploring alternatives to track and automatically flag duplicate exports across multiple drawback claims. CBP expects to complete their assessment and plan for implementation by December 31, 2020.

Recommendation: The Commissioner of CBP should ensure that the Office of Trade develops a plan, with time frames, to establish a reliable system of record for proof of export. (Recommendation 3)

Agency: Department of Homeland Security: United States Customs and Border Protection: Office of the Commissioner
Status: Open

Comments: CBP concurred with this recommendation. According to CBP, the Office of Trade will work to develop a plan for the use of the Automated Export System (and possibly other systems) for electronic proof of export in the future. They expect this to be complete by September 30, 2020.

Recommendation: The Commissioner of CBP should ensure that the Office of Trade turns the claim selection feature in ACE back on and finalizes and implements procedures to target claims for review that were accepted into ACE during the period in which the selection feature was disabled. (Recommendation 4)

Agency: Department of Homeland Security: United States Customs and Border Protection: Office of the Commissioner
Status: Open

Comments: CBP concurred with our recommendation. According to CBP, the Office of Trade, in collaboration with the Office of Information Technology, will automate updates that turn the claim selection feature on in ACE. The Office of Trade plans to retroactively identify drawback claims accepted during the lapse period, and is working to implement a solution by December 31, 2020.

Recommendation: The Commissioner of CBP should ensure that the Office of Trade analyzes the results of its targeting of claims for review and designs responses to mitigate identified risks. (Recommendation 5)

Agency: Department of Homeland Security: United States Customs and Border Protection: Office of the Commissioner
Status: Open

Comments: CBP concurred with this recommendation. According to CBP, on March 25, 2020, the Office of Trade initiated an analysis to improve automation and targeting on an ongoing basis. Based on the results of this analysis, the Office of Trade will make any needed adjustments to policy and procedures to assist with data quality, by September 30, 2020.

Recommendation: The Commissioner of CBP should ensure that the Office of Trade prioritizes developing a plan to conduct an ex post analysis of the impact on industry and government of key changes to the drawback program, including time frames and methodology. (Recommendation 6)

Agency: Department of Homeland Security: United States Customs and Border Protection: Office of the Commissioner
Status: Open

Comments: CBP concurs with this recommendation. According to CBP, the Office of Trade is finalizing a plan to conduct an ex post analysis of the impact on industry and government of key changes to the drawback program. CBP's analytical plan will include a timeline and methodology for assessing changes to the program. They expect to complete this by November 30, 2020.

Recommendation: The Chairman of FCC should ensure that FCC's Office of Managing Director follows the leading practices in GAO's fraud risk framework related to a dedicated entity's management of its antifraud activities, such as serving as the repository of knowledge on fraud risks and coordinating antifraud initiatives. (Recommendation 1)

Agency: Federal Communications Commission
Status: Open

Comments: As of April 2020, FCC reported that the agency was undertaking further improvements of its fraud risk management program consistent with this recommendation. FCC did not indicate a completion date. We will continue to monitor FCC's progress related to establishing a dedicated antifraud management entity.

Recommendation: The Chairman of FCC should plan regular fraud-risk assessments tailored to the high-cost program and assess these risks to determine the program's fraud risk profile, as provided in GAO's fraud risk framework. (Recommendation 2)

Agency: Federal Communications Commission
Status: Open

Comments: As of April 2020, FCC reported that the agency was working with the Universal Service Administrative Company (USAC), which is the entity responsible for the day-to-day administration of the high-cost program, to implement this recommendation. FCC stated that USAC will conduct a fraud risk assessment of the high-cost program, but did not specify a time-frame for this effort. We will continue to review FCC and USAC's progress toward completing this assessment, and any steps taken to routinize this assessment.

Recommendation: The Chairman of FCC should design and implement an antifraud strategy for the high-cost program with specific control activities, based upon the results of fraud-risk assessments and a corresponding fraud risk profile, as provided in GAO's fraud risk framework. (Recommendation 3)

Agency: Federal Communications Commission
Status: Open

Comments: As of April 2020, FCC reported that the agency was working with the Universal Service Administrative Company (USAC), which is the entity responsible for the day-to-day administration of the high-cost program, to implement this recommendation. FCC reported it will ensure the results of the high-cost program's fraud risk assessment, along with other efforts to implement the GAO fraud risk framework, result in an overall fraud risk strategy. FCC did not indicate a completion date for these efforts, and we will continue to track FCC progress in this area.

Recommendation: The Chairman of FCC should assess the model-based support mechanism to determine the extent to which it produces reliable cost estimates. (Recommendation 4)

Agency: Federal Communications Commission
Status: Open

Comments: As of April 2020, FCC reported that it was considering ways to improve the model-based support mechanism for rate-of-return carriers participating in the high-cost program. FCC did not specify a time-frame for this effort. We will continue to review FCC's efforts related to this recommendation, including FCC efforts, if any, to verify the model's cost estimates.

Recommendation: The Chairman of FCC should consider whether to make use of the model-based support mechanism mandatory depending on the results of the assessment. (Recommendation 5)

Agency: Federal Communications Commission
Status: Open

Comments: As of April 2020, FCC reported that it was considering ways to improve the model-based support mechanism for rate-of-return carriers participating in the high-cost program. FCC indicated that any such improvements may help facilitate the transition of carriers from legacy support mechanisms to the model-based support mechanism. FCC did not provide a time-frame for completion of this effort. We will continue to monitor FCC's progress and efforts in regard to this recommendation.

Recommendation: The Administrator of CMS should expand its review of states' implementation of the provider screening and enrollment requirements to include states that have not made use of CMS's optional consultations. Similar to CMS's contractor site visits, such reviews should include any necessary steps to address areas of noncompliance for all types of enrolled providers, including those under contract with managed care organizations. (Recommendation 1)

Agency: Department of Health and Human Services: Centers for Medicare and Medicaid Services
Status: Open
Priority recommendation

Comments: CMS concurred with our recommendation. In February 2020, CMS told us that it plans to reach out to states that have not yet participated in its optional consultations to discuss their progress towards implementing provider screening and enrollment requirements, and outline steps that the states should take to come into full compliance with them. In order to fully address this recommendation CMS would need to review all states' implementation of the provider screening and enrollment requirements, including states that have not made use of CMS's optional consultations. As such, this recommendation remains open until CMS provides evidence that it has assessed the compliance of all states; we will continue to monitor CMS's progress.

Recommendation: The Administrator of CMS should annually monitor progress toward addressing any areas of noncompliance related to the provider screening and enrollment requirements for any state with one or more corrective action plans. (Recommendation 2)

Agency: Department of Health and Human Services: Centers for Medicare and Medicaid Services
Status: Open

Comments: As of February 2020, HHS officials have not informed us of any actions taken to implement this recommendation. We will update the status of this recommendation when we receive additional information

Recommendation: The Director of OHS should perform a fraud risk assessment for the Head Start program, to include assessing the likelihood and impact of fraud risks it faces. (Recommendation 1)

Agency: Department of Health and Human Services: Administration for Children and Families: Office of Head Start
Status: Open
Priority recommendation

Comments: In February 2020, HHS told us that the Administration for Children and Families (ACF) is developing a Fraud Risk Assessment template for all of its programs (including the Office of Head Start) and is on track to complete the initial Fraud Risk Assessment for its pilot program by June 30, 2020. Upon completion of the Fraud Risk Assessment for the ACF pilot program, ACF anticipates completing its initial Fraud Risk Assessment for OHS, by March 31, 2021. We will assess these actions once completed.

Recommendation: The Director of OHS should establish procedures to monitor and evaluate OHS's new internal workflows for monitoring reviews, to include establishing a baseline to measure the effect of these workflows and identify and address any problems impeding the effective implementation of new workflows to ensure timeliness goals for monitoring reviews are met. (Recommendation 3)

Agency: Department of Health and Human Services: Administration for Children and Families: Office of Head Start
Status: Open

Comments: HHS did not concur with this recommendation. In February 2020, HHS stated that OHS regularly evaluates its effectiveness of its workflows to determine how to best adjust the system to support effective follow-up. HHS also stated that, for Fiscal Year 2020, OHS has updated its internal workflow timelines to increase responsiveness to identified findings and ensure grantee support. We will continue to monitor HHS's efforts in this area.

Recommendation: The Director of OHS should provide program-wide guidance on when a student's slot should be considered vacant due to absenteeism. (Recommendation 5)

Agency: Department of Health and Human Services: Administration for Children and Families: Office of Head Start
Status: Open

Comments: In February 2020, OHS told us that it is finalizing program guidance that will address when a child's slot should be considered vacant due to absenteeism and what a program should do fill it. OHS stated that it anticipates having a final paper published by summer, 2020. We will continue to monitor OHS's efforts in this area.

Recommendation: The Director of OHS should develop and implement a method for grantees to document attendance and services under EHS pregnancy programs. (Recommendation 6)

Agency: Department of Health and Human Services: Administration for Children and Families: Office of Head Start
Status: Open

Comments: In February 2020, OHS told us that it is developing a toolkit of resources specifically designed to offer best practice tips for Early Head Start programs on how to track attendance and services to pregnant women. OHS is surveying the Head Start community to better determine what resources are already available and how programs in different regions and cities track services to pregnant women. OHS anticipates a rollout for the toolkit by summer, 2020.

Recommendation: The Director of OMB, after consulting with key stakeholders (e.g., the Chief Financial Officers Council), should develop a strategy for ensuring that agencies communicate sufficient and timely internal control plans for effective oversight of disaster relief funds. (Recommendation 1)

Agency: Executive Office of the President: Office of Management and Budget
Status: Open
Priority recommendation

Comments: The Office of Management and Budget (OMB) disagreed with our recommendation. In the agency's comment section of the GAO report, OMB staff stated that OMB did not believe the sufficiency or timeliness of control plans present material issues that warranted OMB action. While OMB acknowledged that almost all agency control plans were submitted after the statutory deadline, OMB staff stated that this delay in itself neither indicated the absence of controls nor the effectiveness of those controls. Further, OMB staff stated that it is agency management and not OMB that has responsibility for ensuring compliance with applicable laws and regulations. While agencies were responsible for submitting their internal control plans, federal law placed the responsibility of establishing the criteria for the internal control plans with OMB. Therefore, we believe that our recommendation is warranted. In January 2020, OMB informed us that there are no additional updates at this time regarding status, actions, or timelines to develop a strategy. We will continue to monitor agency's actions to address this recommendation.

Recommendation: The Administrator of the Food and Nutrition Service should establish a process to plan and conduct regular fraud risk assessments for the school meals programs that align with the leading practices in the Fraud Risk Framework. (Recommendation 1)

Agency: Department of Agriculture: Office of the Secretary: Food, Nutrition and Consumer Services: Food and Nutrition Service
Status: Open

Comments: As of September 12, 2019, USDA stated that it will undertake, over the course of the next year, a re-evaluation of its existing research and oversight activity to measure and assess fraud risk, its efforts to manage that risk, and its work to minimize the occurrence and impact of fraudulent activity on the school meal programs. USDA also stated that it will look to GAO's Fraud Risk Framework as a model for this effort. USDA expects this effort to include some new activity, such as a deeper examination of the underlying causes of program error in the agency's periodic studies of improper payments. USDA also views this as an opportunity to clarify and highlight how the agency's existing approach to risk management currently addresses fraud risk. USDA agrees that it is appropriate to review and refine its existing controls on a regular basis and recognizes that a more formalized assessment of fraud risk is likely to uncover gaps in existing activity that point to opportunities for further agency action. USDA commits to the development of a response to the effort that is appropriate to the scale of the identified risk and the broader mission of the school meal programs. In September 2020, USDA stated that it has been reviewing agency research and administrative data, as well as conducting new analysis. USDA is concluding work on its risk assessment and plans to circulate it within the agency for review soon. We will continue to monitor USDA's progress in this area.

Recommendation: The Administrator of CMS should institute a process to routinely assess, and take steps to ensure, as appropriate, that Medicare and Medicaid documentation requirements are necessary and effective at demonstrating compliance with coverage policies while appropriately addressing program risks. (Recommendation 1)

Agency: Department of Health and Human Services: Centers for Medicare and Medicaid Services
Status: Open
Priority recommendation

Comments: The Department of Health and Human Services concurred with this recommendation. In February 2020, the Centers for Medicare & Medicaid Services (CMS) noted that it had clarified and amended several Medicare documentation requirements as part of an agency initiative to assess such requirements. CMS further stated that Medicaid documentation requirements are generally established at the state level, and that the agency has taken steps to identify best practices for documentation requirements and share them with states. However, we believe that CMS still needs to take steps to assess documentation requirements in both programs to better understand how the variation in the programs' requirements affects estimated improper payment rates. Without an assessment of how the programs' documentation requirements affect estimates of improper payments, CMS may not have the information it needs to ensure that Medicare and Medicaid documentation requirements are effective at demonstrating compliance and appropriately address program risks.

Recommendation: The Administrator of CMS should take steps to ensure that Medicaid medical reviews provide robust information about and result in corrective actions that effectively address the underlying causes of improper payments. Such steps could include adjusting the sampling approach to reflect state-specific program risks, and working with state Medicaid agencies to leverage other sources of information, such as state auditor and the Department of Health and Human Services' Office of the Inspector General findings. (Recommendation 2)

Agency: Department of Health and Human Services: Centers for Medicare and Medicaid Services
Status: Open

Comments: The Department of Health and Human Services (HHS) did not concur with this recommendation. As of September 2020, HHS has stated that it does not plan to implement this recommendation because the agency believes the resource requirement is not justified based on the potential improper payment findings. HHS further stated that the agency already uses a variety of sources to identify and take corrective actions to address underlying causes of improper Medicaid payments. However, we found that the Centers for Medicare & Medicaid Services (CMS) and state Medicaid agencies are expending time and resources developing and implementing corrective actions that may not be representative of the underlying causes of improper payments in their states. Without robust information to effectively identify the underlying causes of improper payments, CMS and state Medicaid agencies may not develop corrective actions that effectively address Medicaid program risks.

Recommendation: The Administrator of CMS should take steps to minimize the potential for Payment Error Rate Measurement (PERM) medical reviews to compromise fraud investigations, such as by directing states to determine whether providers selected for PERM medical reviews are also under fraud investigation and to assess whether such reviews could compromise investigations. (Recommendation 3)

Agency: Department of Health and Human Services: Centers for Medicare and Medicaid Services
Status: Open

Comments: The Department of Health and Human Services (HHS) concurred with this recommendation. In October 2019, the Centers for Medicare & Medicaid Services (CMS) updated Medicaid Payment Error Rate Measurement (PERM) program guidance to strongly encourage state Medicaid agencies to proactively review providers selected for the state's PERM review; determine whether any of the selected providers are subjects of current or impending fraud investigations; and assess whether a PERM review could compromise the fraud investigation. CMS included this clarification in updated contractor guidance and in information provided to state Medicaid agencies. CMS plans to include the updated guidance in the fiscal year 2019 PERM program manual, which CMS anticipates completing by the end of 2019. Such revisions to the PERM manual will further codify and encourage state efforts to prevent PERM reviews from potentially compromising ongoing fraud investigations. As of September 2020, CMS has not informed us of any additional actions taken to implement this recommendation, including of any revisions to the PERM manual; we will update the status of this recommendation when we receive additional information.

Recommendation: The Administrator of CMS should address disincentives for state Medicaid agencies to notify the PERM contractor of providers under fraud investigation. This could include educating state officials about the benefits of reporting providers under fraud investigation, and taking actions such as revising how claims from providers under fraud investigation are accounted for in state-specific FFS improper payment rates, or the need for corrective actions in such cases. (Recommendation 4)

Agency: Department of Health and Human Services: Centers for Medicare and Medicaid Services
Status: Open

Comments: The Department of Health and Human Services (HHS) concurred with this recommendation. In October 2019, the Centers for Medicare & Medicaid Services (CMS) noted that the agency updated Medicaid Payment Error Rate Measurement (PERM) guidance regarding state Medicaid agencies' corrective action plans for providers under fraud investigation. If a state Medicaid agency opts to remove a provider from the state's PERM review due to a fraud investigation, claims associated with the provider are determined to be improper, due to no documentation. Under the updated guidance, states are no longer required to develop a corrective action plan for such claims, since the state is already addressing the issue through a fraud investigation. CMS included this updated guidance in the fiscal year 2017 PERM corrective action plan template, and plans to include the updated guidance in the fiscal year 2019 PERM program manual, which CMS anticipates completing by the end of 2019. Such revisions to the PERM manual will remove a disincentive for state Medicaid agencies to notify the PERM contractor of providers under fraud investigation. As of September 2020, CMS has not informed us of any additional actions taken to implement this recommendation, including of any revisions to the PERM manual; we will update the status of this recommendation when we receive additional information.

Recommendation: The Secretary of Health and Human Services should revise HHS's process for conducting improper payment risk assessments for Head Start to help ensure that it results in a reliable assessment of whether the program is susceptible to significant improper payments. This should include preparing sufficient documentation to support its risk assessments. (Recommendation 1)

Agency: Department of Health and Human Services
Status: Open
Priority recommendation

Comments: The Department of Health and Human Services (HHS) concurred with this recommendation. In fiscal year 2019, HHS reported that it utilized Microsoft SharePoint to facilitate and begin to automate the Improper Payment Risk Assessment process. According to HHS, the SharePoint risk assessment form included the added ability to track the status of submissions and collect any applicable supporting documentation. Also, HHS stated that the Assistant Secretary for Financial Resources staff discussed the importance of maintaining supporting documentation during the fiscal year 2019 Improper Payment Risk Assessment Kick-Off meeting with HHS's operating divisions, and also built this feature into the SharePoint form. In fiscal year 2020, HHS reported that the implementation of the long-term solution to conducting improper payment risk assessments, the Risk Assessment Portal (previously called the Automated Improper Payment Framework), is underway and went into production in March 2020. Additionally, HHS indicated that it has revised its improper payment questionnaire and scoring process to ensure HHS performs a reliable assessment of susceptibility to significant improper payments. Also, HHS stated that it will leverage the Risk Assessment Portal, new questionnaire, and revised scoring process in the fiscal year 2020 risk assessment reporting period. Further, HHS stated that it is reviewing GAO reports and resources, capturing best practices from other agencies, and soliciting feedback from HHS's operating divisions to further improve its processes. Last, HHS stated that it will continue to develop policies, procedures, and supporting tools throughout calendar year 2020. We will continue to monitor the agency's actions to address this recommendation.

Recommendation: The Secretary of Health and Human Services should revise HHS's procedures for conducting improper payment risk assessments to help ensure that all programs and activities are assessed for susceptibility to significant improper payments at least once every 3 years, as required by IPIA. (Recommendation 2)

Agency: Department of Health and Human Services
Status: Open
Priority recommendation

Comments: The Department of Health and Human Services (HHS) concurred with this recommendation. In fiscal year 2019, HHS reported that it utilized DATA Act information to create an inventory of programs and activities that could potentially be subject to improper payment risk assessment requirements. According to HHS, it developed a risk-based methodology for selecting programs and activities for review using the DATA Act files. Data fields within the DATA Act files allow HHS to further analyze the program and activity inventory. For example, the object class data enabled HHS to categorize the program's spending to provide insight into each program's unique risks. HHS stated that this methodology was used and documented in fiscal year 2019 but HHS plans to further refine and finalize this approach. In fiscal year 2020, HHS reported that its Office of the Inspector General (OIG) is currently reviewing the methodology as part of the Annual Inspector General review of HHS's improper payment reporting under the Improper Payments Elimination and Recovery Act of 2020. HHS stated that it will implement any feedback from the OIG, as well as lessons learned from the fiscal year 2019 and fiscal year 2020 risk assessment reporting period, in fiscal year 2021. We will continue to monitor the agency's actions to address this recommendation.

Recommendation: The Attorney General should revise DOJ's process for conducting improper payment risk assessments for Law Enforcement to help ensure that it results in a reliable assessment of whether the program is susceptible to significant improper payments. This should include preparing sufficient documentation to support DOJ's risk assessments. (Recommendation 4)

Agency: Department of Justice
Status: Open
Priority recommendation

Comments: The Department of Justice (DOJ) did not concur with this recommendation. In January 2020, DOJ reiterated that it continues to not concur with the recommendation. DOJ stated that its risk assessment methodology provides DOJ management with a reasonable basis for determining whether the law enforcement program, as well as DOJ's other four mission-aligned programs, are susceptible to significant improper payments. In addition, DOJ reiterated that it continues to not concur with GAO's conclusion that DOJ's risk assessment documentation is not adequate. DOJ stated that its documentation meets all of the requirements in the Improper Payments Information Act of 2002 (IPIA), as amended, and the Office of Management and Budget's (OMB) implementing guidance. Therefore, DOJ stated that it does not believe it would be a prudent use of limited resources to expand on the documentation that already exists. DOJ stated that notwithstanding its differences from GAO on the recommendation, it will continue to examine its risk assessment methodology. Finally, DOJ stated that its goal has been, and continues to be, meeting the requirements of IPIA, as amended, and OMB's implementing guidance in a cost effective manner. We continue to believe this recommendation is appropriate because DOJ's risk assessment documentation did not adequately demonstrate how DOJ determined the weighting of the risk factors or the numerical risk level ranges or whether a program is or is not susceptible to significant improper payments. We will continue to monitor the agency's actions to address the recommendation.

Recommendation: The Director of OMB should take steps to update OMB guidance to specify other types of quality information that agencies with programs noncompliant for 3 or more consecutive years should include in their notifications to Congress, such as significant matters related to risks, issues, root causes, measurable milestones, designated senior officials, accountability mechanisms, and corrective actions or strategies planned or taken by agencies to achieve compliance. (Recommendation 1)

Agency: Executive Office of the President: Office of Management and Budget
Status: Open
Priority recommendation

Comments: The Office of Management and Budget (OMB) neither agreed or disagreed with the recommendation but stated that it had no comments. In January 2020, OMB informed us that it had no status updates to provide at this time. We will continue to monitor agency's actions to address this recommendation.

Recommendation: The Assistant Secretary of DOL's Employment and Training Administration should provide states with information about its determination that the use of state formal warning policies is no longer permissible under federal law. (Recommendation 1)

Agency: Department of Labor
Status: Open
Priority recommendation

Comments: DOL agreed with this recommendation. The agency stated that it would take action to provide states with information about its determination that the use of state formal warning policies is no longer permissible under federal law. As of December 2019, DOL reported that it is developing new guidance that states can no longer use formal warnings. We will consider closing this recommendation when the agency completes this effort.

Recommendation: The Assistant Secretary of DOL's Employment and Training Administration should monitor states' efforts to discontinue the use of formal warning policies. (Recommendation 2)

Agency: Department of Labor
Status: Open

Comments: DOL agreed with this recommendation and stated that it would monitor states' efforts to discontinue the use of formal warning policies. In December 2019, DOL reported that it has been developing new guidance that more explicitly informs states that formal warning policies are not permissible. We will consider closing this recommendation when the agency completes this effort and monitors states' compliance with the guidance.

Recommendation: The Assistant Secretary of DOL's Employment and Training Administration should clarify information on work search verification requirements in its revised Benefit Accuracy Measurement procedures. The revised procedures should include an explanation of what DOL considers to be sufficient verification of claimants' work search activities. (Recommendation 3)

Agency: Department of Labor
Status: Open
Priority recommendation

Comments: DOL agreed with this recommendation and stated that it would clarify information on work search verification requirements in its revised Benefit Accuracy Measurement procedures. In December 2019, DOL reported that it is developing new guidance with instructions to clarify work search verification requirements. To fully implement this recommendation, DOL should finalize and publish these instructions on verifying claimants' work search activities and provide the clear directions to states.

Recommendation: The Assistant Secretary of DOL's Employment and Training Administration should monitor states' compliance with the clarified work search verification requirements. (Recommendation 4)

Agency: Department of Labor
Status: Open

Comments: DOL agreed with this recommendation and stated that it would monitor states' compliance with clarified work search verification requirements. In December 2019, DOL reported that it is working with the Office of Management and Budget on its draft work search guidance that will more explicitly inform states that formal warning policies are not permissible. We will close this recommendation when DOL publishes these instructions, providing states with clear directions, and monitors their compliance with the guidance.

Recommendation: The Administrator of CMS should eliminate impediments to collaborative audits in managed care conducted by audit contractors and states, by ensuring that managed care audits are conducted regardless of which entity--the state or the managed care organization--recoups any identified overpayments. (Recommendation 2)

Agency: Department of Health and Human Services: Centers for Medicare and Medicaid Services
Status: Open
Priority recommendation

Comments: CMS agreed with and has taken some steps to address this action, as recommended by GAO in July 2018. In September 2019, CMS reported that in July 2019 CMS held a meeting with states and collaborative audit contractors to discuss coordination of managed care audits, including a wide range of challenges with managed care audits. As result of the feedback and recommendations received, CMS is evaluating several process improvements and reiterated that audit contractors will continue to work with states to provide support and assistance in Medicaid managed care, and that Medicaid managed care audits should not be limited by MCO contract language. Although CMS has communicated to states the need to increase audits in managed care and address identified issues, it is unclear if these actions will remove known impediments to managed care audits or result in an increase in the number of collaborative audits. Implementing GAO's July 2018 recommendation is needed because few audits of Medicaid managed care have been conducted and overpayments can be significant based on the findings from federal and state audits and investigations that have been completed. .

Recommendation: The Administrator of SBA should use its on-site and off-site reviews to routinely collect information on lenders' use of credit elsewhere criteria as part of its monitoring of lender practices related to the credit elsewhere requirement. (Recommendation 2)

Agency: Small Business Administration
Status: Open
Priority recommendation

Comments: For the second and third recommendations, related to lender's use of the credit elsewhere criteria as part of its monitoring of lender practices, on June 11, 2019, SBA provided information on 7(a) lender reviews and summary reports. On September 27, 2019, we discussed these recommendations and SBA's responses with an SBA official. Specifically, we discussed the role of statistical sampling in addressing lender practices and SBA's selection of lenders for further review. On November 22, 2019, an SBA official stated that the agency plans to provide additional documentation in six months to further support actions taken. We will continue to monitor SBA's efforts to address this recommendation.

Recommendation: The Administrator of SBA should analyze information on lenders' use of credit elsewhere criteria obtained from its reviews to identify lenders that may be at greater risk of noncompliance and to inform its selection of lenders for further review for credit elsewhere compliance. (Recommendation 3)

Agency: Small Business Administration
Status: Open
Priority recommendation

Comments: For the second and third recommendations, related to lender's use of the credit elsewhere criteria as part of its monitoring of lender practices, on June 11, 2019, SBA provided information on 7(a) lender reviews and summary reports. On September 27, 2019, we discussed these recommendations and SBA's responses with an SBA official. Specifically, we discussed the role of statistical sampling in addressing lender practices and SBA's selection of lenders for further review. On November 22, 2019, an SBA official stated that the agency plans to provide additional documentation in six months to further support actions taken. We will continue to monitor SBA's efforts to address this recommendation.

Recommendation: The Director of OMB should develop guidance on how agencies test to identify improper payments, such as using a risk-based approach to help ensure that key risks of improper payments, such as eligibility, are addressed through testing processes. (Recommendation 1)

Agency: Executive Office of the President: Office of Management and Budget
Status: Open
Priority recommendation

Comments: OMB partially concurred with this recommendation. On July 31, 2019, we met with the Office of Management and Budget (OMB). At the meeting, OMB officials indicated that OMB's position has not changed since the issuance of the GAO report and what OMB had already communicated to GAO at the exit conference. Specifically, OMB stated that it should not have to develop more specific guidance as each program and activity has its own risks. Instead, inspectors general are better equipped and positioned to review the sampling and estimation plans as part of their annual Improper Payments Elimination and Recovery Act of 2010 compliance audits and that agencies, their statisticians, and inspectors general should work out the best testing procedures for their agencies. We continue to believe that OMB could provide suggestions during OMB's annual town meeting related to improper payments for areas that inspectors general may consider. Further, although we agree that programs and activities may face different risks of improper payment, we continue to believe that guidance from OMB on how agencies test to identify improper payments, such as using a risk-based approach, could help ensure that agencies address the specific risks they identify when developing improper payment estimates. In February 2020, OMB informed us that it had no status updates to provide at this time. We will continue to monitor agency's actions to address this recommendation.

Recommendation: The Director of OMB should develop guidance clarifying the appropriate treatment of nonresponse cases during improper payment testing. (Recommendation 2)

Agency: Executive Office of the President: Office of Management and Budget
Status: Open
Priority recommendation

Comments: OMB concurred with this recommendation. On July 31, 2019, we met with the Office of Management and Budget (OMB). At the meeting, OMB officials indicated that OMB's position has not changed since the issuance of the GAO report and what OMB had already communicated to GAO at the exit conference. At the meeting, OMB officials stated that OMB will "consider" updating guidance in OMB Circular A-123, Appendix C, to direct agencies to treat nonresponse cases such as improper payments and to include a new category for tracking such cases but only after assessing the impact such guidance would have on the agencies testing and reporting of improper payments. OMB has not taken action to develop this guidance. In February 2020, OMB informed us that it had no status updates to provide at this time. We will continue to monitor agency's actions to address this recommendation.

Recommendation: The Director of OPM should assess the processes to estimate Retirement improper payments to determine whether they effectively address key risks of improper payments--including eligibility and whether older claims face different risks of improper payments than new claims--and take steps to update the processes to incorporate key risks that are not currently addressed. (Recommendation 4)

Agency: Office of Personnel Management
Status: Open

Comments: The Office of Personnel Management (OPM) partially concurred with this recommendation. Prior to 2006, the improper payment estimate sampling methodology used by OPM included both new and old adjudicated claims. After analyzing several years of data using this methodology, OPM found that including older claims in the sample could result in claimant's records being sampled multiple times. In addition, OPM also found that the variance in the number of errors detected in new claims versus old claims was very low. OPM also looked at the resources used in performing the audit of old and new claims and based on these factors, management determined that it was not an efficient use of resources to include both old and new claims in the review. The methodology was updated to make the process more efficient. By using new claims only, OPM was able to provide feedback to program managers more timely. As a result, management can address issues negatively impacting the improper payment rate and prevent improper payments promptly. OPM agrees with the intent of our recommendation; however, OPM does not agree with our recommendation regarding a risk assessment on eligibility. Eligibility is determined before annuity/survivor benefits are fully adjudicated. As part of its correction plan, OPM stated that it will conduct an audit of older claims to determine if there are different risks to new claims. In February 2020, OPM indicated that it is currently in the process of pulling/gathering the cases that should be in the universe of this audit. OPM plans to complete the corrective action by end of 4th quarter of fiscal year 2020. We will continue to monitor the agency's actions to address this recommendation.

Recommendation: The Administrator of CMS should consider and take steps to mitigate the program risks that are not measured in the PERM, such as overpayments and unallowable costs; such an effort could include actions such as revising the PERM methodology or focusing additional audit resources on managed care. (Recommendation 1)

Agency: Department of Health and Human Services: Centers for Medicare and Medicaid Services
Status: Open
Priority recommendation

Comments: CMS concurred with this recommendation. In October 2018, it reported that it was developing a plan to address the recommendation. CMS also reported that it has published several guidance documents and is in the process of finalizing others. In addition, it reported that it continues to develop educational strategies (such as a recent course managed care offered by CMS' Medicaid Integrity Institute) and oversight and audit strategies and mechanisms related to managed care. CMS communicated that it initiated 32 audits involving Medicaid managed care network providers in 6 states and an audit of a managed care plan in another state in FY 2018. For FY 2019, CMS stated that it will be establishing a medical loss ratio examination process and initiating such audits of managed care organizations in California. CMS also stated that it will be developing guidance for states and managed care plans on managed care delivery and oversight to develop program integrity capacity and reduce program risks. As of December 2019, CMS has not taken any additional steps; we will continue to monitor CMS's progress to mitigate the managed care program risks not measured in the PERM.

Recommendation: The Administrator of CMS should subject accessories essential to the group 3 power wheelchairs in the permanent DMEPOS program to prior authorization. (Recommendation 1)

Agency: Department of Health and Human Services: Centers for Medicare and Medicaid Services
Status: Open

Comments: In August 2018, the Department of Health and Human Services reported that it concurs with this recommendation and that CMS is exploring available options to subject accessories essential to the group 3 power wheelchairs in the permanent DMEPOS program to prior authorization. As of February 2020, HHS officials have not informed us of any actions taken to implement this recommendation. We will update the status of this recommendation when we receive additional information

Recommendation: The Administrator of CMS should take steps, based on results from evaluations, to continue prior authorization. These steps could include: (1) resuming the paused home health services demonstration; (2) extending current demonstrations; or, (3) identifying new opportunities for expanding prior authorization to additional items and services with high unnecessary utilization and high improper payment rates. (Recommendation 2)

Agency: Department of Health and Human Services: Centers for Medicare and Medicaid Services
Status: Open
Priority recommendation

Comments: In August 2018, the Department of Health and Human Services reported that it concurs with this recommendation. CMS has recently taken steps to evaluate and continue its prior authorization programs. In June 2019, CMS issued a final report on the independent evaluation of the non-emergency hyperbaric oxygen therapy demonstration. While the agency does not plan to conduct additional demonstrations on this service, CMS officials reported in December 2019 that the agency may consider this service for the new prior authorization process for certain hospital outpatient department services, established in a 2019 final rule. In April 2019, CMS issued a Federal Register notice that added 12 items-seven power wheelchairs and five pressure reducing support surfaces-to its required prior authorization list for the permanent program. CMS officials said in December 2019 that the agency was in the process of determining cost savings from this action and that additional items would be added to the list in early 2020. CMS resumed the home health services demonstration with changes in one state in June 2019 and in another state in September 2019. The agency plans to extend the demonstration to three additional states in 2020. In September 2019, CMS extended the repetitive scheduled non-emergency ambulance service demonstration for 1 year, through November 2020. GAO will continue to monitor issued agency guidance on the home health services demonstration and to evaluate additional steps CMS takes to evaluate and continue prior authorization in Medicare, such as determining cost savings from its actions and identifying new opportunities for prior authorization.

Recommendation: To improve RRB's ability to make accurate disability benefit eligibility determinations, including CDRs, and to decrease the potential for making improper payments, Congress should consider granting RRB access to the Department of Health and Human Services' quarterly earnings information from the National Directory of New Hires database. (Matter for Consideration 1)

Agency: Congress
Status: Open

Comments: As of March 2020, no legislation has been enacted resulting from this matter to Congress. RRB's (the Board) fiscal year 2020 budget proposal included a legislative proposal to provide the Board access to the NDNH. Although the Board reported that the resulting proposed legislation drafted by HHS - the entity that maintains the NDNH - would, if enacted, provide access to the NDNH, the Board opposed the proposal in part because it would not waive associated fees to access the NDNH, and concluded access to the NDNH would not be cost-effective. In January 2020, the Board informed GAO it is not currently seeking legislation to gain access to the NDNH, resulting in the Board continuing to use earnings data that may be outdated in its continuing disability reviews, but that it may seek access in the future.

Recommendation: To enhance RRB's ability to manage and oversee its CDR program, RRB should routinely compile and analyze CDR program data, such as the number of cases selected for review, the number of beneficiaries in each medical improvement category, outcomes, and the costs and benefits of conducting CDRs, to improve program oversight. (Recommendation 3)

Agency: Railroad Retirement Board
Status: Open

Comments: RRB agreed with this recommendation. In June 2020, RRB reported that its Program Evaluation and Management Services (PEMS) section will compile and analyze all relevant CDR program case and cost data to better oversee CDRs. RRB said that its first analysis would cover CDR's adjudicated from April 2019 through September 2020; as of June 2020 they had adjudicated 107 CDR cases. In addition, RRB reported that its monthly reporting on CDRs to the Director of Disability includes information on the type of CDR completed, the medical improvement category for medical CDR, and the disposition of the CDR. In August 2018, the agency had reported that it began reporting in October 2017 weekly pending CDR type action cases to the Director of Programs, and that it had begun tracking CDR reason codes for each medical improvement category. To close this recommendation, RRB will need to include an analysis of the costs and benefits of conducting CDRs, including any overpayments or underpayments processed, and share its complete analysis of CDRs through September 2020 after it is completed. At that point GAO will review the analysis and decide if it provides a sufficient bases for program oversight.

Recommendation: The Administrator of CMS should provide fraud-awareness training relevant to risks facing CMS programs and require new hires to undergo such training and all employees to undergo training on a recurring basis. (Recommendation 1)

Agency: Department of Health and Human Services: Centers for Medicare and Medicaid Services
Status: Open

Comments: The agency agreed with this recommendation. In July 2018, CMS reported that it is strengthening its efforts to ingrain fraud risk management principles throughout the Agency and is developing a training video, module, and curriculum to train staff agency-wide on fraud risks. In November 2019, CMS provided fraud-awareness training videos for new and current CMS employees. GAO requested and is awaiting documentation to show mandatory nature and annual frequency of the training in order to assess the extent to which the training is consistent with leading practices in fraud risk management.

Recommendation: The Administrator of CMS should conduct fraud risk assessments for Medicare and Medicaid to include respective fraud risk profiles and plans for regularly updating the assessments and profiles. (Recommendation 2)

Agency: Department of Health and Human Services: Centers for Medicare and Medicaid Services
Status: Open

Comments: Agency agreed with this recommendation. In July 2018, CMS reported that it has initiated the fraud risk assessment for some programs in Medicare, including the Medicare Diabetes Prevention Program expanded model. CMS also reported that it is also continuing to draft fraud risk profiles for the Comprehensive End-Stage Renal Disease (ESRD) Care model, the Comprehensive Primary Care Plus model, the permanent Medicare Shared Savings Program, and the new Medicare Beneficiary Identifier. Additionally, CMS reported that it is assessing the Quality Payment Program, established by the Medicare Access and CHIP Reauthorization Act of 2015 (MACRA), utilizing the GAO fraud risk assessment framework. We will continue to monitor CMS's progress in this area. In November 2019, CMS provided a diagram depicting CMS approach to assessing fraud risks and a document for Home Health Request for Anticipated Payment, stating that fraud risk assessments on Medicare Diabetes Prevention Program and Quality Payment Program are under development. We requested and are awaiting additional information on CMS's approach and plans for conducting fraud risk assessments in Medicare programs, including the reasoning for program selection, overall order, and anticipated timeframes.

Recommendation: The Administrator of CMS should, using the results of the fraud risk assessments for Medicare and Medicaid, create, document, implement, and communicate an antifraud strategy that is aligned with and responsive to regularly assessed fraud risks. This strategy should include an approach for monitoring and evaluation. (Recommendation 3)

Agency: Department of Health and Human Services: Centers for Medicare and Medicaid Services
Status: Open

Comments: Agency agreed with this recommendation. In November 2019, CMS reported on activities to conduct fraud risk assessments in Medicare programs (see Recommendation 2), however this work is ongoing and the recommendation remains open. Because completion of a fraud risk assessment is necessary before developing an antifraud strategy, this recommendation also remains open. We will continue to monitor CMS's progress in this area.

Recommendation: The Director of the Office of Allowances (ALS) should clearly document how the conditions at relevant posts meet the criteria for Director Points to ensure that hardship pay rates for overseas posts are consistently determined across posts and tenures of ALS Directors. (Recommendation 1)

Agency: Department of State
Status: Open

Comments: In commenting on our report, State concurred with our recommendation. As of January 2020, the Director of ALS has not granted any Director Points since the subject GAO review was completed. According to State officials, should points be necessary in the future, ALS will document why the conditions at relevant posts require the use of Director Points connected with hardship pay rates. We will continue to follow-up on this.

Recommendation: The Undersecretary of Management should assess the cost-effectiveness of State's policies and procedures for stopping and starting hardship pay for employees who temporarily leave their assigned overseas posts. (Recommendation 2)

Agency: Department of State
Status: Open
Priority recommendation

Comments: State concurred with this recommendation, and reported that the department is taking a two-pronged approach to reviewing the issue. First, the Department is conducting a comprehensive review of all costs associated with the processing of hardship and other associated allowance and differential cables through reviews of post-level and central expenditures. This review is expected to be complete by October 2020. Second, the Department is costing out alternative methods of addressing allowance and differential costs that reduce the manual effort on the Department but address the need to support costs incurred by Foreign Service Officers overseas. Meetings with Foreign Service Officer staff to understand variances in the current model were held in the summer of 2019. Highlights from those sessions are being incorporated into a proposal to coincide with the review of costs from the first phase. The final proposal is expected to be complete by the end of 2020.

Recommendation: The Department's Comptroller should analyze available diplomatic cable data from overseas posts to identify posts at risk of improper payments for hardship pay, identify any improper payments, and take steps to recover and prevent them. (Recommendation 3)

Agency: Department of State
Status: Open
Priority recommendation

Comments: State concurred with this recommendation. According to State, it continues to identify and seek repayment of improper payments and communicate the importance of timely actions to the regional bureaus and posts to ensure improper payments do not occur. In addition, the Bureau of the Comptroller and Global Financial Services (CGFS) supports the roll out of the Overseas Personnel System, which will centralize the collection of arrival and departure data for the calculation of improper payment notification and risk analysis. To fully implement the recommendation, the Bureau of Human Resources (HR) must complete worldwide deployment of the Overseas Personnel System, and both HR and CGFS would need to complete integration work to enable arrival and departure data to flow in an automated fashion between the two systems. CGFS would then need to provide documentation that the system allows it to more easily identify and prevent improper payments. Preliminary development of the integration will begin in the summer of 2020 while the OPS roll-out continues.

Recommendation: To improve annual reporting on PTC improper payments, control activities related to eligibility determinations, and calculations of advance PTC, the Secretary of Health and Human Services should direct the Administrator of CMS to annually report improper payment estimates and error rates for the advance PTC program.

Agency: Department of Health and Human Services
Status: Open
Priority recommendation

Comments: The Department of Health and Human Services (HHS) concurred with this recommendation. On May 23, 2018, HHS's Centers for Medicare and Medicaid Services (CMS) stated that it is currently in the process of developing an improper payment measurement for the advance premium tax credit (PTC). The development of the measurement methodologies will be a multi-year process which consists of the development of measurement policies, procedures, and tools. It also includes extensive pilot testing to ensure an accurate and efficient improper payment estimate, as well as, acquisition activities for procurement of improper payment measurement contractors. In January 2020, CMS stated that it is still in the process of developing an improper payment measurement for the advance PTC. Further, CMS stated that it provided progress updates in the fiscal year 2019 HHS agency financial report (AFR), and will continue to do so in future AFRs until an improper payment rate is estimated. We will continue to monitor the agency's actions to address this recommendation.

Recommendation: To improve annual reporting on PTC improper payments, control activities related to eligibility determinations, and calculations of advance PTC, and until annual reporting of improper payment estimates and error rates for the advance PTC program is performed, the Secretary of Health and Human Services should direct the Administrator of CMS to disclose significant matters relating to the Improper Payments Information Act (IPIA) estimation, compliance, and reporting objectives for the advance PTC program in the agency financial report, including CMS's progress and timeline for expediting the achievement of those objectives and the basis for any delays in meeting IPIA requirements.

Agency: Department of Health and Human Services
Status: Open

Comments: HHS concurred with this recommendation. On February 28, 2018, the Department of Health and Human Services's (HHS) Centers for Medicare and Medicaid Services (CMS) stated that updates on the advance premium tax credit (PTC) program improper payment measurement development were provided in the fiscal year (FY) 2017 Agency Financial Report (AFR), which was published in November 2017. In FY 2018, we reviewed the FY 2017 AFR that HHS's CMS cited in support for closing this recommendation. Based on our review, the FY 2017 AFR does not address our recommendation as it does not provide a timeline for reporting an improper payment estimate. In FY 2019, we reviewed HHS's FY 2018 AFR published in November 2018, which includes a statement that HHS will continue to update its annual AFRs on the status of the measurement program development until the improper payment estimate is reported. However, this latest AFR also does not provide a timeline for reporting an improper payment estimate for HHS's PTC program. In January 2020, CMS stated that it is in the process of procuring federal contractors to perform the improper payment measurement. However, CMS further stated that due to uncertainties surrounding the timing of the procurement, CMS does not anticipate publishing a reporting timeline until the contracts have been awarded. We will continue to monitor the agency's actions to address this recommendation.

Recommendation: To improve annual reporting on PTC improper payments, control activities related to eligibility determinations, and calculations of advance PTC, the Secretary of Health and Human Services should direct the Administrator of CMS to design and implement procedures for verifying the identities of phone and mail applicants to reasonably assure that ineligible individuals are not enrolled in qualified health plans in the marketplaces or provided advance PTC.

Agency: Department of Health and Human Services
Status: Open

Comments: The Department of Health and Human Services (HHS) neither agreed nor disagreed with this recommendation. Regarding verification of filer identity, HHS stated, in response to the draft report, that for individuals starting an application via phone, the call center representatives use verbal attestations for verifications from individuals. HHS stated that for paper applications, individuals must provide names and complete addresses as well as other information. In addition, HHS stated that individuals must attest that the information they provide on all applications is accurate by signing under penalty of perjury. However, these steps do not involve the verification of an applicant's identity to a third-party source. In August 2018, HHS officials stated that they are exploring alternatives for assessing risk and ensuring integrity of applicant information that is provided to the program and ways to ensure personal information provided by an individual is accurate through a variety of means. After this analysis phase, they will assess resource requirements, cost, and operational implications for potential implementation approaches with a target date for completion of 2019. As of December 2018, HHS had not designed and implemented procedures for verifying the identities of phone and mail applicants, as GAO recommended. As of January 2020, HHS indicated that it is developing new policy and guidance which could significantly change potential solutions or requirements. However, HHS did not provide us a time frame for when it plans to finalize the new policy and guidance. We will continue to monitor agency's actions to address the recommendation.

Recommendation: To comply with improper payments reporting requirements and improve procedures related to processing PTC information on tax returns, the Commissioner of Internal Revenue should direct the appropriate officials to assess the program against applicable IPIA-defined thresholds and conclude on its susceptibility to significant improper payments, and revise the scope of its improper payments susceptibility assessment for the PTC program to include instances in which advance PTC is greater than or equal to the amount of PTC claimed on the tax return. If the program meets the IPIA definition for being susceptible to significant improper payments based on this assessment, estimate and report improper payments associated with the PTC program consistent with IPIA requirements.

Agency: Department of the Treasury: Internal Revenue Service
Status: Open
Priority recommendation

Comments: The Internal Revenue Service (IRS) partially agreed with this recommendation. On December 13, 2019, IRS provided us a status update and stated that its Research, Applied Analytics and Statistics division completed an analysis of net premium tax credit (PTC) using National Research Program (NRP) tax years 2015 and 2014 data during the 4th quarter of fiscal year 2019 and developed improper payment estimates using two different methodological approaches. However, IRS indicated that it did not publish these improper payment estimates in Treasury's Agency Financial Report for two reasons: (1) there is as yet insufficient NRP data to develop an estimate that is within the confidence interval and margin of error prescribed by the Office of Management and Budget for improper payments sampling, and (2) the Department of the Treasury (Treasury) wishes to engage with Health and Human Services' Centers for Medicare & Medicaid Services on the potential for developing a joint rate estimate for advance PTC and PTC. In addition, IRS noted that it had not yet determined whether this is even possible from a data compatibility standpoint. Further, IRS stated that while the estimates do not meet the statistical precision requirement, they do suggest that Net PTC would meet the criteria to be considered susceptible to significant improper payments. IRS indicated that when it last discussed this recommendation with GAO, it was suggested this recommendation would be closed once improper payment rates are published. However, IRS would now like GAO to consider closing this recommendation at this time given (1) the IRS's efforts to analyze potential improper payments, (2) Treasury's new approach to reporting, and (3) the need for additional years of data before a statistically valid estimate can be developed. We do not believe the recommendation should be closed at this time based on the three reasons IRS has listed above. However, we credit IRS for exploring ways to meet the intent of the recommendation. We will continue to monitor the agency's actions to address this recommendation.

Recommendation: To comply with improper payments reporting requirements and improve procedures related to processing PTC information on tax returns, the Commissioner of Internal Revenue should direct the appropriate officials to assess and document the feasibility of approaches for incorporating information from the marketplaces on individuals who did not demonstrate that they met the eligibility requirements for citizenship or lawful presence in the tax compliance process. If determined feasible, IRS should work with Treasury to require marketplaces to periodically provide such information on individuals and use such information to recover advance PTC made for those individuals.

Agency: Department of the Treasury: Internal Revenue Service
Status: Open

Comments: The Internal Revenue Service (IRS) agreed with this recommendation. In December 2018, an IRS official indicated that IRS conducted a detailed review of the recommendation. IRS informed GAO that it is internally discussing an alternative way to address the recommendation to prevent premium tax credit to noncitizens. The IRS official indicated that IRS is reviewing this alternative with the Department of the Treasury and the Department of Health and Human Services' Centers for Medicare & Medicaid Services. IRS did not provide GAO with a time frame for its implementation. On December 13, 2019, IRS provided us a status update and stated that it had no new information for this recommendation. We will continue to monitor the agency's actions to address this recommendation.

Recommendation: To allow DOE management to effectively monitor invoice reviews and have assurance that this control activity is operating as intended, the Secretary of Energy should establish a DOE-wide invoice review policy that includes requirements for sites to establish well-documented invoice review operating procedures.

Agency: Department of Energy
Status: Open

Comments: In its comments on a draft of the report in March 2017, DOE concurred in principle with this recommendation, stating that it already had an established, detailed DOE-wide invoice review policy provided in DOE's Financial Management Handbook and in the DOE Acquisition Guide. In February 2020, DOE issued an update to its Financial Management Handbook that included additional procedures to address intra-governmental payment and collection transactions. However, neither the prior version of the Financial Management Handbook nor the additional information includes invoice review procedures. The Financial Management Handbook refers users to the DOE Acquisition Guide for procedures for invoice review. However, the Acquisition Guide states that it is intended to offer general guiding principles for approving officials to consider when reviewing and analyzing cost elements included in contract invoices--as opposed to detailed procedures for invoice review--and does not require sites to establish well-documented invoice review operating procedures, as we recommended.

Recommendation: To help DOE take a more strategic approach to managing improper payments and risk, including fraud risk, the Secretary of Energy should implement leading practices for managing the department's risk of fraud, including creating a structure with a dedicated entity within DOE to design and oversee fraud risk management activities.

Agency: Department of Energy
Status: Open
Priority recommendation

Comments: In its comments on a draft of the report in March 2017, DOE partially agreed with the recommendation. In its written comments on the report, DOE stated that it considered the recommendation to be closed without corrective action and that it would rely on the existing Office of Financial Policy and Internal Controls and on the DOE Office of Inspector General (OIG) to design and oversee financial fraud risk management activities. However, we disagree that relying in part on the OIG to design and oversee fraud risk management activities meets best practices because, according to GAO's Fraud Risk Framework, the dedicated entity should not include the OIG so that the OIG can maintain its independence. In May 2020, DOE officials said they were developing a fraud risk and data analytics framework. Among other steps, DOE expects to establish a new group in fiscal year 2020 that will oversee DOE's fraud risk management activities. We will continue to monitor DOE's progress in implementing this recommendation.

Recommendation: To help DOE take a more strategic approach to managing improper payments and risk, including fraud risk, the Secretary of Energy should implement leading practices for managing the department's risk of fraud, including conducting fraud risk assessments that are tailored to each program and use the assessments to develop a fraud risk profile

Agency: Department of Energy
Status: Open

Comments: In its comments on a draft of the report in March 2017, DOE concurred with the substance of the recommendation; however they considered the recommendation to be closed without corrective action because DOE believed that its risk assessments met the requirements of the Improper Payments Elimination and Recovery Improvement Act of 2012, as reported by the Office of Inspector General (OIG), and because it has implemented updates to OMB Circular A-123 that added requirements related to managing fraud risk and adherence to GAO's Fraud Risk Framework. However, we found that DOE has not conducted fraud risk assessments that were tailored to its programs and, therefore, do not allow the department to create a fraud risk profile. We also found that, although DOE updated its internal control assessment tools with a list of fraud risks as required by OMB Circular A-123, the list of risks were the same for all DOE sites and were not tailored to the sites' different programs. In May 2020, DOE officials said they were developing a fraud risk and data analytics framework. Among other steps, the framework is expected to include changes to DOE's process to develop its fraud risk profile, beginning in fiscal year 2020. We will continue to monitor DOE's progress in implementing this recommendation.

Recommendation: To help DOE take a more strategic approach to managing improper payments and risk, including fraud risk, the Secretary of Energy should implement leading practices for managing the department's risk of fraud, including developing and documenting an antifraud strategy that describes the programs' approaches for addressing the prioritized fraud risks identified during the fraud risk assessment.

Agency: Department of Energy
Status: Open

Comments: In its comments on the draft report in March 2017, DOE concurred with this recommendation but considered the recommendation closed without corrective action because DOE had implemented the updated OMB Circular A-123 and because DOE's antifraud strategy was embedded in the DOE internal control program. However, DOE officials told us that they had not developed or documented a DOE-wide antifraud strategy or directed individual programs to develop program-specific strategies. Furthermore, DOE's implementation of OMB Circular A-123 included adding a list of potential risks to their internal control assessment tool that were the same for all DOE sites and were not tailored to the sites' different programs. In May 2020, DOE officials said they were developing a fraud risk and data analytics framework. Among other steps, DOE is planning to develop an antifraud strategy in fiscal year 2021. We will continue to monitor DOE's progress in implementing this recommendation.

Recommendation: To help DOE take a more strategic approach to managing improper payments and risk, including fraud risk, the Secretary of Energy should implement leading practices for managing the department's risk of fraud, including designing and implementing specific control activities, including fraud awareness training and data analytics, to prevent and detect fraud and other improper payments.

Agency: Department of Energy
Status: Open

Comments: In its comments on the draft report in March 2017, DOE stated that it concurred in principle with the recommendation, but that it had implemented the recommendation. In May 2020, DOE officials said they were developing a fraud risk and data analytics framework. Among other steps, DOE is planning to begin in fiscal year 2022 to use data analytics across the agency to prevent fraud. We will continue to monitor DOE's progress in implementing this recommendation.

Recommendation: To help ensure that necessary data are available to employ data analytics as a tool to perform contractor cost-surveillance activities, the Secretary of Energy should require contractors to maintain sufficiently detailed transaction-level cost data that are reconcilable with amounts charged to the government, including (1) cost data that, at a minimum, represent a full data population and (2) the details necessary to determine the nature of each cost transaction, with such identifiers as transaction date, dollar amount, item or service description, and transaction codes to indicate the type of cost represented (e.g., construction materials, property lease, and office supplies).

Agency: Department of Energy
Status: Open

Comments: In its comments on the draft report in March 2017, DOE did not agree to implement this recommendation because officials believe that the recommendation establishes agency-specific requirements for DOE contractors that are more prescriptive than current federal requirements. In May 2020, DOE officials said they were developing a fraud risk and data analytics framework. Among other steps, DOE is planning to begin in fiscal year 2022 to use data analytics across the agency to prevent fraud. We will continue to monitor DOE's progress in implementing this recommendation.

Recommendation: To improve CNCS's efforts to move toward a risk-based process for monitoring grants and to improve its capacity for monitoring grantee compliance, the Chief Executive Officer of the Corporation for National and Community Service should ensure that CNCS completes its efforts to benchmark its assessment criteria and scoring process to further develop a risk-based approach to grant monitoring and that information from this effort is used to (a) score the indicators so that the riskiest grants get the highest scores; (b) revise the assessment indicators to meaningfully cover all identifiable risks, including fraud and improper payments; and (c) document decisions on how indicators are selected and weighted.

Agency: Corporation for National and Community Service
Status: Open

Comments: CNCS has been working since September 2018 to review and update its risk assessment process. The CNCS Office of Research and Evaluation has developed a methodology to determine the appropriate score and weight for the assessment indicators. It plans to fully implement the new risk assessment process in fiscal year 2020. To close this recommendation, CNCS will need to show documentation for how it selected and weighted revised indicators to cover identifiable risks, and how the revised scoring system identifies the riskiest grants.

Recommendation: To improve CNCS's efforts to move toward a risk-based process for monitoring grants and to improve its capacity for monitoring grantee compliance, the Chief Executive Officer of the Corporation for National and Community Service should review monitoring protocols, including the level of information collected for oversight of subrecipients' activities such as criminal history checks, and enhance protocols, as appropriate.

Agency: Corporation for National and Community Service
Status: Open

Comments: As of July 2019, CNCS stated that revisions to the agency-wide risk assessment instrument include indicators to address prime grantee monitoring and oversight of subrecipients. CNCS established a new Office of Monitoring in 2019, which will be responsible for reviewing and improving monitoring protocols, including those related to subrecipient activities. Enhanced monitoring protocols will be implemented as part of its fiscal year 2020 monitoring plan. To help close this recommendation, CNCS will need to show how it has expanded information it collects pertaining to subrecipients, and how its monitoring efforts reflect this.

Recommendation: To improve CNCS's efforts to move toward a risk-based process for monitoring grants and to improve its capacity for monitoring grantee compliance, the Chief Executive Officer of the Corporation for National and Community Service should establish activities to systematically evaluate grant monitoring results.

Agency: Corporation for National and Community Service
Status: Open

Comments: In July 2019, CNCS reported that the new Office of Monitoring supports the agency's May 2018 Transformation and Sustainability Plan goals related to monitoring and evaluating results. This office is developing a monitoring strategy to align with the agency's IT system improvements, and will allow for reporting and data to support a systematic evaluation of grant monitoring results. To help close this recommendation, CNCS will need to show how the agency has used outcomes and findings from its grant monitoring activities to help guide improvements to these activities.

Recommendation: To improve CNCS's efforts to move toward a risk-based process for monitoring grants and to improve its capacity for monitoring grantee compliance, the Chief Executive Officer of the Corporation for National and Community Service should, as part of CNCS's efforts to develop an employee development program, update critical competencies for grant monitoring, and establish a training planning process linked with agency goals and these competencies.

Agency: Corporation for National and Community Service
Status: Open

Comments: As of July 2019, CNCS is in the process of realigning its grant management and monitoring functions. The agency plans to document critical competencies for grant management and monitoring roles and establish a training program to strengthen its grant monitoring performance. By December 2019, CNCS plans to implement a comprehensive orientation curriculum and a more effective onboarding procedure, updated staff support training materials, among other changes to its training efforts. To close this recommendation, CNCS will need to determine which competencies are critical for grant monitoring, and show how the competencies are linked with the agency's training planning processes and agency goals.

Recommendation: To improve the collection of complete and consistent personal care services data and better ensure CMS can effectively monitor the states' provision of and spending on Medicaid personal care services, CMS should better ensure that personal care services data collected from states through T-MSIS and MBES comply with CMS reporting requirements.

Agency: Department of Health and Human Services: Centers for Medicare and Medicaid Services
Status: Open

Comments: The Centers for Medicare & Medicaid Services (CMS) concurs with GAO's recommendation. In December 2017, CMS cited ongoing efforts related to claims data submitted by states through T-MSIS, CMS's new claims reporting system. Efforts included validation checks of personal care service claims to ensure that key data are not missing or incorrect. In addition, CMS stated it was working with the states to address concerns that are identified with the quality of claims data submitted. However, as of March 2020, CMS had not reported that it had addressed inaccurate state reporting of expenditures through CMS's expenditure reporting system, Medicaid Budget and Expenditure System (MBES). Complete implementation of the recommended action will better ensure state reporting of claims and expenditures is accurate and will allow CMS to effectively perform key management functions.

Recommendation: To improve the collection of complete and consistent personal care services data and better ensure CMS can effectively monitor the states' provision of and spending on Medicaid personal care services, CMS should develop plans for analyzing and using personal care services data for program management and oversight.

Agency: Department of Health and Human Services: Centers for Medicare and Medicaid Services
Status: Open

Comments: The Centers for Medicare & Medicaid Services (CMS) concurred with this recommendation. However, as of March 2020, CMS had not developed a plan for analyzing and using personal care services data as GAO recommended in January 2017. Developing a plan for analyzing and using personal care services data for program management and oversight is an important step CMS needs to take to improve the oversight and management of personal care services.

Recommendation: To achieve a better understanding of the effect of certain Personal care services (PCS) services on beneficiaries and a more consistent administration of policies and procedures across PCS programs, the Acting Administrator of CMS should collect and analyze states' required information on the impact of the Participant-Directed Option and Community First Choice programs on the health and welfare of beneficiaries as well as the state quality measures for the Participant-Directed Option and Community First Choice programs.

Agency: Department of Health and Human Services: Centers for Medicare and Medicaid Services
Status: Open

Comments: The Centers for Medicare & Medicaid Services (CMS) concurred with GAO's recommendation. On December 30, 2016, the agency issued guidance on the Community First Choice program to assist states in submitting information to CMS on the health and welfare of beneficiaries. In March 2019, CMS officials stated that the agency is currently developing the process for states to report this information to CMS. Agency officials also stated they are exploring the value of collecting this information for the Participant-Directed Option program given the limited number of states currently operating under this authority. In February 2020, CMS officials stated that the agency continues to develop policy related to this recommendation.

Recommendation: To provide agencies access to SSA's more complete set of death data, Congress should consider amending the Social Security Act to explicitly allow SSA to share its full death file with Treasury for use through the DNP working system.

Agency: Congress
Status: Open

Comments: In fiscal year 2020, the Senate passed S.4104, which included language to address the recommendation. In the context of the Do Not Pay (DNP) working system, the bill, if enacted, would authorize comparison of the Social Security Administration's (SSA) full death file with personally identifiable information reviewed through the working system and would allow redisclosure of such comparison of information to any federal or state agency authorized to use the working system. As of July 15, 2020, the House has not introduced a related bill for fiscal year 2020. Additionally, in February 2020, the administration released its President's 2021 Budget, which proposes legislation to allow the DNP Business Center full access to the SSA full death file. This proposal would include the Department of the Treasury and the SSA working together to determine the most efficient manner to make full death information available for use in preventing improper payment and fraud. We will continue to monitor congressional legislation to address this recommendation. .

Recommendation: To better monitor agency use of the DNP working system once a strategy has been developed, the Director of OMB should develop and implement monitoring mechanisms--such as goals, benchmarks, and performance measures--to evaluate agency use of the DNP working system.

Agency: Executive Office of the President: Office of Management and Budget
Status: Open
Priority recommendation

Comments: OMB agreed with the concept of monitoring mechanisms and will continue to work with agencies to reduce improper payments and encourage agencies to establish goals to improve payment accuracy that will be monitored and evaluated by OMB. In fiscal year 2019, OMB provided us a status update on July 31, 2019, stating that Treasury does this monitoring and reports updates to OMB on a quarterly basis and that monitoring will occur in conjunction with the President's Management Agenda. In August 2020, Treasury provided us examples of reports that it provides to OMB to assist OMB with evaluating agency use of the DNP working system. We plan to meet with OMB to discuss how it uses these reports and will continue to monitor OMB's actions to address this recommendation.

Recommendation: To reasonably assure that agency-reported information on use of the DNP working system is reliable, the Director of OMB should develop a process for comparing agency reporting on the use of the DNP working system to available sources, such as OMB guidance and DNP working system adjudication reports.

Agency: Executive Office of the President: Office of Management and Budget
Status: Open

Comments: The Office of Management and Budget (OMB) agreed with the concept of ensuring that data are reliable and will consider the feasibility of a process to compare agency submissions to available sources to reasonably assure that agency-reported information on use of the Do Not Pay working system is reliable. OMB provided us a status update on July 1, 2019, stating that OMB will work with Treasury to determine feasibility of doing this review and establishing a process during fiscal year 2019. As of February 2020, OMB has not provided any new status updates for this recommendation. We will continue to monitor the agency's actions to address this recommendation.

Recommendation: To reasonably assure that agency-reported information on use of the DNP working system is complete, the Director of OMB should revise its guidance to clarify whether agencies should report on their uses of all of the functionalities of the DNP working system in their agency financial reports.

Agency: Executive Office of the President: Office of Management and Budget
Status: Open

Comments: The Office of Management and Budget (OMB) agreed with ensuring the completeness of data and will continue to work with agencies and the Chief Financial Officer community to ensure that agency-reported information on the use of the Do Not Pay (DNP) working system is complete. In fiscal year 2019, OMB provided us a status update on July 1, 2019, stating that this recommendation was addressed in OMB's Circular A-136. Additionally, we met with OMB officials on July 31, 2019. During the meeting, OMB officials informed us that the OMB Circular A-136, Section II.4.5 (bullet 3) (dated June 28, 2019) states that "Agencies should provide a brief narrative of the reduction in improper payments that is attributable to the DNP Initiative, as applicable. See OMB Circular A-123, Appendix C, Part V for a thorough overview of the roles and responsibilities of agencies to use centralized data sources such as the Treasury Working System and other government databases to prevent improper payments." We have reviewed OMB Circular A-136 and confirmed that the circular does contain the statements above. However, we do not believe that the OMB Circular A-136 meets the intent of our recommendation. GAO issued its recommendation, in part, because GAO found that OMB guidance does not indicate whether agencies should report on all uses of the DNP working system, including those outside payment integration that the DNP working system does not track. For this reason, GAO report concluded that without complete and reliable data and clear guidance on what information agencies should report, OMB cannot effectively monitor and evaluate the use of the DNP working system. Therefore, we do not believe that the OMB Circular A-136 sufficiently clarifies whether agencies should report on their uses of all of the functionalities of the DNP working system in their agency financial reports. As of February 2020, OMB has not provided any new status updates for this recommendation. We will continue to monitor OMB's actions to address this recommendation.

Recommendation: In order to better ensure proper Medicare payments and protect Medicare funds, CMS should seek legislative authority to allow the RAs to conduct prepayment claim reviews.

Agency: Department of Health and Human Services
Status: Open
Priority recommendation

Comments: In April 2016, we recommended that the Centers for Medicare and Medicaid Services (CMS) should seek legislative authority to allow the Recovery Auditors (RAs) to conduct prepayment claim reviews. The Department of Health and Human Services did not concur with this recommendation, and the President's fiscal year 2021 budget did not include a proposal for such authority. We continue to believe CMS should seek legislative authority to allow RAs to conduct these reviews. Until CMS seeks and implements this authority, it will be missing an opportunity to help identify improper payments before they are made.

Recommendation: As CMS continues to implement and refine the contract-level RADV audit process to improve the efficiency and effectiveness of reducing and recovering improper payments and to improve the accuracy of CMS's calculation of coding intensity, the Administrator should modify that calculation by taking actions such as the following: (1) including only the three most recent pair-years of risk score data for all contracts; (2) standardizing the changes in disease risk scores to account for the expected increase in risk scores for all MA contracts; (3) developing a method of accounting for diagnostic errors not coded by providers, such as requiring that diagnoses added by MA organizations be flagged as supplemental diagnoses in the agency's Encounter Data System to separately calculate coding intensity scores related only to diagnoses that were added through MA organizations' supplemental record review (that is, were not coded by providers); and (4) including MA beneficiaries enrolled in contracts that were renewed from a different contract under the same MA organization during the pair-year period.

Agency: Department of Health and Human Services: Centers for Medicare and Medicaid Services
Status: Open

Comments: CMS is working to improve the accuracy of its calculation of coding intensity, as GAO recommended in April 2016. In October 2017, CMS officials told GAO that the agency is reevaluating the design of the risk adjustment data validation audits to ensure their rigor in the context of all the payment error data acquired since the original design of the audits. As part of this work, CMS officials told GAO that the agency will examine whether coding intensity is the best criterion to use to select contracts for audit. As a result, in October 2018, CMS told GAO that rather than coding intensity, it plans to implement a new methodology using payment error as the key sampling driver beginning with audits for payment year 2014. Additionally, CMS was taking steps to modernize its audit system to improve reliability. For example, it initiated a project to explore how to directly receive electronic medical record documentation. As of January 2020, the agency is continuing to reevaluate the design of these audits. Unless CMS takes this and other actions to improve the risk adjustment data validation contract-level audit process, it will fail to recover improper payments of hundreds of millions of dollars annually.

Recommendation: As CMS continues to implement and refine the contract-level RADV audit process to improve the efficiency and effectiveness of reducing and recovering improper payments. The Administrator should modify CMS's selection of contracts for contract-level RADV audits to focus on those contracts most likely to have high rates of improper payments by taking actions such as the following: (1) selecting more contracts with the highest coding intensity scores; (2) excluding contracts with low coding intensity scores; (3) selecting contracts with high rates of unsupported diagnoses in prior contract-level RADV audits; (4) if a contract with a high rate of unsupported diagnoses is no longer in operation, selecting a contract under the same MA organization that includes the service area of the prior contract; and (5) selecting some contracts with high enrollment that also have either high rates of unsupported diagnoses in prior contract-level RADV audits or high coding intensity scores.

Agency: Department of Health and Human Services: Centers for Medicare and Medicaid Services
Status: Open

Comments: CMS is working to modify the selection of MA contracts for audit, as GAO recommended in April 2016. In October 2017, CMS officials told GAO that the initial RADV audit design was based on a limited set of payment error data available at the time. As part of efforts to improve the audits, CMS officials told GAO that the agency will examine whether coding intensity is the best criterion to select contracts for audit. In October 2018, CMS told GAO that it plans to implement a new methodology using payment error as the key sampling driver-rather than coding intensity-beginning with audits for payment year 2014. As of January 2020, the agency is using the revised methodology on the 2014 and 2015 payment year audits. They expect to conclude this process in late fiscal year 2020 and 2021, respectively. Unless CMS completes actions to improve the RADV contract-level audit process, it will fail to recover improper payments of hundreds of millions of dollars annually.

Recommendation: As CMS continues to implement and refine the contract-level RADV audit process to improve the efficiency and effectiveness of reducing and recovering improper payments. The Administrator should enhance the timeliness of CMS's contract-level RADV process by taking actions such as the following: (1) closely aligning the time frames in CMS's contract-level RADV audits with those of the national RADV audits the agency uses to estimate the MA improper payment rate; (2) reducing the time between notifying MA organizations of contract audit selection and notifying them about the beneficiaries and diagnoses that will be audited; (3) improving the reliability and performance of the agency's process for transferring medical records from MA organizations, including assessing the feasibility of updating Electronic Submission of Medical Documentation for use in transferring medical records in contract-level RADV audits; and (4) requiring that CMS contract-level RADV auditors complete their medical record reviews within a specific number of days comparable to other medical record review time frames in the Medicare program.

Agency: Department of Health and Human Services: Centers for Medicare and Medicaid Services
Status: Open
Priority recommendation

Comments: HHS concurred with this recommendation in its fiscal year 2021 budget justification. HHS reaffirmed its commitment to identifying and correcting improper payments in the MA program. It has begun taking steps to improve the timeliness of the contract-level RADV audit process, such as aligning the time frames in CMS's contract-level RADV audits with those of the national RADV audits. Once completed, CMS needs to provide evidence that the actions taken by the agency have enhanced the timeliness of CMS's contract-level RADV process.

Recommendation: As CMS continues to implement and refine the contract-level RADV audit process to improve the efficiency and effectiveness of reducing and recovering improper payments. The Administrator should improve the timeliness of CMS's contract-level RADV appeal process by requiring that reconsideration decisions be rendered within a specified number of days comparable to other medical record review and first-level appeal time frames in the Medicare program.

Agency: Department of Health and Human Services: Centers for Medicare and Medicaid Services
Status: Open

Comments: CMS is working to improve the timeliness of the agency's contract-level risk adjustment data validation appeals process, as GAO recommended in April 2016. In October 2017, CMS officials told GAO that the agency is actively considering options for expediting the appeals process. For example, CMS is considering the appropriate number of days for rendering reconsideration decisions while allowing for a complete and thorough adjudication. In December 2019, CMS officials told GAO they expect to issue a final rule in January 2021 that will establish uniform timelines to expedite the appeals process. Specifically, they plan to require that a findings determination be made within 60-90 days of an arbiter's receipt of each party's arguments at each stage of an appeal. Unless CMS takes such actions to improve the risk adjustment data validation contract-level audit process, it will fail to recover improper payments of hundreds of millions of dollars annually.

Recommendation: As CMS continues to implement and refine the contract-level RADV audit process to improve the efficiency and effectiveness of reducing and recovering improper payments. The Administrator should ensure that CMS develops specific plans and a timetable for incorporating a RAC in the MA program as mandated by the Patient Protection and Affordable Care Act.

Agency: Department of Health and Human Services: Centers for Medicare and Medicaid Services
Status: Open

Comments: CMS has attempted to incorporate a recovery audit contractor in the Medicare Advantage program, as GAO recommended in April 2016. After failing to receive any proposals when CMS first issued a request for proposals (RFP) in 2014, CMS issued a request for information to industry in December 2015, which included a draft Statement of Work to solicit feedback, gauge interest, and conduct market research regarding CMS entering into a contract with a recovery audit contractor to identify underpayments and overpayments associated with diagnosis data submitted to CMS by Medicare Advantage Organizations. CMS reported that it subsequently issued another RFP in 2016 and did not receive any proposals for a second time. In December 2019, CMS officials told GAO that the functions of the Part C recovery Audit programs are being performed through other program integrity mechanisms. CMS subsequently reported in its fiscal year 2021 budget justification that CMS believes the proposed scope of the Part C RAC has been subsumed by RADV and CMS will demonstrate that the RADV program satisfies this recommendation. Until CMS completes efforts to improve the risk adjustment data validation contract-level audit process and demonstrates that it has satisfied the requirement to incorporate a recovery audit contractor in the MA program, CMS will fail to recover improper payments of hundreds of millions of dollars annually.

Recommendation: To improve SSA's ability to detect, prevent, and recover potential DI benefit overpayments due to the concurrent receipt of FECA benefits, the Commissioner of Social Security should strengthen internal controls designed to prevent DI overpayments due to the concurrent receipt of FECA benefits by implementing the alternative that provides the greatest net benefits.

Agency: Social Security Administration
Status: Open
Priority recommendation

Comments: As of January 2020, SSA had taken steps to strengthen internal controls, as GAO recommended in July 2015, but it had not completed its efforts. In January 2020, SSA told GAO that it continues to work with DOL to establish a computer matching agreement to support the FECA data exchange and the agreement is pending at DOL for final review and signature. According to SSA, if the agreement is established, SSA will use the FECA benefit data to improve efficiencies in its ability to offset/reduce DI benefits when an individual is concurrently receiving FECA benefits. GAO will continue to monitor SSA's work in this area. SSA following through with these plans will help the agency identify and prevent potential DI overpayments.

Recommendation: The Secretary of Defense should direct the Under Secretary of Defense (Comptroller), with regard to estimating improper payments, to establish and implement key quality assurance procedures, such as reconciliations, to ensure the completeness and accuracy of the sampled populations.

Agency: Department of Defense
Status: Open
Priority recommendation

Comments: The Department of Defense (DOD), in concurring with this recommendation, stated that DOD will work with the Defense Finance and Accounting Service (DFAS) to implement key quality assurance procedures, such as reconciliations, to ensure the completeness and accuracy of sampled populations. In August 2017, DOD officials stated that its Office of the Under Secretary of Defense (Comptroller) will continue its work with DFAS to annually reconcile gross outlays (as stated on its Statement of Budgetary Resources) with outlays as reported in its Agency Financial Report. These reconciliations are currently done only on a summary level. In the future, DOD's validation of its universe of transactions combined with planned reconciliations with the Defense Departmental Reporting System trial balance and transaction data from DOD's entitlement systems will provide more complete reconciliations. As of December 2019, DOD officials stated that DOD needs to resolve its material weakness relating to the universe of transactions. This material weakness is preventing the department from performing the reconciliations necessary to ensure that the populations, from which the samples are drawn to estimate improper payments, are complete and accurate. As of May 2020, DOD had developed a spreadsheet including over 80 financial management and disbursing systems. The Office of the Under Secretary of Defense, OUSD(C), is planning to review and analyze these systems to (1) determine the types of payments and lists of systems used to process the types of payments; (2) confirm if reconciliations are done to verify the total outlays; and (3) determine the testing status of the universe of payments. As of September 30, 2020, this recommendation remains open.

Recommendation: The Secretary of Defense should direct the Under Secretary of Defense (Comptroller), with regard to implementing recovery audits, to monitor the implementation of the revised FMR chapter on recovery audits to ensure that the components either develop recovery audits or demonstrate that it is not cost effective to do so.

Agency: Department of Defense
Status: Open
Priority recommendation

Comments: Department of Defense (DOD) officials, in concurring with this recommendation, stated that DOD would work with the applicable components to monitor the implementation of the revised Financial Management Regulation (FMR) chapter on recovery audits (subsequently renamed as payment recapture audits). According to DOD officials, this action would help to ensure that recovery audits are developed, or will demonstrate that it is not cost-effective to do these audits. In July 2015, DOD was working to update the FMR chapter on recovery audits to reflect revised Office of Management and Budget (OMB) guidance issued in October 2014. DOD issued its revised FMR chapter in November 2015. This chapter requires components to develop cost-effective payment recapture audits or to submit a quantitative justification to the Office of the Under Secretary (Comptroller) for approval. However, we consider this recommendation to be open because DOD did not provide documentation demonstrating that the Office of the Under Secretary of Defense (Comptroller) is monitoring component implementation of recovery auditing. Further, as of April 2017, DOD's efforts to develop cost-estimates for recovery audits were still under way. As of October 2018, this recommendation remains open. As of December 2019, DOD stated that in FY 2020, the Office of the Under Secretary (Comptroller) will coordinate with the DOD improper payment reporting components to analyze whether it would be cost effective to implement payment recapture audit programs for their payments. In a March 20, 2020 memorandum, the Deputy CFO asked DOD components, programs, or activities with annual payments exceeding $1 million to submit a payment recapture plan by June 30, 2020. If a component determines that payment recapture audits are not cost-effective, then the plan must provide the specific analysis and documentation used to reach that conclusion. When completed, the results of the evaluation will serve the Department's final position on payment recapture audit programs. As of September 30, 2020, this recommendation remains open as this evaluation was not yet complete.

Recommendation: The Secretary of Defense should direct the Under Secretary of Defense (Comptroller), with regard to implementing recovery audits, to develop and submit to OMB for approval a payment recapture audit plan that fully complies with OMB guidance.

Agency: Department of Defense
Status: Open
Priority recommendation

Comments: Department of Defense (DOD) officials, in concurring with this recommendation, stated that DOD would develop and submit to the Office of Management and Budget (OMB) a payment recapture plan that fully complies with OMB guidance and is informed by a cost-effectiveness analysis. In July 2015, DOD's Office of the Under Secretary of Defense (Comptroller) efforts to develop a payment recapture audit plan to ensure cost-effectiveness were ongoing and these efforts must be completed before a plan can be submitted to the OMB. In June 2016, DOD officials stated that the Comptroller's efforts to develop a payment recapture audit plan to ensure cost-effectiveness were ongoing. As of August 28, 2017, DOD officials stated that the Office of the Under Secretary of Defense (Comptroller) will determine if a payment recapture audit plan was developed and submitted to OMB for approval in the previous fiscal years. If so, the Office of the Under Secretary of Defense (Comptroller) will determine its relevance and significance (i.e. cost effectiveness)to the improper payments program. If the payment recapture audit plan is considered to be applicable, the Office of the Under Secretary of Defense (Comptroller) will update the previous plan to comply with current OMB guidance. As of October 2018, this recommendation remains open. As of December 2019, DOD stated that in FY 2020, the Office of the Under Secretary (Comptroller) will coordinate with the DOD improper payment reporting components to analyze whether it would be cost effective to implement payment recapture audit programs for their payments. In a March 20, 2020 memorandum, the Deputy CFO asked DOD components, programs, or activities with annual payments exceeding $1 million to submit a payment recapture plan by June 30, 2020. If a component determines that payment recapture audits are not cost-effective, then the plan must provide the specific analysis and documentation used to reach that conclusion. When completed, the results of the evaluation will serve the Department's final position on payment recapture audit programs. As of September 30, 2020, this recommendation remains open as this evaluation was not yet complete..

Recommendation: The Secretary of Defense should direct the Under Secretary of Defense (Comptroller), with regard to reporting, to design and implement procedures to ensure that the department's annual improper payment and recovery audit reporting is complete, accurate, and in compliance with IPERA and OMB guidance.

Agency: Department of Defense
Status: Open
Priority recommendation

Comments: Department of Defense (DOD) officials, in concurring with this recommendation, stated that DOD would design and implement procedures to further ensure that its annual improper payment and recovery audit reporting is complete, accurate, and in compliance with the Improper Payments Elimination and Recovery Act (IPERA) requirements and Office of Management and Budget (OMB) guidance. In June 2015, DOD revised its FMR chapter on improper payments to require components to provide information needed to report on improper payment and recovery audit activities in its annual financial report (AFR) in accordance with IPERA requirements and OMB guidance. DOD's fiscal year 2015 AFR reflected its implementation of the revised FMR. We found that DOD's improper payment reporting in its fiscal year 2015 AFR had improved. However, we were not provided with evidence that Office of the Under Secretary of Defense (Comptroller) is performing oversight and monitoring activities to ensure the accuracy and completeness of the improper payment and recovery audit data submitted by DOD components for inclusion in the AFR. DOD is continuing to work on procedures for ensuring that its reporting on improper payment and recovery audits is accurate, complete, and in compliance with IPERA and OMB guidance. The Office of the Under Secretary of Defense (Comptroller) has developed and implemented a Payment Integrity Checklist to ensure that the department's annual improper payment and recovery audit reporting was complete, accurate, and in compliance with IPERA and OMB guidance. However, the DOD Inspector General in its May 2020 report, stated that while DOD published improper payment estimates for all eight programs for fiscal year 2019, it did not publish reliable estimates for five of the eight programs: Military Health Benefits, Civilian Pay, Military Retirement, DOD Travel Pay, and Commercial Pay. Moreover, DOD did not use accurate populations in calculating the improper payment estimates for the Military Retirement, Commercial Pay, and DOD Travel Pay programs. Based on these issues affecting improper payment reporting, we consider this recommendation to be open as of September 30, 2020.

Recommendation: To help further the progress toward meeting the goals of IPIA and determining states' role in assisting federal agencies to report a national improper payment estimate on federal programs, the Director, Office of Management and Budget, should expand IPIA guidance to provide criteria that federal agencies should consider when developing a plan or methodology for estimating a national improper payment estimate for state-administered programs, such as criteria that address the nature and extent of data and documentation needed from the states to calculate a national improper payment estimate.

Agency: Executive Office of the President: Office of Management and Budget
Status: Open

Comments: The Office of Management and Budget (OMB) concurred with this recommendation. Since the issuance of the GAO report, OMB has made several revisions to its OMB Circular No. A-123, Appendix C "Requirements for Effective Measurement and Remediation of Improper Payments." The latest revision is dated June 26, 2018. The intent of OMB Circular No. A-123, Appendix C, is to ensure that federal agencies focus on prevention and have the proper incentives to improve their improper payment rates. In August 2020, OMB provided us its improper payment guidance on sampling and estimation in place at the time of the GAO audit. Based on this documentation, we sent a follow-up request to OMB for additional information. We are currently waiting to hear back from OMB so we can continue with our review. We will continue to monitor the agency's actions to address this recommendation.