    Improper Payments: Agencies' Fiscal Year 2005 Reporting under the
    Improper Payments Information Act Remains Incomplete (14-NOV-06,
    GAO-07-92).

    Fiscal year 2005 marked the second year that executive agencies
    were required to report improper payment information under the
    Improper Payments Information Act of 2002 (IPIA). As a steward of
    taxpayer dollars, the federal government is accountable for how
    its agencies and grantees spend billions of taxpayer dollars and
    is responsible for safeguarding those funds against improper
    payments. GAO was asked to determine the progress agencies have
    made in their improper payment reporting and the total amount of
    improper payments recouped through recovery auditing. To
    accomplish this, GAO reviewed improper payment information
    reported by 35 agencies in their fiscal year 2005 performance and
    accountability or annual reports.
    -------------------------Indexing Terms-------------------------
    REPORTNUM:   GAO-07-92
        ACCNO:   A63304
      TITLE:     Improper Payments: Agencies' Fiscal Year 2005 Reporting
    under the Improper Payments Information Act Remains Incomplete
         DATE:   11/14/2006
      SUBJECT:   Accountability
    	     Audit reports
    	     Data integrity
    	     Erroneous payments
    	     Executive agencies
    	     Government information
    	     Internal controls
    	     Payments
    	     Program abuses
    	     Program evaluation
    	     Program management
    	     Questionable payments
    	     Reporting requirements
    	     Risk assessment
    	     Policies and procedures
    	     Program goals or objectives
    	     Savings estimates

    ******************************************************************
    ** This file contains an ASCII representation of the text of a  **
    ** GAO Product.                                                 **
    **                                                              **
    ** No attempt has been made to display graphic images, although **
    ** figure captions are reproduced.  Tables are included, but    **
    ** may not resemble those in the printed version.               **
    **                                                              **
    ** Please see the PDF (Portable Document Format) file, when     **
    ** available, for a complete electronic file of the printed     **
    ** document's contents.                                         **
    **                                                              **
    ******************************************************************
    GAO-07-92

         * [1]Report to Congressional Requesters

              * [2]November 2006

         * [3]IMPROPER PAYMENTS

              * [4]Agencies' Fiscal Year 2005 Reporting under the Improper
                Payments Information Act Remains Incomplete

         * [5]Contents

              * [6]Results in Brief
              * [7]Background
              * [8]Improvements Needed in Agencies' Reporting of Improper Payment
                Information

                   * [9]Results of Selected Agencies' Risk Assessments Appear
                     Questionable
                   * [10]Only a Limited Number of Agencies Are Estimating
                     Improper Payments
                   * [11]The Extent and Level of Detail Related to Selected
                     Reporting Requirements Varied

                        * [12]Causes of Improper Payments and Corrective Action
                          Plans
                        * [13]Manager Accountability
                        * [14]Statutory or Regulatory Barriers

              * [15]Improper Payments Estimate Is Understated

                   * [16]Some Agencies Continue to Lack Improper Payment
                     Estimates for Susceptible Programs
                   * [17]Certain Methodologies Used to Estimate Improper Payments
                     Do Not Result in Accurate Estimates
                   * [18]Reduction in Improper Payment Estimate May Not Be a
                     Result of Improved Accountability and Enhanced Internal
                     Controls

              * [19]IPIA May Need to Be Amended to Ensure Agencies Fully Meet Its
                Objectives

                   * [20]Identification Threshold Limits Agency Reporting on
                     Susceptible Programs
                   * [21]IPIA Definition of Improper Payments Excludes Certain
                     Payments from Reporting

              * [22]Agencies' Reporting of Recovery Auditing Information
                Questionable
              * [23]Conclusions
              * [24]Matter for Congressional Consideration
              * [25]Recommendations for Executive Action
              * [26]Agency Comments and Our Evaluation

         * [27]Objectives, Scope, and Methodology
         * [28]Improper Payment Estimates Reported in Agency Fiscal Year 2004 and
           2005 PARs or Annual Reports
         * [29]Outlays, Improper Payment Estimates, and Error Rates Reported in
           Agency Fiscal Year 2005 PARs or Annual Reports
         * [30]Comments from the Office of Management and Budget
         * [31]GAO Contact and Staff Acknowledgments
         * [32]Related GAO Products

    Report to Congressional Requesters

    November 2006

    IMPROPER PAYMENTS

    Agencies' Fiscal Year 2005 Reporting under the Improper Payments
    Information Act Remains Incomplete

    Contents

    Tables

    Figures

    Abbreviations

    November 14, 2006Letter

    Congressional Requesters

    Fiscal year 2005 marked the second year that federal executive branch
    agencies were required to report improper payment information under the
    Improper Payments Information Act of 2002 (IPIA).^1 IPIA has increased
    visibility over improper payments by requiring executive agency heads,
    based on guidance from the Office of Management and Budget (OMB),^2 to
    identify programs and activities susceptible to significant improper
    payments,^3 estimate amounts improperly paid, and report on the amounts of
    improper payments and their actions to reduce them. As the steward of
    taxpayer dollars, the federal government is accountable for how its
    agencies and grantees spend hundreds of billions of taxpayer dollars and
    is responsible for safeguarding those funds against improper payments.

    Our work over the past several years has demonstrated that improper
    payments are a long-standing, widespread, and significant problem in the
    federal government.^4 Yet, the extent of the problem initially had been
    masked because only a limited number of agencies reported their annual
    payment accuracy rates and estimated improper payment amounts prior to the
    passage of IPIA.

    As we reported in March 2005,^5 regarding the first year reporting under
    IPIA, the improper payment estimate of $45 billion did not include any
    amounts for some of the highest risk programs, such as Medicaid with
    outlays in excess of $175 billion for fiscal year 2004. Further, we noted
    that some agencies still had not instituted systematic methods of
    reviewing all programs and activities or had not identified all programs
    susceptible to significant improper payments. We concluded that the
    magnitude of the governmentwide improper payments problem is still unknown
    because agencies have not yet prepared improper payment estimates for all
    of their programs. In that report, we made three recommendations to OMB to
    help ensure successful implementation of IPIA requirements.

    Because of the continued interest in addressing the governmentwide
    improper payments issue, you asked us to determine (1) the extent to which
    agencies have included required improper payment information in their
    performance and accountability reports (PAR), (2) the annual improper
    payment estimate reported by agencies for fiscal year 2005, (3) whether
    the definition and types of improper payments included in IPIA and OMB's
    implementing guidance provide adequate disclosure of the extent of
    improper payments at the agencies, and (4) the reported amount of improper
    payments recouped through recovery audits.

    The scope of our review included the 35 federal agencies that the
    Department of the Treasury (Treasury) determined to be significant to the
    U.S. government's consolidated financial statements. We reviewed improper
    payment information reported by the 35 agencies in their fiscal year 2005
    PARs or annual reports. We also reviewed OMB guidance on implementation of
    IPIA and its report^6 on the results of agency-specific reports,
    significant findings, agency accomplishments, and remaining challenges. We
    did not independently validate the data that agencies reported in their
    PARs or annual reports or the data that OMB reported. However, we are
    providing this agency-reported data as descriptive information that will
    inform interested parties about the magnitude of governmentwide improper
    payments and other improper payments-related information. We believe the
    data to be sufficiently reliable for this purpose. We conducted our work
    from April 2006 through September 2006 in accordance with generally
    accepted government auditing standards. See appendix I for more details on
    our scope and methodology.

    Results in Brief

    Our review of agencies' reporting of selected improper payment information
    identified that improvements are still needed to fully address improper
    payments reporting requirements. For example, we found agencies' reporting
    of improper payment information was incomplete and the extent and level of
    detail of agencies' improper payment information varied. Furthermore, the
    total improper payment estimate does not include several large,
    risk-susceptible federal programs, while other program estimates included
    in the total are not statistically valid. In addition, we found that OMB's
    existing threshold criteria to assess program susceptibility to
    significant improper payments affect how agencies identify these programs,
    thus limiting the disclosure and transparency of governmentwide improper
    payments.

    Generally, agencies must perform four key steps to address the improper
    payment reporting requirements--perform a risk assessment, estimate
    improper payments for risk-susceptible programs and activities, implement
    a plan to reduce improper payments for programs with estimates exceeding
    $10 million, and annually report improper payment estimates and actions to
    reduce them. Of the 35 agencies in our review, 23 reported that they had
    performed risk assessments of all of their programs and activities, while
    12 had not. In addition, the adequacy of some of these risk assessments
    was questionable. For example, the auditors for the Departments of Justice
    (DOJ) and Homeland Security (DHS) cited agency noncompliance with IPIA in
    their fiscal year 2005 annual audit reports, primarily caused by
    inadequate risk assessments.

    A lack of detailed guidance may be a contributing factor to agencies'
    inability to adequately assess their programs for risks. Specifically, we
    found that OMB's implementing guidance does not include a description of
    the common types of risk factors agencies should consider when annually
    reviewing their programs, such as program complexity, operational changes,
    findings from investigative reports, and financial statement and
    performance audit reports. Agencies have developed their own processes for
    conducting risk assessments, which may not satisfactorily identify
    programs susceptible to improper payments. For example, at the Department
    of Agriculture (USDA), its auditors reported that the agency's risk
    assessments were not adequate to estimate the agency's susceptibility to
    improper payments because the Office of Chief Financial Officer's (OCFO)
    guidance was not prescriptive and detailed enough to translate into
    meaningful results.

    For fiscal year 2005, 18 agencies reported improper payment estimates for
    57 programs totaling in excess of $38 billion,^7 which is $7 billion less
    than the $45 billion reported for fiscal year 2004.^8 Of the 18 agencies
    reporting improper payment estimates, 14 agencies had one or more programs
    with improper payment estimates exceeding $10 million, and thus were
    required to prepare and implement a plan to reduce improper payments and
    report on actions taken. Key elements that agencies are required to report
    on include causes of improper payments and corrective actions, manager
    accountability, and statutory barriers.^9 Generally, agencies reported
    this information for one or more of their programs in their PARs. However,
    the extent and details of reporting varied. For example, 1 agency
    addressed the manager accountability reporting element in one sentence
    while 2 other agencies provided information on how each program manager
    was held accountable for each of their high-risk programs identified.

    Although the federal government continues to make progress in meeting the
    requirements of IPIA, agencies' fiscal year 2005 reporting does not yet
    reflect the full scope of improper payments across government.
    Specifically, the $7 billion reported decrease in the total improper
    payment estimate represents a reduction of 16 percent reported by agencies
    in fiscal year 2004. On the surface, this would suggest that significant
    progress has been made. Yet, we found that the reduced estimate for
    improper payments for fiscal year 2005 may not represent actual
    improvements in this area.

    In fact, all indications are that the estimate should be markedly higher
    because the total improper payment estimate does not include certain
    factors that if included, would increase the estimate. For example,
    agencies have not estimated improper payments for 10 risk-susceptible
    programs with outlays totaling over $234 billion, even though most of
    these programs had such reporting requirements predating IPIA.^10 In
    addition, we found that improper payment estimates totaling about $389
    million for 9 programs were not based on a statistical sampling
    methodology.^11 Given that total outlays for these 9 programs exceeded
    $58.2 billion in fiscal year 2005, estimates for these programs would
    likely have been much greater had statistically valid methods been used.
    Also, agency auditors have reported major management challenges that
    highlight internal control weaknesses that continue to plague programs
    susceptible to significant improper payments. In some cases, agencies
    reported that their programs were not susceptible to significant improper
    payments, despite the fact that the auditor's reports in the same PARs
    identified major program management challenges, including significant
    internal control weaknesses.

    Further, OMB's implementation^12 of the act's broad criteria to identify
    risk-susceptible programs limits the disclosure and transparency of
    governmentwide improper payments. This limitation does not further the
    objectives of IPIA, as programs that do not meet OMB's criteria are
    excluded from agencies' improper payment reporting. For example, one
    agency identified three programs with estimated improper payments
    exceeding $10 million, but because the estimates did not exceed 2.5
    percent of program outlays, they were not included in the governmentwide
    improper payment total. In addition, we note that the definition of
    improper payments under IPIA excludes certain types of payments required
    to be made under constitutional, statutory, or judicial requirements, even
    though those payments are subsequently determined to be incorrect. This
    includes payments that an agency must make pursuant to a statute or court
    order that later are determined to be overpayments. Yet, because agencies
    are not required to track, monitor, and report on these types of
    overpayments, the governmentwide magnitude of this issue is unknown.

    Lastly, with regard to agencies' recovery audit efforts, the data reported
    may not present an accurate view of the extent of these efforts. While 21
    agencies were required to report on their recovery audit efforts, we
    identified discrepancies in several agencies' information and found
    limited reviews over contract payments. For example, for fiscal year 2005,
    the National Aeronautics and Space Administration (NASA) reported that it
    had identified and recovered $617,442 in contract payments, a reported 100
    percent recovery rate. Yet, the NASA Office of Inspector General (OIG)
    reported it had identified over $515 million in questioned contract costs
    during fiscal year 2005, of which NASA management decided to pursue
    recovery of $51 million. Had the $51 million amount been compared to the
    $617,442 NASA actually recovered, its recovery rate would drop from the
    reported 100 percent to 1.2 percent. In addition, we noted that 5 of the
    21 agencies did not review all of their agency components as part of their
    recovery audit efforts while 2 agencies reported that recovery auditing
    was not cost beneficial without reporting any details to support this
    determination.

    This report includes one matter for congressional consideration and four
    recommendations for executive action. Specifically, to ensure that the
    full extent of improper payments is being captured, the Congress should
    consider whether existing IPIA provisions should be amended to define
    specific criteria, such as a dollar threshold, agencies should use to
    identify which programs and activities are susceptible to significant
    improper payments, thereby triggering improper payment estimating and
    reporting requirements. In addition, to facilitate agencies' progress in
    ensuring accurate and complete improper payments and recovery auditing
    reporting, we recommend that OMB take several actions regarding (1) risk
    assessment methodologies and the level of detail necessary to meet the
    annual improper payment reporting requirements, (2) statistically valid
    estimates, (3) extent of payments agencies make under statute or judicial
    determinations that later are determined to be overpayments, and (4)
    agencies' rationale that recovery auditing is not cost beneficial.

    In commenting on a draft of this report, OMB generally agreed with our
    recommendations and highlighted progress made in the second year of
    governmentwide improper payments reporting, as well as initiatives under
    way to measure improper payments in selected programs susceptible to
    significant improper payments. For example, OMB reported that for fiscal
    year 2005, agencies estimated improper payments for 17 additional programs
    and that this number will increase again by 10 programs for fiscal year
    2006. OMB also stated that beginning in fiscal year 2007, the Department
    of Health and Human Services (HHS) will begin reporting component error
    rates for its Medicaid, Temporary Assistance for Needy Families, and State
    Children's Health Insurance programs. OMB's written comments are reprinted
    in appendix IV.

    Background

    IPIA was passed in November 2002 with the major objective of enhancing the
    accuracy and integrity of federal payments. IPIA requires executive branch
    agency heads to review their programs and activities annually and identify
    those that may be susceptible to significant improper payments. For each
    program and activity agencies identify as susceptible, the act requires
    them to estimate the annual amount of improper payments and to submit
    those estimates to the Congress. The act further requires that for
    programs for which estimated improper payments exceed $10 million,
    agencies are to report annually to the Congress on the actions they are
    taking to reduce those payments.

    The act requires the Director of OMB to prescribe guidance for agencies to
    use in implementing IPIA. OMB issued implementing guidance in May 2003,
    which requires the use of a systematic method for the annual review and
    identification of programs and activities that are susceptible to
    significant improper payments. The guidance defines significant improper
    payments as those in any particular program that exceed both 2.5 percent
    of program payments and $10 million annually.^13 It requires agencies to
    estimate improper payments annually using statistically valid techniques
    for each susceptible program or activity. For those agency programs
    determined to be susceptible to significant improper payments and with
    estimated annual improper payments greater than $10 million, IPIA and
    related OMB guidance require each agency to annually report the results of
    its efforts to reduce improper payments.

    In addition, applicable agencies are required to report their efforts to
    recoup contract-related improper payments under section 831 of the
    National Defense Authorization Act for Fiscal Year 2002.^14 This
    legislation contains a provision that requires all executive branch
    agencies entering into contracts with a cumulative total value exceeding
    $500 million in a fiscal year to have cost-effective programs for
    identifying errors in paying contractors and for recovering amounts
    erroneously paid. The act further states that a required element of such a
    program is the use of recovery audits and recovery activities. The law
    authorizes federal agencies to retain recovered funds to cover in-house
    administrative costs as well as to pay other contractors, such as
    collection agencies. Agencies that are required to undertake recovery
    audit programs were directed by OMB to provide annual reports on their
    recovery audit efforts, along with improper payment reporting details in
    an appendix to their PARs.

    In August 2006, OMB revised its IPIA implementing guidance. The revision
    consolidates into Appendix C of OMB Circular No. A-123, Management's
    Responsibility for Internal Control,^15 all guidance for improper payments
    and recovery auditing reporting.^16 The revised guidance includes
    authorization for risk assessments to be conducted less often than
    annually for programs where improper payment baselines are already
    established, are in the process of being measured, or are scheduled to be
    measured by an established date. Although OMB kept its criteria for
    defining significant improper payments as those exceeding both 2.5 percent
    of program payments and $10 million, OMB added that it may determine on a
    case-by-case basis that certain programs that do not meet the threshold
    may be subject to the annual reporting requirement. Additionally, the
    revised guidance allows agencies to use alternative sampling
    methodologies^17 and requires agencies to report on and provide a
    justification for using these methodologies in their PARs. This revised
    guidance is effective for agencies' fiscal year 2006 improper payment
    estimating and reporting in the PARs or annual reports. For the purposes
    of evaluating agency reporting in this report, we used the requirements
    from the OMB implementing guidance effective for fiscal year 2005.

    OMB has also established Eliminating Improper Payments as a new
    program-specific initiative under the President's Management Agenda (PMA).
    This separate PMA program initiative began in the first quarter of fiscal
    year 2005. Previously, agency efforts related to improper payments were
    tracked along with other financial management activities as part of the
    Improving Financial Performance initiative of the PMA. The objective of
    establishing a separate initiative for improper payments was to ensure
    that agency managers are held accountable for meeting the goals of IPIA
    and are therefore dedicating the necessary attention and resources to
    meeting IPIA requirements. With this new initiative, 15 agencies^18 are to
    measure their improper payments annually, develop improvement targets and
    corrective actions, and track the results annually to ensure the
    corrective actions are effective.

    The fiscal year 2005 PARs, the second set of annual reports representing
    the results of improper payments assessments for federal executive branch
    agency programs, were due November 15, 2005. In our December 2005
    report^19 on the U.S. government's consolidated financial statements for
    the fiscal years ended September 30, 2005, and 2004, which includes our
    associated opinion on internal control, we reported improper payments as a
    material weakness in internal control. Specifically, we reported progress
    in implementing processes and controls to identify, estimate, and reduce
    improper payments, but that significant challenges remain to effectively
    achieve the goals of IPIA.

    Improvements Needed in Agencies' Reporting of Improper Payment Information

    Our review of agencies' reporting of select improper payment information
    identified that improvements are still needed to fully address improper
    payment reporting requirements. Of the 35 fiscal year 2005 agency PARs or
    annual reports included in our review, 23 agencies reported they had
    performed risk assessments of all of their programs and activities.
    However, the results of certain agencies' risk assessments appear
    questionable. For example, agency management at DOJ and DHS reported that
    based on their risk assessments, no risk-susceptible programs were
    identified. Yet, these agencies' auditors cited agency noncompliance with
    IPIA in their fiscal year 2005 annual audit reports, primarily caused by
    inadequate risk assessments.

    Eighteen of the 35 agencies reported improper payment estimates totaling
    in excess of $38 billion for some or all of their high-risk programs in
    fiscal year 2005. Of the 18 agencies, 14 reported having one or more
    programs with improper payment estimates that exceeded $10 million, and
    thus were required to implement plans to reduce improper payments and
    report on actions taken.^20 Based on our review of these key improper
    payment reporting requirements, we generally found that the applicable
    agencies reported this information for one or more of their programs in
    their PARs as required. However, the extent and details of reporting
    varied among the agencies. For example, the Office of Personnel Management
    (OPM) addressed the manager accountability reporting requirement in one
    sentence for its risk-susceptible programs, while USDA and the Department
    of Veterans Affairs (VA) provided information on how each program manager
    was held accountable for each high-risk program identified. Six different
    agencies reported that the responsibility for improper payments is
    included in management's performance plans; however, specific details were
    not discussed.

    IPIA and OMB's implementing guidance require agencies to annually review
    and identify programs susceptible to significant improper payments,
    estimate the amount of their improper payments, and report on the amount
    of their improper payments and their actions to reduce improper payments.
    OMB requires the results of these steps to be reported in the agencies'
    PARs, in the Management Discussion and Analysis section and as a separate
    appendix for each fiscal year ending on or after September 30, 2004.
    Figure 1 provides an overview of the four key steps OMB requires agencies
    to perform in meeting the improper payment reporting requirements.

    Figure 1: Required Steps to Identify, Estimate, Reduce, and Report
    Improper Payment Information

    Agencies must estimate improper payments for each susceptible program
    identified during the risk assessment process. In addition, agency
    programs that were included in former section 57 of OMB Circular No. A-11
    must estimate improper payments even if the estimate does not exceed $10
    million and 2.5 percent of program payments. Further, some agency programs
    voluntarily reported an improper payment estimate or other improper
    payment information. When the program improper payment estimates exceed
    $10 million, agencies are required to report on various actions they are
    taking to reduce improper payments, such as determining causes of improper
    payments and taking corrective actions and ensuring manager
    accountability, and statutory barriers that limit corrective actions to
    reduce improper payments. To address these three reporting requirements,
    OMB requires agencies to report the following information in their PARs:

    oCauses of improper payments and corrective action. A discussion of the
    causes of the improper payments identified, actions taken to correct those
    causes, and results of the actions taken to address those causes.

    oManager accountability. A description of the steps (including timeline)
    the agency has taken and plans to take to ensure that agency managers
    (including the agency head) are held accountable for reducing and
    recovering erroneous payments.

    oStatutory barriers. A description of any statutory or regulatory barriers
    that may limit the agency's corrective actions in reducing erroneous
    payments.

    Figure 2: Improper Payments--Step 1

    Results of Selected Agencies' Risk Assessments Appear Questionable

    Of the 35 fiscal year 2005 agency PARs or annual reports included in our
    review, 23, the same number of agencies that reported having risk
    assessments in our prior year review, reported they had performed risk
    assessments of all of their programs and activities. The remaining 12
    agencies either did not report this information in their PARs or annual
    reports, or included some improper payment details in their PARs, but did
    not report assessing for the risk of improper payments for all of their
    programs and activities. Table 1 indicates for each of the 35 whether the
    agency reported having assessed all programs and activities.

    Table 1: Agency Reporting of Risk Assessments Performed for All Programs
    and Activities

                 Department or agency         Agency reported it had assessed all
                                                          programs and activities
    1  Agency for International
          Development
    2  Department of Agriculture                                             X
    3  Department of Commerce                                                X
    4  Department of Defense                                                 X
    5  Department of Education                                               X
    6  Department of Energy                                                  X
    7  Environmental Protection Agency
    8  Export-Import Bank of the United
          States
    9  Farm Credit System Insurance
          Corporation
    10 Federal Communications Commission                                     X
    11 Federal Deposit Insurance
          Corporation
    12 General Services Administration                                       X
    13 Department of Health and Human                                        X
          Services
    14 Department of Homeland Security                                       X
    15 Department of Housing and Urban                                       X
          Development
    16 Department of the Interior                                            X
    17 Department of Justice
    18 Department of Labor                                                   X
    19 National Aeronautics and Space                                        X
          Administration
    20 National Credit Union
          Administration
    21 National Science Foundation                                           X
    22 Nuclear Regulatory Commission                                         X
    23 Office of Personnel Management                                        X
    24 Pension Benefit Guaranty
          Corporation
    25 U.S. Postal Service
    26 Railroad Retirement Board                                             X
    27 Securities and Exchange Commission
    28 Small Business Administration                                         X
    29 Smithsonian Institution
    30 Social Security Administration                                        X
    31 Department of State                                                   X
    32 Tennessee Valley Authority
    33 Department of Transportation                                          X
    34 Department of the Treasury                                            X
    35 Department of Veterans Affairs                                        X
          Total                                                                23

    Source: GAO analysis of cited agencies' fiscal year 2005 PARs and annual
    reports.

    The first step in OMB's implementing guidance requires agencies' use of a
    systematic method, also known as a risk assessment, to annually review and
    identify those programs and activities that are susceptible to significant
    improper payments. Although OMB's guidance identifies the scope of
    payments agencies are to review, such as federal awards made by recipients
    and subrecipients subject to the Single Audit Act, as amended,^21 it does
    not provide agencies detailed information on how to conduct a risk
    assessment in order to adequately carry out their responsibilities to meet
    the requirements of the act. Specifically, we found that OMB's guidance
    lacks a description of the common types of risk factors agencies should
    consider when annually reviewing their programs, such as program
    complexity; operational changes; and findings from investigative,
    financial statement, and performance audit reports. Developing such a
    framework would begin the process to effectively identify and target
    high-risk areas within a program and better position agencies as they
    determine which control activities to implement to reduce risks and
    ultimately reduce fraud and errors.

    Risk assessment is a key step in gaining assurance that programs are
    operating as intended and that they are achieving their expected outcomes.
    Done properly, it entails a comprehensive review and analysis of program
    operations to determine if risks exist, what those risks are, and the
    potential or actual impact of those risks on program operations. The
    information developed during a risk assessment forms the foundation or
    basis upon which management can determine the nature and type of
    corrective actions needed. It also gives management baseline information
    for measuring progress in reducing improper payments. In performing a risk
    assessment, management should consider all significant interactions
    between the entity and other parties as well as internal factors at both
    the entitywide and program levels.

    The specific risk assessment methodology used can vary by organization
    because of differences in missions and the methods used in assigning risk
    levels. Risk identification methods often include qualitative and
    quantitative ranking activities, management conferences, forecasting and
    strategic planning, and consideration of findings from audits and other
    assessments. Because governmental, economic, and operating conditions
    continually change, risk assessments should be periodically updated to
    identify and deal with any special risks prompted by such changes.

    Although 23 agencies reported meeting this requirement for all of their
    programs and activities, other readily available information suggests to
    us that the adequacy of agencies' risk assessments was questionable. For
    example, auditors for DOJ and DHS cited agency noncompliance with IPIA in
    their fiscal year 2005 annual audit reports, primarily caused by
    inadequate risk assessments. The DOJ auditor stated that one agency
    component had not established a program to assess, identify, and track
    improper payments. The DHS auditors reported that the department did not
    institute a systematic method of reviewing all programs and identifying
    those it believed were susceptible to significant erroneous payments. This
    was the second consecutive year that the auditor reported IPIA
    noncompliance for DHS. Although the auditors identified the agency's risk
    assessment methodology as inadequate, DHS again reported in its PAR that
    it had assessed all of its programs for risk and found none susceptible to
    significant improper payments.

    However, existing significant financial management weaknesses at these
    agencies highlight visible, well-known risks for improper payments. For
    example, DHS continues to face significant financial management weaknesses
    as illustrated by previous reviews of the Federal Emergency Management
    Agency's (FEMA)--a DHS component--Individuals and Households Program
    (IHP). In November 2005, DHS received a disclaimer of opinion on its
    fiscal year 2005 balance sheet and its fiscal year 2004 consolidated
    financial statements,^22 primarily because of financial reporting
    problems. DHS's auditors cited 10 material weaknesses;^23 2 other
    reportable conditions in internal controls; and 7 instances of
    noncompliance with applicable laws and regulations, 1 of those being
    noncompliance with IPIA, as mentioned previously. The DHS OIG cited
    disaster response and recovery as one of DHS's major management challenges
    for that year.

    In May 2005, the DHS OIG reported^24 weaknesses in DHS's IHP program,
    including inspection and verification of losses reported by individuals
    related to the 2004 hurricane season as well as eligibility issues.
    Subsequently, in July 2005, the Senate Committee on Homeland Security and
    Governmental Affairs released its investigation results of FEMA's response
    to the 2004 Florida hurricanes, in particular, Hurricane Frances, and
    found similar weaknesses in FEMA's IHP program. In discussing its risk
    assessment methodology, DHS reported that FEMA's IHP might be at high risk
    for issuing improper payments as a result of the weaknesses identified in
    the DHS OIG report and performed a second round of testing of its fiscal
    year 2004 disbursements. From its test results, DHS concluded that its
    estimate of improper payments for the IHP did not meet OMB's criteria of
    exceeding $10 million and 2.5 percent of program payments. DHS reported
    that IHP would receive closer scrutiny and undergo an independent payment
    review in fiscal year 2006, but that its sample payment testing did not
    show the program to be at high risk for improper payments.

    Our recent review of FEMA's IHP shows a dramatically different result. In
    our June 2006 report,^25 we estimated improper payments related to FEMA's
    IHP of about $1 billion as of February 2006, related to individual
    assistance payments in response to hurricanes Katrina and Rita that
    occurred in 2005. This amount represents 16 percent of the IHP payments.
    For example, we determined that millions of dollars in expedited and
    housing assistance payments went to registrants who provided the names and
    Social Security numbers of individuals incarcerated in federal and state
    prisons during the hurricanes. In addition, FEMA improperly paid
    individuals twice for their lodging--paying both hotels and rental
    assistance. Also, FEMA could not establish that 750 debit cards worth $1.5
    million went to Hurricane Katrina victims.

    We noted risk assessment deficiencies at other agencies as well. The USDA
    OIG reported^26 that the agency's risk assessments were not adequate to
    estimate the agencies' susceptibility to improper payments because the
    guidance from the USDA's OCFO was not sufficiently prescriptive and
    detailed to translate into meaningful results. As such, the OIG
    recommended that USDA OCFO strengthen guidance over its IPIA risk
    assessments to provide reasonable assurance that the requirements of the
    act are met. Further, the OIG stated that USDA should identify risk
    factors that are discrete to the program being assessed and consider
    information from all sources, such as audit reports. In another example,
    Treasury's OIG reported^27 that it planned to evaluate whether the
    agency's current process is effectively identifying and reducing erroneous
    payments, which further validates our concern that agencies' risk
    assessments may not be appropriately identifying a complete universe of
    programs and activities that are susceptible to significant improper
    payments.

    In our previous report^28 on agencies' fiscal year 2004 improper payment
    reporting, we recommended that OMB require those agencies that did not
    address the IPIA requirements or did not perform risk assessments of all
    of their programs and activities to establish time frames and identify
    resources needed to perform risk assessments and satisfy reporting
    requirements. We also recommended that OMB develop a plan to address the
    resource needs of those agencies that did not perform risk assessments or
    satisfy reporting requirements. In response to our recommendations, OMB
    stated that pursuant to the PMA initiative--Eliminating Improper
    Payments--federal agencies were already required to submit relevant time
    frames and account for the resources necessary to complete planned
    actions. Furthermore, OMB stated that the remaining risk assessments to be
    completed, not covered by the PMA initiative, correlated to programs with
    relatively small outlays. As we stated in our March 2005 report, while we
    view the PMA initiative as a positive action, it applies to only 15
    agencies--the 14 agencies that were previously required to report improper
    payments information under OMB Circular No. A-11 and DHS. However, this is
    not a comprehensive list because it does not include the remaining
    executive branch agencies covered under IPIA that are, to some extent,
    required to address improper payments for their programs and activities.
    Thus, agencies not included in the PMA initiative would not be required to
    establish time frames and account for needed resources under that effort.
    Therefore, we reaffirm our previous recommendations that OMB require those
    agencies that did not address the IPIA requirements or did not perform
    risk assessments for all of their programs and activities to establish
    time frames and identify resources needed to perform risk assessments and
    satisfy reporting requirements and that OMB develop a plan to address the
    resource needs of those agencies that did not perform risk assessments or
    satisfy reporting requirements.

    Figure 3: Improper Payments--Step 2

    Only a Limited Number of Agencies Are Estimating Improper Payments

    Agencies must estimate improper payments for each risk-susceptible program
    identified during the risk assessment process. Of the 35 agencies, 18
    agencies accounting for 57 programs reported improper payment estimates
    totaling in excess of $38 billion for some or all of their high-risk
    programs. (See app. II for further details.) Included in this estimate
    were 17 newly reported programs in 10 agencies, totaling about $1.2
    billion for fiscal year 2005.

    The total improper payment estimate of $38 billion represents
    approximately 2 percent of the total fiscal year 2005 government outlays
    of $2.5 trillion. For the remaining 17 agencies that did not report
    estimates, 8 said they did not have any programs susceptible to
    significant improper payments, 8 were silent about whether they had
    programs susceptible to significant improper payments, and the remaining
    agency identified programs susceptible to significant improper payments
    and said it planned to report an estimate by fiscal year 2007. Further
    details are included in table 2.

    Table 2: Agency Improper Payment Estimate Reporting in Fiscal Year 2005

                                       Agency did not
                                       report estimate
            Department or       Agency Agency reported  Agency silent as   Agency
               agency         reported         that no to whether it had reported
                              estimate   programs were          programs   future
                            for one or  susceptible to    susceptible to  date to
                                  more     significant       significant   report
                              programs        improper improper payments estimate
                                              payments
    1  Agency for                                                   X
          International
          Development
    2  Department of              X
          Agriculture
    3  Department of                              X
          Commerce
    4  Department of              X
          Defense
    5  Department of              X
          Education
    6  Department of              X
          Energy
    7  Environmental              X
          Protection Agency
    8  Export-Import                                                X
          Bank of the
          United States
    9  Farm Credit                                                  X
          System Insurance
          Corporation
    10 Federal                                                               X
          Communications
          Commission
    11 Federal Deposit                                              X
          Insurance
          Corporation
    12 General Services                           X
          Administration
    13 Department of              X
          Health and Human
          Services
    14 Department of                              X
          Homeland Security
    15 Department of              X
          Housing and Urban
          Development
    16 Department of the                          X
          Interior
    17 Department of                              X
          Justice
    18 Department of              X
          Labor
    19 National                                   X
          Aeronautics and
          Space
          Administration
    20 National Credit                                              X
          Union
          Administration
    21 National Science           X
          Foundation
    22 Nuclear                                    X
          Regulatory
          Commission
    23 Office of                  X
          Personnel
          Management
    24 Pension Benefit                                              X
          Guaranty
          Corporation
    25 U.S. Postal                                                  X
          Service
    26 Railroad                   X
          Retirement Board
    27 Securities and                             X
          Exchange
          Commission
    28 Small Business             X
          Administration
    29 Smithsonian                                                  X
          Institution
    30 Social Security            X
          Administration
    31 Department of              X
          State
    32 Tennessee Valley           X
          Authority
    33 Department of              X
          Transportation
    34 Department of the          X
          Treasury
    35 Department of              X
          Veterans Affairs
          Total                     18               8                 8        1

    Source: GAO analysis of cited agencies' fiscal year 2005 PARs and annual
    reports.

    Step 2 of OMB's guidance requires agencies to estimate the annual amount
    of improper payments for those programs susceptible to significant
    improper payments. Unless previously approved by OMB, this estimate must
    be based on a statistically valid sampling methodology^29 and should
    include a gross total of both over- and underpayments. In its Circular No.
    A-136, OMB encourages agencies to break out over- and underpayments as
    part of its improper payment reporting, if available. Of the 57 programs
    for which an estimate was reported for fiscal year 2005, a breakout
    between over- and underpayments was provided for 20 programs. This
    included 6 of the 7 largest programs that according to OMB, make up 95
    percent of the

    current total improper payment estimate.^30 Treasury's Earned Income Tax
    Credit (EITC) program, the second largest program constituting the
    reported improper payment total, is the only program of the 7 largest that
    did not do so. Of the 20 programs, 3 attributed all their improper
    payments to overpayments. For example, the USDA's Marketing Assistance
    Loan Program reported an improper payment estimate of about $45 million.
    USDA reported that the entire estimate resulted from overpayments made.
    For more details related to over- and underpayment estimates, see appendix
    III.

    We also found that agencies' auditors identified challenges with certain
    program's improper payment estimates. USDA's OIG reported that it
    considers USDA's efforts to develop supportable methodologies to detect
    and estimate the extent of improper payments as a major challenge because
    of the number and complexity of USDA programs and activities that are
    subject to IPIA. In another example, agency auditors for the Department of
    Education (Education) raised concerns about the methodology Education used
    to estimate improper payments for its Federal Student Aid (FSA) program.
    The auditors reported that the methodology used did not provide a true
    reflection of the magnitude of improper payments in the student loan
    programs. Specifically, FSA's estimate is primarily based on actual
    questioned costs from OIG audits, does not extrapolate questioned costs
    associated with compliance violations identified through OIG audits, and
    does not take into account restitutions and penalties resulting from OIG
    investigations. To address improper payment estimating challenges, it will
    be critical that agencies follow existing OMB guidance to use a
    statistically valid sampling methodology.

    Figure 4: Improper Payments--Step 3

    The Extent and Level of Detail Related to Selected Reporting Requirements
    Varied

    As previously mentioned, 18 of the 35 agencies reported over $38 billion
    of improper payments. Of the 18 agencies, 14 reported improper payment
    estimates that exceeded $10 million^31 for one or more programs, and
    therefore were required to implement plans to reduce improper payments
    under step 3 of OMB's guidance.

    Figure 5: Improper Payments--Step 4

    Based on these plans, under step 4 of OMB's implementing guidance agencies
    are required to report on various elements, such as a description of (1)
    the steps (including time line) the agency has taken and plans to take to
    ensure that agency managers (including the agency head) are held
    accountable for reducing and recovering erroneous payments and (2) any
    statutory or regulatory barriers that may limit the agency's corrective
    actions in reducing improper payments and any statutory or regulatory
    barriers that may limit the agencies' corrective actions in reducing
    improper payments. In addition, the 14 agencies with estimated improper
    payments greater than $10 million were required to report in their PARs or
    annual reports on the above elements as well as other areas, such as the
    causes of the improper payments, actions taken to correct those causes,
    and the results of those actions and additional reporting requirements.
    Generally, these agencies reported on their actions to address the
    additional reporting requirements in their PARs; however, the extent and
    details of reporting varied among agencies. Although not all of the
    agencies in table 3 provided meaningful descriptions for each of the
    additional reporting requirements, our table acknowledges all agencies
    that at least mentioned these reporting elements as part of their improper
    payment reporting. The results of agencies' reporting on these key
    elements are discussed in more detail in the following sections.

    Table 3: Agency Reporting of Certain Reporting Requirements for One or
    More of Its Programs

          Department or agency  Agency reported on Agency reported on      Agency
                                        causes and            manager reported on
                                corrective actions     accountability   statutory
                                                                         barriers
    1  Department of                          X                  X           X
          Agriculture
    2  Department of                          X                  X           X
          Defense
    3  Department of                          X                  X           X
          Education
    4  Department of Energy
    5  Department of Health                   X                  X           X
          and Human Services
    6  Department of                          X                  X
          Housing and Urban
          Development
    7  Department of Labor                    X                  X           X
    8  Office of Personnel                    X                  X           X
          Management
    9  Railroad Retirement                    X                  X
          Board
    10 Small Business                         X                  X
          Administration
    11 Social Security                        X                  X           X
          Administration
    12 Tennessee Valley                       X                  X
          Authority
    13 Department of the                      X                  X           X
          Treasury
    14 Department of                          X                  X           X
          Veterans Affairs
          Total                                 13                 13           9

    Source: GAO analysis of cited agencies' fiscal year 2005 PARs or annual
    reports.

    Causes of Improper Payments and Corrective Action Plans

    Table 3 shows that 13 of the 14 agencies required to report on the causes
    of program improper payments and any associated corrective actions did so.
    Looking at this from a qualitative perspective, we noted that some
    agencies provided few details on the causes and corrective actions taken,
    while others provided detailed descriptions at the program level. For
    example, the Department of Labor (Labor) reported that the causes of
    improper payments for its Unemployment Insurance program resulted from
    claimants who continue to claim benefits despite having returned to work
    as well as coding errors that identify why the claimant separated from
    work. In contrast, the Small Business Administration (SBA) reported that
    it was planning to identify and track reasons for improper payments for
    one of its high-risk programs, but had not yet done so. Similarly, HHS did
    not list causes of improper payments for several of its risk-susceptible
    programs, although it provided detailed corrective actions for reducing
    improper payments. When no causes are reported, they sometimes can be
    inferred based on the descriptions of the corrective actions. However,
    without fully knowing what causes improper payments, it may be difficult
    for the agency to determine what types of internal control need to be
    implemented or changed and if the corrective actions in place will be
    effective in reducing improper payments. As agencies identify causes of
    improper payments, they can implement control activities to address
    identified risk areas and help ensure that management's decisions and
    plans are carried out and program objectives are met.

    Manager Accountability

    All but 1 of the 14 agencies also reported on efforts related to assigning
    and holding managers accountable for reducing improper payments. The
    remaining agency did not address this reporting requirement in its PAR.
    Generally, improper payments result from a lack of or inadequate system of
    internal control, but some result from program design issues. A key
    component of internal control is the control environment. A strong control
    environment is fundamental in creating a culture of accountability by
    establishing a positive and supportive attitude toward improvement and the
    achievement of established program outcomes, including protecting taxpayer
    interests in program integrity.

    Similar to agencies' reporting on causes and corrections, we also found
    that agencies' reporting on the manager accountability requirement varied.
    For example, OPM addressed the manager accountability reporting
    requirement in one sentence for its risk-susceptible programs while USDA
    and VA provided information on how each program manager was held
    accountable for the high-risk programs identified. Furthermore, six
    different agencies reported that the responsibility for improper payments
    is included in management's performance plans; however, specific details
    were not disclosed. For example, the Railroad Retirement Board (RRB)
    reported that agency managers' performance plans are linked to RRB's
    strategic goals of paying benefits accurately and timely and providing
    prudent stewardship over the trust funds.

    Statutory or Regulatory Barriers

    Of the 14 agencies required to report on any statutory or regulatory^32
    barriers, 9 agencies identified such barriers that may limit corrective
    actions to reduce improper payments. The remaining 5 agencies^33 were
    silent as to whether any statutory or regulatory barriers existed or
    reported that no barriers had been identified. Agencies cited various
    barriers that restrict their ability to better manage their programs
    against improper payments. We classified the reported barriers into five
    categories: (1) data matching, (2) contractual requirements, (3)
    state-administered program structure, (4) recovery auditing, and (5)
    other. We also identified agencies that reported barriers that were not
    related to a statute or regulation. Table 4 summarizes the statutory
    barriers agencies reported and, when provided, the legislation or
    regulation citation related to the barriers.

    Table 4: Agency-Reported Statutory Barriers to Reducing Improper Payments

             Agency           Type of barrier(s)       Agency reported law or
                                                        regulation related to
                                                             barrier(s)
    Department of       Data matching,           Finality Rule-Department of
    Agriculture         state-administered       Agriculture Reorganization
                           program structure,       Act of 1994, Section 281,
                           recovery auditing        generally precludes the use
                                                    of recovery auditing
                                                    techniques to recover
                                                    payments considered final
                                                    pursuant to 7 U.S.C.
                                                    7001(a).^a

                                                    Farm Security and Rural
                                                    Investment Act of 2002,
                                                    Section 1502(d)(2), requires
                                                    the agency to use standards
                                                    applied under an earlier law,
                                                    thereby limiting the agency
                                                    from developing a definition
                                                    for a particular type of
                                                    dairy producers.^a
    Department of       Contractual requirements The Department of Defense's
    Defense                                      Retired and Annuitant Pay
                                                    Service Contract, when
                                                    awarded, did not include the
                                                    goals or mandates of IPIA.
                                                    Any additional work or
                                                    changes to meet the goals of
                                                    IPIA would need a contract
                                                    modification and be subject
                                                    to Subpart 43.1 of the
                                                    Federal Acquisition
                                                    Regulation.^b
    Department of       Data matching            Section 6103 of the Internal
    Education                                    Revenue Code concerning
                                                    confidentiality of the tax
                                                    return information precludes
                                                    data matching.^c
    Department of       State-administered       Temporary Assistance for
    Health and Human    program structure, other Needy Families legislation,
    Services                                     including funding for Child
                                                    Care Programs, specifically
                                                    prohibits HHS from regulating
                                                    the conduct of states, unless
                                                    expressly provided. Requiring
                                                    states to identify and report
                                                    improper payments is not
                                                    expressly required.^d
    Department of Labor Data matching,           Section 3304(a)(4) of the
                           state-administered       Federal Unemployment Tax Act
                           program structure,       (FUTA) requires that moneys
                           recovery auditing        in the unemployment fund only
                                                    be withdrawn for benefit
                                                    payments, precluding the
                                                    availability of money in the
                                                    fund to be used for recovery
                                                    auditing techniques. ^a
    Office of Personnel Contractual              5 U.S.C. S 8452 and 5 C.F.R.
    Management          requirements, recovery   844 Subpart C contain the
                           auditing, other          Federal Employees Retirement
                                                    System (FERS) disability
                                                    offset provision which
                                                    mandates that FERS benefits
                                                    be reduced if the annuitant
                                                    also receives Social Security
                                                    benefits. However, the FERS
                                                    benefits cannot be reduced
                                                    until Social Security
                                                    Administration starts paying
                                                    the disability benefits so
                                                    that OPM can reduce the FERS
                                                    benefits to their proper
                                                    level.^c

                                                    Generally, the Right to
                                                    Financial Privacy Act (12
                                                    U.S.C. S. 3401-3422) requires
                                                    financial institutions to
                                                    obtain permission from their
                                                    customers to disclose
                                                    financial information. This
                                                    requirement in effect bars
                                                    OPM from obtaining posthumous
                                                    payments information,
                                                    preventing recovery of
                                                    improper payments.^c

                                                    OIG lacks statutory or
                                                    regulatory audit rights and
                                                    only has limited audit rights
                                                    in contracts entered into
                                                    with pharmaceutical benefits
                                                    managers.^b
    Social Security     Other                    Not cited.^b
    Administration
    Department of the   Other                    IRS Tax Code.^e
    Treasury
    Department of       Other                    38 U.S.C. 5112(b)(4)(A)^c
    Veterans Affairs                             prohibits adjustments to
                                                    benefit payments until the
                                                    first of the month after the
                                                    change in a beneficiary's
                                                    income. Thus, this creates an
                                                    overpayment until the benefit
                                                    payment is adjusted for the
                                                    change in income.

                                                    38 U.S.C. 501(a) and 38
                                                    C.F.R. 3.103^c preclude VA
                                                    from changing benefit
                                                    payments when it determines
                                                    that an adjustment or
                                                    termination of benefits is
                                                    needed. VA must continue to
                                                    make benefit payments based
                                                    on existing information until
                                                    a claimant's due process has
                                                    taken place, which requires
                                                    giving the claimant 60 days
                                                    to submit evidence for a
                                                    claim. This, therefore,
                                                    usually means VA must
                                                    continue payment for
                                                    approximately 90 days after
                                                    discovery because any
                                                    adjustments occur the first
                                                    of the next month.

    Sources: GAO analysis of cited agencies' fiscal year 2005 PARs or annual
    reports and OMB.

    Note: We did not verify whether the legal citation reported actually
    results in a barrier.

    ^aAgency provided specific legislative citation in its PAR.

    ^bAgency did not provide a legislative citation in its PAR or to OMB.

    ^cSpecific legal citation provided by OMB.

    ^dGeneral legal citation provided by OMB.

    ^eAgency only provided a general citation in its PAR.

    Only two of the nine agencies mentioning statutory barriers cited the
    specific law or regulation related to a corresponding barrier in their
    PARs. The remaining seven agencies described the barrier but did not
    provide a specific law or regulation in their PARs. For three of these
    seven agencies, we were able to obtain specific legislative citations for
    some of the agency-reported barriers from OMB, and included these in table
    4. The remaining four agencies did not provide specific legislative
    citations in their PARs, nor did the agencies provide them when we
    followed up with OMB. The lack of transparency in agencies' reporting of
    specific legislative or regulatory barriers impedes the Congress's ability
    to use its authorization, appropriation, and oversight responsibility to
    help agencies meet performance goals. The Congress can review the actions
    taken and regulations formulated by departments and agencies to make
    certain that program officials appropriately execute the laws. If agencies
    provide the required information, the Congress can determine whether the
    public's needs are adequately served by federal programs, and thus take
    corrective action through legislative changes.

    As we previously reported,^34 it should be recognized that many of these
    barriers exist as a result of decisions to ensure beneficiary privacy and
    other data safeguards and the inherent nature of some federal programs. As
    a result, it may be difficult to eliminate or mitigate these barriers to
    the point where they no longer restrict agency actions in certain areas to
    better manage their improper payment problems. Accordingly, federal
    agencies, the administration, the Congress, and the public must recognize
    that some level of improper payments will occur because of these public
    policy decisions.

    Data matching.  Three agencies reported barriers that prevented data
    matching with other agencies' computer databases to reduce improper
    payments. For example, Education reported that requirements in the
    Internal Revenue Code precluded data matching, but that a database match
    with the Internal Revenue Service (IRS) would likely improve the accuracy
    of Pell Grant awards. In addition, it would eliminate the need for schools
    to rely on paper copies of tax returns submitted by applicants, which are
    used to verify applicants' adjusted gross income and taxes paid.
    Currently, the schools have limited assurance that the tax returns
    submitted by the applicants contain the same information that is filed
    with IRS. However, Education's proposal to amend the Internal Revenue Code
    to permit a 100 percent database match has not yet been enacted, and
    Education is uncertain whether or when such legislation may be enacted. As
    a further illustration, Labor reported that for its Federal Employees'
    Compensation Act (FECA) program,^35 legislation does not currently permit
    FECA to verify employment earnings with the Social Security Administration
    (SSA) without the claimant's written permission. Compensation benefits may
    be overpaid if an employee has unreported earnings and does not grant
    Labor permission to verify earnings with SSA.

    Contractual requirements.  Two agencies reported contractual requirements
    as a barrier to reducing improper payments. For example, OPM reported that
    its OIG has begun an initiative to audit pharmaceutical benefits managers
    (PBM). However, in some cases, the OIG has only limited audit rights based
    on the carrier's contracts with the PBMs. To mitigate this, OPM is in the
    process of revising the Federal Employees Health Benefits Acquisition
    Regulations to require carriers to provide the OIG complete audit rights
    in all contracts entered into with PBMs.

    State-administered program structure.  Three agencies reported barriers
    resulting from the state-administered structure of their programs. For
    example, Labor reported that by statute, states administer the
    Unemployment Insurance (UI) program and set operational priorities.
    Therefore, the agency reported it has limited ability to ensure that the
    states pursue improper payment reduction activities. In another example,
    HHS stated that for Medicaid and the State Children's Health Insurance
    Program, its ability to minimize improper payments was limited in the
    absence of statutory authority to hold states accountable for meeting
    targets for the reduction and recovery of improper payments.

    State-administered programs are particularly vulnerable to improper
    payments. Generally, the federal government provides broad statutory and
    regulatory guidelines as well as all or a part of the program funding,
    while the other entities manage the day-to-day program operations. As
    such, federal agencies must depend on state, county, and local officials
    and other entities to ensure that eligibility requirements are met and
    that benefit amounts are determined correctly. Further, states may have
    little incentive to ensure that the right amounts go to the right
    individuals.

    Recovery auditing. Three agencies reported that their ability to reduce
    improper payments through recovery auditing techniques was barred by
    statute. For example, USDA reported that Section 281 of the Department of
    Agriculture Reorganization Act of 1994 precluded the use of recovery
    auditing techniques because Section 281 provides that 90 days after the
    decision of a state, county, or an area committee is final, no action may
    be taken to recover the amounts found to have been disbursed as a result
    of the decision in error unless the participant had reason to believe that
    the decision was erroneous. In another example, Labor stated that Section
    3304(a)(4) of the FUTA, which states that moneys in the fund can only be
    used for benefit payments, precludes using the funding for recovery
    auditing techniques.

    Other. Five agencies reported statutory or regulatory barriers that we
    categorized as other. For example, VA reported that under current
    legislation, adjustments to payments are effective the first of the month
    following the month of the change in income or net worth. Additionally,
    benefits are paid on a prospective basis based on the beneficiary's
    estimate of anticipated income. Thus, VA stated that an award adjustment
    because of changes in income is always after the fact and creates an
    overpayment. Despite this, VA believes this legislation should not be
    changed since the program meets the requirement to provide income support
    for current needs. As a second example, OPM stated that if an applicant
    receives FERS and Social Security disability benefits, then the FERS
    benefits are statutorily required to be reduced.^36 However, OPM cannot
    reduce the applicant's FERS benefits until it knows the amount of Social
    Security disability benefits that the applicant receives from SSA.
    Typically, the applicant receives FERS benefits first and does not start
    receiving SSA disability benefits until several months later. As a result,
    OPM makes FERS benefit overpayments to the applicant knowing that it will
    have to subsequently reduce the FERS benefits to the proper level when SSA
    starts paying the disability benefits.

    During our analysis, we also identified two additional agencies that
    reported barriers in their improper payment information, but these
    barriers did not result from existing statutory requirements. For example,
    USDA reported that its program administration of the Food and Nutrition
    Service is highly decentralized and can involve a myriad of governmental
    and nongovernmental organizations. This decentralization is a hindrance to
    the development of robust accountability processes. As another example,
    Treasury reported several barriers to reducing overpayments in the EITC
    program, including high program turnover and unscrupulous tax preparers.

    For the nine agencies that reported statutory or regulatory barriers, five
    agencies discussed in their PARs actions that they were taking to mitigate
    the effects of the barriers identified. For example, USDA reported that
    its Rural Housing Service agency is seeking to overcome a data-matching
    barrier through legislation that would permit access to HHS's National
    Directory of New Hires (NDNH) data to allow management agents to use the
    data to collect and verify the tenant's income documentation. As a second
    example, Labor reported that Section 3304(a)(4) of FUTA and Section
    303(a)(4) of the Social Security Act require that moneys deposited into
    the UI program must be used for benefits and are precluded from being used
    for prevention, detection, and recovery of improper payments. Labor has
    proposed legislation with its fiscal year 2006 budget that would relax the
    "withdrawal standard" barrier to provide additional funding for recovery
    initiatives.

    We also noted that according to OMB's annual improper payments report that
    six agencies requested legislative intervention in their fiscal year 2007
    budget submissions to facilitate better measurement, detection, and
    elimination of improper payments. For five of these agencies, the
    legislative intervention addressed some barrier reported in their PARs.
    For example, Labor proposed a legislative change related to overpayment
    recoveries in its UI program. According to OMB, the legislative changes
    provide financial incentives to states to more aggressively pursue benefit
    overpayments, enlist debt collection agencies, impose penalties for fraud,
    charge employers when their actions lead to overpayments, and collect
    delinquent overpayments through garnishment of tax refunds. OMB also noted
    that these proposed legislative changes would further improve the accuracy
    of the hiring data in the NDNH by including the actual start work date,
    thereby improving the detection of potential improper payments. OMB
    reported that this proposal is projected to save $1.2 billion over 10
    years.

    Improper Payments Estimate Is Understated

    The total improper payment estimate of about $38 billion represents almost
    a $7 billion, or 16 percent, decrease from the $45 billion of improper
    payments reported by agencies in fiscal year 2004.^37 On the surface, this
    would suggest that significant progress has been made. However, this is
    not the case because the reported $7 billion reduction in the total
    improper payments estimate may not reflect improved accountability or
    strengthened internal controls. As we previously reported in March and
    April 2006,^38 this estimate reduction is primarily attributable to a
    decrease in HHS's Medicare program improper payment estimate. This
    decrease mainly resulted from a change to Medicare's estimating
    methodology rather than from improved payment controls. Regardless of
    whether prior year estimates were reliable, the reported reduction is
    unlikely to represent a measurable improvement in internal control and
    accountability given that HHS's OIG continued to cite the integrity of
    Medicare payments as a top management challenge in HHS's fiscal year 2005
    PAR. As discussed previously, other agency auditors have reported major
    management challenges that highlight internal control weaknesses that
    continue to plague programs susceptible to significant improper payments.
    In some cases, agencies reported that their programs were not susceptible
    to significant improper payments, despite the fact that the auditor's
    reports in the same PARs identified major management challenges, including
    significant internal control weaknesses, for some of the agencies'
    programs.

    Also, the total improper payment estimate does not include certain factors
    that if resolved, would materially increase reports of estimated improper
    payments. For example, 10 risk-susceptible programs with outlays totaling
    over $234 billion for fiscal year 2005 did not estimate improper payments,
    even though OMB required most of these programs to report selected
    improper payment information several years before IPIA became effective.
    In addition, we found six agencies that did not use statistical sampling
    for 9 programs to estimate improper payment amounts. Because
    nonstatistical sampling methods were used, such as results from Single
    Audit Act^39 reports and internal performance reviews, the $389 million
    reported represents only the known improper payment amounts reported by
    agencies. Given that total outlays for these 9 programs exceeded $58.2
    billion in fiscal year 2005, the improper payment estimate for these
    programs would likely have been much greater had statistically valid
    methods been used. We also found instances where agencies estimated
    improper payments for only one component of the risk-susceptible program.
    Using these types of methodologies results in estimates that may be
    significantly understated.

    Some Agencies Continue to Lack Improper Payment Estimates for Susceptible
    Programs

    The fiscal year 2005 governmentwide improper payments estimate of $38
    billion did not include any amounts for 10 programs, with fiscal year 2005
    outlays totaling over $234 billion. OMB had specifically required 7 of
    these programs to report selected improper payment information for several
    years before IPIA reporting requirements became effective. After passage
    of IPIA, OMB's implementing guidance required that these programs continue
    to report improper payment information under IPIA. The remaining 3
    risk-susceptible programs, with no previous reporting requirement,
    provided target dates for estimating improper payments. As shown in table
    5, the fiscal year 2005 improper payment estimate does not include one of
    the largest federal programs determined to be susceptible to risk, HHS's
    Medicaid program, with outlays exceeding $181 billion annually.

    Table 5: Susceptible Programs That Did Not Report Improper Payment
    Estimates and Target Dates for Estimates

              Dollars in billions
                 Agency/program           Fiscal year   Target date    Previously
                                                 2005   for improper  required to
                                                          payment        estimate
                                              outlays    estimates
    Department of Agriculture--School         $8.2  2007                     X
    Programs
    Federal Communications                     1.7  2007
    Commission--Universal Service
    Fund's Schools and Libraries
    Federal Communications                     3.8  2007
    Commission--High Cost Support
    Program
    Department of Health and Human             5.1  2008                     X
    Services--State Children's
    Insurance Program
    Department of Agriculture--Women,          4.8  2008                     X
    Infants, and Children
    Department of Health and Human           181.7  2008                     X
    Services--Medicaid
    Department of Agriculture--Child           2.1  2010
    and Adult Care Food Program
    Department of Health and Human             4.9  Did not report           X
    Services--Child Care and                        target date
    Development Fund
    Department of Health and Human            17.4  Did not report           X
    Services--Temporary Assistance for              target date
    Needy Families
    Department of Housing and Urban            5.0  Did not report           X
    Development--Community Development              target date
    Block Grant
    Total                                   $234.7                           7

    Sources: OMB and cited agencies' fiscal year 2005 PARs.

    Of these 10 programs, 7 reported that they would be able to estimate and
    report on improper payments sometime within the next 3 fiscal years, but
    could not do so for fiscal year 2005. For the remaining 3 programs, the
    agencies did not estimate improper payment amounts in their fiscal year
    2005 PARs and were silent about whether they would report estimates in the
    future. As a result, improper payments for these programs susceptible to
    risk will not be known for at least several years, even though 7 of these
    programs had been required to report this information since 2002, with
    their fiscal year 2003 budget submissions under previous OMB Circular No.
    A-11 requirements.

    OMB reported that some of the agencies were unable to determine the rate
    or amount of improper payments because of measurement challenges or time
    and resource constraints, which OMB expects to be resolved in future
    reporting years. For example, since fiscal year 2002, HHS has conducted
    pilots at the state level to further its progress toward reporting a
    national improper payments estimate for its Medicaid program. Each state
    is responsible for designing and overseeing its own Medicaid program
    within the federal government structure. This type of program structure
    presents challenges for implementing a methodology to estimate improper
    payments as HHS must work with states to obtain applicable documentation
    used in the calculation. An additional challenge HHS and other agencies
    with state-administered programs face is the ability to hold states
    accountable for meeting targets to reduce and recover improper payments in
    the absence of specific statutory authority.

    Of the three programs that did not report a target date for estimating,
    the Department of Housing and Urban Development's (HUD) Community
    Development Block Grant (CDBG) program was the only one that did not
    report any actions under way to begin estimating improper payments. In its
    fiscal year 2005 PAR, HUD reported that based on completed testing of
    fiscal year 2003 payments, this program is below OMB's threshold
    criteria--exceeding $10 million and 2.5 percent of program payments--for
    significant improper payments and, therefore, was removed from HUD's
    at-risk inventory. HUD stated that this program was not subject to
    retesting unless there was a significant change in the nature of activity
    or internal control structure.

    We have several problems with HUD's position. The CDBG program was subject
    to the previous OMB Circular No. A-11 requirements and thus was required
    by OMB's guidance to continue to report improper payment information under
    IPIA, regardless of the agency-determined risk level, which based on other
    known information may not reflect actual risk. During a June 2006
    hearing^40 on the CDBG program, HUD's OIG reported on numerous instances
    of fraudulent, improper, and abusive use of program funds identified over
    a 2- 1/2-year period based on 35 audits. The HUD OIG reported that its
    office has recovered over $120 million in program funds, identified over
    $100 million in questioned costs, indicted 159 individuals, initiated
    administrative actions against 143 individuals, and took 5 civil actions
    and 39 personnel actions. As evidenced by the HUD OIG reviews, the CDBG
    program may be at risk of significant improper payments.

    Certain Methodologies Used to Estimate Improper Payments Do Not Result in
    Accurate Estimates

    The total executive branch-wide improper payment estimate may also be
    understated because of nonstatistical sampling methodologies agencies used
    to estimate improper payments in its programs. OMB's implementing guidance
    requires that agencies use a statistical sample to estimate improper
    payments. With statistical sampling, sample results can be generalized to
    the entire population from which the sample was taken. From our review, we
    found six agencies that did not use statistical sampling to estimate
    improper payments totaling approximately $389 million for nine programs
    with outlays exceeding $58 billion.

    For example, Labor analyzed fiscal year 2003 single audits to identify
    questioned costs for its Workforce Investment Act^41 program, which, in
    turn, were used as a proxy for reporting its improper payment estimate.
    Specifically, the improper payment rate was determined by calculating the
    projected questioned costs and dividing this total amount by the
    corresponding outlays. We do not believe this is a reasonable proxy for
    improper payment levels because single audits, by themselves, may lack the
    level of detail necessary for achieving IPIA compliance. Specifically,
    single audits generally focus on the largest dollars in an auditee's
    portfolio. Thus, all programs identified as susceptible to improper
    payments at the federal level may not receive extensive coverage under a
    single audit. Consequently, both the depth and level of detail of single
    audit results are, generally, insufficient to identify improper payments,
    estimate improper payments, or both.

    We also found instances where agencies estimated improper payments for
    only one component of the risk-susceptible program. For example, HHS's
    Medicare program is the largest program constituting the total improper
    payment estimate, with an estimate of $12.1 billion for fiscal year 2005.
    However, this estimate represents payment errors only for its
    fee-for-service program component. HHS has not yet begun to estimate
    improper payments for its managed care component, with outlays totaling
    about $52 billion, or 15 percent of Medicare program outlays. In its
    fiscal year 2005 financial report, HHS's Centers for Medicare and Medicaid
    Services (CMS) identified bringing the Medicare managed care component
    into compliance with IPIA as a key challenge in the coming years. In
    addition, CMS's external auditors identified Medicare's managed care
    benefits payment cycle as a material weakness in its report on internal
    controls. Specifically, the auditor found that existing CMS policies and
    procedures are not sufficient to adequately reduce the risk of material
    benefit payment errors from occurring or not being detected and corrected
    in a timely manner.

    In addition, the Department of Transportation (DOT) reported zero improper
    payments based on its testing of four state-administered grant programs
    with outlays totaling $42.1 billion in fiscal year 2005. (See app. II.)
    DOT stated that none of these programs exceeded OMB's reporting criteria.
    However, DOT's test procedures only applied to payments made by DOT to
    grantee entities. Test procedures did not address subsequent "flow down"
    payments made at the grantee level, where the risk of improper payments is
    at its greatest. As such, the DOT OIG reported in the agency's fiscal year
    2005 PAR that detecting improper payments and stopping wasteful spending
    by grantees is a top management challenge for the agency. DOT stated that
    it had actions under way to implement an improper payment methodology for
    its grant programs and plans to implement nationwide testing beginning in
    fiscal year 2007.

    Reduction in Improper Payment Estimate May Not Be a Result of Improved
    Accountability and Enhanced Internal Controls

    The reported $7 billion decrease in the governmentwide estimate is
    primarily attributable to a decrease in Medicare's estimate.^42 However,
    we found that this decrease was mainly a result of an improvement made to
    Medicare's estimating methodology rather than to improved payment
    controls. When providers do not submit documentation to justify payments
    received, these payments were counted by HHS as erroneous for purposes of
    calculating an annual improper payment estimate for the Medicare program.
    However, the decreased error rates achieved this year because of increased
    efforts to obtain provider documentation are not directly comparable to
    those reported in prior years before the new procedures were implemented.

    Based on our review, the Medicare improper payment estimate decrease was
    principally caused by increased efforts to educate health care providers
    about its Medicare error rate testing program and the importance of
    responding to its requests for medical records to perform detailed
    statistical reviews of Medicare payments. HHS reported that these more
    intensive efforts had dramatically reduced the number of "no
    documentation" errors in its medical reviews. HHS reported marked
    reductions in its error rate attributable to fewer cases of (1)
    nonresponses to requests for medical records and (2) insufficient
    documentation submitted by the provider. We noted that these improvements
    partially resulted from HHS extending the time that providers have for
    responding to documentation requests from 55 days to 90 days.

    These changes primarily affected HHS's processes related to its efforts to
    perform detailed statistical reviews for the purposes of calculating an
    annual improper payment estimate for the Medicare program. While this may
    represent a refinement in the program's improper payment estimate, the
    reported reduction may not reflect improved accountability over program
    dollars. Therefore, the federal government's progress in reducing improper
    payments may be exaggerated because the reported improper payments
    decrease in the Medicare program accounts for the bulk of the overall
    reduction in the governmentwide improper payments estimate.

    Our work did not include an overall assessment of HHS's estimating
    methodology. However, we noted that the changes made for the fiscal year
    2005 estimate were not related to improvements in prepayment validation
    processes, and we did not find any evidence that HHS had significantly
    enhanced its preventive controls in the Medicare payment process to
    prevent future improper payments. Further, we also found that HHS's OIG
    continues to cite the integrity of Medicare payments as a top management
    challenge. In addition, health care fraud schemes continue to hamper HHS's
    efforts to improve accountability. For example, in May 2006, DOJ
    reported^43 that a businessman pleaded guilty to conspiracy to defraud
    Medicare of $40 million in fraudulent billings over a 16-month period. The
    fraud scheme included billing Medicare for motorized wheelchairs that were
    either not required by the Medicare beneficiary, not delivered, or both.

    Other agency auditors have also reported major management challenges
    related to agencies' internal control weaknesses that continue to plague
    programs susceptible to significant improper payments. For example, SBA's
    auditors reported that for the 7(a) Business Loan program, SBA did not
    consistently identify instances of noncompliance with its own
    requirements, resulting in improper payments. In some cases, agencies
    reported that they had determined that programs were not susceptible to
    significant improper payments despite the fact that the auditor's reports
    in the same PARs identified management challenges, or material weaknesses
    within the programs. For example, the Department of the Interior's OIG
    reported that the agency's grant programs lacked proper management,
    creating accountability and stewardship deficiencies, as well problems
    related to data reliability, training, and ensuring that funds were spent
    appropriately. Likewise, the General Services Administration's (GSA) OIG
    reported several issues related to the agency's contract management
    practices, such as unauthorized personnel issuing task orders, not
    inspecting completed work projects prior to payment, not ensuring services
    were rendered prior to payment, and paying invoices that often lacked
    supporting documentation.

    Table 6 provides four other examples of agencies' major management
    challenges, as reported in the fiscal year 2005 PARs, in specific agency
    programs or activities. None of the programs listed in table 6 have been
    identified by agencies as susceptible to significant improper payments,
    and thus are not included in the total improper payment estimate. These
    examples raise further questions about the adequacy of agencies' risk
    assessments to identify susceptible programs, and whether agencies
    considered major management challenges identified by the OIG as part of
    their risk assessment process.

    Table 6: Examples of Programs or Activities with Major Management
    Challenges but Not Identified as Susceptible to Significant Improper
    Payments

    Department or agency     Program or      Description of major management
                                 activity       challenge identified by the OIG
    Department of the     Workers'          oInefficient and ineffective
    Interior              Compensation      management led to increases in
                                               annual costs. At best, program is
                                               managed inconsistently, and at
                                               worst, is subject to abuse by
                                               managers seeking an easy way to
                                               deal with problem employees.

                                               oProgram is understaffed,
                                               employees lack training, and there
                                               is no uniform process for ensuring
                                               that costs are accurate. Also,
                                               there is an overwhelming lack of
                                               awareness that workers'
                                               compensation fraud exists.
    General Services      Contract          oGSA disbursed almost $19 billion
    Administration        Management        in contract payments for fiscal
                                               year 2005. Certain trends
                                               identified in recent years that
                                               cause concern related to contract
                                               management include

                                               olimited project oversight and, at
                                               times, completed work projects not
                                               inspected prior to payment;

                                               opayments made for services not
                                               provided; and

                                               oinvoices approved for payment,
                                               but lacked supporting
                                               documentation.
    Department of Justice Grant Programs    oLong-standing challenge to
                                               effectively manage grant programs,
                                               which totaled more than $3.5
                                               billion in fiscal year 2005.
                                               Grantees have received unclear,
                                               untimely, and ambiguous guidance
                                               to carry out program objectives.

                                               oThe myriad of policy guidance is
                                               often confusing and contradictory,
                                               increasing the risk that grantees
                                               will be less likely to satisfy
                                               their fiduciary responsibility to
                                               safeguard grant funds and ensure
                                               funds are used solely for the
                                               purposes for which they were
                                               awarded.
    Social Security       School Attendance oAgency disbursed about $70
    Administration                          million in incorrect payments to
                                               32,839 students. The OIG
                                               recommended, and SSA agreed, to
                                               ensure that the overpayments are
                                               established and that subsequent
                                               collection activities are
                                               initiated for those payments.

    Source: GAO analysis of agencies' fiscal year 2005 PARs.

    IPIA May Need to Be Amended to Ensure Agencies Fully Meet Its Objectives

    IPIA includes broad criteria that agencies should use to annually assess
    what programs and activities are at risk of having improper payments.
    However, OMB has prescribed more specific criteria in its implementing
    guidance that in practice have the effect of limiting the disclosure and
    transparency of governmentwide improper payments. This limitation appears
    contrary to the objective of IPIA, which, among other things, was created
    to facilitate the Congress's understanding of the nature and extent of the
    governmentwide improper payment problem and hold agencies accountable for
    improved management over federal funds. An amendment to the act could
    clarify the criteria that agencies should use to identify which programs
    and activities are susceptible to significant improper payments to ensure
    agencies meet the intent of the act. In addition, we note that the
    definition of improper payments under IPIA excludes certain types of
    payments that are required to be made under constitutional, statutory, or
    judicial requirements, even though those payments are subsequently
    determined to be incorrect. This includes payments that an agency is
    required to make under statute or court order that later are determined to
    be overpayments. Because agencies are not required to track, monitor, and
    report on a governmentwide basis these types of overpayments, the
    magnitude of this issue is unknown.

    Identification Threshold Limits Agency Reporting on Susceptible Programs

    For purposes of assessing what programs and activities are at risk of
    improper payments, IPIA states that agency heads must review their
    agencies' programs and activities to determine those that are susceptible
    to significant improper payments. The law does not define susceptibility.
    In its implementing guidance, OMB directed that a program or activity is
    susceptible to significant improper payments if it meets two
    criteria--potential improper payments exceeding $10 million and 2.5
    percent of program payments. Therefore, both criteria must be met for an
    agency to subject the program to the later steps requiring the agency to
    estimate improper payments and address the various improper payment
    reporting requirements.

    As stated earlier in this report, the information developed during a risk
    assessment forms the foundation upon which management can determine the
    nature and type of corrective actions needed. It also gives management
    baseline information for measuring progress in reducing improper payments.
    Thus, these assessment criteria affect how agencies identify, estimate,
    report on, and reduce those programs susceptible to significant improper
    payments. For example, of the 23 agencies that reported assessing all
    programs and activities, we found that 6 agencies limited their risk
    assessment reviews to only those programs that would likely meet OMB's
    definition of programs susceptible to significant improper payments. Two
    of these 6 agencies reported that they did not perform a comprehensive
    risk assessment for those programs with outlays of less than $10 million
    because the programs would not have exceeded both of OMB's threshold
    criteria. The remaining 4 agencies did not perform a comprehensive risk
    assessment of programs with outlays ranging from $40 million to $200
    million, generally citing the threshold criteria as the reason for their
    exclusion.

    We also noted instances where agencies with large program outlays reported
    that their programs or activities were not susceptible to significant
    improper payments because the improper payment estimates only exceeded one
    of OMB's criteria for reporting improper payment information, another
    example of how OMB's criteria could materially affect the extent to which
    agencies report improper payment information in their PARs. From our
    review of the 57 agency programs and activities that were included in the
    total $38 billion improper payment estimate, we identified 20 programs or
    activities that reported improper payment estimates exceeding $10 million,
    but not 2.5 percent of program outlays. We also identified 1 program that
    reported an error rate exceeding 2.5 percent of program outlays, but not
    $10 million. See table 7 for additional details.

    Table 7: Agency Improper Payment Estimates Included in the Governmentwide
    Total That Met One of the Two OMB Reporting Criteria

    Department or  Program or activity    Program    Fiscal  Fiscal year Previous OMB
           agency                            outlays year 2005         2005 Circular No.
                                                 (in  improper     improper         A-11
                                           millions)   payment      payment    reporting
                                                      estimate   error rate requirements
                                                           (in (percentage)
                                                     millions)
    1  Department of  Marketing             $6,400.0       $45         0.70            X
    Agriculture    Assistance Loan
                      Program (previously
                      Commodity Loan
                      Programs)
    2                 Federal Crop           3,170.0        28         0.89
                      Insurance
                      Corporation
    3                 Farm Security and      1,027.0        16         1.55
                      Rural Investment
    4  Department of  Military Retirement   35,700.0      49.3         0.14            X
    Defense        Fund
    5                 Military Health        7,500.0       150         2.00            X
                      Benefits
    6                 Military Pay          69,100.0       432         0.63
    7  Department of  Student Financial     10,085.0        16         0.16
    Education      Assistance--Federal
                      Family Education
                      Loan
    8                 Title I               12,520.0       149         1.19            X
    9  Department of  Payment programs      24,114.0      14.5         0.06
    Energy
    10 Department of  Head Start             6,865.0       110         1.60            X
    Health and
    Human Services
    11 Office of      Retirement Program    54,800.0     152.2         0.28            X
    Personnel      (Civil Service
    Management     Retirement System
                      and Federal
                      Employees
                      Retirement System)
    12                Federal Employees     29,400.0     196.5         0.67            X
                      Health Benefits
                      Program
    13 Railroad       Retirement and         9,185.4     150.6         1.64            X
    Retirement     Survivors Benefits
    Board
    14 Small Business Small Business         1,568.2      10.5         0.67            X
    Administration Investment
                      Companies
    15 Social         Old Age and          493,300.0   3,681.0         0.74            X
    Security       Survivors'
    Administration Insurance
    16                Disability                                                       X
                      Insurance^a
    17 Department of  International             41.0       1.9         4.63
    State          Information
                      Program-U.S.
                      Speaker and
                      Specialist Program
    18 Tennessee      Payment programs       7,080.0      36.3         0.05
    Valley
    Authority
    19 Department of  Compensation          28,960.0     322.9         1.12            X
    Veterans
    Affairs
    20                Dependency and                                                   X
                      Indemnity
                      Compensation^a
    21                Education programs     2,661.0        64         2.40
    Total                              $803,476.6  $5,625.7                        13

    Source: GAO analysis of fiscal year 2005 PARs and annual reports.

    ^aAgency combined with the above program.

    As table 7 shows, we identified, in total, 21 programs or activities with
    improper payment estimates exceeding $5.6 billion that meet only one of
    OMB's reporting criteria. Most of these program estimates greatly exceeded
    $10 million and, without certain stipulations, could have avoided
    reporting improper payment information under OMB's reporting criteria.
    However, OMB has required that 13 of these 21 programs estimate improper
    payments regardless of dollar amount or error rate, because they had
    previous reporting requirements under OMB Circular No. A-11.^44
    Nonetheless, if the Circular No. A-11 requirements did not apply or
    agencies decided not to voluntarily report on their improper payment
    estimates that were under OMB's reporting threshold, OMB's definition of
    significant improper payments could potentially mask the full scope of
    improper payments.

    In addition to our analytical reviews above, we also found specific
    instances where OMB's definition of significant improper payments limits
    agencies' reporting. Although we do not know the extent of improper
    payments that are not reported, a limited number of agencies voluntarily
    provided information in their PARs that allowed us to determine the amount
    of improper payments for certain programs and activities that were
    excluded from the total improper payments estimate of $38 billion for
    fiscal year 2005. For example, Education identified three programs with
    estimated improper payments exceeding $10 million for each program, which
    totaled about $155 million in improper payments. In light of OMB's
    criteria, because these estimates did not exceed 2.5 percent of program
    outlays, they were not included in the agency's total improper payment
    estimate. In another example, the Department of Defense (DOD) OIG
    reported^45 it had identified about $23 million in improper payments
    related to the procurement of fuel at the Defense Energy Support Center
    during fiscal year 2005. DOD did not report this information in its PAR
    since the improper fuel payments did not exceed 2.5 percent of program
    payments.

    As these examples illustrate, OMB's current criteria for identifying
    risk-susceptible programs limit the disclosure of valuable information
    that the Congress, the public, and others with oversight and monitoring
    interests need to hold agencies accountable for reporting and reducing
    improper payments. Thus, amending existing IPIA provisions to define
    risk-susceptible programs and activities, such as the use of a specific
    dollar threshold, would allow for more complete disclosure and
    transparency of govermentwide improper payment reporting and, in turn,
    would require OMB to revise its implementing guidance to reflect such
    amendments as well as align existing guidance with the intent of the act.

    IPIA Definition of Improper Payments Excludes Certain Payments from
    Reporting

    IPIA defines an improper payment as a payment that should not have been
    made or that was made in an incorrect amount (including overpayments and
    underpayments) under statutory, contractual, administrative, or other
    legally applicable requirements. This includes any payment to an
    ineligible recipient, any payment for an ineligible service, any duplicate
    payment, any payment for services not received, and any payment that does
    not account for credit for applicable discounts.

    On August 28, 2003, OMB advised SSA on improper payment reporting. Under
    this advice, SSA was allowed to exclude from its estimate of improper
    payments those payments that it made following constitutional, statutory,
    or judicial requirements, even though those payments were subsequently
    determined to be incorrect. These payments were deemed by OMB to be
    "unavoidable" improper payments,^46 as there are no administrative changes
    SSA could implement that would eliminate such payments, nor would SSA be
    likely to receive other relief from such requirements.

    As we previously reported,^47 although the definition of improper payments
    does not use the terms avoidable^48 or unavoidable, we agree with OMB that
    a payment that was made because of a legal requirement to make the payment
    subject to subsequent determinations that the payment is not due should
    not be included in an agency's estimate of its improper payments. We agree
    with OMB's conclusion not because it is an "unavoidable" payment but
    rather because it does not meet the definition of an improper payment
    under the act.^49

    In its Supplemental Security Income (SSI) program, SSA disburses
    disability payments to recipients at the beginning of the month based on
    the income and asset levels recipients expect to maintain during the
    month.^50 If SSA initially determines that an overpayment occurred, court
    decisions^51 and language in the Social Security Act allow individuals to
    continue receiving the same amount of SSI benefits pending the results of
    a hearing to determine eligibility. If the initial determination is
    affirmed, the payments made during the hearing and appeals processes are
    considered overpayments, which SSA may recover using a variety of
    means.^52

    In this example, SSA, because of the statutory requirement, must make the
    payment. The statute requires SSA to make the payment until applicable due
    process requirements result in a determination that the person is
    ineligible; therefore, the mandatory payments whether subsequently deemed
    to be correct or incorrect, have not been made to an ineligible recipient
    at the time they were made. Accordingly, the facts would not support
    inclusion of these overpayments as improper payments as defined under
    IPIA. However, if as a result of the due process procedures, it is
    subsequently determined that the recipient is no longer eligible for
    benefits and SSA makes a payment subsequent to these procedures, that
    amount would be an improper payment.

    Yet, we would not go so far as to conclude that any payment that is
    unavoidable should not be included as an improper payment under IPIA.
    Rather, the exclusion of payments should be made individually on a
    fact-specific basis using the definition provided in IPIA. In addition, we
    believe that agencies should track and monitor these types of payments as
    part of their debt collection efforts and have the ability to readily
    report this type of information upon request. OMB currently does not
    require SSA to report in its PAR details relating to these types of
    overpayments, nor does OMB require governmentwide reporting of these types
    of overpayments, thus the magnitude of this issue is unknown. Having
    agencies annually report on these types of overpayments would provide
    Congress, agency management, and other decision maker's valuable
    information with which to determine the extent of these types of
    overpayments and to make policy decisions, if needed, to appropriately
    address this issue.

    Agencies' Reporting of Recovery Auditing Information Questionable

    We noted discrepancies in selected agencies' reporting of recovery audit
    information and limited reviews over contract payments. As a result,
    reporting for recovery auditing information may not represent an accurate
    view of the extent of agencies' efforts. From our review of agencies' PARs
    and discussions with OMB, we determined that 21 agencies reported entering
    into contracts with a total value in excess of $500 million and, thus were
    subject to recovery auditing requirements under section 831 of the
    National Defense Authorization Act for Fiscal Year 2002. Generally, these
    agencies reported on their recovery auditing efforts, such as the amount
    identified for recovery and the amount recovered. However, we noted a few
    instances where the agency amount of contract costs identified for
    recovery was considerably lower than the corresponding OIG amount
    identified from current year audit reviews. These discrepancies raise
    questions as to whether the agency amount identified for recovery should
    have been much higher, thereby significantly decreasing the reported
    agency-specific and overall governmentwide high rate of recovery. We also
    noted that 5 of the 21 agencies did not review all of their agency
    components as part of their recovery audit efforts, and 2 agencies
    reported that recovery auditing was not cost beneficial.

    Section 831 of the National Defense Authorization Act provides an impetus
    for applicable agencies to systematically identify and recover contract
    overpayments. The law authorizes federal agencies to retain recovered
    funds to cover in-house administrative costs as well as to pay
    contractors, such as collection agencies. Any residual recoveries, net of
    these program costs, are to be credited back to the original appropriation
    from which the improper payment was made, subject to restrictions as
    described in

    legislation. As we previously testified,^53 with the passage of this law,
    the Congress has provided agencies a much-needed incentive for identifying
    and recovering their improper payments that slip through agency prepayment
    controls.

    Recovery auditing is a method that agencies can use to recoup detected
    improper payments. Recovery auditing is a detective control to help
    determine whether contractor costs were proper. Specifically, it focuses
    on the identification of erroneous invoices, discounts offered but not
    received, improper late penalty payments, incorrect shipping costs, and
    multiple payments for single invoices. Recovery auditing can be conducted
    in-house or contracted out to recovery audit firms. The techniques used in
    recovery auditing offer the opportunity for identifying weaknesses in
    agency internal controls, which can be modified or upgraded to be more
    effective in preventing improper payments before they occur for subsequent
    contract outlays.

    Nonetheless, effective internal control calls for a sound, ongoing invoice
    review and approval process as the first line of defense in preventing
    unallowable contract costs. Given the large volume and complexity of
    federal payments and historically low recovery rates for certain programs,
    it is much more efficient to pay bills and provide benefits properly in
    the first place. Aside from minimizing overpayments, preventing improper
    payments increases public confidence in the administration of benefit
    programs and avoids the difficulties associated with the "pay and chase"
    aspects of recovering improper payments. Without strong preventive
    controls, agencies' internal control activities over payments to
    contractors will not be effective in reducing the risk of improper
    payments.

    For fiscal year 2005, OMB expanded the type of recovery auditing
    information that agencies are to report in their annual PARs. Prior to
    fiscal year 2005, agencies were only required to report on the amount of
    recoveries expected, the actions taken to recover them, and the business
    process changes and internal controls instituted or strengthened to
    prevent further occurrences. In addition, OMB was not reporting on a
    governmentwide basis agencies' recovery audit activities in its annual
    report on agencies' efforts to improve the accuracy and integrity of
    federal payments. In fiscal year 2005, OMB required applicable agencies to
    discuss any contract types excluded from review and justification for
    doing so. In addition, agencies were required to report, in a standard
    table format, various amounts related to contracts subject to review and
    actually reviewed, contract amounts identified for recovery and actually
    recovered, and prior year amounts.

    As shown in table 8, 21 agencies reported over $340 billion as amounts
    subject to review for fiscal year 2005, while the contract amounts
    reviewed totaled over $287 billion. In addition, the 21 agencies reported
    identifying about $557 million in contracts for recovery, which
    represented less than two-tenths of a percentage of the $287 billion
    amount reviewed. Of the $557 million identified, agencies reported
    recovering $467 million in improper payments, an 84 percent recovery rate.
    However, we found two instances where the agency amount of contract costs
    identified for recovery was considerably lower than the corresponding OIG
    amount identified from current year audit reviews. These discrepancies
    raise questions as to whether the agency amount identified for recovery
    should have been much higher, thereby significantly decreasing the
    agency-specific and overall high rate of recovery.

    Table 8: Improper Payment Amounts Recovered in Fiscal Year 2005

         Department or    Agency reported  Agency reported       Agency       Agency
             agency        amount subject    actual amount     reported     reported
                            to review for     reviewed and       amount       amount
                         fiscal year 2005      reported in   identified recovered in
                                reporting fiscal year 2005 for recovery  fiscal year
                                                              in fiscal         2005
                                                              year 2005
     1  Agency for        $13,000,000,000  $13,000,000,000   $5,900,000   $5,782,000
        International
        Development
     2  Department of       4,965,000,000    2,428,000,000      333,000      189,000
        Agriculture
     3  Department of      Did not report   Did not report       96,354       84,551
        Commerce^a,b
     4  Department of     222,800,000,000  222,800,000,000  473,000,000  418,500,000
        Defense
     5  Department of      Did not report   Did not report    274,367^c    112,506^c
        Education^b
     6  Department of      11,387,000,000   11,387,000,000   10,600,000    9,500,000
        Energy
     7  Environmental       6,460,000,000      175,600,000      130,000      130,000
        Protection
        Agency
     8  General Services    1,625,000,000    1,625,000,000   26,638,654    8,317,187
        Administration
     9  Department of      12,600,000,000   11,100,000,000  2,100,000^d       14,430
        Health and Human
        Services
     10 Department of       3,232,300,000    3,232,300,000    2,191,000    1,207,000
        Homeland
        Security
     11 Department of       2,270,000,000      206,600,000          0^f          0^f
        Housing and
        Urban
        Development^b,e
     12 Department of       4,790,000,000    4,790,000,000    1,548,620      195,479
        the Interior^b
     13 Department of       6,667,804,071    4,606,639,213    1,044,320      765,086
        Justice
     14 Department of      Did not report   Did not report      Did not      Did not
        Labor^b,e                                                report       report
     15 National           Did not report       82,542,704      617,442      617,442
        Aeronautics and
        Space
        Administration^b
     16 Social Security     1,160,000,000       61,000,000      317,000       50,000
        Administration
     17 Department of      30,600,000,000   Did not report    5,350,000    5,190,000
        State^g
     18 Tennessee Valley    5,557,600,558       38,491,498      909,573      443,763
        Authority
     19 Department of       3,064,875,000    2,587,772,000    2,663,984    2,663,984
        Transportation
     20 Department of       4,941,295,411    3,851,985,924      428,977      364,680
        the Treasury
     21 Department of       5,368,316,378    5,368,316,378   23,001,137   12,957,264
        Veterans Affairs
        Total            $340,489,191,418 $287,341,247,717 $557,144,428 $467,084,372

    Sources: OMB and cited agencies' fiscal year 2005 PARs.

    ^aDepartment of Commerce (Commerce) reported that the results of its
    recovery audit revealed no significant improper payments or internal
    control deficiencies. However, according to OMB, subsequent to its PAR
    issuance, Commerce reported that based on its final recovery auditing
    report, the amount identified for recovery totaled $96,354 and the amount
    actually recovered totaled $84,551 for fiscal year 2005.

    ^bCommerce, Education, HUD, Interior, Labor, and NASA did not report on
    the required reporting elements nor did they follow the required format
    included in OMB's guidance.

    ^cSubsequent to its PAR issuance, Education reported to OMB that as of
    December 14, 2005, $274,387 had been identified for recovery, and the
    amount collected totaled $112,506 based on its review of payments made
    over a 5-year period, with a collection threshold of $50.

    ^dHHS reported that of the $2.1 million identified as potential improper
    payments, $1.3 million was determined to be related to payments that were
    either voided, subsequently credited, or both.

    ^eHUD and Labor reported that recovery auditing efforts were not cost
    beneficial.

    ^fFor fiscal year 2005, HUD reported reviewing about $207 million in
    contract payments, but identified no improper payments for recovery.

    ^gFor the amount reviewed column, the Department of State reported the
    number of contract payments reviewed instead of the contract dollar amount
    reviewed.

    For example, for fiscal year 2005, NASA reported in its PAR that it had
    identified and recovered $617,442 in contract payments, a 100 percent
    recovery rate. Yet, the NASA OIG reported^54 it had identified over $515
    million in questioned contract costs during fiscal year 2005. Of this
    amount, NASA management decided that $51 million in contract costs should
    be pursued for recovery. When comparing the $51 million in questioned
    contract costs identified for recovery to the $617,442 NASA actually
    recovered, the recovery rate decreases from the reported 100 percent
    recovery rate to a 1.2 percent rate.^55 In another example, DOD reported
    in its PAR that it had identified for recovery $473 million and recovered
    about $419 million in contract payments, an 89 percent recovery rate.
    However, the DOD OIG reported^56 it had identified over $2 billion in
    questioned contract costs as of September 30, 2005. When comparing the $2
    billion in questioned contract costs^57 to the $419 million DOD actually
    recovered, the recovery rate significantly decreases from a reported 89
    percent recovery rate to 21 percent.

    These two discrepancies alone significantly decrease OMB's reported
    overall recovery rate of 84 percent to a 22 percent recovery rate. Other
    factors would also suggest the recovery rate is indeed much lower. We
    noted other instances where OIG-reported questioned costs exceeded agency
    contract amounts identified for recovery. Because these costs were not
    specifically identified as contractor costs versus other payment types, we
    were unable to determine how much of the OIG-identified questioned costs
    related to contract costs.

    In addition, another factor that may call into question the reported high
    recovery rate is that 5 of the 21 agencies did not review all of their
    agency components as part of their recovery audit efforts, and 2
    agencies^58 reported that recovery auditing was not cost beneficial. For
    example, HUD determined that based on its review of $206.6 million in
    contract payments, none were found to be improper. Thus, HUD determined
    that pursuit of an ongoing recovery auditing program was not cost
    beneficial or necessary. Because section 831 of the National Defense
    Authorization Act requires agencies to carry out a cost-effective program
    for identifying errors made in paying contractors and for recovering
    amounts erroneously paid to contractors, agencies have determined that
    they may opt out of conducting a recovery audit if it is not deemed to be
    cost beneficial. However, neither of the two agencies that determined it
    was not cost beneficial to conduct a recovery audit provided support in
    their fiscal year 2005 PARs for this determination.

    Conclusions

    Improper payments are a serious problem. Agencies are working on this
    issue at different paces, and OMB has provided important leadership.
    Because the extent of the problem remains significantly understated, the
    level of effort necessary to address the full extent of improper payments
    is as yet unknown. We recognize that measuring improper payments and
    designing and implementing actions to reduce them are not simple tasks and
    will not be easily accomplished. The ultimate success of the executive
    branch's effort to reduce improper payments depends, in part, on each
    agency's continuing diligence and commitment to meeting the requirements
    of IPIA and the related OMB guidance. Full and reasonable disclosure of
    the extent of the problem could be enhanced by modifying the act's
    underlying criteria used to identify which programs and activities are
    susceptible to significant improper payments. OMB's implementing guidance
    can also be strengthened in several key areas. In this regard, in addition
    to the recommendations in this report, we reiterate that OMB require those
    agencies that did not address the IPIA requirements or did not perform
    risk assessments of all of their programs and activities to establish time
    frames and identify resources needed to perform risk assessments and
    satisfy reporting requirements. We also reiterate that OMB develop a plan
    to address the resource needs of those agencies that did not perform risk
    assessments or satisfy reporting requirements. With the ongoing imbalance
    between revenues and outlays across the federal government, and the
    Congress's and the American public's increasing demands for accountability
    over taxpayer funds, identifying, reducing, and recovering improper
    payments become even more critical. Fulfilling the requirements of IPIA
    will require sustained attention to implementation on the part of OMB and
    the agencies, as well as continued congressional oversight to monitor
    whether desired results are being achieved.

    Matter for Congressional Consideration

    To help ensure the complete disclosure and transparency of governmentwide
    improper payments, the Congress should consider amending existing IPIA
    provisions to define specific criteria, such as a dollar threshold,
    agencies should use to identify which programs and activities are
    susceptible to significant improper payments.

    Recommendations for Executive Action

    We are making four recommendations to OMB to help further the progress
    toward meeting the goals of IPIA and ensuring the integrity of payments.
    Specifically, we recommend that the Director, Office of Management and
    Budget,

    oexpand OMB's IPIA implementing guidance to describe in greater detail

    ofactors that agencies should consider when conducting their annual risk
    assessments, such as program complexity, operational changes, findings
    from investigative reports, and financial statement and performance audit
    reports, and

    ofactors agencies should use when reporting improper payments in their
    PARs, such as (1) provide a baseline of what agencies should include when
    reporting on causes, corrective actions, and manager accountability and
    (2) require that applicable agencies cite the specific law or regulation
    in their PARs when describing statutory barriers that may limit the
    agencies' corrective actions for reducing improper payments;

    oenforce existing guidance requiring agencies to use a statistically valid
    sampling methodology to calculate improper payment estimates;

    ogather from agencies the dollar amount of payments that agencies make
    under statute or judicial determinations that later are determined to be
    overpayments in order for OMB to assess and determine the magnitude of the
    issue and whether additional reporting is warranted; and

    omodify existing guidance to require those agencies stating that recovery
    auditing over contract payments is not cost beneficial to include their
    rationale for this determination.

    Agency Comments and Our Evaluation

    We received written comments on a draft of this report from OMB, and have
    reprinted them in appendix IV. OMB generally agreed with our
    recommendations and also agreed with our assessment that challenges remain
    in meeting the goals of IPIA. In its comments, OMB emphasized that
    progress in estimating and reporting improper payments had been made by
    agencies in fiscal year 2005 and highlighted initiatives underway to
    measure improper payments in other programs susceptible to significant
    improper payments. OMB pointed out that agencies estimated improper
    payments for 17 additional programs for fiscal year 2005, and that this
    number will increase by 10 programs for fiscal year 2006. OMB also said
    that beginning with fiscal year 2007, it expects HHS to begin reporting
    component error rates for its Medicaid, Temporary Assistance for Needy
    Families, and State Children's Health Insurance programs.

    OMB stated that there has been substantial progress in that 85 percent of
    the cost for the programs identified as high risk ($1.3 trillion of the
    $1.5 trillion) reported an error measurement rate for fiscal year 2005.
    While we agree with OMB that there has been progress, as discussed in this
    report, we continue to question the validity of certain agencies' risk
    assessment methodologies used to identify, estimate, and report improper
    payments for all risk susceptible programs and are concerned with how OMB
    defines high risk programs for purposes of agencies' improper payment
    reporting. OMB's definition of programs susceptible to significant
    improper payments covers only those agencies with programs that exceed the
    criteria of 2.5 percent of program outlays and $10 million to estimate
    improper payments. Our continuing concern with OMB's criteria relates to
    those agencies with large program outlays that have improper payment
    estimates that exceed the $10 million threshold but not the 2.5 percent of
    program payments threshold. Applying the 2.5 percent threshold criteria to
    large programs could exclude potentially billions of dollars of improper
    payments from being reported.

    According to OMB, the rationale for its threshold criteria is to ensure
    that agencies focus their resources on programs with the highest levels of
    risk for improper payments. OMB commented that going forward, it is now
    requiring agencies to track any programs that exceed the $10 million
    threshold, but have an error rate of less than 2.5 percent. OMB stated
    that this tracking facilitates a framework that would appropriately
    mitigate the risk that high risk programs will be left out of IPIA
    reporting activities. We view this as a positive step. Although OMB's
    recently revised implementing guidance was outside the scope of this
    review, our preliminary assessment found no mention of this tracking
    requirement. The guidance does state that OMB may determine on a
    case-by-case basis that certain programs that do not meet the threshold
    requirements may still be subject to the annual PAR improper payment
    reporting requirement. In light of OMB's stated intention to require
    agencies to track such programs, we believe it is key that the revised
    implementing guidance clearly reflects this tracking requirement and that
    agencies be required to publicly report this information as part of their
    annual improper payments reporting. Visibility of this type of information
    would help facilitate the Congress's understanding of the nature and
    extent of the governmentwide improper payments problem. To this end, we
    included a matter for congressional consideration to amend IPIA to
    eliminate any uncertainties regarding the identification of programs and
    activities that are susceptible to significant improper payments.

    In its comments, OMB also mentioned that alternative sampling
    methodologies for deriving program component error rates are acceptable
    interim error measurements for select programs until comprehensive
    statistical estimates are completed. We would consider this a pragmatic
    approach for working with agencies to determine and implement appropriate
    and evolving methodologies for improving the sophistication of improper
    payment estimates for these programs. Realistically, larger, complex
    agency programs may require additional time to plan and implement actions
    to fully measure their improper payments, such as the programs cited by
    OMB as using alternative methodologies--Earned Income Tax Credit and
    National School Lunch and Breakfast--as well as initiating reporting of
    component error rates in the future--Medicaid, Temporary Assistance for
    Needy Families, and State Children's Health Insurance Program. It will be
    important that agencies make good use of this additional time. OMB had
    specifically required a number of agencies just now starting to report or
    planning to do so shortly, to report selected improper payment information
    since 2002, several years before the legislative reporting requirements in
    IPIA became effective. Until agencies begin to fully measure and report
    improper payments for these large programs, the extent of the problem and
    level of effort necessary to control these losses are as yet unknown.

    We are sending copies of this report to the Director, Office of Management
    and Budget; appropriate congressional committees; and other interested
    parties. We will also make copies available to others upon request. In
    addition, the report is available at no charge on GAO's Web site at
    http://www.gao.gov .

    Please contact me at (202) 512-9095 or williamsm1@gao.gov if you or
    your staffs have any questions about this report. Contact points for our
    Offices of Congressional Relations and Public Affairs may be found on the
    last page of this report. Major contributors to this report are listed in
    appendix V.

    McCoy Williams
    Director, Financial Management and Assurance

    List of Requesters

    The Honorable Tom Coburn
    Chairman

    The Honorable Tom Carper
    Ranking
    Minority Member
    Subcommittee on Federal Financial Management, Government Information, and
    International Security Committee on Homeland Security and Governmental
    Affairs
    United States Senate

    The Honorable Tom Davis
    Chairman
    Committee on Government Reform
    House of Representatives

    The Honorable Todd Platts
    Chairman
    Subcommittee on Government Management, Finance and Accountability
    Committee on Government Reform
    House of Representatives

    Appendix I

    Objectives, Scope, and Methodology

    The objectives of this report were to determine (1) the extent to which
    agencies have included required improper payment information in their
    performance and accountability reports (PAR), (2) the annual improper
    payment estimate reported by agencies for fiscal year 2005, (3) whether
    the definition and types of improper payments reported in the Improper
    Payments Information Act of 2002 (IPIA) and the Office of Management and
    Budget's (OMB) implementing guidance provide adequate disclosure of the
    extent of improper payments at the agencies, and (4) the reported amount
    of improper payments recouped through recovery audits. The scope of our
    review included the 35 federal agencies^1 that the Department of the
    Treasury determined to be significant to the U.S. government's
    consolidated financial statements.

    To address the above objectives, we reviewed improper payment information
    reported by the 35 agencies in their fiscal year 2005 PARs or annual
    reports. We further reviewed and analyzed the provisions of IPIA and OMB's
    implementing guidance, as well as OMB's annual report^2 on the results of
    agency-specific reports, significant findings, agency accomplishments, and
    remaining challenges. We contacted OMB officials for clarification of
    reported information as needed. We also reviewed office of inspector
    general (OIG) reports, prior GAO reports, and other publicly available
    documents for reported improper payments information, including
    identifying agency reported improper or potentially fraudulent payments
    related to hurricanes Katrina and Rita. In addition, we utilized the
    results from our recent testimonies^3 on agencies challenges' in meeting
    IPIA reporting requirements.

    As part of our review and analysis of agencies' reported improper payment
    information in their fiscal year 2005 PARs or annual reports, we

    odetermined whether agencies' had reviewed all programs and activities for
    risk-susceptible programs and reviewed details of agencies'
    risk-assessment methodologies when reported;

    oidentified program improper payment estimates, including error amounts
    and error rates, a breakdown of overpayments and underpayments, and
    program outlays;

    oidentified agencies' sampling methodologies used to estimate program
    improper payments;

    odetermined the extent and level of detail agencies reported on key
    improper payment reporting elements, including manager accountability,
    causes of improper payments, corrective actions, and statutory barriers;

    oconducted an analysis of OMB's assessment criteria--exceeding $10 million
    in improper payments and 2.5 percent of program outlays--to identify
    programs that met only one of OMB's criteria and thus would not be
    required to estimate and report improper payment information based on
    these criteria alone;

    oanalyzed OIG-reported major management challenges for various programs
    and activities; and

    oanalyzed the amount of improper payments recouped through agencies'
    recovery audit activities.

    We did not independently validate the data that agencies reported in their
    PARs or annual reports or the data that OMB reported. We are providing the
    agency-reported data as descriptive information that will inform
    interested parties about the magnitude of governmentwide improper payments
    and other related information. We believe the data to be sufficiently
    reliable for that purpose. We requested comments on a draft of this report
    from the Director of the Office of Management and Budget or his designee.
    Written comments were received from the Controller, OMB, dated October 26,
    2006. OMB's comments are reprinted in appendix IV. We conducted our work
    from April 2006 through September 2006 in accordance with generally
    accepted government auditing standards.

    Appendix II

    Improper Payment Estimates Reported in Agency Fiscal Year 2004 and 2005
    PARs or Annual Reports

    Source: GAO analysis of cited agencies' fiscal year 2005 PARs or annual
    reports.

    ^aAgency did not report an annual improper payment estimate or error rate.

    ^bFiscal year 2004 estimates or error rates were updated to the revised
    estimates reported in the fiscal year 2005 PARs.

    ^cSee table 5 of this report.

    ^dAgency reported that it had no programs or activities susceptible to
    significant improper payments.

    ^eStudent Financial Assistance--Pell Grants and Federal Family Education
    Loan are combined together as Student Financial Assistance in OMB Circular
    No. A-11, former section 57.

    ^fAgency combined with the above program.

    ^gAgency did not address improper payments or IPIA requirements in its
    fiscal year 2005 PAR or annual report.

    ^hAn additional $266 million of improper payments exist for these three
    programs. In its PAR, the Department of Housing and Urban Development
    (HUD) did not provide a breakout of this amount among the three programs.

    ^iAgency reported error rate was less than 1 percent or reported error
    rate rounded to zero for purposes of this report.

    ^jAgency reported that the annual improper payment amount or error rate
    was zero.

    Appendix III

    Outlays, Improper Payment Estimates, and Error Rates Reported in Agency
    Fiscal Year 2005 PARs or Annual Reports

    Sources: GAO analysis of cited agencies' fiscal year 2005 PARs or annual
    reports and OMB.

    ^aThis number is the disbursements from the agencies' statements of
    budgetary resources in their fiscal year 2005 PARs or annual reports.

    ^bAgency did not report an annual improper payment estimate or error rate.

    ^cAgency reported that the annual improper payment amount was zero.

    ^dThe reported overpayments plus the reported underpayments do not equal
    the reported total improper payments.

    ^eSee table 5 of this report.

    ^fAgency did not provide an estimate breakout between both overpayments
    and underpayments.

    ^gAgency reported it had no programs or activities susceptible to
    significant improper payments.

    ^hStudent Financial Assistance--Pell Grants and Federal Family Education
    Loan are combined together as Student Financial Assistance in OMB Circular
    No. A-11, former section 57.

    ^iAgency combined with the above program.

    ^jAgency did not address improper payments or IPIA.

    ^kAgency program outlays were not reported in the fiscal year 2005 PARs.
    We obtained these amounts from OMB.

    ^lAn additional $266 million of improper payments exist for these three
    programs. In its PAR, HUD did not provide a breakout of this amount among
    the three programs. The $266 million is also excluded from the overpayment
    and underpayment estimates.

    ^mAgency reported error rate was less than 1 percent or reported the error
    rate rounded to zero for the purposes of this report.

    ^nThe overpayments plus the underpayments do not add up total improper
    payments because many of the programs did not provide a breakout of their
    total improper payment estimate between overpayments and underpayments.

    Appendix IV

    Comments from the Office of Management and Budget

    Appendix V

    GAO Contact and Staff Acknowledgments

    McCoy Williams, (202) 512-9095 or williamsm1@gao.gov

    In addition to the contact named above, Carla Lewis, Assistant Director;
    Sharon Byrd; Francine DelVecchio; Francis Dymond; Lisa M. Galvan;
    Jacquelyn Hamilton; James Maziasz; Christina Quattrociocchi; Donell Ries;
    and Autumn Schmid made important contributions to this report.

    Related GAO Products

    Improper Payments: Federal and State Coordination Needed to Report
    National Improper Payment Estimates on Federal Programs. [36]GAO-06-347 .
    Washington, D.C.: April 14, 2006.

    Financial Management: Challenges Continue in Meeting Requirements of the
    Improper Payments Information Act.  [37]GAO-06-581T . Washington, D.C.:
    April 5, 2006.

    Financial Management: Challenges Remain in Meeting Requirements of the
    Improper Payments Information Act.  [38]GAO-06-482T . Washington, D.C.:
    March 9, 2006.

    Financial Management: Challenges in Meeting Governmentwide Improper
    Payment Requirements. [39]GAO-05-907T . Washington, D.C.: July 20, 2005.

    Financial Management: Challenges in Meeting Requirements of the Improper
    Payments Information Act. [40]GAO-05-605T . Washington, D.C.: July 12,
    2005.

    Financial Management: Challenges in Meeting Requirements of the Improper
    Payments Information Act. [41]GAO-05-417 . Washington, D.C.: March 31,
    2005.

    Financial Management: Fiscal Year 2003 Performance and Accountability
    Reports Provide Limited Information on Governmentwide Improper Payments.
    [42]GAO-04-631T . Washington, D.C.: April 15, 2004.

    Financial Management: Status of the Governmentwide Efforts to Address
    Improper Payment Problems. [43]GAO-04-99 . Washington, D.C.: October 17,
    2003.

    Financial Management: Effective Implementation of the Improper Payments
    Information Act of 2002 Is Key to Reducing the Government's Improper
    Payments. [44]GAO-03-991T . Washington, D.C.: July 14, 2003.

    Financial Management: Challenges Remain in Addressing the Government's
    Improper Payments. [45]GAO-03-750T . Washington, D.C.: May 13, 2003.

    (195082)

    www.gao.gov/cgi-bin/getrpt? [46]GAO-07-92 .

    To view the full product, including the scope
    and methodology, click on the link above.

    For more information, contact McCoy Williams at (202) 512-9095 or
    williamsm1@gao.gov.

    Highlights of [47]GAO-07-92 , a report to congressional requesters

    November 2006

    IMPROPER PAYMENTS

    Agencies' Fiscal Year 2005 Reporting under the Improper Payments
    Information Act Remains Incomplete

    Fiscal year 2005 marked the second year that executive agencies were
    required to report improper payment information under the Improper
    Payments Information Act of 2002 (IPIA). As a steward of taxpayer dollars,
    the federal government is accountable for how its agencies and grantees
    spend billions of taxpayer dollars and is responsible for safeguarding
    those funds against improper payments.

    GAO was asked to determine the progress agencies have made in their
    improper payment reporting and the total amount of improper payments
    recouped through recovery auditing. To accomplish this, GAO reviewed
    improper payment information reported by 35 agencies in their fiscal year
    2005 performance and accountability or annual reports.

    [48]What GAO Recommends

    GAO suggests that the Congress consider amending IPIA provisions to define
    specific criteria agencies should use to ensure that the full extent of
    improper payments is being captured. GAO also makes four recommendations
    to the Office of Management and Budget (OMB) to facilitate agencies'
    progress in ensuring accurate and complete improper payments and recovery
    auditing reporting. OMB generally agreed with GAO's recommendations and
    outlined actions planned and under way for continued progress.

    While making progress, agencies' fiscal year 2005 reporting under IPIA
    does not yet reflect the full scope of improper payments across executive
    branch agencies. Major challenges remain in meeting the goals of the act
    and ultimately improving the integrity of payments. GAO found that these
    challenges continue to hinder full reporting of improper payment
    information because of the following three factors:

               o Existing reporting incomplete. Although 18 agencies collectively
               identified and estimated improper payments for 57 programs and
               activities totaling $38 billion, some agencies still had not
               instituted systematic methods of reviewing all programs, resulting
               in their identification of none or only a few programs as
               susceptible to significant improper payments. In many cases, these
               same agencies had well-known and documented financial management
               weaknesses as well as fraudulent, improper, and questionable
               payments. Further, improper payment estimates totaling about $389
               million for 9 programs were not based on a valid statistical
               sampling methodology as required. Higher estimates would have been
               expected had the correct methods been used, given that total
               outlays for these 9 programs exceeded $58.2 billion.
               o Large programs still not included. Improper payment estimates
               for 10 risk-susceptible programs with outlays totaling over $234
               billion still have not been provided. Most of these programs were
               subject to OMB reporting requirements that preceded IPIA.
               o Threshold criteria limit reporting. The act includes broad
               criteria to identify risk-susceptible programs. OMB's implementing
               guidance includes more specific criteria that limit the disclosure
               and transparency of agencies' improper payments.

    With regard to agencies' recovery audit efforts, GAO found that the data
    reported may present an overly optimistic view of these efforts. While 21
    agencies were required to report on their recovery audit efforts, GAO
    identified discrepancies in several agencies' information and found
    limited reviews over contract payments. For example, for fiscal year 2005,
    the National Aeronautics and Space Administration (NASA) reported that it
    had identified and recovered $617,442 in contract payments, a 100 percent
    recovery rate. Yet, the NASA Office of Inspector General reported it had
    identified over $515 million in questioned contract costs during fiscal
    year 2005, of which NASA management decided to pursue recovery of $51
    million. Had this amount been compared to the $617,442 NASA actually
    recovered, its recovery rate would drop from the reported 100 percent to

    1.2 percent. In addition, we noted that 5 of the 21 agencies did not
    review all of their agency components as part of their recovery audit
    efforts while 2 agencies reported that recovery auditing was not cost
    beneficial without reporting any details to support this determination.

    References

    Visible links

      36. http://www.gao.gov/cgi-bin/getrpt?GAO-06-347
      37. http://www.gao.gov/cgi-bin/getrpt?GAO-06-581T
      38. http://www.gao.gov/cgi-bin/getrpt?GAO-06-482T
      39. http://www.gao.gov/cgi-bin/getrpt?GAO-05-907T
      40. http://www.gao.gov/cgi-bin/getrpt?GAO-05-605T
      41. http://www.gao.gov/cgi-bin/getrpt?GAO-05-417
      42. http://www.gao.gov/cgi-bin/getrpt?GAO-04-631T
      43. http://www.gao.gov/cgi-bin/getrpt?GAO-04-99
      44. http://www.gao.gov/cgi-bin/getrpt?GAO-03-991T
      45. http://www.gao.gov/cgi-bin/getrpt?GAO-03-750T
      46. http://www.gao.gov/cgi-bin/getrpt?GAO-07-92
      47. http://www.gao.gov/cgi-bin/getrpt?GAO-07-92
    *** End of document. ***