IMPROPER 

PAYMENTS

Most Selected 

Agencies Improved 

Procedures to Help 

Ensure Risk 

Assessments of All 

Programs and 

Activities

Report to Congressional Requesters

November 2017

GAO-18-36

United States Government Accountability Office
United States Government Accountability Office

Highlights of GAO-18-36, a report to 

congressional requesters

November 2017

IMPROPER PAYMENTS

Most Selected Agencies Improved Procedures 

to Help Ensure Risk Assessments of All 

Programs and Activities

What GAO Found

GAO’s review of the 24 Chief Financial Officers Act of 1990 (CFO Act) agencies’ 

fiscal years 2014 through 2016 agency financial reports (AFR) and performance 

and accountability reports (PAR) found that these agencies generally adhered to

the Office of Management and Budget’s (OMB) improper payment risk 

assessment reporting directives. However, GAO found instances of 

nonadherence, including the following:

• There were two instances of nonadherence to OMB’s directive for agencies 

to report the basis for how they grouped programs and activities, both of 

which occurred in fiscal year 2014. All agencies that completed risk 

assessments adhered to this directive for fiscal years 2015 and 2016. 

• The Improper Payments Information Act of 2002, as amended, identifies 

seven risk factors and OMB guidance includes two additional risk factors that 

agencies are to consider when conducting risk assessments. For fiscal years 

2015 and 2016 reporting, OMB directed agencies to report the risk factors 

considered in their risk assessments. However, GAO found six agencies that 

did not report one or more of the nine risk factors in their AFRs or PARs.

OMB’s revised guidance for fiscal year 2017 no longer directs agencies to report 

on their risk assessments. OMB staff stated that their primary motivation for 

removing such reporting was to reduce the administrative burden. After GAO 

notified OMB of the importance of certain data, OMB staff plan to direct agencies 

to provide additional data, including a listing of risk assessed programs and 

activities, on www.paymentaccuracy.gov for reporting beginning in fiscal year 

2017. OMB staff also plan to revise the guidance for fiscal year 2018 for 

agencies to report the other risk assessment information in their AFRs or PARs.

GAO also found that three of the nine selected agencies (the Departments of 

Energy and Justice and the U.S. Agency for International Development) that it 

reviewed had designed and documented control activities to help ensure that all 

programs and activities were assessed every 3 years. For the remaining six

agencies, GAO found that the agencies did not properly design control activities

for this purpose. Specifically, GAO found the following:

• Three agencies—the Department of Commerce, the National Science 

Foundation, and the Nuclear Regulatory Commission—did not have 

documented procedures for conducting risk assessments during fiscal years 

2014 through 2016 but subsequently documented them. 

• Three agencies—the Departments of the Interior (Interior) and State (State) 

and the National Aeronautics and Space Administration (NASA)—

documented procedures for conducting risk assessments but did not include 

all programs and activities in their risk assessments. Interior later drafted 

revisions to its procedures and State updated its procedures to include them.

Without properly designed and documented control activities, there is a risk that 

an agency may not identify all programs and activities that require a risk 

assessment, which could result in the agency failing to develop and report 

improper payment estimates for programs and activities that should have been 

identified as susceptible to significant improper payments.

View GAO-18-36. For more information, 

contact Beryl H. Davis at (202) 512-2623 or 

davisbh@gao.gov.

Why GAO Did This Study

Reported improper payment estimates

totaled over $1.2 trillion governmentwide from fiscal years 2003 through 

2016. Agencies are statutorily required 

to perform improper payment risk 

assessments to identify programs and 

activities that may be susceptible to 

significant improper payments and are 

required to report an improper payment 

estimate for ones that are susceptible

to significant improper payments.

GAO was asked to review federal 

agencies’ improper payment risk 

assessments. This report examines the 

extent to which (1) the 24 CFO Act 

agencies followed OMB guidance for 

reporting on improper payment risk 

assessments and (2) selected CFO Act 

agencies properly designed control 

activities to include all of their 

programs and activities in an improper 

payment risk assessment at least once 

every 3 years, as statutorily required. 

GAO analyzed the 24 CFO Act 

agencies’ AFRs and PARs and 

reviewed the procedures at 9 selected 

agencies. GAO selected 9 agencies

that did not report improper payment 

estimates in fiscal year 2015, except 

for those estimates that were 

mandated to be reported pursuant to 

the Disaster Relief Appropriations Act, 

2013. For this review, GAO did not 

evaluate the quality of improper 

payment risk assessments completed.

What GAO Recommends

GAO recommends that NASA revise 

its procedures to help ensure that all 

programs and activities are assessed 

for susceptibility to significant improper 

payments at least once every 3 years. 

NASA concurred with the 

recommendation.
Page i GAO-18-36 Agencies Improper Payment Risk Assessments

Letter 1

Background 4

CFO Act Agencies Generally Adhered to Improper Payment 

Reporting Directives for Risk Assessments 7

Six Selected CFO Act Agencies Did Not Have Properly Designed 

Control Activities That Included All Programs and Activities in 

Their Improper Payment Risk Assessments 14

Conclusions 18

Recommendation for Executive Action 18

Agency Comments and Our Evaluation 18

Appendix I Objectives, Scope, and Methodology 22

Appendix II Standards for Internal Control in the Federal Government 25

Appendix III Agency Adherence to Office of Management and Budget Reporting 

Directives for Risk Assessments 26

Appendix IV Summary of Agencies’ Procedures for Performing Improper 

Payment Risk Assessments 31

Appendix V Comments from the National Aeronautics and Space Administration 33

Appendix VI Comments from the Social Security Administration 35

Appendix VII Comments from the Department of State 36

Appendix VIII Comments from the U.S. Agency for International Development 39

Contents
Page ii GAO-18-36 Agencies Improper Payment Risk Assessments

Appendix IX GAO Contact and Staff Acknowledgments 41

Tables

Table 1: Office of Management and Budget (OMB) Improper 

Payment Risk Assessment Reporting Directives for Fiscal 

Years 2014 through 2016 6

Table 2: Chief Financial Officers Act of 1990 (CFO Act) Agencies’ 

Adherence to Office of Management and Budget 

Guidance to Report a Basis for Grouping Programs and 

Activities 26

Table 3: Chief Financial Officers Act of 1990 (CFO Act) Agencies’ 

Adherence to Office of Management and Budget 

Guidance to Report a Listing of All Programs and 

Activities Assessed for Risk and Report Consideration of 

Risk Factors 28

Table 4: Summary of Selected Agencies’ Fiscal Years 2014 

through 2016 Procedures for Performing Improper 

Payment Risk Assessments 31

Figure

Figure 1: Agencies’ Adherence to Office of Management and 

Budget (OMB) Improper Payment Risk Assessment 

Reporting Directives for Fiscal Years 2014 through 2016 8
Page iii GAO-18-36 Agencies Improper Payment Risk Assessments

Abbreviations

AFR agency financial report

CFO Act Chief Financial Officers Act of 1990

CIGIE Council of the Inspectors General on Integrity and

Efficiency

Commerce Department of Commerce 

DFAS Defense Finance and Accounting Service

DOD Department of Defense 

Education Department of Education

Energy Department of Energy

FSA Federal Student Aid

HUD Department of Housing and Urban Development 

IG inspector general

Interior Department of the Interior 

IPERA Improper Payments Elimination and Recovery Act of 2010

IPERIA Improper Payments Elimination and Recovery

Improvement Act of 2012

IPIA Improper Payments Information Act of 2002

Labor Department of Labor 

NASA National Aeronautics and Space Administration 

NRC Nuclear Regulatory Commission 

NSF National Science Foundation

OIG Office of Inspector General

OMB Office of Management and Budget

OPM Office of Personnel and Management 

PAR performance and accountability report 

SSA Social Security Administration 

State Department of State

USAID U.S. Agency for International Development 

USDA U.S. Department of Agriculture 

This is a work of the U.S. government and is not subject to copyright protection in the 

United States. The published product may be reproduced and distributed in its entirety 

without further permission from GAO. However, because this work may contain 

copyrighted images or other material, permission from the copyright holder may be 

necessary if you wish to reproduce this material separately.
Page 1 GAO-18-36 Agencies Improper Payment Risk Assessments

441 G St. N.W.

Washington, DC 20548

November 16, 2017

Congressional Requesters:

As the steward of taxpayer dollars, the federal government is accountable 

for how it spends hundreds of billions of taxpayer dollars annually. 

However, improper payments—payments that should not have been 

made or were made in incorrect amounts—remain a significant and 

pervasive government-wide issue.1 Specifically, from fiscal years 2003 

through 2016, improper payments have been estimated to total over 

$1.2 trillion government-wide. The most recent government-wide 

improper payment estimate reported for fiscal year 2016 was 

$144.3 billion, an increase of approximately $7.6 billion from the

$136.7 billion estimate reported for fiscal year 2015.2 It is important to 

note that these estimates themselves may not be accurate, reliable, or 

complete, as we have reported that the federal government is unable to 

determine the full extent of improper payments and to reasonably assure 

that actions are taken to reduce them.3 In addition, certain inspectors 

general (IG) have reported issues with agencies’ reported improper 

payment estimates because agencies used inappropriate sampling 

 1

An improper payment is defined as any payment that should not have been made or that 

was made in an incorrect amount (including overpayments and underpayments) under 

statutory, contractual, administrative, or other legally applicable requirements. It includes 

any payment to an ineligible recipient, any payment for an ineligible good or service, any 

duplicate payment, any payment for a good or service not received (except for such 

payments where authorized by law), and any payment that does not account for credit for 

applicable discounts. See 31 U.S.C. § 3321 note. Office of Management and Budget 

(OMB) guidance also instructs agencies to report as improper payments any payment for 

which insufficient or no documentation was found. 

2

The improper payment estimates for fiscal years 2015 and 2016 exclude the Department 

of Defense’s Defense Finance and Accounting Service (DFAS) Commercial Pay program. 

Although OMB included this program in its government-wide improper payment estimate 

for both years, because of our continuing concerns based on audit findings in a 2013 

report regarding the reliability of its improper payment estimate, we have excluded the 

DFAS Commercial Pay estimate from our calculations. See GAO, DOD Financial 

Management: Significant Improvements Needed in Efforts to Address Improper Payment 

Requirements, GAO-13-227 (Washington, D.C.: May 13, 2013). 

3

GAO, Financial Audit: Fiscal Years 2016 and 2015 Consolidated Financial Statements of 

the U.S. Government, GAO-17-283R (Washington, D.C.: Jan. 12, 2017).

Letter
Page 2 GAO-18-36 Agencies Improper Payment Risk Assessments

methods and inadequate estimation methodologies to calculate and 

report these estimates.4

The Improper Payments Information Act of 2002 (IPIA), as amended by 

the Improper Payments Elimination and Recovery Act of 2010 (IPERA) 

and the Improper Payments Elimination and Recovery Improvement Act 

of 2012 (IPERIA), requires, among other things, that each federal agency 

review all programs and activities that the agency head administers and 

identify those that may be susceptible to significant improper payments—

a process commonly referred to as an improper payment risk 

assessment. Specifically, IPIA, as amended,5 (hereafter referred to as 

IPIA) requires agencies to conduct improper payment risk assessments 

for all federal programs and activities in fiscal year 2011 and at least once 

every 3 years thereafter. Office of Management and Budget (OMB) 

guidance provides that programs that have been determined to be 

susceptible to significant improper payments and that are already 

reporting an estimate—or in the process of establishing an estimate—do 

not have to perform additional risk assessments.6 IPIA defines significant 

improper payments as gross annual improper payments—the total 

amount of payments that should not have been made or that were made 

in an incorrect amount—that may have exceeded (1) both 1.5 percent of 

program outlays and $10 million of all program or activity payments made 

during the fiscal year reported or (2) $100 million (regardless of the 

improper payment percentage of total program outlays).

You requested that we review federal agencies’ improper payment risk 

assessments. This report examines the extent to which (1) the 24 

agencies subject to the Chief Financial Officers Act of 1990 (CFO Act) 

followed OMB guidance for reporting on improper payment risk 

assessments and (2) selected CFO Act agencies designed control 

activities to include all of their programs and activities in an improper 

payment risk assessment at least once during a 3-year period, as 

 4

GAO, Improper Payments: Additional Guidance Could Provide More Consistent 

Compliance Determinations and Reporting by Inspectors General, GAO-17-484 

(Washington, D.C.: May 31, 2017).

5

IPIA, Pub. L. No. 107-300, 116 Stat. 2350 (Nov. 26, 2002), amended by IPERA, Pub. L. 

No. 111-204, 124 Stat. 2224 (July 22, 2010), and IPERIA, Pub. L. 112-248, 126 Stat. 2390 

(Jan. 10, 2013), codified as amended at 31 U.S.C. § 3321 note.

6

Office of Management and Budget, Appendix C to OMB Circular A-123, Requirements for 

Effective Estimation and Remediation of Improper Payments, OMB Memorandum M-15-

02 (Washington, D.C.: Oct. 20, 2014).
Page 3 GAO-18-36 Agencies Improper Payment Risk Assessments

required by IPIA.7 At the time of our review, the most recent 3-year period

was fiscal years 2014 through 2016.

To address our first objective, we reviewed the improper payment risk 

assessment requirements in IPIA, as well as reviewed the related 

guidance in OMB Circular A-136, Financial Reporting Requirements, 

including the OMB directives for agencies’ risk assessment reporting, and 

OMB M-15-02.8 To determine if the agencies adhered to OMB reporting 

directives, we analyzed the agency financial reports (AFR) or the 

performance and accountability reports (PAR) of the 24 CFO Act 

agencies for fiscal years 2014 through 2016. Our review focused on 

whether the agencies reported the risk assessment information in their 

AFRs or PARs but did not include an evaluation of the quality of these 

agencies’ improper payment risk assessments. For agencies that did not 

adhere to the reporting directives, we interviewed appropriate agency 

officials to determine the reason(s) they did not.

To address our second objective, we reviewed IPIA, the related OMB 

guidance, and relevant internal control standards to determine the 

relevant control activities needed to help ensure that agencies conduct 

improper payment risk assessments for all programs and activities at 

least once every 3 years.9 Although the control activities are relevant for 

all of the 24 CFO Act agencies, we selected those agencies that have not 

identified any programs or activities that were susceptible to significant 

improper payments. Specifically, we focused on those 9 agencies that did 

not report improper payment estimates in fiscal year 2015, except for 

those estimates that were mandated to be reported pursuant to the 

Disaster Relief Appropriations Act, 2013.10 These 9 agencies were the 

 7

The CFO Act, Pub. L. No. 101-576, 104 Stat. 2838 (Nov. 15, 1990), established, among 

other things, chief financial officers to oversee financial management activities at 23 major 

executive departments and agencies. The list now includes 24 entities, which are often 

referred to collectively as CFO Act agencies, and is codified, as amended, in section 901 

of Title 31, United States Code. The CFO Act agencies accounted for over 99 percent of 

the government-wide improper payment estimate in fiscal year 2015.

8

IPIA does not have requirements related to the reporting of risk assessments. 

9

GAO, Standards for Internal Control in the Federal Government, GAO/AIMD-00-21.3.1

(Washington, D.C.: November 1999). GAO/AIMD-00-21.3.1 was effective through the end 

of fiscal year 2015 (Sept. 30, 2015). The revised version of Standards for Internal Control 

in the Federal Government, GAO-14-704G (Washington, D.C.: September 2014), became 

effective the first day of fiscal year 2016 (Oct. 1, 2015). Both versions were applicable to 

this review.

10Pub. L. No. 113-2, div. A, title IX, § 904(b), 127 Stat. 4, 17 (Jan. 29, 2013).
Page 4 GAO-18-36 Agencies Improper Payment Risk Assessments

Departments of Commerce, Energy, the Interior, Justice, and State; the 

National Aeronautics and Space Administration; the National Science 

Foundation; the Nuclear Regulatory Commission; and the U.S. Agency 

for International Development. Specifically, for these 9 agencies 

(hereafter referred to as selected agencies), we reviewed the agencies’

procedures for conducting improper payment risk assessments and 

interviewed agency officials to determine whether the agencies properly 

designed and documented control activities to review all programs and 

activities at least once every 3 years. Appendix I provides further details 

on our scope and methodology.

While our second objective focused on certain key control activities 

related to the selected agencies’ inclusion of programs and activities in 

their improper payment risk assessments at least once during fiscal years 

2014 through 2016, we did not evaluate all control activities and other 

components of internal control. If we had done so, additional deficiencies 

may or may not have been identified that could impair the effectiveness of 

the control activities evaluated as part of this audit. Appendix II provides 

additional details on standards for internal control in the federal 

government.

We conducted this performance audit from June 2016 to November 2017 

in accordance with generally accepted government auditing standards. 

Those standards require that we plan and perform the audit to obtain 

sufficient, appropriate evidence to provide a reasonable basis for our 

findings and conclusions based on our audit objectives. We believe that 

the evidence obtained provides a reasonable basis for our findings and 

conclusions based on our audit objectives.

IPIA requires agencies to conduct a risk assessment for all programs and 

activities at least once every 3 years, and OMB guidance implementing 

IPIA also directs agencies to report on the assessment in either the 

agencies’ AFRs or PARs. Each agency must institute a systematic 

method of performing the improper payment risk assessment, which may 

take the form of either a quantitative analysis based on a statistical 

sample or qualitative evaluation (e.g., a risk assessment questionnaire).

IPIA identifies seven risk factors and OMB guidance includes two 

additional risk factors that agencies are to consider when conducting 

Background
Page 5 GAO-18-36 Agencies Improper Payment Risk Assessments

improper payment risk assessments.11 According to OMB M-15-02, 

agencies’ risk assessments (either quantitative or qualitative) should 

consider all of the following nine risk factors that are likely to contribute to 

significant improper payments:

1. whether the program or activity reviewed is new to the agency;

2. the complexity of the program or activity reviewed, particularly with 

respect to determining correct payment amounts;

3. the volume of payments made annually;

4. whether payments or payment eligibility decisions are made outside of 

the agency, for example, by a state or local government or a regional 

federal office;

5. recent major changes in program funding, authorities, practices, or 

procedures;

6. the level, experience, and quality of training for personnel responsible 

for making program eligibility determinations or certifying that 

payments are accurate;

7. inherent risks of improper payments because of the nature of agency 

programs or operations;

8. significant deficiencies in the agency’s audit reports, including but not 

limited to the agency IG or GAO audit findings or other relevant 

management findings that might hinder accurate payment 

certification; and

9. results from prior improper payment work.

OMB guidance describes these nine risk factors as the minimum factors

that agencies should consider and notes that additional risk factors, such 

as those specific to the program or activity being assessed, should also 

be considered, as appropriate.

If an agency’s improper payment risk assessment finds that a program is 

susceptible to significant improper payments, the agency is required by 

IPIA to estimate the annual amount of improper payments for the 

program, publish corrective action plans, set reduction targets, and 

 11The two additional risk factors that OMB M-15-02 directs agencies to consider when 

conducting improper payment risk assessments are (1) inherent risks of improper 

payments because of the nature of agency programs or operations and (2) results from 

prior improper payment work. 
Page 6 GAO-18-36 Agencies Improper Payment Risk Assessments

annually report on the results of addressing these requirements for that 

program. IPIA states that each agency is required to publish the improper 

payment information in an annual report in the form and content required 

by OMB—typically an AFR or a PAR—for the most recent fiscal year, and 

post that report on the agency’s website.

OMB Circular A-136 and OMB M-15-02 provide guidance for agencies on 

preparing their AFRs or PARs, including the reporting of improper 

payment information. Specifically, this OMB guidance directs agencies to 

disclose the following in their AFRs or PARs: (1) the basis for grouping 

programs and activities for improper payment risk assessments;12 (2) the 

risk factors considered during their risk assessment; and (3) a listing of all 

programs that were assessed for a given year, regardless of whether a 

program or activity was deemed susceptible to significant improper 

payments. Given that OMB guidance is updated periodically, some 

reporting directives may differ for each fiscal year. As shown in table 1, 

the directive to disclose the basis for grouping programs and activities 

was applicable for all 3 years included in the scope of our review (i.e., 

fiscal years 2014 through 2016). However, the directives to disclose all 

the risk factors considered and include a listing of all programs and 

activities assessed were only applicable for fiscal years 2015 and 2016.

Table 1: Office of Management and Budget (OMB) Improper Payment Risk 

Assessment Reporting Directives for Fiscal Years 2014 through 2016

OMB reporting directive Fiscal year

2014 2015 2016

1. Report the basis for grouping programs and activities ✓ ✓ ✓

2. Report a listing of all programs and activities 

assessed during the agency’s risk assessment

N/A ✓ ✓

3. Describe the risk factors considered during the 

agency’s risk assessment

N/A ✓ ✓

Legend:

✓: OMB reporting directive was applicable in this fiscal year.

N/A: OMB reporting directive was not applicable in this fiscal year.

Source: GAO analysis of OMB guidance related to agencies’ improper payment reporting directives. | GAO-18-36

 12Unless otherwise specified in OMB Circular A-11, Preparation, Submission, and 

Execution of the Budget, OMB M-15-02 authorizes each agency, after consultation with 

OMB, to determine the grouping of programs that most clearly identifies and reports 

improper payments for the agency. However, OMB M-15-02 also states that agencies 

must not put programs or activities into groupings that may mask significant improper 

payment rates by the large size or scope of a group. 
Page 7 GAO-18-36 Agencies Improper Payment Risk Assessments

During fiscal years 2014 through 2016, the 24 CFO Act agencies, 

excluding the Department of Defense (DOD),13 reported in their AFRs or 

PARs that that they completed at least one risk assessment on at least 

one program or activity in one or more of those years. For the agencies 

that reported that they completed an improper payment risk assessment, 

we found that most generally adhered to the reporting directives that were 

applicable for fiscal years 2014 through 2016. For example, for fiscal year 

2014, 21 of the 24 CFO Act agencies reported completing a risk 

assessment, and for those 21 agencies, we found that 19 agencies 

adhered to OMB guidance for reporting the basis of groupings of 

programs and activities and 2 did not. (See fig. 1.) For fiscal years 2015 

and 2016, all 18 CFO Act agencies that reported completing a risk 

assessment adhered to OMB guidance for this directive. Appendix III 

provides additional details regarding the agencies’ reporting of completing 

an improper payment risk assessment each year and adherence to the 

OMB improper payment risk assessment reporting directives. Further 

details on each of these reporting directives are provided below.

 13According to DOD officials, each of DOD’s programs that make payments has reported 

improper payment estimates; as a result, DOD officials told us that DOD did not have to 

perform risk assessments during the review period (fiscal years 2014 through 2016) to 

assess the susceptibility to improper payments in accordance with OMB guidance. 

CFO Act Agencies 

Generally Adhered to 

Improper Payment 

Reporting Directives 

for Risk Assessments
Page 8 GAO-18-36 Agencies Improper Payment Risk Assessments

Figure 1: Agencies’ Adherence to Office of Management and Budget (OMB) 

Improper Payment Risk Assessment Reporting Directives for Fiscal Years 2014 

through 2016

a

OMB reporting directive was not applicable in this fiscal year.

Reporting the basis for grouping programs and activities. During the 

3-year period from fiscal years 2014 through 2016, we found two 

instances where the agencies—the Departments of Commerce 

(Commerce) and Energy (Energy)—did not adhere to the reporting 

directive for agencies to report the basis of grouping programs and 

activities. Although these two agencies did not adhere to this reporting 

directive in fiscal year 2014, Commerce adhered to this directive in fiscal 

year 2015 and fiscal year 2016. Energy adhered to this directive in fiscal 

year 2015, and this reporting directive was not applicable for fiscal year 

2016 because Energy did not report completing any risk assessments 

that year. All other applicable agencies were in full adherence to this 

OMB directive in fiscal years 2015 and 2016.
Page 9 GAO-18-36 Agencies Improper Payment Risk Assessments

Reporting a listing of all programs and activities assessed during 

the agencies’ improper payment risk assessments. During fiscal 

years 2015 through 2016, the applicable CFO Act agencies, except for 

the U.S. Agency for International Development (USAID), adhered to the 

reporting directive for listing all programs and activities assessed during 

the agencies’ improper payment risk assessments. USAID did not adhere 

to this reporting directive in fiscal year 2015; however, in fiscal year 2016, 

USAID did list all programs and activities. USAID officials provided us an 

OMB e-mail indicating, among other things, that USAID could be on a 3-

year cycle of performing risk assessments starting in fiscal year 2015. 

Notwithstanding that e-mail, USAID continued to perform improper 

payment risk assessments annually, according to USAID officials, to 

maintain audit readiness and expertise. These officials further stated that 

this OMB e-mail served as support for not adhering to the OMB directive 

for reporting risk assessments. However, we did not find upon our review 

that the e-mail explicitly provided such support.

Reporting the risk factors considered during the agencies’ risk 

assessments. As directed by OMB guidance, agencies are to report the 

risk factors considered during improper payment risk assessments in their 

AFRs or PARs. Given that IPIA identifies seven risk factors that agencies 

are to consider and OMB guidance includes two additional risk factors, 

agencies are directed by OMB to consider a minimum of nine risk factors. 

Therefore, the AFRs and PARs adhering to OMB guidance are to include 

a discussion regarding the agencies’ consideration of these nine factors 

as well as any other factors considered. In our analysis, we found that six 
Page 10 GAO-18-36 Agencies Improper Payment Risk Assessments

agencies failed to adhere to OMB reporting directives either in fiscal year 

2015, fiscal year 2016, or both.14 Specifically, we found the following:

• The Office of Personnel Management (OPM) did not adhere to the 

improper payment risk assessment reporting directives in fiscal year 

2015. However, OPM subsequently corrected the reporting issue in 

fiscal year 2016.

• Three agencies—USAID, the U.S. Department of Agriculture (USDA), 

and the Social Security Administration (SSA)—did not adhere to the 

improper payment risk assessment reporting directives in fiscal years 

2015 and 2016. In their fiscal years 2015 and 2016 AFRs, USAID did 

not report its consideration of any of the nine risk factors, USDA 

reported that it considered four of the nine risk factors, and SSA 

reported that it considered six of the nine risk factors.

• Two agencies, the Department of Education (Education) and the 

Department of Labor (Labor), did not adhere to the improper payment 

risk assessment reporting directive in fiscal year 2016. In their fiscal 

year 2016 AFRs, neither Education nor Labor provided a detailed 

description of all the risk factors that were considered in their risk 

assessments. Education stated that its risk assessment analysis 

“included a quantitative review of questioned costs from Single Audit 

 14Our review focused on whether the agencies reported the risk assessment information 

in their AFRs or PARs in accordance with OMB guidance and did not include evaluating 

the quality of the improper payment risk assessments completed. However, the quality of 

Energy’s and the Department of Housing and Urban Development’s (HUD) risk 

assessments was examined in a prior GAO report and HUD Office of Inspector General 

(OIG) report, respectively. Specifically, in a 2014 GAO report, we recommended that 

Energy take steps to improve its improper payment risk assessments, including revising 

guidance on how its programs are to address OMB’s risk factors and providing examples 

of other risk factors likely to contribute to improper payments and directing its programs to 

consider those factors. Energy concurred with our recommendations. Subsequent to our 

2014 report, Energy took certain actions to address our recommendations. For example, 

Energy made revisions to its guidance to improve its improper payment risk assessments. 

We are continuing to monitor Energy’s efforts to ensure that it implements this new 

guidance. See GAO, Improper Payments: DOE’s Risk Assessments Should Be 

Strengthened, GAO-15-36 (Washington, D.C.: Dec. 23, 2014). Additionally, the HUD OIG 

reported that certain HUD program improper payment risk assessments for fiscal year

2015 were not completed in accordance with OMB guidance. Specifically, HUD did not 

consider all of the nine risk factors for certain programs. HUD OIG recommended that 

HUD revise its risk assessment process to ensure that consideration of all of the risk 

factors is clearly documented. As noted in the OIG’s latest report on HUD’s compliance 

with IPERA, which was issued in May 2017, the recommendation was still open. 

Department of Housing and Urban Development, Office of Inspector General, Compliance 

with the Improper Payments Elimination and Recovery Act, 2016-FO-0005 (Washington, 

D.C.: May 13, 2016).
Page 11 GAO-18-36 Agencies Improper Payment Risk Assessments

findings versus total program expenditures, as well as a qualitative 

review of other risk factors including changes in legislation or 

regulations and history of audit findings.” Labor did not list the risk 

factors considered in its improper payment risk assessments but 

instead provided a hyperlink to IPIA.

As noted above, officials from USAID stated that an OMB e-mail served 

as support for not adhering to the OMB directive for reporting risk 

assessments, including the risk factors. However, we found upon our 

review that the e-mail did not explicitly provide such support.

Officials from USDA, Labor, and SSA, three of the five agencies that did 

not adhere to the reporting directive in fiscal year 2016, informed us that 

they considered the nine risk factors but were not aware that they had to 

specifically list the nine risk factors in their AFRs or PARs. In addition, 

Labor officials stated that they included a link to IPIA instead of 

mentioning the nine risk factors to help simplify the reporting. However, 

OMB Circular A-136 specifically directs the agencies to include a 

description of the risk factors considered in their improper payment risk 

assessments in their AFRs or PARs. Although Labor officials stated that 

they considered all nine risk factors, Labor’s link to IPIA only includes 

seven required risk factors and not the two additional risk factors that are 

referenced in OMB guidance. After we brought these concerns to their 

attention, officials from these three agencies indicated that they plan to 

report the risk factors considered, as directed by OMB, which should 

include consideration of all nine risk factors. By adhering to the OMB 

directive for reporting risk factors, the agencies will improve the 

transparency of the risk assessments reported in their AFRs or PARs.

An Education official stated that the department did not consider all nine 

risk factors for its non-Federal Student Aid programs during fiscal year 

2016 because Education’s analysis was quantitative in nature.15

However, OMB guidance states that all nine risk factors must be 

considered in both qualitative and quantitative improper payment risk 

assessments. In May 2017, the Inspector General for Education 

recommended that Education ensure that improper payment risk 

assessments conform with IPIA and OMB guidance when determining 

whether programs may be susceptible to significant improper payments 

 15For improper payment risk assessment purposes, Education separates its programs into 

those managed by its Office of Federal Student Aid (FSA) and non-FSA-managed 

programs. In regard to the FSA-managed programs, Education’s AFRs for fiscal years 

2015 and 2016 properly reported that the agency considered the nine risk factors.
Page 12 GAO-18-36 Agencies Improper Payment Risk Assessments

and identify all programs that may be susceptible to significant improper 

payments.16 In response to the recommendation in the Office of Inspector 

General (OIG) audit report, Education stated that it will align its improper 

payment risk assessments with the nine risk factors beginning in fiscal 

year 2017.

A revised version of OMB Circular A-136 that was issued in August 2017 

no longer directs agencies to report improper payment risk assessment 

information in the agencies’ fiscal year 2017 AFRs and PARs. 

Specifically, agencies will no longer have to report in their AFRs or PARs 

for a given year (1) the basis for grouping programs and activities for 

improper payment risk assessments, (2) a listing of all programs and 

activities assessed during their risk assessments, and (3) the risk factors 

considered during their risk assessments. OMB staff stated that their 

primary motivation for eliminating the risk assessment reporting directives 

from OMB guidance was to reduce the administrative burden on 

agencies.17 Although OMB guidance will not direct agencies to report the 

three items noted above, agencies are still required to complete the risk 

assessments, as required by IPIA and directed in OMB guidance. Further, 

OMB staff stated that they rely on each agency’s OIG to review the 

quality of each agency’s risk assessment, which should include assessing 

the three items noted above; therefore, these reporting directives are not 

necessary.18

While we recognize the importance of reducing administrative burden, we 

also have previously reported on the importance of risk assessments for 

managing improper payments. We believe that the requirement for 

agencies to publicly report the improper payment risk assessment 

information has helped hold agencies accountable and provided 

additional transparency to the agencies’ improper payment processes, as 

well as assisted Congress and others in their oversight of governmentwide improper payments. However, if OMB is going to rely on each 

agency’s OIG to ensure quality risk assessments, it is important that 

 16Department of Education, Office of Inspector General, U.S. Department of Education’s 

Compliance with Improper Payment Reporting Requirements for Fiscal Year 2016, EDOIG/A04-Q0011 (Washington, D.C.: May 12, 2017).

17IPIA does not require agencies to report risk assessment information. OMB guidance 

directed agencies to report on their risk assessments. 

18Although IPIA does not require the reporting of risk assessments, IPIA does require 

agencies to conduct a risk assessment for all programs and activities at least once every 3 

years and to consider specific risk factors in their risk assessments.
Page 13 GAO-18-36 Agencies Improper Payment Risk Assessments

these reviews are performed consistently throughout the federal 

government. In our May 2017 report,19 we found that OIGs inconsistently 

reported agencies’ compliance with the IPERA criterion for conducting 

program-specific risk assessments. For example, certain OIGs reported 

agencies as noncompliant when agencies did not consider all nine risk 

factors, as outlined in IPIA, OMB guidance, or both, during programspecific risk assessments, whereas other OIGs reported agencies as 

compliant with this IPERA criterion, despite also finding issues with the 

agencies’ consideration of the nine risk factors. To help ensure that 

government-wide compliance under IPERA is consistently determined 

and reported, we recommended in May 2017 that the Director of OMB 

coordinate with the Council of the Inspectors General on Integrity and 

Efficiency (CIGIE) to develop and issue guidance, either jointly or 

independently, to specify what procedures should be conducted as part of 

the OIGs’ IPERA compliance determinations.20 OMB did not provide any 

comments on our recommendation, and as of August 2017, OMB had not 

yet issued such guidance. CIGIE stated that it would coordinate with OMB 

as needed and provide feedback on any draft OMB guidance.

Subsequent to the issuance in August 2017 of a revised version of OMB 

Circular A-136 and after we notified OMB of our views on the importance 

of certain data, OMB staff stated that they plan to direct agencies to 

report additional risk assessment data. Specifically, in September 2017, 

OMB staff told us that they plan to direct agencies to provide a listing of 

all programs and activities assessed during their risk assessments on 

www.paymentaccuracy.gov for fiscal year 2017 reporting, and that they 

plan to continue to direct agencies to report this listing for subsequent 

fiscal years.21 In addition, although the basis for grouping programs and 

activities for improper payment risk assessments and the risk factors 

considered during the risk assessments will not be required to be 

reported in fiscal year 2017 AFRs and PARs, OMB staff stated that they 

 19GAO-17-484. 

20CIGIE was statutorily established as an independent entity within the executive branch 

by the Inspector General Reform Act of 2008 to (1) address integrity, economy, and 

effectiveness issues that transcend individual government agencies and (2) increase the 

professionalism and effectiveness of personnel by developing policies, standards, and 

approaches to aid in establishing well-trained and highly skilled workforces in the OIGs. 

21An official website of the United States government managed by OMB, 

www.paymentaccuracy.gov contains information about current and historical rates and 

amounts of improper payments, why improper payments occur, and what agencies are 

doing to reduce and recover improper payments.
Page 14 GAO-18-36 Agencies Improper Payment Risk Assessments

plan to revise the guidance for fiscal year 2018 so that agencies report

such information in their AFRs and PARs.

We found that three of the nine selected CFO Act agencies that we 

reviewed, Energy, the Department of Justice, and USAID, had 

documented procedures for performing the required improper payment 

risk assessments and these procedures included the design of control 

activities necessary to help ensure that all programs and activities were 

assessed at least once every 3 years. However, the remaining six 

agencies did not properly design control activities for this purpose. 

Specifically, three of these six selected agencies did not have 

documented procedures for performing the required improper payment 

risk assessments. The remaining three agencies improperly excluded 

specific programs and activities from the improper payment risk 

assessment process. Appendix IV provides more detail on our analysis of 

these selected agencies’ procedures for performing improper payment 

risk assessments.

We did not evaluate whether all control activities related to conducting 

improper payment risk assessments were properly designed or evaluate 

other internal control components, such as the control environment. If we 

had done so, additional deficiencies may or may not have been identified 

that could impair the overall effectiveness of the control activities 

evaluated as part of this audit.

Three of the nine selected CFO Act agencies—Commerce, the National 

Science Foundation (NSF), and the Nuclear Regulatory Commission 

(NRC)—did not have documented procedures for conducting improper 

payment risk assessments for fiscal years 2014 through 2016. Although 

two of these three agencies (Commerce and NSF) had developed 

processes to help ensure that all programs and activities were assessed 

for susceptibility to significant improper payments at least once every 3 

years, these processes were not documented in written procedures.22 By 

 22NRC officials stated that NRC relies on its accounting firm’s expertise to properly 

complete these improper payment risk assessments. In addition, NRC officials stated that 

NRC improper payment information in its PAR served as the relevant documented 

procedures for performing the required risk assessment every 3 years. However, we 

believe that the PAR is a method for reporting financial and performance information and 

is not a procedural document that agencies follow.

Six Selected CFO Act 

Agencies Did Not 

Have Properly 

Designed Control 

Activities That 

Included All Programs 

and Activities in Their 

Improper Payment 

Risk Assessments

Three Selected CFO Act 

Agencies Did Not Have 

Documented Procedures 

for Conducting Their 

Improper Payment Risk 

Assessments but Have 

Now Documented Them
Page 15 GAO-18-36 Agencies Improper Payment Risk Assessments

the end of our review, the three agencies subsequently established 

documented procedures during fiscal year 2017. We reviewed the 

procedures for Commerce, NRC, and NSF and found that they included 

control activities designed to help ensure that all programs and activities 

are included in the agencies’ improper payment risk assessments at least

once every 3 years, as required by IPIA.23

Although the Departments of the Interior and State and the National 

Aeronautics and Space Administration (NASA) had documented 

procedures for conducting improper payment risk assessments,24 we 

found that these agencies did not have properly designed control 

activities to help ensure that all programs and activities were assessed for 

susceptibility to improper payments. These three agencies specifically 

excluded certain programs and activities from the improper payment risk 

assessment process, as follows.

• Department of the Interior (Interior). In our review of Interior’s 

design of control activities, we found that Interior did not include 

payments made by the department for certain programs. When asked 

why the programs associated with these payments were not 

assessed, Interior officials told us that the list that the department 

used to ensure that all programs and activities for which the 

department made payments were properly assessed excluded those 

payments from Interior’s program population. Subsequent to our 

inquiry, Interior officials told us that Interior will update its procedures

to ensure that they capture all programs in Interior’s assessments. In 

addition, Interior officials provided us a draft of Interior’s updated

procedures, and we found that these draft procedures included control 

activities designed to help ensure that all programs and activities are 

included in the department’s improper payment risk assessments at 

least once every 3 years, as required by IPIA.

 23Commerce and NRC subsequently documented their procedures after we brought this 

to their attention. NSF documented its procedures in response to a recommendation from 

the NSF OIG.

24Our review focused on the design of control activities to help ensure that all programs

and activities were assessed at least once every 3 years and did not include an evaluation 

of the quality of the improper payment risk assessments completed. We and the OIGs 

have previously reported on deficiencies in the quality of improper payment risk 

assessments completed at certain federal agencies. See GAO-17-484. 

Three Selected CFO Act 

Agencies Did Not Properly 

Design Control Activities to 

Help Ensure That All 

Programs and Activities 

Were Assessed
Page 16 GAO-18-36 Agencies Improper Payment Risk Assessments

• Department of State (State). In our review of State’s design of 

control activities, we found that State excluded certain programs and 

activities from the improper payment risk assessment based on 

threshold limitations on outlay data. Specifically, State only included

programs and activities in the improper payment risk assessments if 

the outlays were greater than (1) $100 million or (2) $85 million and a 

50 percent increase from the prior year.25 Programs and activities that 

fell below these thresholds were not assessed for susceptibility to 

significant improper payments. State officials told us that they 

believed the $100 million threshold limitation was reasonable because 

State predicted that it was improbable one of its programs would have

an improper payment estimate of at least 10 percent in order to meet 

the IPIA threshold of $10 million.26 According to State officials, State’s 

justification for its assessment threshold was based on many factors, 

including sampling of expenditures, past external audits, and internal 

OMB Circular A-123 reviews. However, IPIA requires that improper 

payment risk assessments be performed for each program and 

activity that the agency head administers. In commenting on our draft 

report, State officials informed us that State had updated its

documented procedures to lower the assessment threshold to the 

$10 million threshold identified in IPIA. State officials provided us a 

copy of the updated procedures, and we found that the procedures 

included control activities designed to help ensure that all programs 

and activities are included in the department’s improper payment risk 

assessments at least once every 3 years, as required by IPIA.

• NASA. In our review of NASA’s design of control activities, we found 

that NASA has documented procedures for conducting improper 

payment risk assessments; however, the procedures used for 

 25In its fiscal year 2015 report on State’s compliance with IPERA, State OIG 

recommended that the agency expand its improper payment risk assessment process to 

identify programs with significant funding changes to consider, at a minimum, the 

percentage increase of the change. See Department of State, Office of Inspector General, 

Audit of Department of State FY 2015 Compliance With Improper Payments 

Requirements, AUD-FM-16-38 (Arlington, Va.: May 2016). According to State officials, the 

recommendation is now closed because the fiscal year 2016 procedures keep the 

threshold for programs to undergo an improper payment risk assessment at $100 million 

in outlays, but expanded the category to also include programs with $85 million in outlays 

that have experienced a 50 percent increase in outlays from the prior year. 

26As mentioned earlier, IPIA defines “significant” improper payments as gross annual 

improper payments (i.e., the total amount of overpayments and underpayments) that may 

have exceeded (1) both 1.5 percent of program outlays and $10 million of all program or 

activity payments made during the fiscal year reported or (2) $100 million (regardless of 

the improper payment percentage of total program outlays).
Page 17 GAO-18-36 Agencies Improper Payment Risk Assessments

improper payment risk assessments conducted for fiscal years 2014 

through 2016 were outdated. Specifically, the documented 

procedures, dated 2012, did not account for changes to IPIA in 2013 

or updates to OMB’s guidance issued in fiscal year 2014.27 In June 

2017, NASA subsequently updated its procedures for improper 

payment risk assessments to properly address OMB’s current 

improper payments guidance. The updated procedures also included 

a description of key control activities designed to help ensure that all 

NASA programs and activities, other than OIG activities, have 

undergone an improper payment risk assessment.

According to NASA officials, NASA’s improper payment risk assessment 

process specifically excluded OIG activities because its OIG receives its 

own appropriation, and therefore, OIG activities are not considered part of 

NASA’s programs or activities for improper payment risk assessments. In 

addition, NASA officials stated that NASA OIG activities are excluded 

from the improper payment risk assessments because of concerns 

regarding NASA OIG’s independence as NASA OIG conducts the 

agency’s annual IPERA compliance audit. NASA could not provide us 

with any guidance or documentation that specifically addresses the 

exclusion of OIG activities.

The NASA OIG is part of NASA, and IPIA requires that improper payment 

risk assessments be performed for each program and activity that the 

agency head administers. To the extent that the potential threat to OIG 

independence prevents NASA from conducting a risk assessment of 

payments made by the OIG’s programs and activities, the NASA 

Administrator may transfer this responsibility to the OIG. By not making 

an assessment, NASA has not determined whether OIG programs and 

activities are susceptible to significant improper payments.

Standards for Internal Control in the Federal Government states that 

management should develop control activities to achieve objectives and 

respond to risks and implement control activities through policies.28 When 

an agency does not have properly designed policies and procedures to 

help ensure that all programs and activities are assessed for susceptibility 

to significant improper payments at least once every 3 years, there is an 

increased risk that the agency may not always identify all risk-susceptible 

 27IPERIA, Pub. L. No. 112-248, 126 Stat. 2390 (Jan. 10, 2013).

28GAO-14-704G. 
Page 18 GAO-18-36 Agencies Improper Payment Risk Assessments

programs and activities, resulting in incomplete improper payment 

estimates.

Performing improper payment risk assessments and reporting on such 

assessments are key to identifying programs and activities that may be 

susceptible to significant improper payments. Agencies’ nonadherence to 

the OMB guidance to report on the results of their risk assessments may 

result in Congress not having the information necessary to monitor and 

take prompt action to address problematic programs. Most of the nine

selected agencies did not properly design control activities to include all 

programs and activities in their improper payment risk assessments at 

least once every 3 years during fiscal year 2014 through fiscal year 2016, 

the time period of our review. Subsequent to fiscal year 2016, with the 

exception of NASA, which did not include its OIG’s activities, the federal 

agencies that were identified as lacking properly designed control 

activities drafted or updated their procedures to help ensure that all 

programs and activities were assessed for susceptibility to significant 

improper payments. Without proper control activities, NASA may not be 

identifying all programs and activities that should be included in its

improper payment risk assessments. If a program or activity is not 

assessed for risk, then an agency could be at risk of noncompliance with 

IPIA or nonadherence to OMB guidance as the risk assessment process 

is a crucial step in determining programs and activities that are 

susceptible to significant improper payments and thus subject to 

additional reporting and monitoring requirements.

We are making the following recommendation to NASA:

The Administrator of NASA should take steps to revise the agency’s 

procedures for conducting improper payment risk assessments to include 

the activities of its OIG in its risk assessment process to help ensure that 

all programs and activities are assessed for susceptibility to significant 

improper payments at least once every 3 years as required by IPIA. 

(Recommendation 1)

We provided a draft of this report to the 24 CFO Act agencies and OMB 

for comment. We received written comments from 4 agencies—NASA, 

State, SSA, and USAID, which are reproduced in appendixes V through 

VIII. We also received technical comments from Energy, OMB, State, and 

Conclusions

Recommendation for 

Executive Action

Agency Comments

and Our Evaluation
Page 19 GAO-18-36 Agencies Improper Payment Risk Assessments

USAID, which we incorporated in the report as appropriate. All of the 

other agencies notified us that they had no comments. 

The following discusses the written comments we received from the four 

agencies noted above.

• In its comments, NASA concurred with our recommendation and 

stated that the agency will revise its procedures for conducting 

improper payment risk assessments to include OIG programs and 

activities by September 2018. 

• In the draft report provided to State for comment, we had 

recommended that State reevaluate the agency’s use of dollar 

thresholds for excluding programs and activities from its risk 

assessment process and revise its procedures for conducting 

improper payment risk assessments to help ensure that all programs 

and activities are assessed for susceptibility to significant improper 

payments at least once every 3 years as required by IPIA. In its 

comments, State questioned the practicality of our proposed 

recommendation; however, State stated that it updated its procedures 

to lower the assessment threshold to the minimum dollar threshold of 

$10 million. We noted that this threshold aligns with the IPIA threshold 

of $10 million.

29 We reviewed State’s updated procedures and 

confirmed that State had revised its dollar threshold for conducting 

risk assessments, which effectively addressed our preliminary 

findings. Therefore, we have removed the recommendation from our 

report. 

• In its comments, SSA stated that it believed that its risk assessment 

reporting fully complied with OMB guidance. SSA stated that it 

considered the nine required risk factors but only reported on the risk 

factors that were applicable to the agency. However, given that SSA 

reported that it considered six risk factors and did not indicate in its 

AFRs that the other factors were not applicable to SSA, we continue 

to believe that SSA did not report, as directed by OMB guidance, on 

 29As mentioned earlier, IPIA defines “significant” improper payments as gross annual 

improper payments (i.e., the total amount of overpayments and underpayments) that may 

have exceeded (1) both 1.5 percent of program outlays and $10 million of all program or

activity payments made during the fiscal year reported or (2) $100 million (regardless of 

the improper payment percentage of total program outlays).
Page 20 GAO-18-36 Agencies Improper Payment Risk Assessments

all the risk factors considered in its improper payment risk 

assessments for fiscal years 2015 and 2016. 

• In its comments, USAID stated that our draft report was inaccurate in 

stating that USAID did not adhere to OMB reporting directives. USAID 

stated that an e-mail from OMB provided USAID relief from improper 

payment reporting. However, OMB’s e-mail did not explicitly provide 

USAID a waiver from the OMB risk assessment reporting directives.

Moreover, USAID reported in its AFRs for fiscal years 2014 through

2016 that it conducted annual risk assessments for the time period 

covered in this audit. As stated in appendix III, USAID did properly 

report the basis for grouping programs and activities for fiscal years 

2014 through 2016, and the agency also properly reported a listing of 

all programs and activities that were assessed for fiscal year 2016. 

Accordingly, we believe that USAID also should have followed all

OMB risk assessment reporting directives for the time period covered

for our audit, and we believe that our report accurately characterizes 

this issue. 

We are sending copies of this report to the appropriate congressional 

committees, the heads of the 24 CFO Act agencies, the Director of the 

Office of Management and Budget, and other interested parties. In 

addition, the report is available at no charge on the GAO website at 

http://www.gao.gov.

If you or your staff have any questions about this report, please contact 

me at (202) 512-2623 or davisbh@gao.gov. Contact points for our Offices 

of Congressional Relations and Public Affairs may be found on the last 

page of this report. GAO staff who made key contributions to this report 

are listed in appendix IX.

Beryl H. Davis

Director

Financial Management and Assurance
Page 21 GAO-18-36 Agencies Improper Payment Risk Assessments

List of Congressional Requestors

The Honorable Claire McCaskill

Ranking Member

Committee on Homeland Security and Governmental Affairs 

United States Senate

The Honorable Thomas R. Carper

Ranking Member

Permanent Subcommittee on Investigations

Committee on Homeland Security and Governmental Affairs

United States Senate

The Honorable Trey Gowdy

Chairman

Committee on Oversight and Government Reform

House of Representatives

The Honorable Mark Meadows

Chairman

Subcommittee on Government Operations

Committee on Oversight and Government Reform

House of Representatives

The Honorable Gary J. Palmer

Chairman

Subcommittee on Intergovernmental Affairs

Committee on Oversight and Government Reform

House of Representatives
Appendix I: Objectives, Scope, and 

Methodology

Page 22 GAO-18-36 Agencies Improper Payment Risk Assessments

This report examines the extent to which (1) the 24 agencies subject to 

the Chief Financial Officers Act of 1990 (CFO Act) followed Office of 

Management and Budget (OMB) guidance for reporting on improper 

payment risk assessments in their agency financial reports (AFR) or 

performance and accountability reports (PAR) for fiscal years 2014 

through 2016 and (2) selected CFO Act agencies have designed control 

activities to include all of their programs and activities in an improper 

payment risk assessment at least once during a 3-year period, as 

required by the Improper Payments Information Act of 2002 (IPIA), as 

amended by the Improper Payments Elimination and Recovery Act of 

2010 and the Improper Payments Elimination and Recovery Improvement 

Act of 2012. At the time of our review, the latest 3-year period was fiscal 

years 2014 through 2016.

To address our first objective, we reviewed improper payment risk 

assessment requirements in IPIA, as amended, and the related guidance 

in OMB Circular A-136, Financial Reporting Requirements, including the 

OMB directives for agencies’ risk assessment reporting, and OMB 

Circular A-123, Appendix C, Requirements for Effective Estimation and 

Remediation of Improper Payments (OMB M-15-02). We analyzed these 

statutes and guidance to identify key criteria that agencies must meet for 

reporting on improper payment risk assessments. IPIA, as amended, 

identifies seven risk factors and OMB guidance includes two additional 

risk factors that agencies are to consider in their improper payment risk 

assessment to determine susceptibility to significant improper payments. 

Additionally, for fiscal years 2014 through 2016, OMB M-15-02 directed 

agencies that conducted improper payment risk assessments to disclose 

in their AFRs or PARs the basis for grouping programs and activities for 

improper payment risk assessments. For fiscal years 2015 and 2016, 

OMB Circular A-136 directed agencies to report (1) a listing of programs 

and activities that were assessed for susceptibility to significant improper 

payments in a given year, regardless of whether a program or activity was 

deemed risk-susceptible, and (2) the risk factors considered during their 

improper payment risk assessments. We analyzed the AFRs or PARs of 

the 24 CFO Act agencies for fiscal years 2014 through 2016 to determine 

whether each agency met the key OMB reporting criteria described 

above. For our review, we focused on whether the agencies reported the 

risk assessment information in their AFRs or PARs and did not evaluate 

the quality of improper payment risk assessments completed.

For any agencies that did not meet the reporting directives outlined in 

OMB guidance for their improper payment risk assessments, we 

interviewed appropriate agency officials to determine why those agencies 

Appendix I: Objectives, Scope, and 

Methodology
Appendix I: Objectives, Scope, and 

Methodology

Page 23 GAO-18-36 Agencies Improper Payment Risk Assessments

did not meet these key criteria. For fiscal year 2017, a revised version of 

OMB Circular A-136 that was issued in August 2017 no longer directs 

agencies to report improper payment risk assessment information in the 

agencies’ fiscal year 2017 AFRs and PARs. Subsequent to the issuance 

in August 2017 of a revised version of OMB Circular A-136 and after we 

notified OMB of our views on the importance of certain data, OMB staff 

stated that they plan to direct agencies to report additional risk 

assessment data. Specifically, in September 2017, OMB staff told us that 

they plan to direct agencies to provide a listing of all programs and 

activities assessed during their risk assessments on 

www.paymentaccuracy.gov for fiscal year 2017 reporting, and that they 

plan to continue to direct agencies to report this listing for subsequent 

fiscal years. In addition, although the basis for grouping programs and 

activities for improper payment risk assessments and the risk factors 

considered during the risk assessments will not be required to be 

reported in fiscal year 2017 AFRs and PARs, OMB staff stated that they 

plan to revise the guidance for fiscal year 2018 so that agencies report

such information in their AFRs and PARs.

To address our second objective, we reviewed IPIA, as amended; the 

related OMB guidance; and relevant internal control standards to 

determine the relevant control activities needed to help ensure that 

agencies conduct improper payment risk assessments for all programs 

and activities at least once every 3 years.1 For this objective, we selected 

nine CFO Act agencies that did not report improper payment estimates 

for any programs or activities in fiscal year 2015 or 2016 except those 

estimates that were required to be reported pursuant to the Disaster 

Relief Appropriations Act, 2013.2 These nine agencies were the 

Departments of Commerce, Energy, the Interior, Justice, and State; the 

National Aeronautics and Space Administration; the National Science 

Foundation; the Nuclear Regulatory Commission; and the U.S. Agency 

for International Development. We reviewed these agencies’ procedures 

for conducting improper payment risk assessments and interviewed 

agency officials to determine whether the agencies designed and 

 1

GAO, Standards for Internal Control in the Federal Government, GAO/AIMD-00-21.3.1

(Washington, D.C.: November 1999). GAO/AIMD-00-21.3.1 was effective through the end 

of fiscal year 2015 (Sept. 30, 2015). The revised version of Standards for Internal Control 

in the Federal Government, GAO-14-704G (Washington, D.C.: September 2014) became 

effective the first day of fiscal year 2016 (Oct. 1, 2015). Both versions were applicable to 

our engagement.

2

Pub. L. No. 113-2, div. A, title IX, § 904(b), 127 Stat. 4, 17 (Jan. 29, 2013).
Appendix I: Objectives, Scope, and 

Methodology

Page 24 GAO-18-36 Agencies Improper Payment Risk Assessments

documented control activities to include all programs and activities in an 

improper payment risk assessment at least once every 3 years. To verify 

each agency’s assertions that all programs and activities are reviewed at 

least once every 3 years, we compared the line item for gross outlays 

contained in each agency’s Statement of Budgetary Resources for the 

relevant period to outlay data provided by each agency for each program 

and activity covered by improper payment risk assessments for fiscal 

years 2014 through 2016. When we identified differences between the 

two data sources, we interviewed agency officials to understand the 

cause for the differences and obtained any supporting documentation to 

ensure that all significant programs and activities were properly assessed.

While our second objective focused on certain significant control activities 

related to the selected agencies’ inclusion of programs and activities in 

their improper payment risk assessments at least once during fiscal years 

2014 through 2016, we did not evaluate all control activities and other 

components of internal control. If we had done so, additional deficiencies 

may or may not have been identified that could impair the effectiveness of 

the control activities evaluated as part of this audit.

We conducted this performance audit from June 2016 to November 2017 

in accordance with generally accepted government auditing standards. 

Those standards require that we plan and perform the audit to obtain 

sufficient, appropriate evidence to provide a reasonable basis for our 

findings and conclusions based on our audit objectives. We believe that 

the evidence obtained provides a reasonable basis for our findings and 

conclusions based on our audit objectives.
Appendix II: Standards for Internal Control in 

the Federal Government

Page 25 GAO-18-36 Agencies Improper Payment Risk Assessments

Standards for Internal Control in the Federal Government provides the 

overall framework for establishing and maintaining internal control.1

Internal control should be designed, implemented, and operating 

effectively to provide reasonable assurance that the operations, reporting, 

and compliance objectives of an entity will be achieved. The five 

components of internal control are as follows:

• Control environment - The foundation for an internal control system. It 

provides the discipline and structure to help an entity achieve its 

objectives.

• Risk assessment - Assesses the risks facing the entity as it seeks to 

achieve its objectives. This assessment provides the basis for 

developing appropriate risk responses.

• Control activities - The actions management establishes through 

policies and procedures to achieve objectives and respond to risks in 

the internal control system, which includes the entity’s information 

system.

• Information and communication - The quality information management 

and personnel communicate and use to support the internal control 

system.

• Monitoring - Activities management establishes and operates to 

assess the quality of performance over time and promptly resolve the 

findings of audits and other reviews.

An effective internal control system has each of the five components of 

internal control effectively designed, implemented, and operating and the 

five components operating together in an integrated manner. In this audit, 

we focused on certain significant control activities related to the selected 

agencies’ inclusion of programs and activities in their improper payment 

risk assessments at least once during fiscal years 2014 through 2016.

 1

GAO, Standards for Internal Control in the Federal Government, GAO-14-704G 

(Washington, D.C.: September 2014).

Appendix II: Standards for Internal Control in 

the Federal Government
Appendix III: Agency Adherence to Office of 

Management and Budget Reporting Directives 

for Risk Assessments

Page 26 GAO-18-36 Agencies Improper Payment Risk Assessments

As noted in our report, the Improper Payments Information Act of 2002, 

as amended by the Improper Payments Elimination and Recovery Act of 

2010 and the Improper Payments Elimination and Recovery Improvement 

Act of 2012, requires agencies to conduct improper payment risk 

assessments for all federal programs and activities in fiscal year 2011 

and at least once every 3 years thereafter. During fiscal years 2014 

through 2016, the 24 agencies subject to the Chief Financial Officers Act 

of 1990 (CFO Act), excluding the Department of Defense, reported in 

their agency financial reports (AFR) or performance and accountability 

reports (PAR) that they completed at least one risk assessment on at 

least one program or activity in one or more of those years. For each 

agency that reported completing an improper payment risk assessment in 

a given year, we evaluated whether the agency adhered to certain Office 

of Management and Budget (OMB) reporting directives. It is important to 

note that our audit scope did not include evaluating whether the agencies 

completed the required risk assessment for all programs and activities.

We evaluated the 24 CFO Act agencies’ fiscal years 2014 through 2016 

AFRs and PARs to determine if agencies adhered to OMB guidance for 

reporting on improper payment risk assessments. Table 2 summarizes 

agencies’ adherence to the OMB guidance to report a basis for grouping 

programs and activities in the AFRs or PARs for fiscal years 2014 through 

2016.

Table 2: Chief Financial Officers Act of 1990 (CFO Act) Agencies’ Adherence to 

Office of Management and Budget Guidance to Report a Basis for Grouping 

Programs and Activities

Reported a basis for grouping 

programs and activities 

CFO Act agencies Fiscal 

year 

2014

Fiscal 

year 

2015

Fiscal 

year 

2016

Department of Agriculture ✓ ✓ ✓

Department of Commercea ✗ ✓ ✓

Department of Defenseb NA NA NA

Department of Education ✓ ✓ ✓

Department of Energyc ✗ ✓ NA

Department of Health and Human Services ✓ ✓ ✓

Department of Homeland Security ✓ ✓ ✓

Department of Housing and Urban Development ✓ ✓ ✓

Department of the Interiord NA NA ✓

Appendix III: Agency Adherence to Office of 

Management and Budget Reporting 

Directives for Risk Assessments
Appendix III: Agency Adherence to Office of 

Management and Budget Reporting Directives 

for Risk Assessments

Page 27 GAO-18-36 Agencies Improper Payment Risk Assessments

Reported a basis for grouping 

programs and activities 

CFO Act agencies Fiscal 

year 

2014

Fiscal 

year 

2015

Fiscal 

year 

2016

Department of Justice ✓ ✓ ✓

Department of Labor ✓ NA ✓

Department of State ✓ ✓ ✓

Department of Transportation ✓ ✓ NA

Department of the Treasury ✓ ✓ ✓

Department of Veterans Affairs ✓ ✓ ✓

Environmental Protection Agency ✓ ✓ ✓

General Services Administration ✓ ✓ NA

National Aeronautics and Space Administration ✓ ✓ ✓

National Science Foundation ✓ NA ✓

Nuclear Regulatory Commission ✓ NA NA

Office of Personnel Management NA ✓ ✓

Small Business Administration ✓ NA NA

Social Security Administration ✓ ✓ ✓

U.S. Agency for International Development ✓ ✓ ✓

Total number of agencies that adhered to OMB 

guidance

19 18 18

Total number of agencies that did not adhere to 

OMB guidance 

2 0 0

Total number of agencies whose adherence to 

OMB guidance was not applicable because 

agencies did not report completing a risk 

assessment

3 6 6

Total number of agencies 24 24 24

Legend:

✓: Agency adhered to Office of Management and Budget (OMB) reporting directive in the applicable 

agency financial report (AFR) or performance and accountability report (PAR) for the applicable fiscal 

year.

✗: Agency did not adhere to OMB reporting directive for the completed risk assessments in the AFR 

or PAR for the applicable fiscal year.

NA: Not applicable. The agency did not report that it completed an improper payment risk 

assessment during the applicable fiscal year, and therefore, the OMB reporting directive was not 

applicable.

Source: GAO analysis of agencies’ fiscal year 2014 through 2016 AFRs or PARs reporting on improper payment risk assessments. |

GAO-18-36

a

The Department of Commerce (Commerce) did not explicitly report its basis for grouping programs 

and activities. However, in fiscal years 2015 and 2016 reporting, Commerce included a listing of all 

the programs and activities that were assessed for susceptibility to significant improper payments, 

and we concluded, and Commerce agreed, that the programs and activities were grouped by major 

program within each bureau.
Appendix III: Agency Adherence to Office of 

Management and Budget Reporting Directives 

for Risk Assessments

Page 28 GAO-18-36 Agencies Improper Payment Risk Assessments

b

Each of the Department of Defense’s (DOD) programs that make payments have reported improper 

payment estimates; as a result, DOD officials told us that DOD did not have to perform risk 

assessments during the review period (fiscal years 2014 through 2016) to assess the susceptibility to

improper payments in accordance with OMB guidance.

c

According to Department of Energy (Energy) officials, based on OMB approval received in 2011, 

Energy was considered to have one program with multiple payment types for improper payment risk 

assessment purposes. As such, Energy did not report the basis of its groupings in the AFR prior to 

fiscal year 2015. However, based on an OMB request received during the fiscal year 2015 AFR 

review process, Energy included the basis of its groupings in the fiscal year 2015 AFR.

d

The Department of the Interior (Interior) completed a risk assessment in fiscal year 2012 and 

deemed that its programs and activities were not susceptible to significant improper payments. 

Therefore, Interior was required, by the Improper Payments Information Act of 2002, as amended, to 

complete an improper payment risk assessment at least once during fiscal years 2013 through 2015. 

However, Interior did not perform the required risk assessment until fiscal year 2016, which was 1 

year past the required due date.

Table 3 summarizes agencies’ adherence to the OMB directive to list all 

of the programs and activities that were assessed for susceptibility to 

significant improper payments and describe the risk factors considered 

during their assessments for fiscal years 2015 and 2016. There was no

directive to report this information for fiscal year 2014.

Table 3: Chief Financial Officers Act of 1990 (CFO Act) Agencies’ Adherence to 

Office of Management and Budget Guidance to Report a Listing of All Programs 

and Activities Assessed for Risk and Report Consideration of Risk Factors

Reported a listing of 

all programs and 

activities that were 

assessed 

Reported 

consideration of all 

nine risk factors

CFO Act agencies Fiscal 

year

2015

Fiscal 

year 

2016

Fiscal 

year

2015

Fiscal 

year 

2016

Department of Agriculture ✓ ✓ ✗ ✗

Department of Commerce ✓ ✓ ✓ ✓

Department of Defensea NA NA NA NA

Department of Education ✓ ✓ ✓ ✗

Department of Energy ✓ NA ✓ NA

Department of Health and Human 

Services

✓ ✓ ✓ ✓

Department of Homeland Security ✓ ✓ ✓ ✓

Department of Housing and Urban 

Development

✓ ✓ ✓ ✓

Department of the Interiorb NA ✓ NA ✓

Department of Justice ✓ ✓ ✓ ✓

Department of Labor NA ✓ NA ✗

Department of State ✓ ✓ ✓ ✓
Appendix III: Agency Adherence to Office of 

Management and Budget Reporting Directives 

for Risk Assessments

Page 29 GAO-18-36 Agencies Improper Payment Risk Assessments

Reported a listing of 

all programs and 

activities that were 

assessed 

Reported 

consideration of all 

nine risk factors

CFO Act agencies Fiscal 

year

2015

Fiscal 

year 

2016

Fiscal 

year

2015

Fiscal 

year 

2016

Department of Transportation ✓ NA ✓ NA

Department of the Treasury ✓ ✓ ✓ ✓

Department of Veterans Affairs ✓ ✓ ✓ ✓

Environmental Protection Agency ✓ ✓ ✓ ✓

General Services Administration ✓ NA ✓ NA

National Aeronautics and Space 

Administration

✓ ✓ ✓ ✓

National Science Foundation NA ✓ NA ✓

Nuclear Regulatory Commissiona NA NA NA NA

Office of Personnel Management ✓ ✓ ✗ ✓

Small Business Administrationa NA NA NA NA

Social Security Administration ✓ ✓ ✗ ✗

U.S. Agency for International 

Development

✗ ✓ ✗ ✗

Total number of agencies that adhered 

to OMB guidance

17 18 14 13

Total number of agencies that did not 

adhere to OMB guidance 

1 0 4 5

Total number of agencies that 

adherence to OMB guidance was not 

applicable because agencies did not 

report completing a risk assessment

6 6 6 6

Total number of agencies 24 24 24 24

Legend:

✓: Agency adhered to the Office of Management and Budget (OMB) guidance in its agency financial 

report (AFR) or performance and accountability report (PAR) for the applicable fiscal year.

✗: Agency did not adhere to the OMB guidance in its AFR or PAR for the applicable fiscal year.

NA: Not applicable. The agency did not report that it completed an improper payment risk 

assessment during the applicable fiscal year, and therefore, the OMB reporting directive was not 

applicable.

Source: GAO analysis of agencies’ fiscal years 2015 and 2016 AFRs or PARs reporting on improper payment risk assessments. |

GAO-18-36

Note: The directive to list programs and activities assessed for susceptibility to significant improper 

payments and describe the risk factors used in the assessments in AFRs or PARs was effective for 

fiscal years 2015 and 2016. Therefore, agencies were not directed to list all programs and activities 

that were assessed for improper payment risk for fiscal year 2014, and as a result, this table does not 

include any information regarding that year.

a

Three agencies were not required to complete an improper payment risk assessment in either fiscal 

year 2015 or 2016. Specifically, the Nuclear Regulatory Commission and the Small Business 

Administration completed the required improper payment risk assessments in fiscal year 2014 and, 
Appendix III: Agency Adherence to Office of 

Management and Budget Reporting Directives

for Risk Assessments

Page 30 GAO-18-36 Agencies Improper Payment Risk Assessments

as a result, were not required to complete an improper payment risk assessment in either fiscal year 

2015 or 2016. Each of the Department of Defense’s (DOD) programs that make payments have 

reported improper payment estimates; as a result, DOD officials told us that DOD did not have to 

perform risk assessments during the review period (fiscal years 2014 through 2016) to assess the 

susceptibility to improper payments in accordance with OMB guidance.

b

The Department of the Interior (Interior) completed a risk assessment in fiscal year 2012 and 

deemed that its programs and activities were not susceptible to significant improper payments. 

Therefore, Interior was required, by the Improper Payments Information Act of 2002, as amended, to 

complete an improper payment risk assessment at least once during fiscal years 2013 through 2015. 

However, Interior did not perform the required risk assessment until fiscal year 2016, which was 1 

year past the required due date.
Appendix IV: Summary of Agencies’ 

Procedures for Performing Improper Payment 

Risk Assessments

Page 31 GAO-18-36 Agencies Improper Payment Risk Assessments

Table 4 summarizes our analysis of the selected agencies’ procedures for 

performing improper payment risk assessments to help ensure that all 

programs and activities were properly reviewed once every 3 years.

Table 4: Summary of Selected Agencies’ Fiscal Years 2014 through 2016 

Procedures for Performing Improper Payment Risk Assessments

Agency Agency had 

documented procedures 

for conducting improper 

payment risk 

assessments 

Agency’s procedures 

contained specific control 

activities to help ensure 

that all programs and 

activities were properly 

reviewed once every 

3 years

Department of Commerce 

(Commerce)a ✗ N/A

Department of Energy ✓ ✓

Department of Justice ✓ ✓

Department of the Interior 

(Interior)b ✓ ✗

Department of State (State)b ✓ ✗

National Aeronautics and 

Space Administration 

✓ ✗

National Science Foundation 

(NSF)a ✗ N/A

Nuclear Regulatory 

Commission (NRC)a ✗ N/A

U.S. Agency for International 

Development

✓ ✓

Total agencies that had 

documented procedures

6

Total agencies that lacked 

documented procedures 

3

Total agencies that had 

procedures but lacked 

specific control activities 

3

Legend:

✓: Agency had documented procedures.

✗: Agency did not have documented procedures or agency’s documented procedures lacked specific 

control activities.

N/A: Not applicable as the agency did not have documented procedures to evaluate.

Source: GAO analysis of agency procedures for improper payment risk assessments during fiscal years 2014 through 2016. |

GAO-18-36

a

Although the agencies’ procedures for fiscal year 2017 were not within the scope of our review, we 

found that Commerce, NRC, and NSF documented procedures during fiscal year 2017 that included 

control activities to help ensure that all programs and activities are assessed at least once every 3 

years. 

Appendix IV: Summary of Agencies’

Procedures for Performing Improper 

Payment Risk Assessments
Appendix IV: Summary of Agencies’ 

Procedures for Performing Improper Payment 

Risk Assessments

Page 32 GAO-18-36 Agencies Improper Payment Risk Assessments

b

Subsequent to fiscal year 2016, we found that Interior drafted updated procedures and State 

updated its procedures for future improper payment risk assessments, and that in both cases these 

procedures included control activities designed to help ensure that all programs and activities are 

assessed at least once every 3 years.
Appendix V: Comments from the National 

Aeronautics and Space Administration

Page 33 GAO-18-36 Agencies Improper Payment Risk Assessments

Appendix V: Comments from the National 

Aeronautics and Space Administration
Appendix V: Comments from the National 

Aeronautics and Space Administration

Page 34 GAO-18-36 Agencies Improper Payment Risk Assessments
Appendix VI: Comments from the Social 

Security Administration

Page 35 GAO-18-36 Agencies Improper Payment Risk Assessments

Appendix VI: Comments from the Social 

Security Administration
Appendix VII: Comments from the Department 

of State

Page 36 GAO-18-36 Agencies Improper Payment Risk Assessments

Appendix VII: Comments from the 

Department of State
Appendix VII: Comments from the Department 

of State

Page 37 GAO-18-36 Agencies Improper Payment Risk Assessments
Appendix VII: Comments from the Department 

of State

Page 38 GAO-18-36 Agencies Improper Payment Risk Assessments
Appendix VIII: Comments from the U.S. 

Agency for International Development

Page 39 GAO-18-36 Agencies Improper Payment Risk Assessments

Appendix VIII: Comments from the U.S. 

Agency for International Development
Appendix VIII: Comments from the U.S. 

Agency for International Development

Page 40 GAO-18-36 Agencies Improper Payment Risk Assessments
Appendix IX: GAO Contact and Staff 

Acknowledgments

Page 41 GAO-18-36 Agencies Improper Payment Risk Assessments

Beryl H. Davis, (202) 512-2623 or davisbh@gao.gov

In addition to the contact named above, Matt Valenta (Assistant Director), 

Michelle Philpott (Assistant Director), Laura Bednar (Auditor-in-Charge), 

Stephanie Adams, Youssef Amrani, Francine DelVecchio, and Kailey 

Schoenholtz made key contributions to this report.

Appendix IX: GAO Contact and Staff 

Acknowledgments

GAO Contact

Staff 

Acknowledgments

(100978)
The Government Accountability Office, the audit, evaluation, and investigative 

arm of Congress, exists to support Congress in meeting its constitutional 

responsibilities and to help improve the performance and accountability of the 

federal government for the American people. GAO examines the use of public 

funds; evaluates federal programs and policies; and provides analyses, 

recommendations, and other assistance to help Congress make informed 

oversight, policy, and funding decisions. GAO’s commitment to good government 

is reflected in its core values of accountability, integrity, and reliability.

The fastest and easiest way to obtain copies of GAO documents at no cost is 

through GAO’s website (http://www.gao.gov). Each weekday afternoon, GAO 

posts on its website newly released reports, testimony, and correspondence. To 

have GAO e-mail you a list of newly posted products, go to http://www.gao.gov

and select “E-mail Updates.”

The price of each GAO publication reflects GAO’s actual cost of production and 

distribution and depends on the number of pages in the publication and whether 

the publication is printed in color or black and white. Pricing and ordering 

information is posted on GAO’s website, http://www.gao.gov/ordering.htm. 

Place orders by calling (202) 512-6000, toll free (866) 801-7077, or 

TDD (202) 512-2537.

Orders may be paid for using American Express, Discover Card, MasterCard, 

Visa, check, or money order. Call for additional information.

Connect with GAO on Facebook, Flickr, LinkedIn, Twitter, and YouTube.

Subscribe to our RSS Feeds or E-mail Updates. Listen to our Podcasts.

Visit GAO on the web at www.gao.gov and read The Watchblog.

Contact:

Website: http://www.gao.gov/fraudnet/fraudnet.htm

E-mail: fraudnet@gao.gov

Automated answering system: (800) 424-5454 or (202) 512-7470

Orice Williams Brown, Managing Director, WilliamsO@gao.gov, (202) 512-4400, 

U.S. Government Accountability Office, 441 G Street NW, Room 7125, 

Washington, DC 20548

Chuck Young, Managing Director, youngc1@gao.gov, (202) 512-4800

U.S. Government Accountability Office, 441 G Street NW, Room 7149 

Washington, DC 20548

James-Christian Blockwood, Managing Director, spel@gao.gov, (202) 512-4707

U.S. Government Accountability Office, 441 G Street NW, Room 7814, 

Washington, DC 20548

GAO’s Mission

Obtaining Copies of 

GAO Reports and 

Testimony

Order by Phone

Connect with GAO

To Report Fraud, 

Waste, and Abuse in 

Federal Programs

Congressional 

Relations

Public Affairs

Strategic Planning and 

External Liaison

Please Print on Recycled Paper.