EFFORTS TO PREVENT, IDENTIFY, AND 

RECOVER IMPROPER AND ERRONEOUS 

PAYMENTS BY SELECTED DEPARTMENT 

OF JUSTICE COMPONENTS

U.S. Department of Justice 

Office of the Inspector General 

Audit Division 

Audit Report 07-17 

January 2007
EFFORTS TO PREVENT, IDENTIFY, AND RECOVER 

IMPROPER AND ERRONEOUS PAYMENTS BY SELECTED 

DEPARTMENT OF JUSTICE COMPONENTS 

EXECUTIVE SUMMARY 

An initiative of the President’s Management Agenda, implemented in 

August 2001, is the identification and reduction of improper payments within 

the federal government. Improper payments are payments that should not 

have been made or payments that were made for an incorrect amount 

because of errors, poor business practices, or intentional fraud or abuse. 

Improper payments include: (1) payments to an ineligible recipient, 

(2) payments for an ineligible service, (3) duplicate payments, (4) payments 

for services not rendered, and (5) payments that do not account for credit 

for applicable discounts. Additionally, when an agency is unable to discern 

whether a payment was proper due to insufficient or lack of documentation, 

this payment must also be considered an error.1 

According to a February 2006 Office of Management and Budget 

(OMB) report, Improving the Accuracy and Integrity of Federal Payments, 

the government-wide improper payment total reported for fiscal year 

(FY) 2005 was $37.3 billion. The report also found that the amount reported 

for FY 2005 was approximately $7.8 billion less than the $45.1 billion 

reported in FY 2004.2 However, improper payments remain a significant 

problem in the federal government. 

In recent years, legislation has been enacted to address this problem 

followed by implementation of guidance from OMB. This legislation requires 

government agencies to conduct program inventories and assess each 

program’s risk of making improper payments. Additionally, government 

agencies are to report on progress made in identifying and recovering 

improper payments. 

 1

 The scope of this audit did not include improper payments identified when an 

agency was unable to discern whether the payment was proper due to insufficient or lack of 

documentation. This type of improper payment was first defined in Office of Management 

and Budget Circular A-123, Appendix C, Requirements for Effective Measurement and 

Remediation of Improper Payments, August 2006. 

2

 Office of Management and Budget, Improving the Accuracy and Integrity of 

Federal Payments, February 2006. 
Background 

Two federal laws address the prevention, identification, and recovery 

of improper payments. Pub. L. No. 107-300 (2002), the Improper Payments 

Information Act of 2002 (IPIA), requires the heads of federal agencies to 

annually: (1) review all programs and activities to identify those susceptible 

to significant improper payments, (2) estimate the amount of improper 

payments, and (3) report the estimate to Congress. Additionally, for 

improper payments estimated in excess of $10 million, the agency must 

report the actions it is taking to reduce improper payments, including a 

discussion of the potential causes, a statement on whether the agency's 

information system and infrastructure are adequate to reduce improper 

payments, and a description of the steps taken to ensure agency managers 

are held accountable for reducing improper payments. 

 Pub. L. No. 107-107 (2001), the National Defense Authorization Act for 

FY 2002 (NDAA), Subchapter VI - Recovery Audits, requires all agencies that 

enter into contracts totaling more than $500 million in a fiscal year to carry 

out a cost-effective program to identify errors in payments and recover 

amounts erroneously paid. 

Between January and May 2003, OMB issued three memoranda that 

provided additional guidance related to the IPIA and the NDAA. In 

August 2006, these three memoranda were consolidated into OMB 

Circular A-123, Appendix C, Requirements for Effective Measurement and 

Remediation of Improper Payments, which became effective immediately for 

the FY 2006 Performance and Accountability Report (PAR).3

OMB Circular A-123, Appendix C details the IPIA information that 

should be included within an agency’s PAR and requires that “when an 

agency’s review is unable to discern whether a payment was proper as a 

result of insufficient or lack of documentation, this payment must also be 

considered an error.” 

For recovery auditing, OMB Circular A-123, Appendix C permits 

contingency fee contracts, which allow a portion of recovered funds to be 

used to pay recovery audit contractors. OMB Circular A-123, Appendix C 

also provides guidance on the disposition of recovered amounts and directs 

affected agencies to submit annual reports detailing recovery audit activities. 

Additionally, the guidance states that "agency Inspectors General and other 

 3

 The PAR is an annual report that provides information on an agency’s actual 

performance and progress in achieving the goals in its strategic plan and performance 

budget. 

- ii - 
external agency auditors are encouraged to assess the effectiveness of 

agencies' recovery audit programs." 

OMB issued Circular A-136 - Revised July 2006, Financial Reporting 

Requirements, which superseded Memorandum M-04-20, FY 2004 

Performance and Accountability Reports and Reporting Requirements for the 

Financial Report of the United States Government, July 2004. Memorandum 

M-04-20 directed agencies to include a description of recovery audit 

activities in the PAR for FY 2004 forward. OMB Circular A-136 - Revised July 

2006, requires additional information to be included in an agency’s annual 

IPIA report, such as information from grant-making agencies, an improper 

payment reduction outlook table, a list of contracts excluded from the 

recovery audit program, and a table detailing the overall recovery audit 

effort. 

 In March 2006, the Department of Justice’s (DOJ) Justice Management 

Division (JMD) issued the Financial Management Policies and Procedures 

Bulletin 06-11 (Bulletin 06-11), which provides direction on recovery audit 

programs and the IPIA for DOJ components. 

Prior Audit 

In April 2005, the Office of the Inspector General (OIG) issued an 

audit report on the Department of Justice Process for Identifying, 

Preventing, and Recovering Improper and Erroneous Payments, Audit Report 

Number 05-19. The audit included four DOJ components: (1) the Federal 

Bureau of Prisons (BOP), (2) Office of Justice Programs (OJP), (3) Federal 

Bureau of Investigation (FBI), and (4) United States Marshals Service 

(USMS). The audit found that: 

• The USMS and OJP risk assessments were not adequate to completely 

measure the risk of improper payments for all programs the 

components administered. 

• The BOP, OJP, and USMS IPIA reports did not contain a complete 

description of the risk assessment performed. 

• Weaknesses were identified in certain FBI and USMS policies and 

procedures used to prevent improper payments. 

• None of the risk assessments included an analysis or consideration of 

any material weaknesses, reportable conditions, or non-compliance 

matters resulting from the components’ annual financial statement 

audits. 

- iii - 
• The FBI, OJP, and USMS did not have processes in place to determine 

the full extent of improper payments. 

• The BOP and OJP initiated recovery audit programs but had not 

implemented written policies and procedures. Additionally, the FBI 

and USMS had not initiated any type of formalized recovery audit 

program. 

• JMD did not have an official reporting mechanism in place to monitor 

each component’s recovery audit activities. Additionally, JMD’s 

recovery audit guidance was not adequate to ensure consistency 

among the components related to progress in implementing and 

maintaining a recovery audit program. 

The OIG provided recommendations to these conditions. At the time 

of this audit, all 22 recommendations had been agreed upon, 13 have been 

fully implemented, and 9 are in the process of being implemented. 

Audit Approach 

 This audit was requested by JMD to review the remaining DOJ 

components. Based on the magnitude of the government-wide improper 

payments identified in the February 2006 OMB report and the findings 

identified in the April 2005 OIG audit, we conducted a follow-up audit, which 

included the: (1) Offices, Boards and Divisions (OBDs); 4 (2) Federal Prison 

Industries (FPI); (3) Drug Enforcement Administration (DEA); and 

(4) Bureau of Alcohol, Tobacco, Firearms and Explosives (ATF). 

The purpose of the audit was to assess these components’ processes 

for preventing, identifying, and recovering improper and erroneous 

payments. Specifically, the objectives of the audit were to determine 

whether the components established: 

• policies and procedures for preventing improper and erroneous 

payments, 

 4

 In order to assess the OBDs, we selected a sample of six subcomponents of the 

OBDs to review and conclude upon compliance with the IPIA and the NDAA. The 

subcomponents selected were the: (1) Regime Crimes Liaison Office (RCLO), (2) Office on 

Violence Against Women (OVW), (3) Civil Division (CIV), (4) Office of Community Oriented 

Policing Services (COPS), (5) Executive Office for Immigration Review (EOIR), and 

(6) Wireless Management Office (WMO). The methodology for the selection of the OBD 

subcomponents is detailed in Appendix I. 

- iv - 
• policies and procedures for identifying improper and erroneous 

payments, and 

• methods to recover improper and erroneous payments. 

We reviewed the FY 2005 IPIA reports submitted by the components 

to JMD. The information in these reports was analyzed in conjunction with 

Bulletin 06-11, dated March 2006. We used this approach in order to 

identify any necessary enhancements for full compliance in the FY 2006 IPIA 

reporting period. 

Summary of Findings and Recommendations 

Preventing Improper and Erroneous Payments 

We reviewed the policies and procedures to prevent improper 

payments that were used by management at the OBDs, FPI, DEA, and ATF, 

and the risk assessment prepared by each of those components. 

In evaluating the components’ efforts, we determined that the risk 

assessments conducted by the OBDs, FPI, and ATF did not include an 

analysis of the results from the most recent financial statement audit as 

required by Bulletin 06-11. We also found that the OBDs’ risk assessment 

did not include a review of federal award payments made by the recipients 

and subrecipients as required by Bulletin 06-11. In addition, we found that 

ATF did not conduct a risk assessment or program inventory for FY 2005 as 

required by Bulletin 06-11. 

We recommend that JMD evaluate the recent changes to OMB 

Circular A-123, Appendix C and determine whether changes need to be 

made to Bulletin 06-11. We also recommend that Bulletin 06-11 be updated 

to include component disclosure of: (1) an unqualified, qualified, or 

no-assurance opinion related to the adequacy and effectiveness of internal 

controls and the effectiveness of the internal controls over financial 

reporting, following the requirements of OMB Circular A-123 revision, 

Management’s Responsibility for Internal Control; (2) the reason for the 

opinion and its effect on the component's risk of making improper 

payments; and (3) any corrective actions being taken to address the opinion 

and the component's risk. 

- v - 
Identifying and Recovering Improper and Erroneous Payments 

JMD oversees DOJ components’ compliance with the IPIA and the 

NDAA. In addressing this function, JMD has issued guidance that is detailed 

in Bulletin 06-11 on complying with the IPIA and on conducting recovery 

audits. After comparing Bulletin 06-11 to applicable laws and regulations, 

we recommend that JMD improve Bulletin 06-11 by including time limits for 

confirming or providing documentation refuting any improper payments 

identified by the recovery audit contractor. 

In assessing the components’ efforts in identifying and recovering 

improper payments, we reviewed laws and regulations applicable to recovery 

audit activities, including Bulletin 06-11. We reviewed each component’s 

FY 2005 IPIA report, which included a description of its recovery audit 

program, and reviewed the recovery audit program in place at each 

component. In addition, we interviewed component officials and reviewed 

policies and procedures used by the OBDs, FPI, DEA, and ATF to identify and 

recover improper payments. 

Table 1 illustrates the amounts identified and recovered by DOJ 

components included in this audit. 

Table 1: IMPROPER PAYMENTS IDENTIFIED AND RECOVERED BY 

SELECTED DOJ COMPONENTS 

COMPONENT

IMPROPER 

PAYMENTS 

IDENTIFIED

IMPROPER 

PAYMENTS 

RECOVERED

IMPROPER 

PAYMENTS 

OUTSTANDING

PERCENTAGE 

RECOVERED

OBDs5 $1,198,443 $916,711 $281,732 76% 

OBDs6 215,212 203,896 11,316 95% 

FPI 43,182 12,355 30,827 29% 

DEA 403,305 386,833 16,472 96% 

ATF 42,465 8,830 33,636 21% 

TOTAL $1,902,607 $1,528,625 $373,983 

Source: Management at the following DOJ components: the RCLO, COPS, OVW, WMO, 

CIV, EOIR, FPI, DEA, ATF, and the recovery audit contractor. The differences in the totals 

are due to rounding. 

 5

 These totals are the amounts the recovery audit contractor identified and 

recovered for all of the OBD’s components. 

6

 These totals are the additional amounts identified and recovered by the six OBD 

subcomponents that were included in the scope of this audit. The subcomponents included 

the: RCLO, COPS, OVW, WMO, CIV, and EOIR. 

- vi - 
Offices, Boards and Divisions. JMD manages the recovery audit 

program for the OBDs. Beginning in May 2003, the OBDs utilized a private 

contractor to conduct recovery audits. Payments made from FYs 1999 

through 2004 were reviewed by the private contractor, as of April 2006. 

While this effort was ongoing, the recovery audit contractor identified 

improper payments totaling $1,198,443 for all of the OBDs. At the time of 

our audit, the recovery audit contractor stated that $916,711 (76 percent) 

had been recovered and $281,732 remained to be recovered. Additionally, 

the six OBD subcomponents included in our audit identified an additional 

$215,212 in improper payments, of which the subcomponents stated 

$203,896 (95 percent) was recovered, and $11,316 remained to be 

recovered. 

However, we determined that the OBDs could be underreporting the 

improper payment amounts identified and recovered to JMD, due to breaks 

in communication. These breaks occur when the OBD subcomponents do 

not utilize the Notification of Erroneous Payments form (Attachment 2 of 

Financial Management Policies and Procedures Bulletin 05-037) when 

reporting improper payments to JMD. Additionally, the OBDs’ recovery audit 

program did not consider a review of all categories of payments as required 

by Bulletin 06-11. Specifically, a review of all grant payments was not 

included in the OBDs’ recovery audit program. 

Federal Prison Industries. Beginning in July 2004, the FPI began using 

a private contractor to conduct recovery audits. Payments made in FY 2003 

were reviewed and vendor letters requesting reimbursement for 

overpayments were sent for FYs 2003 through 2005. As of April 2006, a 

total of $43,182 in improper payments had been identified and confirmed 

from those fiscal years, and the FPI stated that $12,355 (29 percent) of this 

amount had been recovered. The FPI stated that it is in the process of 

recovering the remaining $30,827 from a single vendor and has requested 

that the funds be returned. 

We determined that the FPI does not include a contract compliance 

review as required by Bulletin 06-11. Specifically, according to FPI 

management, the contract compliance review had not started because the 

recovery audit contractor is not at the level to conduct this review. The 

recovery audit contractor operates in phases, and has not implemented the 

review yet. Further, we found that the FPI had not implemented a final 

written policy for its recovery audit program as required by Bulletin 06-11. 

 7

 Financial Management Policies and Procedures Bulletin 05-03, November 2004, 

details the OBDs’ procedures for preventing, identifying, and recovering improper payments, 

including controls built into the OBDs’ financial management system. 

- vii - 
Drug Enforcement Administration. Although the DEA's initial recovery 

audit program began in FY 2004 and continued through FY 2005, it was not 

a comprehensive recovery audit program. Instead, a statistical sample of 

payments pulled from a population of all DEA payment categories, except 

payroll, were selected and tested to determine if any improper payments 

were made. Additionally, improper payments were identified by Contracting 

Officer Technical Representatives, Financial Management Division, as well as 

through other internal controls. In FY 2006, the DEA established a new 

recovery audit program, administered by the Financial Analysis and 

Reporting Unit (FNOF). The FNOF reviews all payments applicable to the 

IPIA, instead of sampling payments. This effort constitutes a comprehensive 

recovery audit program. As of May 2006, a total of $403,305 in improper 

payments were identified and confirmed from FYs 2003 through 2005. The 

DEA stated that it has recovered $386,833 (96 percent) of this amount and 

is in the process of recovering the remaining $16,472. 

 Bureau of Alcohol, Tobacco, Firearms and Explosives. Although ATF 

began its internal recovery audit activities in 2001, as of May 2006, ATF 

stated that it had recovered only $8,830 (21 percent) of the $42,465 in 

improper payments it had identified, leaving $33,636 still to be recovered. 

ATF officials stated that they planned to pursue the remaining amount, as 

well as pursue collection of all identified improper payments. 

We determined that ATF did not consider a review of all categories of 

payments required by Bulletin 06-11. Specifically, ATF should expand the 

scope of its review to include all payments made from FY 2003 forward. 

Further, ATF could be underreporting the improper payment amounts 

identified and recovered to JMD because it is not tracking improper 

payments separately from other debts and it is not maintaining information 

on the scope of the improper payments identified and recovered. 

We also noted that ATF needs to improve its policy implementation 

and compliance with existing requirements. We found that ATF should 

demonstrate progress toward utilizing the recovery audit contractor or in 

developing an internal recovery audit program compliant with all areas of 

Bulletin 06-11 and other applicable laws and regulations. In addition, we 

found that ATF did not have a final written policy for its recovery audit 

program, which should be developed and implemented when a program is in 

place as required by Bulletin 06-11. 

- viii - 
EFFORTS TO PREVENT, IDENTIFY, AND RECOVER 

IMPROPER AND ERRONEOUS PAYMENTS BY SELECTED 

DEPARTMENT OF JUSTICE COMPONENTS 

TABLE OF CONTENTS 

INTRODUCTION .................................................................................. 1 

Background ....................................................................................... 1 

FINDINGS AND RECOMMENDATIONS ..................................................... 9 

I. PREVENTING IMPROPER AND ERRONEOUS PAYMENTS ................. 9 

Offices, Boards and Divisions......................................................12 

Federal Prison Industries............................................................14 

Drug Enforcement Administration................................................16 

Bureau of Alcohol, Tobacco, Firearms and Explosives ....................18 

Recommendations.....................................................................20 

II. IDENTIFYING AND RECOVERING IMPROPER AND ERRONEOUS 

PAYMENTS ........................................................................... 23 

Offices, Boards and Divisions......................................................25 

Federal Prison Industries............................................................29 

Drug Enforcement Administration................................................31 

Bureau of Alcohol, Tobacco, Firearms and Explosives ....................34 

Recommendations.....................................................................36 

STATEMENT ON COMPLIANCE WITH LAWS AND REGULATIONS ............... 38 

STATEMENT ON INTERNAL CONTROLS ................................................. 40 

APPENDIX I - OBJECTIVES, SCOPE, AND METHODOLOGY ....................... 41 

APPENDIX II - THE PRESIDENT’S MANAGEMENT AGENDA ....................... 43 

APPENDIX III - DEPARTMENT OF JUSTICE OFFICES, BOARDS AND 

DIVISIONS....................................................................................... 44 

APPENDIX IV - UNITED STATES ATTORNEY DISTRICTS .......................... 45 

APPENDIX V - ANNUAL IMPROPER PAYMENT INFORMATION ACT REPORT.. 47 
APPENDIX VI - ACRONYMS ................................................................. 50 

APPENDIX VII - JMD RESPONSE TO THE DRAFT REPORT......................... 51 

APPENDIX VIII - FPI RESPONSE TO THE DRAFT REPORT ......................... 54 

APPENDIX IX - DEA RESPONSE TO THE DRAFT REPORT .......................... 56 

APPENDIX X - ATF RESPONSE TO THE DRAFT REPORT............................ 58 

APPENDIX XI - ANALYSIS AND SUMMARY OF ACTIONS NECESSARY TO 

CLOSE THE REPORT .......................................................................... 61 
INTRODUCTION 

According to the Office of Management and Budget (OMB) report, 

Improving the Accuracy and Integrity of Federal Payments, February 2006, 

the government-wide improper payment total reported for fiscal year 

(FY) 2005 was $37.3 billion. The report also found that the amount reported 

for FY 2005 was approximately $7.8 billion less than the $45.1 billion 

reported in FY 2004. Despite this improvement, improper payments remain 

a significant problem in the federal government. 

Improper payments are payments that should not have been made or 

payments that were made for an incorrect amount because of errors, poor 

business practices, or intentional fraud or abuse. Improper payments 

include: (1) payments to an ineligible recipient, (2) payments for an 

ineligible service, (3) duplicate payments, (4) payments for services not 

rendered, and (5) payments that do not account for credit for applicable 

discounts. 

The President’s Management Agenda, August 2001, is a strategy for 

improving the management and performance of the federal government, and 

includes five government-wide initiatives, one of which is “Improved 

Financial Performance.”1 Included in this initiative are requirements for the 

identification and reduction of improper payments within the federal 

government. In recent years, legislation has been enacted to address this 

problem followed by implementation of guidance from OMB. This legislation 

requires that government agencies conduct program inventories and assess 

each program’s risk for making improper payments. In addition, 

government agencies are to report on progress made in identifying and 

recovering improper payments. 

Background 

Two federal laws address the prevention, identification, and recovery 

of improper payments. Pub. L. No. 107-300 (2002), the Improper Payments 

Information Act of 2002 (IPIA), requires the heads of federal agencies to 

annually: (1) review all programs and activities to identify those susceptible 

to significant improper payments, (2) estimate the amount of improper 

payments, and (3) report the estimate to Congress. In addition, for 

improper payments estimated in excess of $10 million, the agency must 

report the actions it is taking to reduce improper payments and include a 

discussion of the potential causes, a statement on whether the agency's 

 1

 The five initiatives of the President’s Management Agenda are further detailed in 

Appendix II of this report. 

- 1 - 
information system and infrastructure are adequate to reduce improper 

payments, and a description of the steps taken to ensure agency managers 

are held accountable for reducing improper payments. 

Pub. L. No. 107-107 (2001), the National Defense Authorization Act for 

FY 2002 (NDAA), Subchapter VI - Recovery Audits, requires all agencies that 

enter into contracts totaling more than $500 million in a fiscal year to carry 

out a cost-effective program to identify errors in payments and recover 

amounts erroneously paid. These actions are known as "recovery audits." 

Between January and May 2003, OMB issued three memoranda that 

provided additional guidance related to the IPIA and the NDAA.2 In 

August 2006, these three memoranda were consolidated into OMB 

Circular A-123, Appendix C, Requirements for Effective Measurement and 

Remediation of Improper Payments, which became effective immediately for 

the FY 2006 Performance and Accountability Report (PAR).3

OMB Circular A-123, Appendix C requires that “when an agency’s 

review is unable to discern whether a payment was proper as a result of 

insufficient or lack of documentation, this payment must also be considered 

an error.” 4 OMB Circular A-123, Appendix C details the IPIA information 

that should be included within an agency’s PAR, which changed so that 

agencies with improper payment estimates less than $10 million are no 

longer required to complete the entire IPIA section of the PAR. Instead, 

these agencies are required to report only the improper payment estimate 

totals. 

For recovery auditing, OMB Circular A-123, Appendix C permits 

contingency fee contracts, which allow a portion of recovered funds to be 

used to pay recovery audit contractors. OMB Circular A-123, Appendix C 

also provides guidance on the disposition of recovered amounts and directs 

 2

 These three Memoranda included: (1) Memorandum M-03-07, Programs to 

Identify and Recover Erroneous Payments to Contactors, January 2003; (2) Memorandum 

M-03-12, Allowability of Contingency Fee Contracts for Recovery Audits, May 2003; and 

(3) Memorandum M-03-13, Implementation Guidance for the Improper Payments 

Information Act of 2002, P.L. 107-300, May 2003.

3

 The PAR is an annual report that provides information on an agency’s actual 

performance and progress in achieving the goals in its strategic plan and performance 

budget. 

4

 The scope of this audit did not include improper payments identified when an 

agency was unable to discern whether the payment was proper due to insufficient or lack of 

documentation. This type of improper payment was first defined in Office of Management 

and Budget Circular A-123, Appendix C, Requirements for Effective Measurement and 

Remediation of Improper Payments, August 2006. 

- 2 - 
affected agencies to submit annual reports detailing recovery audit activities. 

Additionally, the guidance states that "agency Inspectors General and other 

external agency auditors are encouraged to assess the effectiveness of 

agencies' recovery audit programs." 

OMB issued Circular A-136 - Revised July 2006, Financial Reporting 

Requirements, which superseded Memorandum M-04-20, FY 2004 

Performance and Accountability Reports and Reporting Requirements for the 

Financial Report of the United States Government, July 2004. Memorandum 

M-04-20 directed agencies to include the following recovery audit 

information, beginning in the FY 2004 PAR: (1) a discussion of each 

agency’s recovery audit effort, (2) the amount of recoveries expected, 

(3) the actions taken to recover them, and (4) the business processes 

changed and internal controls instituted or strengthened to prevent future 

occurrences. OMB Circular A-136 requires agencies to include the following 

additional information in the annual IPIA report: 

• Accomplishments in the area of funds management past the primary 

recipient, including the status on projects and results of any reviews, 

which are applicable to grant-making agencies with risk-susceptible 

grant programs. 

• The reduction outlook table, which should include: (1) all 

risk-susceptible programs, whether or not improper payments were 

identified; (2) dates when measurements are expected to be provided; 

(3) the baseline measurement year; (4) separate dollar amount 

estimates if the estimates correspond to both newly and previously 

established measurements; (5) estimates for the future 3 years; and 

(6) a report on current year activity and previous year activity, if 

applicable. 

• The contract types that were excluded from the recovery audit review 

and an explanation for their exclusion. 

• A table detailing the recovery audit effort, including the amount 

subject to review, the actual amount reviewed and reported on, the 

amount identified for recovery, the percentage of amount identified 

over the actual amount reviewed, the amount recovered, and the 

amount recovered in previous years. 

OMB Circular A-123 revision, Management’s Responsibility for Internal 

Control, dated December 2004, effective FY 2006, requires agencies to 

annually submit an overall statement of assurance as to the adequacy and 

effectiveness of internal controls within the agency, and a statement of 

- 3 - 
assurance over the effectiveness of the internal controls over financial 

reporting. Agencies are to document the internal controls over financial 

reporting in hard copy or electronic forms and include documentation of 

tests of internal controls, internal control deficiencies, and suggestions for 

improvement. 

Department of Justice Guidance 

In March 2006, the Department of Justice’s (DOJ) Justice Management 

Division (JMD) issued guidance on recovery audit programs and the IPIA in 

Financial Management Policies and Procedures Bulletin 06-11 

(Bulletin 06-11). This department-wide bulletin supports guidance set forth 

in the IPIA, the NDAA, and OMB circulars and memoranda. Bulletin 06-11 

requires each component to "review all programs and activities 

administered, and identify those susceptible to significant improper 

payments. This includes payments from federal awards made by recipients 

and subrecipients subject to the Single Audit Act Amendments of 1996." 

Further, Bulletin 06-11 requires that "each component must ensure that its 

risk assessment, required under the IPIA, contain, at a minimum: (1) the 

results from the most recent financial statement audit, including any 

material weaknesses or reportable conditions; (2) the effect of those 

weaknesses or conditions on its risk of making improper payments; and 

(3) a description of the corrective actions taken to address those 

weaknesses or conditions.” 

Bulletin 06-11 also requires that “the risk assessment should also 

include a review of systems, procedures, policies, and practices, including 

oversight, that help prevent or correct improper payments. It also can 

include, but is not limited to, independent audit reports, internal control 

reviews, Inspector General reviews, results of recovery audit activities, other 

internal reviews, and the results of the internal audit program or any other 

mechanism implemented to analyze susceptible risk." 

JMD combines all of the components’ annual IPIA reports and 

summarizes them in DOJ’s annual PAR. The annual IPIA report is required 

to include: 

• a description of the risk assessment performed and a list of 

risk-susceptible programs; 

• the statistical sampling process conducted to estimate the improper 

payment rate for each program identified, if applicable; 

- 4 - 
• the corrective action plan for reducing improper payments, and the 

corrective action plan for grant-making agencies with risk-susceptible 

grant programs, including a discussion of accomplishments in the area 

of funds stewardship past the primary recipient; 

• estimates of improper payments in future years; 

• a description of the recovery audit program, including a table detailing 

the recovery audit effort, the amount subject to review, the actual 

amount reviewed and reported on, the amounts identified for 

recovery, the percentage of amounts identified over the actual amount 

reviewed, the amount recovered, and the amount recovered in 

previous years; 

• the steps planned and taken to ensure management is held 

accountable for reducing improper payments; 

• a description of whether the information system and infrastructure are 

adequate to reduce improper payments; and if not, a description of 

the resources requested to improve its information systems and 

infrastructure; 

• any statutory or regulatory barriers that may limit the corrective 

actions in reducing improper payments; and 

• additional comments on overall efforts, specific programs, best 

practices, or common challenges identified. 5

Bulletin 06-11 further requires each component to carry out a 

cost-effective recovery audit program to prevent, identify, and recover 

improper payments. Each recovery audit program must include a 

comprehensive review of prior payments to determine whether they were 

improper. Further, the recovery audit program must: 

• look for several types of improper payments, including: (1) duplicate 

payments, (2) payments made that were not in accordance with an 

applicable contract, (3) payments made for incorrect amounts, 

(4) payments for which allowable discounts were not taken, and 

(5) payments made for goods not received or services not rendered; 

• encompass, at a minimum, all payments made from FY 2003 forward; 

and 

 5

 The Annual Improper Payments Information Act Report is detailed in Appendix V. 

- 5 - 
• include the component’s grant programs, if applicable. 

Recovery audits may be performed by component employees, by other 

departments or agencies of the federal government acting on behalf of the 

component, or by contractors performing recovery audit services under 

contracts awarded by the agency. Each component is required to develop 

and implement written policies and procedures for its recovery audit 

program, in accordance with the framework set forth in Bulletin 06-11. 

In May 2003, the Director, JMD Finance Staff, implemented a 

department-wide recovery audit contract, which all components are required 

to use unless a waiver is granted. Requests for waivers must be forwarded 

to the Director and include a complete description of the proposed alternate 

recovery audit program and its cost. 

Bulletin 06-11 further requires each component to complete a 

quarterly report on recovery audit activities. The report is due within 

5 working days following the end of each quarter and should include the type 

and total amount of improper payments identified, the total amount 

recovered, and the total amount outstanding. Components are to report 

separate totals for amounts attributable to internal agency activities and also 

those attributable to recovery audit contractors. Additionally, the report 

should include the identified causes for improper payments, as well as the 

corrective actions taken, business processes changed, and internal controls 

instituted and strengthened to prevent future occurrences. Finally, 

descriptions of the recovery audit program and planned recovery audit 

activities for the following quarter are to be included within the quarterly 

report. 

Prior Audit 

In April 2005, the Office of the Inspector General (OIG) issued an 

audit report on the Department of Justice Process for Identifying, 

Preventing, and Recovering Improper and Erroneous Payments, Audit Report 

Number 05-19. The scope of this audit included four DOJ components: 

(1) the Federal Bureau of Prisons (BOP), (2) Office of Justice Programs 

(OJP), (3) Federal Bureau of Investigation (FBI), and (4) United States 

Marshals Service (USMS). At each of the components, the auditors reviewed 

the reports submitted in accordance with the IPIA and assessed each 

component’s efforts for preventing, identifying, and quantifying improper 

payments. Additionally, the auditors reviewed the recovery audit efforts at 

each of the selected components. The audit revealed that: 

- 6 - 
• The USMS and OJP risk assessments were not adequate to completely 

measure the risk of improper payments for all programs the 

components administered. 

• The BOP, OJP, and USMS IPIA reports did not contain a complete 

description of the risk assessment performed. 

• Weaknesses were identified in certain FBI and USMS policies and 

procedures used to prevent improper payments. 

• None of the risk assessments included an analysis or consideration of 

any material weaknesses, reportable conditions, or non-compliance 

matters resulting from the components’ annual financial statement 

audits. 

• The FBI, OJP, and USMS did not have processes in place to determine 

the full extent of improper payments. 

• The BOP and OJP initiated recovery audit programs but had not 

implemented written policies and procedures. Additionally, the FBI 

and USMS had not initiated any type of formalized recovery audit 

program. 

 

• JMD did not have an official reporting mechanism in place to monitor 

each component’s recovery audit activities. Additionally, JMD’s 

recovery audit guidance was not adequate to ensure consistency 

among the components related to progress in implementing and 

maintaining a recovery audit program. 

The OIG provided the recommendations to these conditions. At the 

time of this audit, all 22 recommendations had been agreed upon, 13 have 

been fully implemented, and 9 are in the process of being implemented. 

Audit Approach 

 This audit was requested by JMD. Based on the magnitude of the 

government-wide improper payments identified in the February 2006 OMB 

report and the findings identified in the April 2005 OIG audit report, we 

conducted a follow-up audit, which included the: (1) Offices, Boards and 

- 7 - 
Divisions (OBDs);6 (2) Federal Prison Industries (FPI); (3) Drug Enforcement 

Administration (DEA); and (4) Bureau of Alcohol, Tobacco, Firearms and 

Explosives (ATF). The purpose of the audit was to assess the selected 

component’s processes for preventing, identifying, and recovering improper 

and erroneous payments. Specifically, the objectives of the audit were to 

determine whether the components established: 

• policies and procedures for preventing improper and erroneous 

payments, 

• policies and procedures for identifying improper and erroneous 

payments, and 

• methods to recover improper and erroneous payments. 

During this audit, we reviewed current laws, regulations, guidance, 

and policies to obtain an understanding of the requirements with which 

federal agencies must comply. We also conducted interviews with 

component management; reviewed policies and procedures related to 

preventing, identifying, and recovering improper payments; and analyzed 

reports submitted to JMD to determine whether the components complied 

with applicable laws and regulations. Specifically, we reviewed the FY 2005 

IPIA reports submitted by the components to JMD. The information in these 

reports was analyzed in conjunction with Bulletin 06-11, dated March 2006. 

We used this approach in order to identify any necessary enhancements for 

full compliance in the FY 2006 IPIA reporting period. 

 6

 In order to assess the OBDs, we selected a sample of six sub-components of the 

OBDs to review and conclude upon compliance with the IPIA and the NDAA. The 

sub-components selected included the: (1) Regime Crimes Liaison Office (RCLO), (2) Office 

on Violence Against Women (OVW), (3) Civil Division (CIV), (4) Office of Community 

Oriented Policing Services (COPS), (5) Executive Office for Immigration Review (EOIR), and 

(6) Wireless Management Office (WMO). The methodology for the selection of the OBD 

subcomponents is detailed in Appendix I. 

- 8 - 
FINDINGS AND RECOMMENDATIONS 

I. PREVENTING IMPROPER AND ERRONEOUS PAYMENTS 

Our audit determined that the risk assessments conducted by the 

OBDs, FPI, and ATF did not include an analysis of the results from the 

most recent financial statement audit. We further determined that the 

OBDs’ risk assessment did not include a review of federal award 

payments made by the recipients and subrecipients, and ATF did not 

conduct a risk assessment or program inventory for FY 2005. In 

addition, we recommended that JMD evaluate the recent changes to 

OMB Circular A-123, Appendix C and determine whether changes need 

to be made to Bulletin 06-11. We also recommended Bulletin 06-11 

be updated to include component disclosure of: (1) an unqualified, 

qualified, or no-assurance opinion related to the adequacy and 

effectiveness of internal controls and the effectiveness of the internal 

controls over financial reporting, following the requirements of OMB 

Circular A-123 revision; (2) the reason for the opinion and its effect on 

the component's risk of making improper payments; and (3) any 

corrective actions being taken to address the opinion and the 

component's risk. 

Many improper payments are caused by a lack of or an inadequate 

system of internal control. According to information obtained from the Chief 

Financial Officers Council and the President’s Council on Integrity and 

Efficiency, the causes for improper payments can be broken down into the 

following three broad categories: 

• A weak or incomplete program control environment: this includes the 

systems, procedures, and practices, including rigorous oversight, that 

can help prevent or correct improper payments. 

• Risks inherent in the regulatory and policy structure: these define and 

support each federal program, and may stem directly from policy 

choices and mandates. 

• A lack of government-wide consistency, coordination, and 

standardization: this includes a lack of alignment of program eligibility 

policies, sharing of data, consistency in measuring improper payments, 

and dissemination of best practices. 

The IPIA requires a risk assessment of all programs to identify those 

susceptible to significant improper payments. Guidance provided by OMB in 

accordance with the IPIA requires each agency to conduct a full program 

- 9 - 
inventory and perform a risk assessment of each program in the program 

inventory. 

In March 2006, JMD issued Bulletin 06-11, which required each 

component to include the following within its risk assessment: (1) the 

results from the most recent financial statement audit, including any 

material weaknesses or reportable conditions; (2) the effect of any 

weaknesses or conditions as it pertains to the risk of making improper 

payments; and (3) a description of the corrective actions taken to address 

any weaknesses or conditions. 

We reviewed the FY 2005 risk assessments conducted by the OBDs, 

FPI, DEA, and ATF, and found that: 

• The assessments conducted by the OBDs, FPI, and ATF did not include 

an analysis or consideration of the overall financial statement audit. 

Additionally, the OBDs, FPI, and ATF did not include an analysis or 

consideration of the material weaknesses or reportable conditions 

resulting from the component’s annual financial statement audit. 

Specifically, the OBDs and ATF had material weaknesses or reportable 

conditions in the components’ FY 2005 financial statement audits but 

did not address them in their risk assessments. The FPI did not have 

any issues noted within its FY 2005 financial statement audit. 

• The assessment conducted by the DEA did include an analysis of its 

overall financial statement audit. The DEA did not have any issues 

noted within its FY 2005 financial statement audit. 

In our judgment, certain internal control deficiencies could increase 

the risk of making improper payments. Thus, a thorough risk assessment 

should include a review of the financial statement audit opinion, any 

reportable conditions or material weaknesses noted by the independent 

auditors, and an analysis of whether those weaknesses or conditions could 

potentially affect the component’s risk of making improper payments as 

required by Bulletin 06-11. In our judgment, unqualified audit opinions 

should also be included because they can further support a component’s risk 

assessment concluding that the component is not at significant risk of 

making improper payments. When we discussed this issue with 

management at the OBDs, FPI, and ATF, they generally concurred with our 

assessment. 

OMB Circular A-123 revision requires annual assurance statements, a 

summary of material weaknesses and non-conformances, and a summary of 

the corrective action plans to be included within the PAR. The two required 

- 10 - 
assurances include a statement on the overall adequacy and effectiveness of 

internal controls within the agency and the effectiveness of the internal 

controls over financial reporting. Documentation supporting the assurances 

should be maintained, including the assessment process, testing of controls, 

deficiencies identified, and suggestions for improvement. 

During the period covered by our audit, the requirements of OMB 

Circular A-123 revision related to annual assurance statements in the PAR 

were not yet enacted. Further, none of the components included in our 

audit individually fall under the requirements of OMB Circular A-123 revision 

because it relates to DOJ as a whole. However, in order for DOJ to provide 

the assurances in its PAR, according to JMD management, individual 

components were required to provide assurances to them as of June 2006. 

In our judgment, a thorough risk assessment for the IPIA should 

include the OMB Circular A-123 revision assurance opinion, the reason for 

the opinion, and an analysis of whether the reasons for the opinion could 

potentially affect the component’s risk of making improper payments. As a 

result, we are recommending that each component include this information 

in its risk assessments. Management at the OBDs, FPI, DEA, and ATF, as 

well as JMD, generally concurred with our recommendation. 

 In addition to our findings related to the annual financial statement 

audit and OMB Circular A-123 revision assurance results, we noted the 

conditions described below during our review of policies and procedures used 

by management at the OBDs, FPI, DEA, and ATF to prevent improper 

payments, and in the risk assessment prepared by each component. 

It should be noted that OMB Circular A-123, Appendix C states that 

each agency with improper payment estimates less than $10 million are only 

required to report the total improper payment estimate in its annual PAR to 

OMB. Agencies are no longer required to include: (1) information on the 

risk assessment conducted, (2) a description of management accountability 

for reducing improper payments, and (3) a description on whether the 

information system and infrastructure are adequate to reduce improper 

payments.7 Those requirements apply to each DOJ program, rather than to 

the individual components. Moreover, because the improper payment 

estimate for each DOJ program is less than $10 million, in our judgment, 

DOJ is not required to include this information in its PAR for FY 2006. 

Nonetheless, Bulletin 06-11 still required the individual components to 

include the information in their IPIA reports. We recommend JMD evaluate 

 7

 OMB Circular A-136 - Revised July 2006, requires additional IPIA and recovery 

audit information to be included in the annual PAR. 

- 11 - 
the recent changes to OMB Circular A-123, Appendix C and determine 

whether changes need to be made to Bulletin 06-11. 

As a result, throughout this report, we disclosed our findings related to 

Bulletin 06-11 requirements. However, we did not offer any 

recommendations related to the descriptions on: (1) the risk assessment 

conducted for the OBDs and ATF; (2) management accountability for 

reducing improper payments for the FPI, DEA, and ATF; and (3) whether the 

information system and infrastructure are adequate to reduce improper 

payments for the DEA. 

Offices, Boards and Divisions 

Preventive Measures 

JMD manages the recovery audit program for the OBDs. JMD also 

established a written policy for the OBDs describing the identification, 

prevention, and recovery of improper payments in Financial Management 

Policies and Procedures Bulletin 05-03 (Bulletin 05-03), November 2004. 

Bulletin 05-03 explains procedures for preventing improper payments 

including controls built into the OBDs’ financial management system. The 

built-in controls alert the user when a potential duplicate invoice is entered 

into the system. 

Additionally, according to JMD management, the OBDs have the 

internal control structure necessary to prevent improper payments.8 This 

structure includes written policies and procedures, separation of duties, and 

certification by a supervisor of no conflicting duties before a user is granted 

access to enter obligation data into the financial management system. 

Finally, the OBDs’ financial management system will not permit 

payments that exceed the allowance amount to be recorded. However, the 

financial management system does provide "tolerance limits" that allow 

expenditures to be processed that exceed the obligated amount. The 

“tolerance limits” are generally set at the lower of $100 or 10 percent of the 

obligation. 

Risk Assessment 

For FY 2005, JMD submitted the IPIA report for the OBDs in 

accordance with regulations. We reviewed the OBDs’ full program inventory 

 8

 See the Statement on Internal Controls, at the back of this report, for details of 

our review of the OBDs’ controls, policies, and procedures. 

- 12 - 
and risk assessment. The risk assessment included four programs that were 

considered at risk of making improper payments.9 However, it did not 

include how those programs were determined to be at risk. 

According to JMD management, the risk assessments included a 

review of the: (1) mock audit risk assessments, which identify the OBD 

programs at high risk;10 (2) high-risk areas, including foreign payments; 

(3) the level of dollars involved; and (4) the recovery audit contractor’s 

analysis to determine whether any program reached the criteria for 

significant risk. Therefore, according to JMD, the risk assessment for the 

OBDs was more comprehensive than what was described in the IPIA report. 

However, a description of this four-step risk assessment was not included in 

the IPIA. Bulletin 06-11 states, "the Annual IPIA Report is to include a 

description of the component's risk assessment subsequent to compiling a 

full program inventory,” and the component is to “. . . maintain 

documentation of the risk assessment and the results." Therefore, according 

to JMD’s own criteria, the risk assessment methodology JMD described to the 

OIG during this audit should have been included in the IPIA report. 

Bulletin 06-11 states that, "components are required to review all 

programs and activities administered, and identify those susceptible to 

significant improper payments. This includes payments from federal awards 

made by recipients and subrecipients subject to the Single Audit Act 

Amendments of 1996." JMD management stated that they were unsure 

whether all grant programs were included in JMD’s risk assessment of the 

OBDs. Based on our review of the FY 2005 IPIA report submitted by JMD for 

the OBDs, we found that JMD did not include a review of all payments from 

COPS and OVW federal awards in the risk assessment.

We discussed this issue with JMD management and they concurred 

with our finding that the risk assessment for the OBDs conducted for the 

FY 2005 IPIA report is missing an assessment of payments from federal 

awards made by recipients and subrecipients. JMD management agreed to 

conduct an assessment of all payments from federal awards made by 

recipients and subrecipients in the OBDs’ future risk assessments. 

 9

 The OBDs’ risk assessment for FY 2005 included the: (1) Office on Violence 

Against Women, (2) Radiation Exposure Compensation, (3) Regime Crimes Liaison Office, 

and (4) salaries and other outlays. 

10 Mock audits, administered by the JMD Quality Control and Compliance Group, are 

audit simulations that aim to reduce audit findings, minimize organizational weaknesses, 

and strengthen financial management and practices of the OBDs, Working Capital Fund, and 

the United States Attorneys’ district offices. Each mock audit analyzes and tests a 

component’s financial processes and assigns a risk ranking to the component based upon 

the results. 

- 13 - 
Management Accountability 

JMD and the OBDs provided various documents demonstrating that 

management is held accountable for reducing improper payments. 

Management at JMD and the OBDs provided Performance Work Plans, which 

included a discussion on accountability for taxpayer dollars, specifically 

effective management of financial resources and unqualified financial audits. 

Additionally, the results from the mock audit can identify improper 

payments. If an improper payment was identified, it would be reflected on 

the component’s scorecard, which is reflected in management performance 

reviews and evaluations. 

Information System and Infrastructure 

We found that the OBDs have the infrastructure and information 

system necessary to reduce improper payments within the financial 

management system. We verified that the financial management system 

prompts the user if a potential improper payment is entered into the system. 

Additionally, the OBDs can produce the financial management system 

duplicate payment report, which identifies potential duplicates. These 

processes are also described in Bulletin 05-03. 

Federal Prison Industries 

Preventive Measures 

According to FPI management, the FPI has the internal control 

structure in place to prevent improper payments.11 This structure includes 

existing written policies and procedures, segregating duties, centralizing 

payments, pre-auditing disbursement vouchers, utilizing the original invoice, 

tying the receipt to the line item received, and matching the purchase order 

to the original invoice. In addition, controls are built into the FPI’s financial 

management system, which alerts the user when a potential duplicate 

invoice is entered into the system. The FPI has a Program Review Division, 

which conducts internal audits on a rotating basis at FPI institutions, every 

3 years. These audits include transaction testing. 

 11 See the Statement on Internal Controls, at the back of this report, for details of 

our review of the FPI’s controls, policies, and procedures. 

- 14 - 
Risk Assessment 

In October 2005, the FPI submitted a report to JMD in accordance with 

the IPIA, which included a complete program inventory and a description of 

the FPI’s complete risk assessment. In the report, the FPI was defined as a 

single program, the purpose of which is to employ inmates. 

Management Accountability 

Bulletin 06-11 requires the annual IPIA reports to include a description 

of how managers are held accountable for reducing improper payments. 

The FPI’s FY 2005 IPIA report states that the "FPI's risk assessment has 

determined that internal controls governing the payment cycle are not a 

high-risk area. Therefore, no action is being taken in this regard at this 

time. If the recovery audit results should justify such action, then the FPI 

will amend it at that time." However, according to the FPI, managers are 

given responsibility and held accountable for reducing improper payments. 

The FPI Program Statement on Accounts Payable, Accountable Officer 

Liability states, "An accountable officer may be held personally liable and 

subject to disciplinary actions for the loss or improper payment of funds for 

which they are accountable." The FPI also provided a draft policy on the 

IPIA, which states that the FPI will comply with the IPIA and ". . . provide 

other information on management accountability." Finally, the FPI Program 

Statement on Employee Code of Conduct states, "Employees will conform to 

procurement integrity regulations." We noted that management 

accountability described in the FPI’s IPIA report was not reflective of its 

actual policies related to management accountability for reducing improper 

payments at the FPI. 

Information System and Infrastructure 

We found that the FPI has a fully integrated accounting system which 

provides the infrastructure and information system necessary to reduce 

improper payments. We verified that the accounting system prompts the 

user if a potential improper payment is entered into the system. Then, the 

user will determine whether the payment is in fact improper. 

- 15 - 
Drug Enforcement Administration 

Preventive Measures 

 According to DEA management, the DEA has an internal control 

structure in place to prevent improper payments.12 This structure includes: 

• Using standardized stamps to verify receipt of goods or services; to 

approve, certify, and reject duplicates; and to date the arrival of an 

invoice in the designated office. 

• Paying duplicate invoices only if the approving officer verifies that the 

original invoice was not paid and stamping the invoice, “Duplicate 

Original Approved as Proper for Payment.” 

• Perforating paid invoices to prevent duplicate payments. 

• Approving and certifying officers perform a three-way match among 

the obligating document, receiving document, and the invoice prior to 

payment. This is to assure that the goods or services were procured 

by an authorized individual; the goods or services were received; and 

the payment was legal, proper, and correct. 

• Holding approving officers administratively liable for an incorrect, 

improper, or illegal payment. 

• Certifying officers are financially liable for an incorrect, improper, or 

illegal payment. 

• Reviewing the payment process annually through the Office of 

Inspections’ self-inspection program. 

• Segregating key functions to ensure effective checks and balances to 

reduce the risk of improper, wasteful, or wrongful acts. 

We verified that internal controls have been built into the DEA’s 

financial management system. These controls include access security 

controls and a financial management system that will prompt "Possible 

Duplicate Payment" if a user enters an invoice with the same invoice 

number, date, and amount as a previously accepted invoice. DEA 

management explained that the "Possible Duplicate Payment" prompt will 

 12 See the Statement on Internal Controls, at the back of this report, for details of 

our review of the DEA’s controls, policies, and procedures. 

- 16 - 
not appear for a duplicate payment if the vendor payment document has 

been “warehoused,” meaning payments are scheduled for payment by the 

Department of the Treasury (Treasury) in conformity with the time frame of 

the Prompt Payment Act or within the time frame negotiated on the 

obligation. However, an Erroneous Payment database was established to 

capture an improper payment that was “warehoused” the following day for 

the reason described above. 

Risk Assessment 

In October 2005, the DEA submitted a report to JMD in accordance 

with the IPIA, which included a complete program inventory and a complete 

description of the DEA’s risk assessment. The report defined the DEA’s 

programs by payment types. In the risk assessment, the DEA identified the 

preventive and detective controls for each program in the full program 

inventory. Additionally, the report described weaknesses within each 

program and identified areas where improper payments could occur, which 

assisted the DEA’s recovery audit program. The program inventory and risk 

assessment conducted by the DEA demonstrates a thorough and 

comprehensive review. 

Management Accountability 

The DEA provided various documents that hold management 

accountable for reducing improper payments. The DEA maintains scorecards 

for each division, regarding electronic payments to vendors, non-credit card 

invoices paid on time, and interest penalties paid on invoices. 

Department-wide scorecards are maintained to inform employees on how 

the DEA is performing. The DEA provided Performance Work Plans that 

explain accountability for taxpayer value, effective management of financial 

resources, and unqualified audits. Finally, the DEA provided documentation 

on Approving and Certifying Officers. Approving Officers may be subject to 

administrative discipline if they approve an incorrect, illegal, or improper 

payment. Certifying Officers are personally and financially accountable for 

the amount of any incorrect, illegal, or improper payment resulting from 

false or misleading certification, as well as for any payment prohibited by 

law that does not represent a legal obligation under the appropriation or 

fund involved. Certifying Officers may be required to reimburse the federal 

government for the entire amount of any incorrect, illegal, or improper 

payment resulting from their certification. In our opinion, the DEA’s 

management accountability for reducing improper payments ensures that 

the IPIA and the NDAA are addressed within the component, which is 

particularly important during times when budgets are tight. 

- 17 - 
Bulletin 06-11 required the annual IPIA reports to include a description 

of how managers are held accountable for reducing improper payments. In 

reviewing the DEA’s FY 2005 IPIA report, we noted that the DEA stated “not 

applicable” for Item 6, which asks for a description of the steps taken or 

planned to ensure managers are held accountable for reducing improper 

payments. However, as described above, managers are given responsibility 

and held accountable for reducing improper payments. 

Information System and Infrastructure 

Bulletin 06-11 required the annual IPIA reports to include within 

Item 7, a description as to whether the component has the information 

system and other infrastructure it needs to reduce improper payments to the 

levels the component has targeted. If the component does not have the 

information system or infrastructure necessary to reduce improper 

payments, the component should include a description of the resources the 

component requested in its budget submission to Congress to obtain the 

necessary information system and infrastructure. In reviewing the DEA’s 

FY 2005 IPIA report that was submitted to JMD, we found that the DEA 

stated “not applicable” for Item 7. However, we found that the DEA has the 

information system and infrastructure necessary to reduce improper 

payments through its financial management system. 

Bureau of Alcohol, Tobacco, Firearms and Explosives 

Preventive Measures 

According to ATF management, ATF has the internal control structure 

and three processes in place to prevent improper payments.13 The first 

control, which we verified, is a prompt that appears to the user when a 

duplicate invoice is entered into the system. Second, prior to authorizing a 

payment, ATF performs a draft referencing process by examining the 

obligating documents, receiving documents, and the invoice. The draft 

referencing process compares the information on all of these documents and 

ensures the accuracy on each. This process is performed both when funds 

have and have not been obligated. The referencing process can prevent 

improper payments because when funds have been obligated, the payment 

should reference the vendor invoice; when funds have not been obligated, 

the payment should reference the purchase order. Finally, ATF provided a 

draft policy for transactions greater than $2,500, which requires system 

approval prior to being processed and paid by the Certifying Officer. The 

 13 See the Statement on Internal Controls, at the back of this report, for details of 

our review of ATF’s controls, policies, and procedures. 

- 18 - 
Certifying Officer reviews documentation prior to certifying an invoice for 

payment. 

Risk Assessment 

For FY 2005, ATF submitted a report to JMD as required by the IPIA. 

The program inventory and risk assessment completed by ATF stated, “ATF 

does not have any significant risk programs in which improper payments 

exceed both 2.5 percent of program payments and $10 million.” However, 

according to ATF management, a risk assessment was not performed in 

FY 2005. Instead, we determined that ATF management relied on the 

FY 2004 risk assessment and data on improper payments identified and 

recovered in 2005 to make the concluding statement in the FY 2005 IPIA 

report. 

Bulletin 06-11 requires each component to review all programs and 

activities administered and identify those susceptible to significant risk and 

to "describe the risk assessment performed, subsequent to compiling the full 

program inventory." A full program inventory and risk assessment ensures 

that all payments and controls are reviewed for weaknesses and strengths in 

preventing and identifying improper payments and the reasons they occur. 

When we discussed the lack of a risk assessment conducted for the FY 2005 

report with ATF managers, they stated that because the FY 2004 IPIA report 

reported no significant risk programs, a risk assessment for FY 2005 was not 

necessary. However, ATF needs to conduct a risk assessment of its full 

program inventory each year until the level of risk is known and the baseline 

estimates, if applicable, are established as required by Bulletin 06-11. ATF 

should maintain documentation of the risk assessment. When ATF’s 

programs are deemed not risk susceptible and documentation is maintained, 

ATF can conduct a risk assessment every 3 years. 

We discussed with ATF management this finding related to conducting 

a complete risk assessment of all programs within the full program inventory 

and maintaining documentation of the risk assessment. ATF management 

concurred and agreed to conduct a complete risk assessment and to 

maintain documentation of the risk assessment performed. 

Management Accountability 

ATF management described Certifying Officers, Contracting Officer 

Technical Representatives (COTRs), and post-contract responsibilities that 

ensure management's responsibility for reducing improper payments. 

Certifying Officers are held accountable for any improper payments they 

certify. Additionally, Certifying Officers are also responsible for reviewing 

- 19 - 
the appropriate documents prior to certifying an invoice for payment. ATF 

explained and provided documentation on COTRs’ responsibilities, which 

include: (1) reviewing invoices to ensure ATF is not receiving duplicate 

invoices, (2) comparing invoices to the terms of the contract, (3) reviewing 

the performance accomplished on the contract, (4) analyzing the spend rate 

based on the work completed on the contract, and (5) handling any other 

contract issues. According to Acquisition Management Policy No. 007, 

Accelerated Closeout Procedures for Simplified Acquisition Procedures 

Contract Files, post-contract responsibilities include ensuring all goods and 

services were received, reviewing terms of the contract, verifying that the 

final invoice has been received and approved for payment, and determining 

that multiple payments were not made. In our judgment, these processes 

assist in ensuring no duplicate, under- or over-payments occur. 

Bulletin 06-11 requires the annual IPIA report to include a description 

of how managers are held accountable for reducing improper payments. In 

reviewing the FY 2005 IPIA report, we noted that ATF stated “not applicable” 

for Item 6, which asks for a description of the steps taken or planned to 

ensure managers are held accountable for reducing improper payments. 

However, ATF designates responsibilities for reducing improper payments 

through Certifying Officers, COTRs, and post-contract responsibilities. 

Information System and Infrastructure 

We determined that ATF has the infrastructure and information system 

necessary to reduce improper payments. We verified that the financial 

management system prompts the user if a potential improper payment is 

entered into the system. Then, the user will determine whether the 

payment is in fact improper. 

Recommendations: 

We recommend that JMD: 

1. Ensure that risk assessments for each component are required to 

include: (1) an assurance statement of an unqualified, qualified, or 

no-assurance opinion, following the requirements of OMB 

Circular A-123 revision, Management’s Responsibility for Internal 

Control, for DOJ as a whole; (2) the reason for the opinion and its 

effect on the component's risk of making improper payments; and 

(3) any corrective actions being taken to address the opinion and the 

component's risk. 

- 20 - 
2. Evaluate the recent changes to OMB Circular A-123, Appendix C and 

determine whether changes need to be made to Bulletin 06-11. 

We recommend that for the OBDs, JMD: 

3. Ensure future risk assessments include: (1) the results from the most 

recent financial statement audit, including any material weaknesses or 

reportable conditions; (2) the effect of those weaknesses or conditions 

on its risk of making improper payments; and (3) a description of the 

corrective action taken to address those weaknesses or conditions as 

required by Bulletin 06-11. 

4. Ensure future risk assessments include: (1) an assurance statement 

of an unqualified, qualified, or no-assurance opinion; (2) the reason 

for the opinion and its effect on the component's risk of making 

improper payments; and (3) any corrective actions being taken to 

address the opinion and the component's risk. 

5. Ensure future risk assessments include an assessment of federal 

award payments made by the recipients and subrecipients as required 

by Bulletin 06-11. 

We recommend that the FPI: 

6. Ensure future risk assessments include: (1) the results from the most 

recent financial statement audit, including any material weaknesses or 

reportable conditions; (2) the effect of those weaknesses or conditions 

on its risk of making improper payments; and (3) a description of the 

corrective action taken to address those weaknesses or conditions as 

required by Bulletin 06-11. 

7. Ensure future risk assessments include: (1) an assurance statement 

of an unqualified, qualified, or no-assurance opinion; (2) the reason 

for the opinion and its effect on the component's risk of making 

improper payments; and (3) any corrective actions being taken to 

address the opinion and the component's risk. 

We recommend that the DEA: 

8. Ensure future risk assessments include: (1) an assurance statement 

of an unqualified, qualified, or no-assurance opinion; (2) the reason 

for the opinion and its effect on the component's risk of making 

improper payments; and (3) any corrective actions being taken to 

address the opinion and the component's risk. 

- 21 - 
We recommend that ATF: 

9. Ensure future risk assessments include: (1) the results from the most 

recent financial statement audit, including any material weaknesses or 

reportable conditions; (2) the effect of those weaknesses or conditions 

on its risk of making improper payments; and (3) a description of the 

corrective action taken to address those weaknesses or conditions as 

required by Bulletin 06-11. 

10. Ensure future risk assessments include: (1) an assurance statement 

of an unqualified, qualified, or no-assurance opinion; (2) the reason 

for the opinion and its effect on the component's risk of making 

improper payments; and (3) any corrective actions being taken to 

address the opinion and the component's risk. 

11. Conduct a complete program inventory and risk assessment for each 

program, and maintain documentation as required by Bulletin 06-11. 

- 22 - 
II. IDENTIFYING AND RECOVERING IMPROPER AND ERRONEOUS 

PAYMENTS 

In general, the agencies complied with OMB and DOJ requirements for 

identifying and recovering improper payments. However, our audit 

determined that the recovery audit programs at the OBDs, FPI, and 

ATF did not consider a review of at least one of the categories of 

payments required by Bulletin 06-11. Further, we found that identified 

and recovered improper payment amounts reported to JMD may be 

understated for the OBDs, due to breaks in communication within the 

component and for ATF because it is not tracking improper payments 

separately from other debts. We also noted agencies that needed 

improvement in policy implementation and in compliance with existing 

requirements. Finally, we found that JMD could improve Bulletin 

06-11 by establishing time limits for confirming or refuting any 

improper payments identified by the recovery audit contractor. 

In February 2006, OMB issued Improving the Accuracy and Integrity of 

Federal Payments, which identified approximately $888 million in improper 

payments made by federal agencies in FY 2005. Additionally, the report 

stated, “Of the $888 million in improper vendor payments, agencies 

recovered $656 million. Approximately, $205 million is pending resolution, 

with the remainder either still in dispute or deemed unrecoverable. This 

demonstrates an improper payment recovery rate of 74 percent.” DOJ was 

included in this report, which compiled information from the agencies’ PARs. 

According to DOJ’s FY 2005 PAR, DOJ identified improper payments totaling 

$1,044,320 and $765,086 (73 percent) had been recovered. 

However, according to testimony by David Walker, the Comptroller 

General of the United States, “Significant challenges remain to effectively 

achieve the goals of the IPIA . . . .”14 Walker also reported that the 

Government Accountability Office’s review of FY 2005 PARs, “. . . noted that 

some agencies still have not instituted a systematic method of reviewing all 

programs and activities, have not identified all programs susceptible to 

significant improper payments, and have not annually estimated improper 

payments for their high-risk programs.” Specific agencies were not 

identified in his testimony. 

 14 Government Accountability Office, Fiscal Year 2005 U.S. Government Financial 

Statements, Sustained Improvement in Federal Financial Management Is Crucial to 

Addressing Our Nation’s Financial Condition and Long-term Fiscal Imbalance, Statement of 

David M. Walker, Comptroller General of the United States, March 2006. 

- 23 - 
Identifying improper payments is an essential step in assessing the 

need for and types of corrective action required to manage improper 

payments and help ensure efficient and effective program operations. A 

recovery audit program includes a comprehensive review of prior payments 

to determine whether they were improper. A recovery audit program also 

looks for several types of improper payments, including: 

• duplicate payments; 

• errors on invoices or financing requests; 

• failure to reduce payments by applicable sales discounts, cash 

discounts, rebates, or other allowances; 

• payments for items not received; 

• mathematical or other errors in determining payment amounts and 

executing payments; and 

• the failure to obtain credit for returned merchandise. 

Not only is a recovery audit program an important tool for identifying 

improper payments already made, the results of the program can also be 

used to address the flaws in an agency's internal controls. 

Recovering identified improper payments is the final aspect of a 

recovery audit program. Establishing a written policy for the component’s 

recovery audit program ensures that the goal of the program – to recover 

the improper payments made by the component – and the procedures for 

accomplishing the goal are available to all employees. JMD recognized the 

importance of a written policy and required each component to establish a 

written policy for its recovery audit program, in accordance with 

Bulletin 06-11. 

However, in reviewing Bulletin 06-11, we found that JMD did not 

define time limits for confirming or refuting an improper payment identified 

by the recovery audit contractor. In our opinion, the time limits for 

confirming or providing documentation refuting the improper payment, 

should be included in Bulletin 06-11. JMD managers concurred with our 

finding and agreed to include time limits within Bulletin 06-11. 

During our audit, we reviewed laws and regulations applicable to 

recovery audit activities. We reviewed each component’s IPIA report, which 

included a description of its recovery audit program. In addition, we 

- 24 - 
interviewed component officials and reviewed policies and procedures used 

by the OBDs, FPI, DEA, and ATF to identify and recover improper payments. 

In addition to considering the time limits for components utilizing the 

recovery audit contractor, we noted the following conditions during our 

review of policies and procedures used to identify and recover improper 

payments, and in the recovery audit program. 

Offices, Boards and Divisions 

The OBDs are made up of 35 DOJ Offices, Boards and Divisions. One 

of the 35 subcomponents, the Executive Office for United States Attorneys, 

is the liaison between the DOJ and 93 United States Attorney Districts. 

Appendix III provides a complete listing of the OBD subcomponents and 

Appendix IV lists the United States Attorney Districts.15 In order to assess 

the OBDs’ compliance with the IPIA and the NDAA, we selected a sample of 

six OBD subcomponents for review.16 The subcomponents selected for our 

review included the: 

• Regime Crimes Liaison Office,17

• Office on Violence Against Women, 

• Civil Division, 

• Office of Community Oriented Policing Services, 

• Executive Office for Immigration Review, and 

• Wireless Management Office. 

Recovery Audit Program 

JMD’s Financial Management Policies and Procedures Bulletin 05-03 

(Bulletin 05-03), November 2004, details the recovery audit program in 

three parts for the OBDs. 

 15 The OIG is a subcomponent of the OBDs and is included in Appendix III. 

16 The methodology for the selection of the OBD subcomponents is detailed in 

Appendix I. 

17 The RCLO is not listed in Appendix III, because the RCLO is a component of the 

Office of the Deputy Attorney General. 

- 25 - 
The first part is provided internally by each subcomponent and 

includes the following elements: 

• Each subcomponent of the OBDs can produce a duplicate payment 

report using the financial management system, which identifies 

potential duplicate payments after the payments have been made. 

• Any potential duplicate payment that appears on the report must be 

researched to determine if a duplicate payment was made. 

• Once any improper payment is identified, it must be reported to JMD 

Finance Staff within 5 days using the Notification of Erroneous 

Payment form (Attachment 2 of Bulletin 05-03). 

When a subcomponent of the OBDs identifies and recovers an 

improper payment, the subcomponent can keep 100 percent of the 

recovered amount, rather than a percentage going to the recovery audit 

contractor or to JMD. 

In the second part of the OBDs’ recovery audit program, JMD searches 

for improper payments by generating the financial management system 

duplicate payment reports and researching the results. If JMD identifies and 

verifies a duplicate payment, the OBD subcomponent that made the 

duplicate payment must pay JMD a fee of 14.46 percent of any recovered 

amount for administering the OBDs’ recovery audit program. Therefore, the 

subcomponent that made the improper payment only receives 85.54 percent 

of the recovered amount. 

The third and primary aspect of the OBDs’ recovery audit program 

consists of utilizing a private contractor to conduct recovery audits. This 

effort began in May 2003, and payments made from FYs 1999 through 2004 

were reviewed for improper payments as of April 2006. At the time of our 

audit, the recovery audit contractor was reviewing fiscal year data 6 months 

after each fiscal-year end. 

When the recovery audit contractor identifies an improper payment, 

the subcomponent is notified. The subcomponent then has 15 days to 

respond to the recovery audit contractor to confirm whether the payment is 

in fact improper and whether the improper payment has already been 

recovered. After the improper payment is recovered, the recovery audit 

contractor receives 20 percent of the recovered amount for identifying the 

improper payment, the Department of the Treasury receives 2 percent for 

the OBDs using Treasury’s contract, and JMD receives 14.46 percent for 

administering the OBDs’ recovery audit program. Therefore, the 

- 26 - 
subcomponent that made the improper payments only receives the 

remaining 63.54 percent of the recovered amount. 

As shown in Table 1, as of April 2006, the recovery audit contractor 

stated that it had identified improper payments totaling $1,198,443 for all of 

the OBDs and recovered $916,711 of this amount. 

Table 1: IMPROPER PAYMENTS IDENTIFIED AND RECOVERED BY 

THE RECOVERY AUDIT CONTRACTOR 

NAME

IMPROPER 

PAYMENTS 

IDENTIFIED

IMPROPER 

PAYMENTS 

RECOVERED

IMPROPER 

PAYMENTS 

OUTSTANDING

PERCENTAGE 

RECOVERED

Recovery 

Audit 

Contractor 

$1,198,443 $916,711 $281,732 76% 

Source: Recovery audit contractor 

As shown in Table 2, the six OBD subcomponents included in our audit 

stated that they identified an additional $215,212 in improper payments, of 

which $203,896 was recovered. 

Table 2: IMPROPER PAYMENTS IDENTIFIED AND RECOVERED BY 

SIX SUBCOMPONENTS OF THE OBDs 

COMPONENT

IMPROPER 

PAYMENTS 

IDENTIFIED

IMPROPER 

PAYMENTS 

RECOVERED

IMPROPER 

PAYMENTS 

OUTSTANDING

PERCENTAGE 

RECOVERED

RCLO $6,180 $6,180 $ 0 100% 

COPS 2,605 2,605 0 100%

OVW 2,155 2,155 0 100%

WMO 773 773 0 100%

CIV 188,802 186,774 2,028 99% 

EOIR 14,696 5,408 9,288 37% 

TOTAL $215,212 $203,896 $11,316 95% 

Source: Management at the following OBD subcomponents: the RCLO, COPS, OVW, WMO, 

CIV, and EOIR. The differences in the totals are due to rounding. 

As mentioned previously, Bulletin 05-03 requires each subcomponent 

of the OBDs to submit the Notification of Erroneous Payment form 

(Attachment 2 of Bulletin 05-03) to JMD Finance Staff informing JMD of any 

improper payments identified and confirming that a receivable has been 

established. However, we found that some subcomponents provided the 

information but did not utilize the Notification of Erroneous Payment form. 

Instead, they submitted the refund and supporting documentation directly to 

JMD or used a Transmittal of Currency form to report improper payment 

- 27 - 
recovery activities. Utilizing the Notification of Erroneous Payment form is 

the only way to guarantee that appropriate JMD Finance Staff, who 

administer the OBDs recovery audit program, receive the information. It is 

essential for appropriate JMD personnel to receive the information so these 

amounts can be included within the Quarterly Recovery Audit Reports and 

within the annual IPIA reports. When subcomponents do not submit the 

Notification of Erroneous Payment form, JMD cannot accurately report what 

has been identified and recovered by the OBDs, which is combined with the 

other DOJ components and reported in the annual PAR. Table 3 details how 

each of the six subcomponents of the OBDs reported recovery audit 

information to JMD.

Table 3: SUBCOMPONENTS OF THE OBDs UTILIZING THE 

NOTIFICATION OF ERRONEOUS PAYMENT FORM 

(ATTACHMENT 2 OF BULLETIN 05-03) 

COMPONENT HOW RECOVERY AUDIT INFORMATION IS REPORTED TO JMD 

EOIR Utilized Attachment 2 

WMO Utilized Attachment 2 

COPS Did not utilize Attachment 2, but submitted information on a 

Transmittal of Currency form 

OVW Did not utilize Attachment 2, but submitted information on a 

Transmittal of Currency form 

CIV Did not utilize Attachment 2, but the refund and support 

were forwarded to JMD 

RCLO Did not utilize Attachment 2 

Source: Management at the following OBD subcomponents: the RCLO, COPS, OVW, WMO, 

CIV, and EOIR

 When we discussed this issue with JMD management, they concurred 

with our finding and agreed to ensure that each of the OBD subcomponents 

submit the Notification of Erroneous Payment form to ensure accurate 

reporting. 

We also found that some of the six OBD subcomponents included in 

our audit had additional procedures for identifying and recovering improper 

payments. The additional procedures included reviews of the Open 

Obligation Report and the Consolidated Obligation Report. The Open 

Obligation Report shows whether the appropriate account payable was 

properly liquidated; when an item has been paid for, but has not been 

received; and when a transaction has not been paid. The Open Obligation 

Report identifies these issues so they can be researched to determine if a 

transaction was expected or occurred in error. The Consolidated Obligation 

Report shows when a good or service was paid for, but the corresponding 

obligation was not established and liquidated. This activity can identify 

- 28 - 
potential errors which should be researched. Table 4 identifies the OBD 

subcomponents that use additional procedures beyond the recovery audit 

contractor and the financial management system duplicate payment report. 

Table 4: SUBCOMPONENTS OF THE OBDs WITH ADDITIONAL 

RECOVERY AUDIT PROGRAMS 

COMPONENT RECOVERY AUDIT PROGRAM

COPS Monthly review of the Open Obligation Report 

WMO Monthly review of the Open Obligation Report and the 

Consolidated Obligation Report 

OVW Quarterly review of the Open Obligation Report and monthly 

review of the Consolidated Obligation Report 

Source: Management at the following OBD subcomponents: COPS, WMO, and OVW

COPS and OVW were two of the OBD subcomponents included in our 

audit that manage grant programs. According to COPS and OVW, 

monitoring of grantee expenditures occurs through: the Office of Justice 

Programs, Office of the Comptroller, Desk Reviews; and Financial Monitoring 

Site Visits. 18 However, Desk Reviews and Financial Monitoring Site Visits 

are not conducted for all grants awarded by COPS and OVW and do not 

include a review of all grant expenditures for the selected grants. In other 

words, only a sample of expenditures for selected grants are reviewed and 

verified for accuracy. According to Bulletin 06-11, "the recovery audit must 

encompass . . . all payments made from FY 2003 forward . . . grant 

payments are to be included in each component's recovery audit activity." 

Therefore, the OBD’s recovery audit program is not in compliance with 

Bulleting 06-11 because it does not include all grant payments. 

 When we discussed this issue with JMD management, they concurred 

with our finding and agreed to include grant payments within the scope of 

the OBDs’ recovery audit program. 

Federal Prison Industries 

Recovery Audit Program 

Beginning in July 2004, the FPI began using a private contractor to 

conduct recovery audits. Payments made in FY 2003 were reviewed and 

vendor letters requesting reimbursement for any overpayments were sent 

for FYs 2003 through 2005. As shown in Table 5, as of April 2006, the FPI 

stated that a total of $43,182 in improper payments had been identified and 

 18 The Office of the Comptroller provides financial monitoring activities for both 

COPS and OVW. 

- 29 - 
confirmed from those fiscal years, and the FPI had recovered $12,355 of this 

amount. 

Table 5: IMPROPER PAYMENTS IDENTIFIED AND RECOVERED AT 

THE FPI

COMPONENT

IMPROPER 

PAYMENTS 

IDENTIFIED

IMPROPER 

PAYMENTS 

RECOVERED

IMPROPER 

PAYMENTS 

OUTSTANDING

PERCENTAGE 

RECOVERED

FPI $43,182 $12,355 $30,827 29% 

Source: Management at the FPI and the recovery audit contractor 

The scope of the FPI's recovery audit program includes the following 

two criteria to ensure that the program is cost-effective. 

• The recovery audit contractor reviews data in fiscal year increments 

and only includes vendors with total payments exceeding $12,500 

during the fiscal year. 

• The recovery audit contractor will not pursue claims less than $500 per 

transaction. 

After the recovery audit contractor's review, the FPI receives the 

potential improper payment claims and validates them. According to the 

draft Recovery Audit Program, Program Statement, the validation will include 

confirmation by the vendor of the amount recoverable, confirmation by the 

FPI transacting staff (such as the receiver of goods or services, the procuring 

official, and the disbursing official) of the amount recoverable, verification 

that subsequent resolution of the recoverable amount has not occurred, and 

verification that amounts due have not been recovered. Upon validation, the 

claim is approved and collection is pursued. Additionally, the FPI prepares 

monthly summaries of recovery audit claims, including the causes. 

 According to Bulletin 06-11, "recovery audit programs must determine, 

at a minimum, duplicate payments, payments made for incorrect amounts, 

payments for which allowable discounts were not taken and goods and 

services were not received, and if payments were contract compliant. 

Contract compliance reviews will determine if payments made were 

consistent with the terms and conditions of the contract. All classes of 

contract/vendor payments are to be considered for recovery audits." The 

FPI's recovery audit program looks for all of those types of improper 

payments except that it does not include a contract compliance review as 

required by Bulletin 06-11. 

- 30 - 
We discussed this issue with FPI management, and they explained that 

contract compliance review had not started because the contractor is not at 

the level to conduct this review. Specifically, according to FPI management, 

the recovery audit contractor operates in phases, and has not implemented 

the review yet. 

Additionally, our audit found that the FPI does not have a final written 

policy for its recovery audit program. Instead, the FPI has a draft policy for 

complying with the IPIA and for its recovery audit program. According to 

Bulletin 06-11, “each component is required to develop and implement 

written policies and procedures for its recovery audit program.” We 

acknowledge that the FPI has a draft policy for its recovery audit program, 

but recommend that the FPI develop a final written policy as it is an 

important tool to ensure FPI staff complies with the IPIA and the NDAA. 

 We discussed this issue with FPI management, and they concurred. 

However, they stated that due to various levels of review, it takes 

approximately 1 year for a draft policy to become final. The FPI 

management agreed to implement a final policy for its recovery audit 

program. 

Drug Enforcement Administration 

Recovery Audit Program 

Although the DEA's initial recovery audit program began in FY 2004 

and continued through FY 2005, it was not a comprehensive recovery audit 

program. Instead, a statistical sample of payments pulled from a population 

of all DEA payment categories, except payroll, were selected and tested to 

determine if any improper payments were made. Additionally, improper 

payments were identified by COTRs, Financial Management Division, as well 

as through other internal controls. In FY 2006, the DEA established a new 

recovery audit program, administered by the Financial Analysis and 

Reporting Unit (FNOF), which reports recovery audit information to JMD. 

The FNOF reviews all payments applicable to the IPIA, instead of sampling 

payments, and constitutes a comprehensive recovery audit program. As 

shown in Table 6, as of May 2006, the DEA stated that a total of $403,305 in 

improper payments were identified and confirmed from FYs 2003 through 

2005, of which $386,833 was recovered. 

- 31 - 
Table 6: IMPROPER PAYMENTS IDENTIFIED AND RECOVERED BY 

THE DEA 

COMPONENT

IMPROPER 

PAYMENTS 

IDENTIFIED

IMPROPER 

PAYMENTS 

RECOVERED

IMPROPER 

PAYMENTS 

OUTSTANDING

PERCENTAGE 

RECOVERED

DEA $403,305 $386,833 $16,472 96% 

Source: Management at the DEA 

The scope of the DEA’s recovery audit program encompasses all 

payments made from FYs 2003 through 2005. However, the DEA’s initial 

recovery audit program did not review all payments made from FY 2003 

forward as required by Bulletin 06-11. Instead, a sample of payments was 

tested from each fiscal year. After we noted this deficiency to DEA 

management during the course of our audit, the DEA completed and 

provided documentation for its review of all payments related to the IPIA 

from FYs 2003 through 2005. Therefore, a formal recommendation will not 

be made. 

DEA management had established an internal recovery audit team, 

FNOF, rather than utilizing the recovery audit contractor. Bulletin 06-11 

states, "The Director, JMD Finance Staff, has implemented a 

department-wide recovery audit contract, which all components are required 

to use unless a waiver is granted. Requests for waivers must be forwarded 

to the Director, Finance Staff, and include a complete description of your 

Recovery Audit Program and the cost of the program." During our audit we 

found that the DEA had not submitted a request for waiver to the Director of 

the JMD Finance Staff describing its internal recovery audit program or its 

cost. In our opinion, submitting a request for waiver ensures each DOJ 

component has a cost-effective recovery audit program in place. As a result 

of our audit, on November 30, 2006, DEA management submitted a request 

for waiver to the Director of the JMD Finance Staff describing its internal 

recovery audit program and received approval on the same day. Therefore, 

a formal recommendation will not be made. 

 

During our audit, we found that the DEA has a contract closeout 

process, which verifies that: (1) all payments are proper; (2) all goods and 

services have been received; (3) all federal property has been returned; 

(4) all invoices have been paid; (5) no over, under, or duplicate payments 

were paid; (6) all applicable discounts have been taken and received; and 

(7) interest has been paid. At the time of our audit, no improper payments 

were identified through the contract closeout process. The DEA 

management explained that if an improper payment was identified, it would 

be corrected by the contract closeout team at the time of reconciliation and 

would not be reported to the FNOF. By not reporting identified and 

- 32 - 
recovered improper payments to the FNOF, the DEA may potentially 

understate the amounts in its annual IPIA report, which are consolidated 

with other DOJ components into the DOJ’s PAR. As a result of our audit, on 

November 22, 2006, DEA management revised its Contract Closeout 

Handbook to include the requirements that the Financial Operations Section 

be notified of any improper payments prior to actual contract close out. The 

Financial Operation Section contains four units, one of which is the FNOF, 

and will notify FNOF of any improper payment information. Therefore, a 

formal recommendation will not be made. 

 During our fieldwork we found that the DEA had established policies 

for its recovery audit program, although the policies were in various 

documents. Bulletin 06-11 requires, "each component to develop and 

implement written policies and procedures for its recovery audit program." 

We recommended the DEA consolidate the policies into a single source that 

can be easily accessed. DEA management concurred with our 

recommendation and combined the recovery audit policies into a Recovery 

Audit Standard Operating Procedure, which the DEA provided to us. 

Therefore, a formal recommendation will not be made. 

Statutory and Regulatory Barriers 

OMB Circular A-123, Appendix C states that agencies with improper 

payment estimates less than $10 million are only required to report the total 

estimate in their annual PARs to OMB. These agencies are no longer 

required to include a description of any statutory or regulatory barriers 

which limit corrective actions in reducing improper payments.19 This 

criterion applies to each DOJ program, rather than to the individual 

components. Because the improper payment estimate for each DOJ 

program is less than $10 million, in our judgment, DOJ is not required to 

include this information in its PAR report for FY 2006. Nonetheless, 

Bulletin 06-11 still required the individual components to include the 

information in their IPIA reports. As a result, below we noted a finding 

related to the DEA and this requirement, but do not offer a recommendation 

related to this issue. 

While reviewing the DEA's recovery audit program, we found that the 

DEA does not include contract payments at DEA foreign offices, which are 

processed by the Department of State via a reimbursable agreement. The 

DEA has not been granted disbursing authority by the Department of the 

Treasury. Instead, the State Department has designated United States 

 19 OMB Circular A-136 - Revised July 2006, requires additional IPIA and recovery 

audit information to be included in the annual PAR. 

- 33 - 
Disbursing Officers, who have been delegated disbursing authority by the 

Department of the Treasury and authorized by the Treasury Secretary. Only 

a Disbursing Officer can make payments in local currency, which enables an 

agency to conduct business overseas. As a result, the State Department 

makes all of the DEA’s foreign payments. Additionally, if a federal agency 

wants to conduct business overseas, contracts must be negotiated through 

the International Cooperative Administrative Support Services. 

Bulletin 06-11 required the annual IPIA reports to include within 

Item 8 a description of any statutory or regulatory barriers which limit 

corrective actions in reducing improper payments. We recognize that the 

DEA does not have contracting or disbursing authority overseas. However, 

in our opinion, this information concerning disbursements by the State 

Department on behalf of the DEA should be included within Item 8 of the 

IPIA. 

Bureau of Alcohol, Tobacco, Firearms and Explosives 

Recovery Audit Program 

ATF's internal recovery audit activities began in 2001. They include: 

(1) reviewing the accounts payable listing to identify payables exceeding 

90 days that can identify multiple payments made in other forms; 

(2) requiring COTRs to ensure that payments follow the terms of the 

contract that can identify duplicate payments and under- or over-spending 

on the contracts; and (3) conducting the contract closeout process, which 

compares payments to the language in the contract to identify missed 

discounts, duplicate payments, under- or over-payments, or improper 

payments that may not be allowed by the contract. 

As shown in Table 7, ATF stated that it had identified $42,465 in 

improper payments and recovered $8,830, as of May 2006. ATF officials 

stated that they planned to pursue the remaining amount, as well as pursue 

collection of all identified improper payments. 

Table 7: IMPROPER PAYMENTS IDENTIFIED AND RECOVERED BY 

ATF 

COMPONENT

IMPROPER 

PAYMENTS 

IDENTIFIED

IMPROPER 

PAYMENTS 

RECOVERED

IMPROPER 

PAYMENTS 

OUTSTANDING

PERCENTAGE 

RECOVERED

ATF $42,465 $8,830 $33,636 21% 

Source: ATF management. The differences in the totals are due to rounding. 

- 34 - 
During our audit we found that improper payments that had not been 

recovered are tracked on an aging of accounts receivable schedule. 

However, after an improper payment is collected, ATF no longer tracks the 

recovered improper payment. In addition, ATF pursues all improper 

payments as regular debts and does not separately track improper payments 

from other debts. Therefore, ATF cannot determine when the identified and 

recovered improper payments occurred. Additionally, ATF cannot determine 

whether the identified and recovered improper payment amounts provided 

include all improper payments identified and recovered. Bulletin 06-11 

requires each component to report the amount of improper payments 

identified and recovered over the reporting period and cumulatively. It is 

important for ATF to develop methods for tracking improper payments 

separately from other debts, so it can provide accurate information on 

improper payments identified and recovered that can be included in DOJ’s 

annual PAR. Additionally, ATF should include the timeframe in which the 

identified and recovered improper payments occurred. When we discussed 

this issue with ATF management, they concurred with our finding and agreed 

to revise and report the correct information – when it is available – in annual 

IPIA and quarterly reports. 

Additionally, we found that ATF has not requested a waiver from the 

Director, JMD Finance Staff, to not use the recovery audit contractor as 

required by Bulletin 06-11. We believe, however, that ATF should utilize the 

recovery audit contractor, unless an approved internal recovery audit 

program that is compliant with all areas of Bulletin 06-11 and other 

applicable laws and regulations is developed. When we discussed this issue 

with ATF management, they concurred with our finding. 

ATF management stated that they are reviewing the accounts payable 

listing for payments that are over 90 days old and conducting the contract 

closeout process after a contract is closed. Management is also making sure 

that Certifying Officers and COTRs perform their duties as necessary. 

Although ATF management stated that they anticipate utilizing the recovery 

audit contractor to review all payments from FY 2004 forward, they will need 

to include all payments made from FY 2003 forward to be compliant with 

Bulletin 06-11. Specifically, Bulletin 06-11 states, "the recovery audit must 

encompass, at a minimum, all payments made from FY 2003 forward." 

When we discussed this issue with ATF management, they noted that they 

could encounter difficulties researching payments that occurred prior to 

January 2003, when ATF became a DOJ component. In our judgment, ATF 

needs to obtain a waiver if it is not possible to research prior payments. 

Otherwise, ATF should expand the scope of its recovery audit activities to 

encompass, at a minimum, all payments made from FY 2003 forward as 

required by Bulletin 06-11. ATF management agreed to discuss the scope of 

- 35 - 
its review of payments with JMD and review all payments FY 2003 forward, if 

possible. 

Finally, our audit found that ATF had not developed a written policy for 

its recovery audit activities. Instead, policies exist in both draft and final 

form for portions of ATF’s recovery audit activities. According to 

Bulletin 06-11, "each component is required to develop and implement 

written policies and procedures for its recovery audit program." We 

discussed this issue with ATF management and they concurred with our 

finding and agreed to develop and implement a written final policy for the 

recovery audit program when a program is in place. 

Recommendations: 

We recommend that JMD: 

12. Develop and implement a department-wide policy for time limits after 

the recovery audit contractor identifies a potential improper payment 

and submits the claim to the component. 

We recommend that for the OBDs, JMD: 

13. Ensure each subcomponent submit the Notification of Erroneous 

Payment form (Attachment 2 of Bulletin 05-03) to JMD Finance Staff 

regarding improper payments identified and recovered by the OBDs as 

required by Bulletin 05-03. 

14. Ensure that its recovery audit program addresses and includes grants 

as required by Bulletin 06-11. 

We recommend that the FPI: 

15. Implement a contract compliance review within its recovery audit 

program as required by Bulletin 06-11. 

16. Implement a final policy for its recovery audit program as required by 

Bulletin 06-11. 

We recommend that ATF: 

17. Develop methods for tracking improper payments separately from 

other debts, so it can provide information on the amount of improper 

payments identified and recovered. Additionally, ATF should include 

- 36 - 
and maintain documentation on the timeframe in which the identified 

and recovered improper payments occurred. 

18. Demonstrate progress toward utilizing the recovery audit contractor as 

required by Bulletin 06-11, unless an approved internal recovery audit 

program that is compliant with all areas within Bulletin 06-11 and 

other applicable laws and regulations is developed, and a waiver is 

submitted to and approved by the Director, JMD Finance Staff as 

required by Bulletin 06-11. 

19. Expand the scope of the recovery audit program to encompass, at a 

minimum, all payments made from FY 2003 forward as required by 

Bulletin 06-11. 

20. Develop and implement a final written policy and procedure when a 

program is in place for ATF’s recovery audit program as required by 

Bulletin 06-11. 

- 37 - 
STATEMENT ON COMPLIANCE WITH 

LAWS AND REGULATIONS 

 As required by Government Auditing Standards, we reviewed records 

and other documents pertaining to improper payments to obtain reasonable 

assurance about each component’s compliance with applicable laws and 

regulations, which, if not complied with, could have a material effect on DOJ 

compliance with those laws and regulations. Compliance with laws and 

regulations applicable to improper payments is the responsibility of each 

component’s management. An audit includes examining, on a test basis, 

evidence about compliance with laws and regulations. At the time of our 

audit, the pertinent legislation and the applicable regulations were: 

• Pub. L. No. 107-300 (2002), Improper Payments Information Act of 

2002 

• Pub. L. No. 107-107 (2001), National Defense Authorization Act for 

FY 2002, Subchapter VI – Recovery Audits 

• Office of Management and Budget Memorandum M-03-07, Programs to 

Identify and Recover Erroneous Payments to Contactors 

• Office of Management and Budget Memorandum M-03-12, Allowability 

of Contingency Fee Contracts for Recovery Audits 

• Office of Management and Budget Memorandum M-03-13, 

Implementation Guidance for the Improper Payments Information Act 

of 2002, P.L. 107-300 

• Office of Management and Budget Memorandum M-04-20, FY 2004 

Performance and Accountability Reports and Reporting Requirements 

for the Financial Report of the United States Government 

• Office of Management and Budget Circular A-136 - Revised July 2006,

Financial Reporting Requirements, Sections II.2.9 and II.5.6 

• Office of Management and Budget Circular A-123, Appendix C, 

Requirements for Effective Measurement and Remediation of Improper 

Payments

• Office of Management and Budget Circular A-123 Revision, 

Management’s Responsibility for Internal Control

• Financial Management Policies and Procedures Bulletin 06-11 

- 38 - 
Except for the issues discussed in the Findings and Recommendations 

section of this report, nothing came to our attention that caused us to 

believe that the components in our audit were not in compliance with the 

laws and regulations listed above and on the previous page. 

- 39 - 
STATEMENT ON INTERNAL CONTROLS 

 In planning and performing our audit, we considered internal controls 

at DOJ components for the purpose of determining our auditing procedures. 

We also reviewed various controls over the payment processes at these 

components to develop an understanding of those processes. In addition, 

we conducted a limited review of the controls, including policies and 

procedures, which the OBDs, FPI, DEA, and ATF represented were in place to 

prevent improper payments. However, these reviews did not include an 

overall assessment or testing of the internal control structure. Therefore, 

these reviews were not made for the purpose of providing assurance on the 

internal control structure as a whole. However, we noted certain matters 

that we consider to be reportable conditions under generally accepted 

Government Auditing Standards. 

Reportable conditions involve matters coming to our attention relating 

to significant deficiencies in the design or operation of the internal control 

structure that, in our judgment, could increase the risks for making improper 

payments or could hinder the implementation of cost-effective recovery 

audit programs. We noted deficiencies relating to the prevention of 

improper payments, discussed in Finding 1. We also noted deficiencies 

concerning the identification and recovery of improper payments, discussed 

in Finding 2. However, we did not consider these deficiencies to be a result 

of systemic internal control issues. 

Because we are not expressing an opinion on the components’ internal 

control structure as a whole, this statement is intended solely for the 

information and use of JMD, OBDs, FPI, DEA, and ATF in overseeing each 

component’s compliance with the IPIA, and with implementing and 

administering a recovery audit program within each component. 

- 40 - 
APPENDIX I 

OBJECTIVES, SCOPE, AND METHODOLOGY 

The objectives of our audit were to determine whether selected DOJ 

components established: 

• policies and procedures for identifying improper and erroneous 

payments, 

• policies and procedures for preventing improper and erroneous 

payments, and 

• methods to recover improper and erroneous payments. 

We conducted our audit in accordance with Government Auditing 

Standards. We included such tests as were considered necessary to 

accomplish the audit objectives. 

The audit generally covered activities from FY 1999 through the 

conclusion of our fieldwork in May 2006. Audit work was conducted at the 

Justice Management Division and at the four DOJ components selected for 

review: (1) Offices, Boards and Divisions; (2) Federal Prison Industries; 

(3) Drug Enforcement Administration; and (4) Bureau of Alcohol, Tobacco, 

Firearms and Explosives. These components were selected based on a 

request from JMD to expand the scope of the April 2005 OIG audit to include 

the remaining four DOJ components mentioned above.20

Audit work was also performed at six subcomponents of the OBDs: 

(1) Regime Crimes Liaison Office, (2) Office on Violence Against Women, 

(3) Civil Division, (4) Office of Community Oriented Policing Services, 

(5) Executive Office for Immigration Review, and (6) Wireless Management 

Office.21 Our methodology for selection of the specific subcomponents of the 

OBDs included in our audit was to review the OBDs listing of 

subcomponents, select high-vendor payment subcomponents, 

subcomponents with foreign payments, and subcomponents with federal 

award functions. 

 20 Department of Justice, Office of the Inspector General. Department of Justice 

Process for Identifying, Preventing, and Recovering Improper and Erroneous Payments, 

Audit Report No. 05-19, April 2005. 

21 The Regime Crimes Liaison Office is a component of the Office of the Deputy 

Attorney General. 

 

- 41 - 
We conducted on-site work at JMD and at each of the four components 

in March and April 2006. Additional on-site work was performed at the six 

selected subcomponents of the OBDs in May 2006. We interviewed staff 

members at each location to: 

• obtain an understanding of the procedures and rationale used to 

complete IPIA reports, 

• gather information relating to payment processes, 

• identify the controls in place to prevent or reduce improper payments, 

• obtain an understanding of any processes used to identify and quantify 

improper payments already made, and 

• assess any current recovery audit activities. 

 In addition, we reviewed policies, procedures, and other 

documentation related to these issues. Specifically, we reviewed the FY 

2005 IPIA reports submitted by the components to JMD. The information in 

these reports was analyzed in conjunction with Bulletin 06-11, dated March 

2006. We used this approach in order to identify any necessary 

enhancements for full compliance in the FY 2006 IPIA reporting period. 

 Finally, we interviewed officials from the recovery audit contractor 

being utilized by selected DOJ components and the subcomponents of the 

OBDs. We obtained information on current efforts within DOJ, including the 

processes used, results achieved, and anticipated future activities. 

- 42 - 
APPENDIX II 

THE PRESIDENT’S MANAGEMENT AGENDA 

According to a report from OMB, the President’s Management Agenda, 

enacted in August 2001, is a strategy for improving the management and 

performance of the federal government. It focuses on the areas where 

deficiencies were most apparent and where the government could begin to 

deliver concrete, measurable results. The President’s Management Agenda 

includes the following five government-wide initiatives:22

• Strategic Management of Human Capital – having processes in place to 

ensure the right person is in the right job, at the right time, and is not 

only performing, but performing well; 

• Competitive Sourcing – regularly examining commercial activities 

performed by the government to determine whether it is more efficient 

to obtain such services from federal employees or from the private 

sector; 

• Improved Financial Performance – accurately accounting for the 

taxpayers’ money, giving managers timely and accurate program cost 

information to make informed management decisions, and controlling 

costs; 

• Expanded Electronic Government – ensuring that the federal 

government’s annual investment in information technology (IT) 

significantly improves the government’s ability to serve citizens, and 

that IT systems are secure, and delivered on time and on budget; and 

• Budget and Performance Integration – ensuring that performance is 

routinely considered in funding and management decisions, and that 

programs achieve expected results and work toward continual 

improvement. 

The third initiative, “Improved Financial Performance,” includes 

provisions for agencies to determine the extent of improper payments and to 

establish goals for reducing them. 

 22 Excerpts from the President’s Management Agenda were taken from an OMB 

report, entitled The Federal Government is Results-Oriented, dated August 2004. 

- 43 - 
APPENDIX III 

DEPARTMENT OF JUSTICE 

OFFICES, BOARDS AND DIVISIONS

SUBCOMPONENT

Antitrust Division 

Civil Division 

Civil Rights Division 

Community Relations Service 

Criminal Division 

Environment and Natural Resources Division 

Executive Office for Immigration Review 

Executive Office for United States Attorneys 

Executive Office for United States Trustees 

Foreign Claims Settlement Commission 

Interpol-United States National Central Bureau 

Justice Management Division 

National Drug Intelligence Center 

Office of the Associate Attorney General 

Office of the Attorney General 

Office of Community Oriented Policing Services 

Office of the Deputy Attorney General 

Office of Dispute Resolution 

Office of the Federal Detention Trustee 

Office of Information and Privacy 

Office of the Inspector General 

Office of Intelligence Policy and Review 

Office of Intergovernmental and Public Liaison 

Office of Legal Counsel 

Office of Legal Policy 

Office of Legislative Affairs 

Office of the Pardon Attorney 

Office of Professional Responsibility 

Office of Public Affairs 

Office of the Solicitor General 

Office on Violence Against Women 

Professional Responsibility Advisory Office 

Tax Division 

United States Parole Commission 

Wireless Management Office 

 Source: DOJ FY 2005 Performance and Accountability Report, Appendix B 

- 44 - 
APPENDIX IV 

UNITED STATES ATTORNEY DISTRICTS 

DISTRICT NAME DISTRICT NAME

Alabama Middle District Louisiana Middle District 

Alabama Northern District Louisiana Western District 

Alabama Southern District Maine District 

Alaska District Maryland District 

Arizona District Massachusetts District 

Arkansas Eastern District Michigan Eastern District 

Arkansas Western District Michigan Western District 

California Central District Minnesota District 

California Eastern District Mississippi Northern District 

California Northern District Mississippi Southern District 

California Southern District Missouri Eastern District 

Colorado District Missouri Western District 

Connecticut District Montana District 

Delaware District Nebraska District 

District of Columbia District Nevada District 

Florida Middle District New Hampshire District 

Florida Northern District New Jersey District 

Florida Southern District New Mexico District 

Georgia Middle District New York Eastern District 

Georgia Northern District New York Northern District 

Georgia Southern District New York Southern District 

Guam District New York Western District 

Hawaii District North Carolina Eastern District 

Idaho District North Carolina Middle District 

Illinois Central District North Carolina Western District 

Illinois Northern District North Dakota District 

Illinois Southern District Ohio Northern District 

Indiana Northern District Ohio Southern District 

Indiana Southern District Oklahoma Eastern District 

Iowa Northern District Oklahoma Northern District 

Iowa Southern District Oklahoma Western District 

Kansas District Oregon District 

Kentucky Eastern District Pennsylvania Eastern District 

Kentucky Western District Pennsylvania Middle District 

Louisiana Eastern District Pennsylvania Western District 

- 45 - 
UNITED STATES ATTORNEY DISTRICTS 

 Source: Management at JMD Quality Control and Compliance Group 

DISTRICT NAME DISTRICT NAME

Puerto Rico District Vermont District 

Rhode Island District Virgin Islands District 

South Carolina District Virginia Eastern District 

South Dakota District Virginia Western District 

Tennessee Eastern District Washington Eastern District 

Tennessee Middle District Washington Western District 

Tennessee Western District West Virginia Northern District 

Texas Eastern District West Virginia Southern District 

Texas Northern District Wisconsin Eastern District 

Texas Southern District Wisconsin Western District 

Texas Western District Wyoming District 

Utah District 

- 46 - 
APPENDIX V 

ANNUAL IMPROPER PAYMENT INFORMATION ACT REPORT 

To satisfy the reporting requirements of the Improper Payments Information 

Act (IPIA), a brief summary of what components have accomplished, and 

plan to accomplish, must be included in the Management Discussion and 

Analysis (MD&A) portion of the Annual Performance and Accountability 

Report. This summary, not to exceed 2 pages, must be entitled: 

Improper Payments Information Act of 2002 

Narrative Summary of Implementation Efforts for FY_____ 

and Agency Plans for FY ____ - FY ____ 

In addition to the narrative summary above, the following items are the IPIA 

Reporting Detail required for the report. 

I. Describe your component’s risk assessment(s), performed subsequent 

to compiling your full program inventory. List the risk-susceptible 

programs (i.e., programs that have a significant risk of improper 

payments based on OMB guidance thresholds) identified through your 

risk assessments. Be sure to include the programs previously 

identified in the former Section 57 of OMB Circular A-11. 

II. Describe the statistical sampling process conducted to estimate the 

improper payment rate for each program identified. Statistical 

sampling is not required in any program you have determined not to 

be at significant risk according to OMB thresholds. 

III. Describe the Corrective Action Plan for: 

A. Reducing the estimated rate of improper payments. Include in 

this discussion what is seen as the cause(s) of errors and the 

corresponding steps necessary to prevent future occurrences. If 

efforts are already underway, and/or have been ongoing for 

some length of time, it is appropriate to include that information 

in this section. 

B. Grant-making agencies with risk susceptible grant programs, 

discuss what your component has accomplished in the area of 

fund stewardship past the primary recipient. Include the status 

on projects and results of any reviews. 

- 47 - 
A response is not required for any program you have determined not 

to be at significant risk according to the OMB thresholds. 

IV. The table titled “Improper Payment Reduction Outlook” is required for 

each component. Note that: (1) all risk-susceptible programs must 

be listed in this chart whether or not an error measurement is being 

reported; (2) where no measurement is provided, components should 

indicate the date by which a measurement is expected; (3) if the 

Current Year (CY) is the baseline measurement year, indicate by either 

footnote or by “n/a” in the Prior Year (PY) column; (4) if any of the 

dollar amount(s) included in the estimate correspond to newly 

established measurement components in addition to previously 

established measurement components, separate the two amounts to 

the extent possible; (5) include outlay estimates for CY+1, +2, and 

+3; and (6) components are expected to report on CY activity. 

Improper Payment Reduction Outlook 

($ in millions) 

Future year estimates (CY+1, +2, and +3) should match the outlay 

estimates for those years as reported in the most recent President’s Budget. 

PROGRAM

PY

OUTLAYS

PY

IP

% 

PY

IP $

CY

OUTLAYS

CY

IP

% 

CY

IP $

CY+1

OUTLAYS

CY+1

IP % 

CY+1

IP $ 

PROGRAM

CY+2

OUTLAYS

CY+2

IP % 

CY+2

IP $ 

CY+3

OUTLAYS

CY+3

IP % 

CY+3

IP $ 

Note: Improper Payment (IP) 

Over- and under-payments should be indicated if this information is 

available. The absolute value of the dollars and the rates should be 

shown - do not net the figures. 

V. Discuss your component’s recovery auditing effort, if applicable, 

including any contract types excluded from review and the justification 

for doing so; actions taken to recoup improper payments, and the 

business process changes and internal controls instituted and/or 

strengthened to prevent further occurrences. In addition, complete 

the table below. 

- 48 - 
COMPONENT

AMOUNT 

SUBJECT TO 

REVIEW FOR 

FY __

REPORTING1

ACTUAL 

AMOUNT 

REVIEWED 

AND 

REPORTED

AMOUNTS 

IDENTIFIED 

FOR 

RECOVERY

AMOUNTS 

IDENTIFIED/

ACTUAL 

AMOUNT 

REVIEWED

AMOUNTS 

RECOVERED 

CY 

AMOUNTS 

RECOVERED 

PY(S) 

1 This amount should equal the total of each component’s commercial and noncommercial payments. 

VI. Describe the steps the component has taken and planned (including a 

timeline) to ensure those agency managers (including agency heads) 

are held accountable for reducing and recovering improper payments. 

VII. A. Describe whether the component has the information system 

and infrastructure it needs to reduce improper payments to the 

levels the component has targeted. 

 B. If the component does not have such systems and 

infrastructure, describe the resources the component requested 

in its budget submission to Congress to obtain the necessary 

information systems and infrastructure. 

VIII. Describe any statutory or regulatory barriers, which may limit the 

component’s corrective actions in reducing improper payments and 

actions taken by the component to mitigate the barriers’ effects. 

IX. Additional comments, if any, on overall component efforts, specific 

programs, best practices, or common challenges identified, as a result 

of IPIA implementation. 

- 49 - 
- 50 - 

APPENDIX VI 

ACRONYMS

ACRONYM NAME

ATF Bureau of Alcohol, Tobacco, Firearms and Explosives 

BOP Federal Bureau of Prisons 

CIV Civil Division 

COPS Office of Community Oriented Policing Services 

COTRs Contracting Officer Technical Representatives 

CY Current Year 

DEA Drug Enforcement Administration 

DOJ Department of Justice 

EOIR Executive Office for Immigration Review 

FBI Federal Bureau of Investigation 

FNOF Financial Analysis and Reporting Unit 

FPI Federal Prison Industries 

FY Fiscal Year 

IP Improper Payment 

IPIA Improper Payments Information Act of 2002 

JMD Justice Management Division 

MD&A Management Discussion and Analysis 

NDAA National Defense Authorization Act for FY 2002 

OBDs Offices, Boards and Divisions 

OIG Office of the Inspector General 

OJP Office of Justice Programs 

OMB Office of Management and Budget 

OVW Office on Violence Against Women 

PAR Performance and Accountability Report 

PY Prior Year 

RCLO Regime Crimes Liaison Office 

USMS United States Marshals Service 

WMO Wireless Management Office 
- 51 - 

APPENDIX VII
- 52 - 
- 53 - 
- 54 - 

APPENDIX VIII
- 55 - 
- 56 - 

APPENDIX IX
- 57 - 
- 58 - 

APPENDIX X
- 59 - 
- 60 - 
APPENDIX XI 

ANALYSIS AND SUMMARY OF ACTIONS 

NECESSARY TO CLOSE THE REPORT 

We provided a draft audit report to JMD, FPI, DEA, and ATF for review 

and comments. Each component’s comments have been incorporated in 

Appendices VII through X of this report, which details the actions taken or 

plans for implementing our recommendations. Based on the written 

comments from the audited components, minor adjustments were made to 

the report and the status of the recommendations are as follows. 

1. Closed (JMD).

2. Closed (JMD).

3. Resolved (OBDs/JMD). This recommendation can be closed when 

we receive documentation supporting that for the OBDs, JMD has 

included the following information within the OBDs’ risk assessment: 

(1) the results from the most recent financial statement audit, 

including any material weaknesses or reportable conditions; (2) the 

effect of those weaknesses or conditions on its risk of making improper 

payments; and (3) a description of the corrective action taken to 

address those weaknesses or conditions as required by Bulletin 06-11. 

4. Resolved (OBDs/JMD). This recommendation can be closed when 

we receive documentation supporting that for the OBDs, JMD has 

included the following information within the OBDs’ risk assessment: 

(1) an assurance statement of an unqualified, qualified, or 

no-assurance opinion; (2) the reason for the opinion and its effect on 

the component's risk of making improper payments; and (3) any 

corrective actions being taken to address the opinion and the 

component's risk. 

5. Resolved (OBDs/JMD). This recommendation can be closed when 

we receive documentation supporting that for the OBDs, JMD has 

included an assessment of federal award payments made by the 

recipients and subrecipients as required by Bulletin 06-11. 

6. Resolved (FPI). This recommendation can be closed when we 

receive documentation supporting that the FPI has included the 

following information within its risk assessment: (1) the results from 

the most recent financial statement audit, including any material 

weaknesses or reportable conditions; (2) the effect of those 

- 61 - 
weaknesses or conditions on its risk of making improper payments; 

and (3) a description of the corrective action taken to address those 

weaknesses or conditions as required by Bulletin 06-11. 

7. Resolved (FPI). This recommendation can be closed when we 

receive documentation supporting that the FPI has included the 

following information within its risk assessment: (1) an assurance 

statement of an unqualified, qualified, or no-assurance opinion; 

(2) the reason for the opinion and its effect on the component's risk of 

making improper payments; and (3) any corrective actions being 

taken to address the opinion and the component's risk. 

8. Resolved (DEA). This recommendation can be closed when we 

receive documentation supporting that the DEA has included the 

following information within its risk assessment: (1) an assurance 

statement of an unqualified, qualified, or no-assurance opinion; 

(2) the reason for the opinion and its effect on the component's risk of 

making improper payments; and (3) any corrective actions being 

taken to address the opinion and the component's risk. 

9. Resolved (ATF). This recommendation can be closed when we 

receive documentation supporting that ATF has included the following 

information within its risk assessment: (1) the results from the most 

recent financial statement audit, including any material weaknesses or 

reportable conditions; (2) the effect of those weaknesses or conditions 

on its risk of making improper payments; and (3) a description of the 

corrective action taken to address those weaknesses or conditions as 

required by Bulletin 06-11. 

10. Resolved (ATF). This recommendation can be closed when we 

receive documentation supporting that ATF has included the following 

information within its risk assessment: (1) an assurance statement of 

an unqualified, qualified, or no-assurance opinion; (2) the reason for 

the opinion and its effect on the component's risk of making improper 

payments; and (3) any corrective actions being taken to address the 

opinion and the component's risk. 

11. Resolved (ATF). This recommendation can be closed when we 

receive documentation supporting that ATF has conducted a complete 

program inventory and risk assessment for each program, and 

maintained documentation as required by Bulletin 06-11. 

12. Closed (JMD).

- 62 - 
13. Closed (OBDs/JMD).

14. Resolved (OBDs/JMD). This recommendation can be closed when 

we receive documentation supporting that for the OBDs, JMD has 

addressed and included grants within the OBDs’ recovery audit 

program as required by Bulletin 06-11. 

15. Resolved (FPI). This recommendation can be closed when we 

receive documentation supporting that the FPI has implemented a 

contract compliance review within its recovery audit program as 

required by Bulletin 06-11. 

16. Resolved (FPI). This recommendation can be closed when we 

receive documentation supporting that the FPI has implemented a final 

policy for its recovery audit program as required by Bulletin 06-11. 

17. Resolved (ATF). This recommendation can be closed when we 

receive documentation supporting that ATF has developed methods for 

tracking improper payments separately from other debts, so it can 

provide information on the amount of improper payments identified 

and recovered; and ATF has included and maintained documentation 

on the timeframe in which the identified and recovered improper 

payments occurred. 

18. Resolved (ATF). This recommendation can be closed when we 

receive documentation supporting that ATF has demonstrated progress 

toward utilizing the recovery audit contractor as required by 

Bulletin 06-11. 

19. Resolved (ATF). This recommendation can be closed when we 

receive documentation supporting that ATF has expanded the scope of 

the recovery audit program to encompass, at a minimum, all 

payments made from FY 2003 forward as required by Bulletin 06-11. 

20. Resolved (ATF). This recommendation can be closed when we 

receive documentation supporting that ATF has developed and 

implemented a final written policy and procedure when a program is in 

place for ATF’s recovery audit program as required by Bulletin 06-11. 

- 63 -