OFFICE OF 

INSPECTOR GENERAL 

UNITED STATES 

SECURITIES AND EXCHANGE COMMISSION 

 WASHINGTON, D.C. 20549 

l 

 

 

 

March 19, 2024 

TO: Caryn Kauffman, Chief Financial Officer, Office of Financial Management 

FROM: Rebecca L. Sharek, Deputy Inspector General for Audits, Evaluations, and 

Special Projects, Office of Inspector Genera

SUBJECT: Final Management Letter: Evaluation of the U.S. Securities and Exchange 

Commission’s Fiscal Year 2023 Compliance with the Payment Integrity 

Information Act of 2019 

The Payment Integrity Information Act of 2019 (PIIA) defines an “improper payment” as “any 

payment that should not have been made or that was made in an incorrect amount, including 

an overpayment or underpayment, under a statutory, contractual, administrative, or other 

legally applicable requirement.”1 Among other things, improper payments include duplicate 

payments and any payment to an ineligible recipient or for an ineligible good or service.2 

To improve efforts to identify and reduce government-wide improper payments, PIIA requires 

federal agencies to identify and review all programs and activities that may be susceptible to 

significant improper payments based on Office of Management and Budget (OMB) guidance.3 

PIIA also requires inspectors general to review their agency’s improper payment reporting and 

issue an annual report regarding agency compliance with PIIA requirements.4 

In January 2024, the U.S. Securities and Exchange Commission’s (SEC) Office of Inspector 

General (OIG) announced an evaluation of the SEC’s fiscal year (FY) 2023 compliance with 

PIIA. We sought to determine whether the SEC met all applicable requirements of PIIA, and to 

evaluate the SEC’s efforts to prevent and reduce improper payments. Overall, we concluded 

that the SEC complied with PIIA in FY 2023 and reported efforts to prevent and reduce 

improper payments. This management letter summarizes the results of our evaluation. 

Objective, Scope, and Methodology 

Our objective was to determine whether, in FY 2023, the SEC complied with PIIA and 

evaluate, if applicable, the SEC’s (a) risk assessment methodology, (b) improper payment rate 

estimates, (c) sampling and estimation plan(s), (d) corrective action plan(s), and (e) efforts to 

prevent and reduce improper payments. We conducted our review based on requirements 

from OMB Circular No. A-123, Appendix C, Requirements for Payment Integrity Improvement 

(March 2021); OMB Circular No. A-136, Financial Reporting Requirements (May 2023); OMB 

1

 Payment Integrity Information Act of 2019 (PIIA), P.L. 116-117, 31 U.S.C. § 3351 (4) (A), et seq. (2019). PIIA repealed the Improper 

Payments Information Act of 2002 (IPIA), the Improper Payments Elimination and Recovery Act of 2010 (IPERA), the Improper Payments 

Elimination and Recovery Improvement Act of 2012 (IPERIA), and the Fraud Reduction and Data Analytics Act of 2015. 

2

 31 U.S.C. § 3351 (4) (B). 

3

 31 U.S.C. § 3352 (a) (1) (B). 

4

 31 U.S.C. § 3353 (a) (1). 
Ms. Kauffman 

March 19, 2024 

Page 2 

Annual Data Call Instructions; and the Council of the Inspectors General on Integrity and 

Efficiency’s guidance required under PIIA.5 To address our objective, we: 

 met with officials from the SEC’s Office of Financial Management Internal Controls 

Branch; 

 reviewed internal controls and prior work performed regarding improper payments and 

payment integrity reporting; and 

 reviewed the SEC’s FY 2023 Agency Financial Report (AFR) and accompanying 

materials. 

We conducted this evaluation from January to March 2024 in accordance with the Council of 

the Inspectors General on Integrity and Efficiency’s Quality Standards for Inspection and 

Evaluation. Those standards require that we plan and perform the evaluation to obtain 

sufficient, appropriate evidence to provide a reasonable basis for our findings, conclusions, 

and recommendations based on our evaluation objective. We believe that the evidence 

obtained provides a reasonable basis for our findings and conclusions based on our evaluation 

objective. 

Results 

Based on our review of relevant information, we determined that the SEC complied with PIIA in 

FY 2023. As described in OMB guidance, agencies must complete the following steps, as 

applicable, to be considered compliant: 

 Requirement 1a: Publish payment integrity information with the annual financial 

statement. 

 Requirement 1b: Post the annual financial statement and accompanying materials on 

the agency website. 

 Requirement 2a: Conduct improper payment risk assessments for each program with 

annual outlays greater than $10 million at least once in the last three years. 

 Requirement 2b: Adequately conclude whether the program is likely to make improper 

payments and unknown payments above or below the statutory threshold. 

 Requirement 3: Publish improper payment and unknown payment estimates for 

programs susceptible to significant improper payments and unknown payments in the 

accompanying materials to the annual financial statement. 

 Requirement 4: Publish corrective action plans for each program for which an estimate 

above the statutory threshold was published in the accompanying materials to the 

annual financial statement. 

5

 Council of the Inspectors General on Integrity and Efficiency, Guidance for Payment Integrity Information Act Compliance Reviews 

(October 19, 2023). 
 

 

 

 

 

 

 

 

Ms. Kauffman 

March 19, 2024 

Page 3 

 Requirement 5a: Publish an improper payment and unknown payment reduction target 

for each program for which an estimate above the statutory threshold was published in 

the accompanying materials to the annual financial statement. 

 Requirement 5b: Demonstrate improvements to payment integrity or reach a tolerable 

improper payment and unknown payment rate. 

 Requirement 5c: Develop a plan to meet the improper payment and unknown payment 

reduction target. 

 Requirement 6: Report an improper payment and unknown payment estimate of less 

than 10 percent for each program for which an estimate was published in the 

accompanying materials to the annual financial statement. 

The following table shows the SEC’s compliance with PIIA requirements that were applicable, 

and PIIA requirements that were not applicable, for the eight SEC payment programs subject 

to PIIA in FY 2023. 

TABLE. PIIA Compliance Reporting, FY 2023 

Program

Name 

Requirement 1a 

Requirement 1b 

Requirement 2a 

Requirement 2b 

Requirement 3 Requirement 4 

Requirement 5a 

Requirement 5b 

Requirement 5c 

Requirement 6 

Vendor payments N/A 

Disgorgement and penalty distributions N/A 

Registration filing fee refunds N/A 

Payroll and benefit payments N/A 

Supplemental retirement payments N/A 

Purchase card payments N/A 

Travel payments N/A 

Whistleblower payments N/A 

Source: OIG-generated. “ ” indicates compliance; “N/A” indicates requirements that were not applicable. 

The SEC was not required to, and thus did not perform risk assessments for its eight payment 

programs in FY 2023.6 This determination was based on the SEC having: 

6

 Under OMB Memorandum M-21-19, Section II.A.2, agencies must perform risk assessments at least once every three years for programs 

with annual outlays greater than $10 million and that are deemed to be not susceptible to significant improper payments. However, if a 

program that is on a three-year risk assessment cycle experiences a significant change in legislation and/or a significant increase in its funding 

level, agencies may need to reassess the program’s risk susceptibility during the next annual cycle, even if it is less than three years from the 

last risk assessment. 
 

 

 

 

 

 

 

 

 

Ms. Kauffman 

March 19, 2024 

Page 4 

 performed a program-specific risk assessment in FY 2022, which did not identify any 

programs or activities susceptible to significant improper payments at or above the 

reporting threshold;7 

 determined that there was low risk of improper payments given the controls and 

processes in place;8 and 

 no changes to its oversight or reporting on improper payments, funding, or legislation 

that would impact its payment integrity reporting or oversight of internal controls over 

reporting.9 

The SEC determined that implementing a payment recapture audit program was not costeffective and notified OMB of this decision in September 2015. This determination was still 

effective in FY 2023. The SEC has advised that it will continue to monitor for improper 

payments across all of its programs and activities and will assess whether implementing 

payment recapture audits for each program is cost-effective in the future. Additionally, in 

compliance with Section II.4.5 of OMB Circular A-136, Financial Reporting Requirements, the 

SEC’s FY 2023 AFR included a link to paymentaccuracy.gov to further explain improper 

payments and the information reported in previous AFRs not included in the FY 2023 AFR. 

On March 7, 2024, we provided SEC management with a draft of our management letter for 

review and comment. On March 12, 2024, the SEC stated it did not have any comments and 

would not be submitting a formal written response. 

We appreciate the courtesies and cooperation extended to us during this evaluation. If you 

have questions, please contact me or Colin Heffernan, Audit Manager. 

cc: Gary Gensler, Chair 

Amanda Fischer, Chief of Staff, Office of Chair Gensler 

Heather Slavkin Corzo, Policy Director, Office of Chair Gensler 

Kevin Burris, Counselor to the Chair and Director of Legislative and Intergovernmental 

Affairs 

Scott Schneider, Counselor to the Chair and Director of Public Affairs 

Philipp Havenstein, Operations Counsel, Office of Chair Gensler 

Ajay Sutaria, Legal Counsel, Office of Chair Gensler 

Hester M. Peirce, Commissioner 

7

 Section 3352 (a)(3)(A) of PIIA defines “significant” to mean that, in a preceding fiscal year, the sum of a program or activity’s improper 

payments and payments whose propriety cannot be determined by an executive agency due to lacking sufficient documentation may have 

exceeded: (1) both 1.5 percent of program outlays and $10 million of all program or activity payments made during the fiscal year reported; or 

(2) $100 million (regardless of the improper payment percentage of total program outlays). On May 5, 2023, we issued a report titled, 

Evaluation of the SEC’s FY 2022 Compliance With the Payment Integrity Information Act of 2019 (Report No. 578). We determined that the 

SEC complied with PIIA reporting requirements in FY 2022. 

8

 The SEC did not identify any programs or activities susceptible to significant improper payments during its FY 2022 risk assessment. 

Therefore, the agency was not required to publish improper payment estimates, publish corrective action plans, publish and meet reduction 

targets, or report an improper payment rate of less than 10 percent. 

9

 In FY 2023, the SEC conducted an internal risk assessment for the agency’s student loan repayment program because agency officials 

expect future program payments to increase. The SEC determined that the risk of significant improper payments stemming from the student 

loan repayment program was low, and we assessed the determination of low risk as reasonable. We verified that disbursements for the 

student loan repayment program were less than $4 million in FY 2023. Because disbursements were less than $10 million, the SEC was not 

required to report and did not report this information in its FY 2023 annual financial statement. 
 

 

 

 

 

 

 

 

 

Ms. Kauffman 

March 19, 2024 

Page 5 

Benjamin Vetter, Counsel, Office of Commissioner Peirce 

Caroline A. Crenshaw, Commissioner 

Malgorzata Spangenberg, Counsel, Office of Commissioner Crenshaw 

Mark T. Uyeda, Commissioner

 Holly Hunter-Ceci, Counsel, Office of Commissioner Uyeda 

Jaime Lizárraga, Commissioner 

Laura D’Allaird, Counsel, Office of Commissioner Lizárraga 

Parisa Haghshenas, Counsel, Office of Commissioner Lizárraga 

Megan Barbero, General Counsel 

Elizabeth McFadden, Deputy General Counsel General Litigation, Office of the 

 General Counsel 

Lisa Helvin, Principal Deputy General Counsel for Adjudication and Oversight, Office 

 of the General Counsel 

David Leviss, Associate General Counsel for Oversight and Investigations, Office 

 of the General Counsel 

 Stephen Jung, Assistant General Counsel for Intragovernmental and 

 Congressional Affairs, Office of the General Counsel 

Kenneth Johnson, Chief Operating Officer, Office of Financial Management 

Shelly Luisi, Chief Risk Officer, Office of the Chief Risk Officer 

Jim Lloyd, Assistant Chief Risk Officer/Audit Coordinator, Office of the Chief Risk 

Officer 

Deborah J. Jeffrey, Inspector General