IMPROPER 

PAYMENTS

Improvements 

Needed in CMS and 

IRS Controls over 

Health Insurance 

Premium Tax Credit

Report to Congressional Committees

July 2017

GAO-17-467

United States Government Accountability Office
United States Government Accountability Office

Highlights of GAO-17-467, a report to 

congressional committees

July 2017

IMPROPER PAYMENTS

Improvements Needed in CMS and IRS Controls over 

Health Insurance Premium Tax Credit

What GAO Found

In fiscal year 2016, the Department of Health and Human Services’ (HHS) 

Centers for Medicare & Medicaid Services (CMS) assessed its advance premium 

tax credit (PTC) program as susceptible to significant improper payments. CMS 

instituted a qualitative method for assessing the susceptibility of its program that 

was consistent with requirements, including assessing each of the nine required 

qualitative risk factors. However, CMS stated that it may not report improper 

payment estimates for the PTC program as required until at least fiscal year 

2022 because of the complexity and timing of the process for developing such 

estimates. As a result, HHS’s overall improper payments estimate will continue 

to be understated, and Congress and others will continue to lack key payment 

integrity information for monitoring HHS’s improper payments. The fiscal year 

2016 Internal Revenue Service (IRS) assessment for its PTC program was not 

consistent with requirements nor did it demonstrate whether the program met 

applicable thresholds for susceptibility to significant improper payments. Until 

IRS conducts an appropriate assessment, it will remain uncertain whether IRS 

should estimate the amount of improper payments for its PTC program.

Although CMS properly designed and implemented control activities related to 

the accuracy of advance PTC payments, it did not properly design control 

activities related to preventing and detecting improper payments of advance 

PTC, such as verifying individuals’ eligibility. As a result, CMS is at increased risk 

of making improper payments of advance PTC to issuers on behalf of 

individuals.

CMS Key Control Activities Related to Preventing and Detecting Improper Payments of 

Advance PTC

a

GAO did not evaluate whether control activities that were not properly designed were operating as 

designed.

Why GAO Did This Study

The Patient Protection and Affordable 

Care Act (PPACA) aims to expand 

health insurance coverage and 

affordability. PPACA provides eligible 

individuals with PTC to help cover the 

cost of premiums for health plans 

purchased through a marketplace. 

CMS maintains the federally facilitated 

marketplace known as 

HealthCare.gov. IRS is responsible for 

processing PTC-related amounts on 

tax returns. The estimated fiscal year 

2016 net outlay for PTC that was 

refunded to taxpayers was about $24 

billion, while the estimated revenue 

effect from PTC that taxpayers used to 

reduce their tax liabilities was about $2 

billion.

GAO was asked to examine improper 

payments related to PTC. This report 

assesses the extent to which (1) CMS 

and IRS assessed the susceptibility of 

their PTC programs to significant 

improper payments; (2) CMS properly 

designed and implemented key control 

activities related to preventing and 

detecting improper payments of 

advance PTC; and (3) IRS properly 

designed and implemented key control 

activities related to preventing and 

detecting improper payments of PTC, 

including recovering overpayments and 

reimbursing underpayments of PTC. 

GAO reviewed the improper payment 

susceptibility assessments completed 

by CMS and IRS; interviewed agency 

officials; reviewed policies and 

procedures; and tested statistical 

samples of (1) CMS applications with 

advance PTC transactions during the 

2016 open enrollment period and 

(2) income tax returns with PTC 

transactions processed during the first

9 months of fiscal year 2016.
United States Government Accountability Office

IRS did not design and implement certain key control activities related to 

preventing and detecting PTC improper payments, including recovering excess 

advance PTC overpayments. For example, IRS did not properly design 

procedures to routinely check for duplicate employer- or government-sponsored 

coverage. In addition, in 2015 and 2016, IRS used an ad hoc process for 

notifying nonfilers of the requirement to file tax returns; however, IRS did not 

establish procedures for sending these notices regularly during each filing 

season to facilitate compliance. Without properly designed control activities 

related to PTC, IRS is at increased risk of making improper payments to 

individuals.

IRS faces challenges that affect its ability to design and implement procedures 

related to preventing and detecting PTC improper payments, including recovering 

advance PTC overpayments and reimbursing advance PTC underpayments. For 

example, IRS maintains that reduced resources have impaired its ability to 

implement needed controls. Further, statutory limitations contributed to IRS’s 

inability to fully collect excess advance PTC overpayments and reimburse PTC 

underpayments and to automatically correct errors in tax returns. GAO previously 

suggested that IRS seek legislative authority to correct tax returns at filing based 

on marketplace data. The Department of the Treasury, on behalf of IRS, has 

submitted proposals for congressional consideration to permit IRS to correct

such errors where individuals’ information on tax returns does not match 

corresponding information provided in government databases. Congress has not 

yet granted this broad authority.

IRS Key Control Activities for Preventing and Detecting Improper Payments of PTC

a

Except for control activities related to IRS’s review of tax returns that contain errors, GAO did not 

evaluate whether other control activities that were not properly designed were operating as designed.

What GAO Recommends

GAO is making 10 recommendations 

to HHS. Of these, 2 recommendations 

are related to complying with annual 

reporting of advance PTC improper 

payments estimates, including

assuring that CMS expedites the

process for reporting such estimates. 

The 8 remaining recommendations

address improving control activities 

related to eligibility determinations and 

calculations of advance PTC based on 

incomes and family sizes. HHS 

concurred with 7 of the

recommendations and neither agreed 

nor disagreed with the remaining 3 

recommendations, which related to 

improving control activities for verifying 

identities of individuals, preventing 

duplicate coverage of individuals

receiving minimum essential coverage 

through their employers, and verifying 

household incomes and family sizes. 

GAO continues to believe that actions 

to implement these 3 

recommendations are needed as 

discussed in the report.

GAO is also making 5

recommendations to IRS. Of these, 1

recommendation focuses on properly 

assessing the susceptibility of the PTC 

program to significant improper 

payments. The remaining 4 

recommendations address improving 

control activities related to processing 

PTC information on tax returns, such 

as recovering advance PTC made for

individuals who do not meet the 

eligibility requirements for citizenship 

or lawful presence. IRS agreed with 2 

recommendations, partially agreed 

with 2 other recommendations, and 

disagreed with the remaining 

recommendation. For the 2 partial 

concurrences, GAO continues to 

believe that actions to fully implement 

these recommendations are needed 

as discussed in the report. Although 

IRS disagreed with the 1 

recommendation related to reviewing 

tax returns to those who are not 

reporting shared responsibility 

payments, the actions IRS described 

in its comments, if implemented

effectively, would address the 

recommendation.

View GAO-17-467. For more information, 

contact Beryl H. Davis at (202) 512-2623 or 

davisbh@gao.gov.
Page i GAO-17-467 Improper Payments

Letter 1

Background 6

CMS and IRS Did Not Take All Required Actions to Assess, 

Estimate, and Report PTC-Related Improper Payments 15

CMS Control Activities Related to Preventing and Detecting 

Improper Payments of Advance PTC Were Not Properly 

Designed 19

IRS’s Control Activities Related to PTC Were Not Properly 

Designed and Implemented 38

Conclusions 51

Recommendations for Executive Action 53

Agency Comments and Our Evaluation 55

Appendix I Objectives, Scope, and Methodology 60

Appendix II Standards for Internal Control in the Federal Government 66

Appendix III Comments from the Department of Health and Human Services 67

Appendix IV Comments from the Internal Revenue Service 76

Appendix V GAO Contact and Staff Acknowledgements 81

Table

Table 1: Repayment Limits for Excess Advance Premium Tax 

Credit for Tax Year 2016 49

Figures

Figure 1: Process for Taxpayers to Claim PTC 10

Figure 2: IRS’s Process for Verifying PTC Amounts on 

Tax Returns 12

Contents
Page ii GAO-17-467 Improper Payments

Figure 3: IRS Definitions of Risk Levels in Relation to IPIA 

Requirements 18

Figure 4: CMS Key Control Activities Related to Preventing and 

Detecting Improper Payments of Advance PTC 20

Figure 5: IRS Key Control Activities Related to Preventing and 

Detecting Improper Payments of PTC 39
Page iii GAO-17-467 Improper Payments

Abbreviations

ASFR Automated Substitute for Return

AVS Affordable Care Act Verification Service

CHIP Children’s Health Insurance Program

CMS Centers for Medicare & Medicaid Services

DHS Department of Homeland Security

EPD Exchange Periodic Data

FFM federally facilitated marketplace

HHS Department of Health and Human Services

IPIA Improper Payments Information Act of 2002, as amended

IRM Internal Revenue Manual

IRS Internal Revenue Service

OMB Office of Management and Budget

PARIS Public Assistance Reporting Information System

PPACA Patient Protection and Affordable Care Act 

PTC premium tax credit

PUPS Prisoner Update Processing System

SFR substitute for return

SSA Social Security Administration

SRP shared responsibility payment

Treasury Department of the Treasury

This is a work of the U.S. government and is not subject to copyright protection in the 

United States. The published product may be reproduced and distributed in its entirety 

without further permission from GAO. However, because this work may contain 

copyrighted images or other material, permission from the copyright holder may be 

necessary if you wish to reproduce this material separately.
Page 1 GAO-17-467 Improper Payments

441 G St. N.W.

Washington, DC 20548

July 13, 2017

The Honorable Roy Blunt

Chairman

The Honorable Patty Murray

Ranking Member

Subcommittee on Labor, Health and Human Services, 

Education, and Related Agencies

Committee on Appropriations

United States Senate

The Honorable Tom Cole

Chairman

The Honorable Rosa DeLauro

Ranking Member

Subcommittee on Labor, Health and Human Services, 

Education, and Related Agencies

Committee on Appropriations

House of Representatives

The Patient Protection and Affordable Care Act (PPACA) aims to expand 

health insurance coverage and make it more affordable for low-income 

households.1 PPACA required the establishment of health insurance 

exchanges, or marketplaces, in all states to assist individuals in 

comparing and selecting among insurance plans offered by participating 

private issuers of health care coverage,2 such as health insurance 

companies. Under PPACA, states may elect to operate their own 

respective health insurance marketplaces, but a majority of states rely on 

the federally facilitated marketplace (FFM), known to the public as 

HealthCare.gov. The Centers for Medicare & Medicaid Services (CMS) 

within the Department of Health and Human Services (HHS) is 

 1

Pub. L. No. 111-148, 124 Stat. 119 (Mar. 23, 2010), as amended by the Health Care and 

Education Reconciliation Act of 2010, Pub. L. No. 111-152, 124 Stat. 1029 (Mar. 30, 

2010). In this report, references to PPACA include any amendments made by the Health 

Care and Education Reconciliation Act.

2

We use “issuer” when referring to an insurance entity licensed by a state to engage in the 

business of insurance in that specific state.

Letter
Page 2 GAO-17-467 Improper Payments

responsible for overseeing the establishment of these state-based 

marketplaces and maintaining the FFM.

To help pay the cost of insurance premiums for taxpayers and their 

dependents, PPACA provides a premium tax credit (PTC) to individuals 

who meet certain income and other requirements. Individuals can have 

the federal government pay PTC to their issuers in advance on their 

behalf, known as advance PTC, which lowers their monthly premium 

payments. The advance PTC is based on estimates of household income. 

Taxpayers who choose to have advance PTC must reconcile the amount 

of advance PTC paid to issuers on their behalf with PTC they are eligible 

for on their income tax returns, which is computed based on the actual 

modified adjusted gross income calculated when filing their returns.3 PTC 

is a refundable tax credit in that in addition to offsetting tax liability, any 

credit amounts in excess of tax liability are refunded to taxpayers. The 

Internal Revenue Service (IRS) is responsible for ensuring individuals, 

employers, and issuers comply with certain PPACA health coverage and 

tax filing requirements.

PTC represents a significant fiscal commitment for the federal 

government. According to the Department of the Treasury (Treasury), the 

estimated fiscal year 2016 net outlay for the portion of PTC that was 

refunded to taxpayers was about $24 billion; the estimated revenue effect 

from the portion that taxpayers used to reduce their tax liabilities was 

about $2 billion.4 Enrollment control activities to reasonably assure that 

 3

The amount of PTC also varies with changes in family size and the insurance premiums 

for the marketplace health plans offered in the area where a taxpayer resides.

4

Department of the Treasury, Office of Tax Analysis, “Table 1. Estimates of Total Income 

Tax Expenditures for Fiscal Years 2016-2026,” Tax Expenditures (Washington, D.C.: 

September 2016), accessed March 23, 2017, https://www.treasury.gov/resourcecenter/tax-policy/Documents/Tax-Expenditures-FY2018.pdf. The refundable portion of a 

tax credit is not reported as a revenue loss estimate but as an outlay. Tax expenditure 

estimates—for the nonrefundable portion of a tax credit—do not necessarily equal the 

increase in federal revenues (or the change in the budget balance) that would result from 

repealing the related tax provision because of potential incentive effects that may alter 

economic behaviors and interdependencies across tax provisions. For this reason, such 

estimates should be regarded as approximations.
Page 3 GAO-17-467 Improper Payments

only qualified applicants receive PTC5—and any advance payments 

toward their insurance premiums—are a key factor in administering the 

credit effectively and efficiently.6

House Report No. 114-195, which accompanied H.R. 3020, Departments 

of Labor, Health and Human Services, and Education, and Related 

Agencies Appropriations Bill, 2016, included a provision for GAO to 

evaluate the process and coordination between HHS and Treasury to 

prevent improper payments of PTC.7 The objectives of this report are to 

determine the extent to which (1) CMS and IRS assessed the 

susceptibility of their PTC programs to significant improper payments and, 

if the programs were deemed susceptible, whether CMS and IRS took 

actions required by the Improper Payments Information Act of 2002, as 

amended (IPIA),8 and Office of Management and Budget (OMB) 

guidance;9 (2) CMS properly designed and implemented key control 

activities related to preventing and detecting improper payments of 

advance PTC; and (3) IRS properly designed and implemented key 

control activities related to preventing improper payments of PTC in 

processing federal income tax returns, detecting and recovering advance 

PTC overpayments made to issuers on behalf of policyholders, and 

reimbursing underpayments made to policyholders. Further, for those key 

 5

According to internal control standards, management designs control activities to achieve 

objectives and respond to risks. Control activities are the policies, procedures, techniques, 

and mechanisms that enforce management’s directives to achieve the entity’s objectives 

and address related risks. See GAO, Standards for Internal Control in the Federal 

Government, GAO-14-704G (Washington, D.C.: September 2014). App. II provides 

additional details on components of internal control.

6

According to CMS data, about 11 million people had enrolled into a 2016 health 

insurance plan under PPACA as of March 2016. About 85 percent of these enrollees 

qualified for the advanced PTC provided by PPACA. 

7

The explanatory statement accompanying the enacted Consolidated Appropriations Act, 

2016, reiterated the provision for GAO to perform this audit. 161 Cong. Rec. H9693, 

H10290 (Dec. 17, 2015). 

8

IPIA, Pub. L. No. 107-300, 116 Stat. 2350 (Nov. 26, 2002), as amended by the Improper 

Payments Elimination and Recovery Act of 2010, Pub. L. No. 111-204, 124 Stat. 2224 

(July 22, 2010), and the Improper Payments Elimination and Recovery Improvement Act 

of 2012, Pub. L. No. 112-248, 126 Stat. 2390 (Jan. 10, 2013), and codified as amended at

31 U.S.C. § 3321 note. In this report, references to IPIA include any amendments made 

thereto.

9

Office of Management and Budget, Appendix C to Circular No. A-123, Requirements for 

Effective Estimation and Remediation of Improper Payments, OMB Memorandum No. M15-02 (Washington, D.C.: Oct. 20, 2014). In this report, references to OMB guidance refer 

to this OMB memorandum and the guidance contained therein.
Page 4 GAO-17-467 Improper Payments

control activities that we determined were properly designed and 

implemented, we evaluated the extent to which such control activities 

were operating as designed.

To address our first objective, we reviewed relevant laws, regulations, 

and guidance to identify the requirements that agencies must meet to 

identify programs that are susceptible to significant improper payments. 

We reviewed improper payment assessments that CMS and IRS 

conducted for fiscal year 2016 for their respective PTC program areas. 

We then analyzed those assessments against relevant IPIA requirements 

and OMB guidance to determine whether the agencies had evaluated the 

appropriate risk factors for improper payments and appropriately 

considered those factors in their susceptibility assessments. We also 

interviewed CMS and IRS officials on their plans to estimate and report 

improper payments for their PTC programs.

To address our second objective, we first reviewed PPACA and its 

implementing regulations, relevant internal control standards,10 and 

leading practices for managing fraud risks in federal programs (GAO’s 

fraud risk framework),11 and identified the relevant risks for which control 

activities are needed. To assess the design and implementation of key 

control activities related to PTC at CMS and to identify any deficiencies, 

we focused on key control activities at CMS related to the FFM for plan 

year 2016. We selected CMS’s FFM because, at the time of our audit, it 

operated on behalf of about two-thirds of the states and about 75 percent 

of all enrollees receiving advance PTC. We evaluated the design and 

implementation of key control activities by reviewing CMS policies, 

procedures, and other relevant documents, such as interagency 

agreements and standard operating procedures for eligibility support 

workers. We compared the key risks we identified with the key control 

activities we identified to evaluate whether CMS’s design of its control 

activities sufficiently addressed each key risk area.

For key control activities that we determined were properly designed and 

implemented, we evaluated whether they were operating as designed by 

testing a statistically random sample of applications for FFM policyholders 

with advance PTC transactions from CMS. The testing period covered 

 10GAO-14-704G.

11GAO, A Framework for Managing Fraud Risks in Federal Programs, GAO-15-593SP 

(Washington, D.C.: July 2015).
Page 5 GAO-17-467 Improper Payments

applications received during the 2016 open enrollment period (November 

1, 2015, through February 1, 2016). We did not evaluate control activities 

related to advance PTC payments to issuers on behalf of individuals 

because such payments included other aggregated costs and 

adjustments, such as cost-sharing reduction subsidies and user fees, 

which were beyond the scope of our audit. We also did not evaluate 

whether key control activities that we determined were not properly 

designed and implemented were operating as designed because, without 

proper design and implementation, such control activities cannot achieve 

the control objective.

To address our third objective, we reviewed PPACA and its implementing 

regulations, relevant internal control standards,12 and GAO’s fraud risk 

framework,13 and identified the relevant risks areas for which control 

activities are needed. Consistent with our procedures for our second 

objective, we also reviewed IRS’s processes to evaluate the design and 

implementation of its key control activities and identify any deficiencies. 

We evaluated the design and implementation of key control activities at 

IRS by reviewing IRS policies and procedures, such as the Internal 

Revenue Manual (IRM). We then compared the key risks we identified 

with key control activities to evaluate whether IRS’s design of its control 

activities sufficiently addressed each key risk area. To assess whether 

IRS key control activities identified in our evaluation as properly designed 

and implemented were also operating as designed, we tested a statistical 

random sample of individual federal income tax returns with PTC 

transactions for the first 9 months of fiscal year 2016 (from October 1, 

2015, to June 18, 2016).

To assess the reliability of the CMS application data and IRS PTC 

transaction data, we reviewed relevant documentation and interviewed 

officials responsible for these data. We also performed electronic testing 

to determine the validity of specific data elements we used to perform our 

work. For both sets of data, based on the reliability examination we 

undertook for each, we concluded that the data we used for this report 

were sufficiently reliable for our purposes. Appendix I provides additional 

details on our scope and methodology.

 12GAO-14-704G.

13GAO-15-593SP.
Page 6 GAO-17-467 Improper Payments

While our second and third audit objectives focused on certain significant 

control activities related to preventing and detecting improper payments in 

the PTC programs at CMS and IRS,14 we did not evaluate all control 

activities and other components of internal control. If we had done so, 

additional deficiencies may have been identified that could impair the 

effectiveness of the control activities evaluated as part of this audit. 

Appendix II provides additional details on standards for internal control in 

the federal government.

We conducted this performance audit from January 2016 to July 2017 in 

accordance with generally accepted government auditing standards. 

Those standards require that we plan and perform the audit to obtain 

sufficient, appropriate evidence to provide a reasonable basis for our 

findings and conclusions based on our audit objectives. We believe that 

the evidence obtained provides a reasonable basis for our findings and 

conclusions based on our audit objectives.

Under PPACA, health care marketplaces are the mechanisms through 

which applicants enroll in qualified health plans15 and apply for incomebased advance PTC payments (paid directly to issuers) to offset the cost 

of these plans. As applicable, they also obtain eligibility determinations for 

other health coverage programs, such as Medicaid or the Children’s 

Health Insurance Program (CHIP).16 CMS is responsible for overseeing 

the establishment of state-based marketplaces and operating the FFM for 

states that did not establish their own marketplaces. Applicants in these 

states enroll in qualified health plans through the FFM. CMS operates the 

FFM in about two-thirds of the states. Specifically, CMS oversees 

implementation of certain PPACA provisions related to the FFM, including 

 14In addition, we also used the information and communication component of internal 

control and related principles as criteria for addressing all three of our audit objectives.

15A qualified health plan is a health insurance plan that meets certain requirements and, 

on the basis of meeting those requirements, is certified to be sold through a marketplace. 

A qualified health plan must be certified by each marketplace through which it is sold.

16Medicaid is a joint federal-state program that finances health insurance coverage for 

certain categories of lower-income individuals, including children. CHIP provides 

insurance for some children whose household income is above the threshold for Medicaid 

eligibility. 

Background

CMS Marketplace 

Responsibilities for 

Advance PTC Payments
Page 7 GAO-17-467 Improper Payments

ensuring that individuals are eligible to receive health insurance coverage 

through the FFM and determining the amount of any advance PTC they 

are eligible to receive.

To be eligible to enroll in a qualified health plan offered through a 

marketplace, applicants must be U.S. citizens or nationals, or otherwise 

lawfully present in the United States; reside in the marketplace service 

area; and not be incarcerated (unless incarcerated while awaiting 

disposition of charges). Marketplaces are required by law to verify certain 

application information to determine applicant eligibility for enrollment 

and, if applicable, advance PTC. The verification steps include validating 

applicant Social Security numbers, if provided; verifying citizenship or 

lawful presence status, and verifying household income.

PPACA requires that applicant-submitted information be verified and that 

determinations of eligibility be made through either an electronic 

verification system or another HHS-approved method. To implement this 

verification process, CMS developed its Data Services Hub, which acts as 

a conduit for exchanging information between (1) the FFM; state-based 

marketplaces; Medicaid agencies; and other federal, state, and 

commercial entities and (2) CMS’s external partners, including IRS, the 

Social Security Administration (SSA), and other federal agencies. The 

FFM accesses this information through the Data Services Hub to verify

that applicant information necessary to support an eligibility determination 

is consistent with external data sources.

CMS generates an “inconsistency” when applicant-submitted information 

does not match information from trusted data sources—either because 

information an applicant provided does not match information contained 

in the data sources or because such information is not available. 

Inconsistencies are also created whenever the FFM is unable to solicit 

information from trusted data sources due to data element requirements. 

As required by federal regulations,17 when there are inconsistencies, the 

marketplace grants temporary eligibility using applicant attestations and 

ensures that advance PTC is provided to issuers on behalf of the 

applicants qualified to receive them while such inconsistencies are being 

resolved. Also, under this marketplace process, applicants are asked to 

provide additional information or documentation for the marketplaces to 

review to resolve the inconsistencies. When applicants are unable to 

 1745 C.F.R. § 155.315(f)(4).
Page 8 GAO-17-467 Improper Payments

resolve the inconsistencies within the resolution period, the marketplace 

may terminate advance PTC and coverage in certain circumstances.18

Marketplaces are required to provide Form 1095-A, Health Insurance 

Marketplace Statement, to recipients enrolled in qualified health plans 

through the marketplace and to IRS. This form includes information on 

covered enrollees, coverage periods, monthly premiums, and amounts of 

advance PTC paid to issuers on behalf of the enrollees. Enrollees are 

instructed to use Form 1095-A information to prepare Form 8962, 

Premium Tax Credit, for their federal income tax returns.

Treasury regulations require marketplaces to report detailed information 

for each qualified health plan to IRS monthly, by the 15th day after each 

month of health insurance coverage. This monthly transmission—the 

Exchange Periodic Data (EPD) transmission—contains cumulative 

coverage information for the year, starting in January; thus, the EPD 

transmission due to IRS by January 15 should contain complete 

marketplace data for the entire previous coverage year. The EPD 

transmission is also required to include information on any exemptions 

from coverage requirements that are granted by the marketplace.

CMS is responsible for performing certain oversight functions intended to 

help ensure that the plans offered through the FFM meet certification 

standards. These oversight functions are intended to verify that enrollees 

receive appropriate health insurance coverage and that federal funds are 

not provided to health plans and issuers that do not meet the certification 

standards. When plans no longer meet certification standards, CMS may 

decertify them.

Each month, CMS is also responsible for calculating, processing, and 

authorizing aggregated advance PTC payments to issuers on behalf of 

eligible enrollees, along with cost-sharing reduction subsidies and 

collecting user fees from issuers in certain states. For enrollees 

determined eligible for advance PTC, the marketplace determines the 

 18For most types of inconsistencies, the standard resolution period is 90 days from the 

date the notices are sent to applicants. However, for inconsistencies related to citizenship, 

status as a U.S. national, or lawful presence, the inconsistency period is 90 days from the 

date the notices are received by applicants. To accommodate mail delivery time for these 

inconsistencies, CMS generally applies a standard resolution period of 95 days from the 

date that the notices are sent to applicants.
Page 9 GAO-17-467 Improper Payments

advance PTC amounts using, among other things, enrollee-reported 

incomes and family sizes.

IRS is responsible for determining the final amounts of PTC that 

taxpayers are entitled to receive based on household incomes and family 

sizes reported on their tax returns. Taxpayers are eligible for PTC if they 

meet various criteria: (1) buy qualified health insurance through a 

marketplace; (2) are ineligible for affordable, minimum-value coverage 

through an employer or government plan; (3) are within certain income 

limits (household income from 100 percent to 400 percent of the federal 

poverty level);19 (4) do not file a tax return with the status of married filing 

separately; and (5) cannot be claimed as a dependent by another 

person.20 While marketplaces determine the amounts of advance PTC for 

which individuals are eligible based on their anticipated family sizes and 

household incomes for the year reported to the marketplace, the final 

PTC amounts are based on actual incomes reported when those 

individuals file their federal income tax returns. As shown in figure 1, 

taxpayers use Form 1095-A, provided by marketplaces, and their actual 

modified adjusted gross incomes and family sizes to calculate their actual 

PTC amounts on Form 8962.

 19For 2016, the federal poverty level in the 48 contiguous states and the District of 

Columbia was $11,770 for an individual and $24,250 for a family of four. Federal poverty 

level amounts are higher in Alaska and Hawaii. 

20Household income is the taxpayer’s modified adjusted gross income, plus that of every 

other individual in a family for whom the taxpayer can properly claim a personal exemption 

and who is required to file a federal income tax return. Certain victims of domestic abuse 

and spousal abandonment may claim PTC using the married filing separately filing status. 

Also eligible for PTC are certain lawfully present immigrants who have household incomes 

less than 100 percent of the federal poverty level but are ineligible for Medicaid because 

of their immigration status.

IRS Responsibilities 

Related to PTC
Page 10 GAO-17-467 Improper Payments

Figure 1: Process for Taxpayers to Claim PTC

Form 8962 is the key form that IRS uses to determine and recover 

advance PTC overpayments and reimburse underpayments to 

individuals. When the claimed amounts are greater than the total advance 

PTC paid to issuers on behalf of individuals, those individuals report net 

PTC on their federal income tax returns (e.g., Form 1040, Individual 

Income Tax Return). The net PTC can increase refund amounts that 

taxpayers receive or reduce amounts due from taxpayers. When the 

claimed amounts are less than the total advance PTC paid to issuers on 

behalf of individuals, those individuals report the excess advance PTC on 

their federal income tax returns (e.g., Form 1040) as an increase in tax, 

subject to limitations on the increase. The excess advance PTC can 

reduce refund amounts that taxpayers receive or increase the amounts 

due from taxpayers.21 Taxpayers are responsible for submitting their 

federal income tax returns to IRS for processing with an attached Form 

8962.

IRS is responsible for processing tax returns to determine the final 

amount of PTC to which taxpayers are entitled and recovering advance 

PTC overpayments. When IRS receives tax returns, IRS checks them for 

completeness and attempts to verify taxpayer identities and PTC 

 21As discussed later in this report, federal law limits the amount of excess advance PTC 

overpayments that individuals must repay, based on their household incomes as a 

percentage of the federal poverty level and filing status.
Page 11 GAO-17-467 Improper Payments

eligibility. To verify PTC claims on federal income tax returns, IRS relies 

on marketplace data to confirm that taxpayers were enrolled in qualified 

health plans. As illustrated in figure 2, at the time of filing (i.e., before 

refunds are issued), IRS’s Affordable Care Act Verification Service (AVS) 

system compares the information taxpayers reported on their tax returns 

to information furnished by the marketplaces, potentially identifying math 

errors or discrepancies with marketplace data. For example, AVS may 

identify taxpayers who received advance PTC according to the 

marketplaces, but did not report it on their tax returns through Form 8962. 

AVS may also detect cases when taxpayers claim the PTC on Form 8962 

but are ineligible because they were not enrolled in a marketplace plan. 

When discrepancies are identified, IRS may correspond with taxpayers to 

address the related issues, or IRS may correct certain mathematical or 

clerical errors on tax returns and notify taxpayers of the proper tax 

liabilities based on those corrections.22 If IRS is unable to resolve such 

discrepancies through correspondence with taxpayers or through its math 

error authority, it may refer cases to examination for further review.23

 22IRS can use math error authority for certain purposes specified in statute, including 

correcting calculation errors and checking for other obvious noncompliance, such as 

claims above income and credit limits. 26 U.S.C. § 6213(g)(2). For PTC, IRS can use 

math error authority to resolve issues such as a discrepancy between the family size 

reported on Form 8962 and the number of exemptions claimed on Form 1040. 

Compliance conditions that cannot be resolved with math error authority include 

mismatches with marketplace data, such as with PTC amounts paid in advance.

23During return processing, IRS runs returns through additional systems to screen for 

fraud and errors. For example, one system—the Dependent Database—incorporates IRS 

and other government data, such as the National Prisoner File or child custody information 

from HHS, along with rules and scoring models to identify questionable tax returns and 

further detect identity theft. Once the suspicious tax returns are identified, the Dependent 

Database assigns a score to each tax return. Based in large part on these scores, as well 

as available resources, IRS selects a portion of suspicious returns for correspondence 

audits, which are audits conducted through the mail.
Page 12 GAO-17-467 Improper Payments

Figure 2: IRS’s Process for Verifying PTC Amounts on Tax Returns

a

The pre-refund phase and post-refund phase steps apply to IRS processing of tax returns, 

regardless of whether a taxpayer actually receives a refund. These phases indicate whether such 

process steps are performed before or after refunds are sent to taxpayers.

IPIA defines an improper payment as any payment that should not have 

been made or that was made in an incorrect amount (including 

overpayments and underpayments) under statutory, contractual, 

administrative, or other legally applicable requirements. It includes 

duplicate payments; any payment made for an ineligible recipient, an 

ineligible good or service, or a good or service not received; or any 

payment that does not account for credit for applicable discounts. OMB 

Improper Payment 

Reporting Requirements
Page 13 GAO-17-467 Improper Payments

guidance also instructs agencies to treat any payments for which 

insufficient or no documentation is found as improper payments.

IPIA also defines the scope of payments subject to assessment, 

estimation, and reporting. Specifically, a payment is defined as any 

transfer or commitment for future transfer of federal funds—such as cash, 

securities, loans, loan guarantees, and insurance subsidies—to any 

nonfederal person or entity that is made by a federal agency, a federal 

contractor, a federal grantee, or a governmental or other organization 

administering a federal program or activity. IRS has historically estimated 

improper payments for the Earned Income Tax Credit but not for other 

refundable credits.

IPIA and OMB guidance together provide the specific requirements for 

assessing, estimating, and reporting on improper payments. Federal 

agencies are required to review all programs and activities that they 

administer and identify any program or activity that may be susceptible to 

significant improper payments.24 IPIA defines “significant improper 

payments” as gross annual improper payments (i.e., the total amount of 

overpayments and underpayments) that may have exceeded (1) both 1.5 

percent of program outlays and $10 million of all program or activity 

payments made during the fiscal year reported or (2) $100 million 

(regardless of the improper payment percentage of total program 

outlays). Agencies must institute a systematic method of reviewing and 

assessing their programs, which may take the form of either through a 

quantitative analysis based on a statistical sample or qualitative 

evaluation.

OMB guidance requires that agencies take into account the following nine 

risk factors that are likely to contribute to significant improper payments:

1. whether the program or activity reviewed is new to the agency;

2. the complexity of the program or activity reviewed, particularly with 

respect to determining correct payment amounts;

3. the volume of payments made annually;

 24The head of each executive agency is responsible for complying with IPIA requirements, 

and the required reporting is done in the executive agency’s agency financial reports.
Page 14 GAO-17-467 Improper Payments

4. whether payments or payment eligibility decisions are made outside of 

the agency, for example, by a state or local government or a regional 

federal office;

5. recent major changes in program funding, authorities, practices, or 

procedures;

6. the level, experience, and quality of training for personnel responsible 

for making program eligibility determinations or certifying that 

payments are accurate;

7. inherent risks of improper payments because of the nature of agency 

programs or operations;

8. significant deficiencies in the agency’s audit reports, including but not 

limited to the agency inspector general or GAO audit findings or other 

relevant management findings that might hinder accurate payment 

certification; and

9. results from prior improper payment work.

OMB guidance describes these risk factors as the minimum that agencies 

should consider. An agency’s assessment may include other risk factors, 

as appropriate, specific to the program or activity being assessed.

IPIA requires agencies to assess the risk of improper payments for each 

program and activity that they administer, at least once every 3 years for 

programs and activities deemed not susceptible to significant improper 

payments. If an agency finds that a program is susceptible to significant 

improper payments, the agency is required to estimate the annual amount 

of improper payments for the program, publish corrective action plans, set 

reduction targets, and annually report on the results of addressing these 

requirements for that program.

OMB established an interagency working group, which included officials 

from Treasury, IRS, HHS, and CMS, to help agencies navigate OMB 

improper payments guidance. The interagency working group concluded 

that CMS would be responsible for assessing risks and developing 

improper payment error rates for advance PTC payments and that IRS 

would be responsible for assessing risk and developing improper 

payment error rates for net PTC in tax return processing.
Page 15 GAO-17-467 Improper Payments

In fiscal year 2016, neither CMS nor IRS took all required actions for 

assessing, estimating, and reporting improper payments related to PTC. 

CMS assessed its advance PTC program as susceptible to significant 

improper payments by appropriately considering each of OMB guidance’s 

nine qualitative risk factors; however, it did not complete other key IPIA 

requirements for programs deemed susceptible to significant improper 

payments for its advance PTC program. IRS did not assess its PTC 

program’s susceptibility to significant improper payments in a manner 

consistent with IPIA requirements.

In fiscal year 2016, CMS concluded that its advance PTC program was 

susceptible to significant improper payments. We determined that CMS 

instituted a systematic, qualitative method for assessing risk that was 

consistent with IPIA requirements and OMB guidance. CMS appropriately 

assessed each of the nine risk factors required by OMB guidance. For 

example, CMS considered the risk factor regarding whether a program is 

new to the agency and rated the advance PTC program, which started in 

2014, as high risk. CMS also appropriately tailored risk factors to its 

advance PTC program. For example, in considering the risk factor 

regarding recent changes in program operations and funding, CMS also 

considered projected future changes in program operations and funding 

that could affect improper payments for the program. The analysis that 

CMS performed on the risk factors supported its conclusion that the 

advance PTC program was susceptible to significant improper payments, 

as defined by IPIA and OMB guidance.

Although CMS reviewed its advance PTC program and concluded that it 

was susceptible to significant improper payments, it did not complete 

other key IPIA requirements for programs deemed susceptible to 

significant improper payments for its advance PTC program. Specifically, 

CMS did not estimate or report the annual amount of improper payments 

for the advance PTC program. According to the fiscal year 2016 HHS 

agency financial report, CMS was unable to specify the year that the rate 

and the improper payment estimate amount will be reported. Further, 

CMS officials could not provide us with a specific date when they 

expected to be in compliance with these IPIA requirements. CMS officials 

told us that they will not report improper payment estimates in fiscal year 

2017 and may not be able to report estimates until at least fiscal year 

2022. According to the fiscal year 2016 HHS agency financial report, the 

agency is unable to specify the year that it will report the improper 

payment rate and amount because of the complexity of the improper 

CMS and IRS Did Not 

Take All Required 

Actions to Assess, 

Estimate, and Report 

PTC-Related 

Improper Payments

CMS Assessed Its PTC 

Program as Susceptible to 

Significant Improper 

Payments but Has Not 

Estimated or Reported 

Amounts as Required
Page 16 GAO-17-467 Improper Payments

payment error rate measurement methodology development process. 

This process involves conducting pilot testing, using those tests to refine 

the methodology, and then undergoing the rule-making process before 

implementing the methodology. However, the fiscal year 2016 HHS 

agency financial report did not disclose a timeline for completion of the 

key steps necessary for developing the improper payment methodology 

or why challenges will result in delays in meeting IPIA requirements for 

estimating and reporting improper payments.

According to internal control standards, management should externally 

communicate the necessary quality information to achieve the entity’s 

objectives. This involves communicating with external parties—such as 

legislators, oversight bodies, and the general public—using established 

reporting lines. Information communicated to oversight bodies includes 

significant matters relating to risks, changes, or issues that affect the 

entity’s internal controls for achieving compliance and reporting 

objectives. This communication is necessary for the effective oversight of 

internal control.

Because CMS does not plan to report improper payment estimates for 

this program for several years, HHS’s overall improper payment estimate 

will continue to be understated, and CMS may be hindered in its efforts to 

reduce improper payments in this program. Additionally, Congress and 

other external stakeholders will continue to lack key payment integrity 

information for monitoring improper payments. Likewise, if CMS does not 

communicate significant matters relating to IPIA estimation, compliance, 

and reporting objectives for the advance PTC program; its progress and 

timeline for achieving those objectives; and the basis for its timeline for 

reporting improper payment estimates, legislators’, oversight bodies’, and 

the general public’s expectations for CMS improper payments reporting 

may not align with those set by CMS management.

In its fiscal year 2016 improper payments susceptibility assessment, IRS 

did not assess the PTC program’s susceptibility to significant improper 

payments in a manner consistent with IPIA requirements. IPIA and OMB 

guidance require agencies to identify all programs and activities that may 

be susceptible to significant improper payments. OMB guidance further 

instructs agencies not to put programs or activities into groupings that 

may mask significant improper payment rates by the scope of a grouping. 

However, IRS did not consider key types of PTC-related errors that may 

result in improper payments within the scope of its assessment. IRS 

focused its assessment on payment errors for taxpayers who reported a 

IRS Did Not Determine 

Whether Its PTC Program 

Is Susceptible to 

Significant Improper 

Payments
Page 17 GAO-17-467 Improper Payments

net PTC amount on their tax returns—that is, individuals who reported a 

final PTC amount that was greater than the advance PTC amounts they 

reported on their tax returns. IRS did not assess payment errors for 

taxpayers who (1) reported final PTC amounts equal to the advance PTC 

amounts they reported on their tax returns or (2) reported an excess 

advance PTC—that is, advance PTC amounts that exceeded the final 

PTC amounts they reported on their tax returns. Such errors fall under the 

purview of IRS controls and can affect the accuracy of net PTC payments 

and tax collections of excess advance PTC.

IRS officials told us that errors resulting in (1) final PTC claims equal to 

advance PTC and (2) excess advance PTC, which increase taxes owed, 

do not affect program outlays or improper payments. As a result, IRS 

maintains that these types of errors are not covered by IPIA. However, 

IPIA defines improper payments to include both overpayments and 

underpayments.

Although we agree that excess advance PTC increases taxes owed, 

taxpayers may inaccurately complete Form 8962 and erroneously report 

excess advance PTC on their returns instead of claiming net PTC, or they

may simply fail to report net PTC on their tax returns altogether. Such 

errors would result in underpayments of net PTC and therefore affect 

program outlays and improper payments. These error types were not 

considered within the scope of the IRS susceptibility assessment for 

improper payments.

Likewise, IRS did not conclude on whether the PTC program is or is not 

susceptible to significant improper payments. Instead, IRS concluded that 

the risk of improper payments in the net PTC program was “medium.” The 

assessment defined a “medium” risk level as one that is partially mitigated 

by current mitigation measures and internal controls (see fig. 3). IRS’s 

fiscal year 2016 IPIA susceptibility assessment for the net PTC was 

prepared by a contractor under the direction and oversight of IRS 

management. IRS management allowed the contractor to use a risk level 

definition that was inconclusive for purposes of assessing whether or not 

the program may be susceptible to significant improper payment 

thresholds, as defined by IPIA.
Page 18 GAO-17-467 Improper Payments

Figure 3: IRS Definitions of Risk Levels in Relation to IPIA Requirements

Although IRS used all of the required qualitative risk factors specified in 

IPIA and OMB guidance within its assessment, IRS did not analyze how 

each of the risk factors affected the susceptibility of the program to 

significant improper payments, as defined by IPIA. For example, rather 

than analyzing whether the volume of PTC payments made was likely to 

cause the program to meet applicable IPIA thresholds for susceptibility to 

significant improper payments, IRS compared the projected total number 

of taxpayers who are able to claim net PTC on their federal income tax 

returns to the total number of taxpayers filing federal income tax returns 

as a whole during the 2015 filing season. Such a comparison is not 

relevant to assessing whether the program’s error rates or improper 

payment amounts may have exceeded the applicable thresholds for 
Page 19 GAO-17-467 Improper Payments

susceptibility: either (1) 1.5 percent of program outlays and $10 million or 

(2) $100 million.

Internal control standards state that management should use quality 

information to achieve the entity’s objectives.25 Management obtains 

relevant data from reliable internal and external sources in a timely 

manner based on the identified information requirements. Relevant data 

have a logical connection with, or bearing upon, the identified information 

requirements. Reliable internal and external sources provide data that are 

reasonably free from error and bias and faithfully represent what they 

purport to represent.

By not considering certain types of underpayments or concluding whether 

its PTC program is susceptible to significant improper payments, IRS did 

not demonstrate whether the program met applicable thresholds for 

susceptibility to significant improper payments. Until IRS conducts an 

appropriate assessment, it will continue to be uncertain whether IRS 

should estimate the amount of improper PTC payments.

CMS control activities were not properly designed and implemented to 

help achieve management objectives related to preventing and detecting 

improper payments of advance PTC. Specifically, we identified 

deficiencies in the design of key CMS control activities related to

• eligibility requirements for advance PTC payments and

• the accuracy of advance PTC calculations based on incomes and 

family sizes.

As shown in figure 4, we found that CMS control activities related to 

determining the accuracy of PTC payments to certified issuers of qualified 

health plans were properly designed and implemented. However, we did 

not evaluate whether all control activities related to preventing and 

detecting improper payments of advance PTC were operating as 

designed or evaluate other internal control components, such as the 

control environment. Deficiencies, if any, in the internal control 

components that were not evaluated could impair the overall 

effectiveness of CMS’s control activities related to preventing and 

detecting improper payments in the advance PTC program.

 25GAO-14-704G.

CMS Control 

Activities Related to 

Preventing and 

Detecting Improper 

Payments of Advance 

PTC Were Not 

Properly Designed
Page 20 GAO-17-467 Improper Payments

Figure 4: CMS Key Control Activities Related to Preventing and Detecting Improper Payments of Advance PTC

CMS did not properly design control activities related to individuals 

meeting key eligibility requirements for receiving advance PTC. While 

CMS’s procedures related to verifying citizenship and lawful presence of 

individuals with Social Security Administration (SSA) and the Department 

of Homeland Security (DHS) were properly designed and implemented 

and were operating as designed, CMS procedures to verify other key 

eligibility requirements were not properly designed.

Most CMS Control 

Activities Related to Key 

Eligibility Requirements for 

Advance PTC Were Not 

Properly Designed
Page 21 GAO-17-467 Improper Payments

To be eligible to enroll in a qualified health plan offered through a 

marketplace, an individual must be a U.S. citizen or national, or otherwise 

lawfully present in the United States.26 For verifying citizenship or lawful 

presence of individuals, CMS relies on data in SSA and DHS information 

systems. According to CMS’s control activities for citizenship, CMS 

queries an SSA system to validate, among other things, whether an 

individual is a U.S. citizen. If the SSA system cannot verify citizenship, 

and the individual has provided an immigration document number that 

indicates possible citizenship or lawful presence, CMS queries a DHS 

system to verify the individual’s citizenship or other immigration status.27

We tested a statistical sample of 93 enrollment applications submitted 

during the 2016 open enrollment period and found that CMS verified 

citizenship and lawful presence with SSA or DHS for all applications.28

Based on our audit work, CMS control activities for verifying citizenship 

and lawful presence of individuals with SSA or DHS were properly 

designed and implemented and were operating as designed.

An individual begins the marketplace enrollment process in a qualified 

health plan by providing basic personal information, such as name, birth 

date, and Social Security number. To prevent unauthorized individuals 

from creating marketplace accounts using the identities of others when 

applying for health coverage, CMS verifies some individual identities 

through an identity proofing process. According to CMS’s internal control 

documentation, for individuals applying for marketplace coverage online 

via HealthCare.gov, CMS validates their identities through an external 

source.29

CMS does not perform identity proofing for individuals applying for health 

coverage through the mail or over the phone. For paper applications 

submitted by mail, the marketplace requires individual signatures before 

 2645 C.F.R. § 155.305(a)(1).

2745 C.F.R. § 155.315(c).

28We did not identify any cases during our testing where CMS did not verify citizenship 

and lawful presence with SSA, DHS, or both. For an observed number of zero cases in a 

sample size of 93, we can be 95 percent confident that the population deviation rate is not 

more than 3.17 percent. This is less than our tolerable deviation rate of 5 percent. 

29For online applications, the marketplace employs a process known as identity proofing 

to verify an individual’s identity. It does so by using personal and financial history on file 

with a credit reporting agency contracted by the marketplace. The marketplace generates 

questions, based on information on file with the contractor, that only the individual is 

believed to be likely to know.

Verifying Citizenship and 

Lawful Presence

Verifying the Identities of 

Individuals
Page 22 GAO-17-467 Improper Payments

the marketplace processes those applications. For phone applications, 

CMS does not validate identities of individuals, instead relying solely on 

the basis of verbal attestations made by individuals. CMS allows 

individuals to complete the application process on the basis of these 

attestations, given under penalty of perjury.

According to CMS officials, PPACA does not require CMS to validate 

identities of individuals. However, internal control standards state that 

management should consider the potential for fraud when identifying, 

analyzing, and responding to risks and design and implement control 

activities to respond to risks.30 Further, these standards also state that 

management should design control activities to achieve objectives and 

respond to risks.

Because CMS does not validate the identities of individuals who apply by 

phone or mail, CMS is vulnerable to enrolling ineligible individuals in 

qualified health plans with advance PTC. To illustrate, we previously 

reported on our undercover testing of CMS enrollment processes in 2014, 

in which we made six online applications using fictitious identities that 

failed to clear an identity validation step. We subsequently were able to 

obtain coverage for all six of these applications that we began online by 

completing them by phone. By following instructions to make telephone 

contact with the marketplace, we circumvented the initial identity-proofing 

control that had stopped our online applications.31

CMS did not properly design procedures to verify the residencies of 

individuals. HHS regulations permit CMS to accept attestations of 

residency.

32 In order to be eligible to enroll in a qualified health plan 

offered through a marketplace, individuals must reside in the marketplace 

service area.33 CMS officials told us that they were unaware of a 

comprehensive, national electronic data source that could be used to 

verify residence. However, CMS did not document an evaluation of 

available external sources to determine the quality, relevance, and 

 30GAO-14-704G.

31GAO, Patient Protection and Affordable Care Act: Observations on 18 Undercover Tests 

of Enrollment Controls for Health-Care Coverage and Consumer Subsidies Provided 

under the Act, GAO-15-702T (Washington, D.C.: July 16, 2015).

3245 C.F.R. § 155.315(d).

3345 C.F.R. § 155.305(a)(3).

Verifying Residencies
Page 23 GAO-17-467 Improper Payments

reliability of the data. Internal control standards state that management 

should use quality information to achieve the entity’s objectives.34 In 

addition, according to GAO’s fraud risk framework, it is a leading practice 

to conduct data matching to verify key information, including self-reported 

data and information necessary to determine eligibility.35 Without verifying 

the residencies of individuals, CMS is vulnerable to enrolling ineligible 

individuals in qualified health plans and improperly providing advance 

PTC to issuers on their behalf.

We found design deficiencies in CMS’s procedures related to determining 

that advance PTC is not provided to issuers on behalf of individuals who 

are receiving or eligible for minimum essential coverage through their 

employers or government-sponsored programs.36 Specifically, CMS does 

not (1) use data from nonfederal employers to check for duplicate 

minimum essential coverage; (2) have procedures for terminating 

coverage for individuals who have employer-sponsored minimum 

essential coverage; and (3) have procedures for sharing coverage 

information with, and obtaining coverage information from, such 

employers. In addition, CMS checks for duplicate government-sponsored 

Medicaid and CHIP coverage only in the states where applicants attest to 

residing and thus would not detect whether applicants received such 

coverage in different FFM states.37

Coverage from Nonfederal Employers

Although CMS has procedures to obtain data from the Office of Personnel 

Management for identifying individuals receiving health care coverage 

 34GAO-14-704G.

35GAO-15-593SP.

36Health insurance that meets the minimum essential coverage standards includes certain 

types of government-sponsored coverage (such as Medicare Part A or Medicaid) as well 

as most types of private insurance plans (such as employer-sponsored insurance). Health 

insurance that provides limited benefits, such as dental-only coverage, does not constitute 

minimum essential coverage. 

37The Department of Health and Human Services Office of Inspector General also 

previously reported on how the federal marketplace resolved inconsistencies related to 

minimum essential coverage during the first open enrollment period (January 1, 2014 

through April 19, 2014). For more information, see Department of Health and Human 

Services, Office of Inspector General, Not All of the Federally Facilitated Marketplace’s 

Internal Controls Were Effective in Ensuring That Individuals Were Properly Determined 

Eligible for Qualified Health Plans and Insurance Affordability Programs, A-09-14-01011 

(Washington, D.C.: August 6, 2015).

Preventing Duplicate Coverage
Page 24 GAO-17-467 Improper Payments

from federal employers, CMS does not have procedures that use data 

sources to identify individuals receiving minimum essential coverage 

through nonfederal employers.38 CMS officials stated that PPACA does 

not require that employers report information on employer-sponsored 

coverage offers to HHS. CMS officials told us that they have explored 

other possible data sources, including Medicare Coordination of Benefits, 

the National Directory of New Hires, and Equifax data, but they have 

been unable to identify comprehensive electronic data sources that are 

sufficiently current and accurate for identifying these individuals. 

However, CMS did not document its evaluation of the availability and 

reliability of potential data sources. As a result, we were unable to 

evaluate CMS’s review of these electronic data sources and assess 

whether CMS reviewed other potential data sources.

CMS relies on individuals to update their marketplace applications and 

has not established a process for terminating advance PTC for individuals 

who have not updated their applications. CMS has not designed 

procedures for the FFM to send notices to employees who have been 

identified as having access to minimum essential employer-sponsored 

coverage regularly during each enrollment season. CMS officials told us 

that in 2016 they began notifying certain employers of individuals enrolled 

in FFM coverage with advance PTC.39 If employers responded and 

asserted that they provide individuals with access to affordable, minimumvalue employer-sponsored coverage, the FFM would then send notices to 

those individuals notifying them to update their marketplace applications 

to reflect that they have access to or are enrolled in other coverage and 

warning them that failure to update their profiles accordingly may result in 

a tax liability. CMS officials told us that CMS has published information, 

for example, on a Frequently Asked Questions page, on the CMS website 

that describes the notices. However, these Frequently Asked Questions 

do not constitute procedures that provide guidance for sending out the 

notices regularly.

According to GAO’s fraud risk framework, it is a leading practice to 

conduct data matching to verify key information, including self-reported 

 38Individuals eligible to receive minimum essential coverage through employers are not 

eligible for PTC. See 26 U.S.C. § 36B(c)(2)(B), as added by PPACA § 1401(a).

39According to CMS officials, the FFM sent notices to employers if advance PTC was 

provided to issuers on behalf of their employees for at least 1 month and if CMS had 

addresses for the employers.
Page 25 GAO-17-467 Improper Payments

data and information necessary to determine eligibility.40 In addition, 

internal control standards state that management should use quality 

information to achieve the entity’s objectives and should obtain relevant 

data from reliable internal and external sources based on the identified 

information requirements for achieving the entity’s objectives and address 

risks.41 These standards also state that management should design 

control activities to achieve objectives and respond to risks.

Without policies and procedures for identifying individuals who have 

minimum essential coverage from nonfederal employers and for 

terminating advance PTC for those individuals, CMS is at greater risk of 

providing advance PTC to issuers on behalf of ineligible individuals.

Coverage from Government-Sponsored Programs

Individuals receiving coverage from government-sponsored programs, 

such as Medicare, Medicaid, and CHIP, are generally allowed PTC only 

for the months that one or more members of the individuals’ families are 

not eligible for government-sponsored coverage.42 CMS has designed a 

process that identifies some but not all cases in which individuals who are 

applying for the advance PTC may also have government-sponsored 

coverage. Specifically, CMS has procedures to identify individuals with 

duplicate government-sponsored coverage using data from Medicare, the 

Peace Corps, TRICARE,43 and the Veterans Health Administration.

CMS did not establish a process to fully identify all individuals with 

duplicate government-sponsored coverage through Medicaid and CHIP. 

Specifically, CMS’s procedures are designed to detect duplicate coverage 

with Medicaid and CHIP only in the states where individuals applied for 

coverage through the FFM and not in any other state where the FFM 

 40GAO-15-593SP.

41GAO-14-704G.

4226 C.F.R. § 1.36B-2(a).

43TRICARE is a system of health care that the Department of Defense purchases from 

private insurers to supplement the health care that the department provides through its 

military treatment facilities and dental treatment facilities.
Page 26 GAO-17-467 Improper Payments

operates.44 Consequently, its procedures do not detect when FFM 

applicants have duplicate coverage through Medicaid and CHIP from 

different FFM states than the states in which they applied and attested to 

residing.

According to CMS officials, FFM procedures are designed to check for 

Medicaid and CHIP only in the states where individuals have attested to 

residing during the application review process and not in other FFM 

states. Federal regulations require the FFM to verify whether individuals 

have been determined eligible for coverage through Medicaid and CHIP 

within the state or states in which the FFM operates by using information 

obtained from the agencies administering such programs.45 Thus, the 

FFM is required to verify whether individuals also have Medicaid and 

CHIP coverage in all states covered by the FFM and not just in states 

where the individuals applied for coverage and attested to reside. 

According to CMS officials, it would be technically difficult and 

impracticable for all FFM states to provide information that would allow 

the FFM to check Medicaid and CHIP coverage for individuals in each of 

those states. However, CMS did not provide us with documented 

analyses to support this assessment. As a result, we were unable to 

evaluate CMS’s assessment and determine whether CMS reviewed the 

feasibility of using other existing resources and tools for checking for 

Medicaid and CHIP coverage in all FFM states.

Internal control standards state that management should use quality 

information to achieve the entity’s objectives.46 In addition, these 

standards also state that management should design control activities to 

achieve objectives and respond to risks.

Without procedures in place to detect duplicate coverage by Medicaid 

and CHIP in states other than those in which individuals applied for 

 44At the time of our audit, 12 states and the District of Columbia operated their own 

marketplaces. We found that CMS did not check household members listed on the FFM 

enrollment applications for Medicaid and CHIP coverage in New Jersey and Georgia, 

which use the FFM. CMS officials informed us that Georgia and New Jersey were having 

technical issues validating the response with CMS. CMS informed us that New Jersey 

accepted individual attestations until the issue was resolved in September 2016. CMS 

officials also informed us that they are working with Georgia to resolve the issue, but in the 

interim, CMS was accepting individual attestations. 

4545 C.F.R. § 155.320(b).

46GAO-14-704G.
Page 27 GAO-17-467 Improper Payments

coverage and attested to residing, CMS is at greater risk of providing 

advance PTC on behalf of individuals who receive Medicaid and CHIP 

coverage from other FFM states and are therefore ineligible for advance 

PTC.

Inconsistencies are generated when individual-attested information does 

not reasonably match information from the marketplace’s trusted data 

sources, or because the needed information is not available from a 

federal data source. In such instances, the FFM sends eligibility letters to 

individuals requesting explanations or supporting documentation to 

resolve inconsistencies within a specific time frame, referred to as an 

inconsistency period. Individuals are generally given 95 days to provide 

the requested documentation to substantiate citizenship and lawful 

presence and 90 days for other types of inconsistencies.

During inconsistency periods, individuals may enroll in a qualified health 

plan and elect to receive advance PTC. Individuals can provide 

explanations and substantiating documents by mail or through the 

marketplace website. When individuals provide sufficient documentation 

to substantiate the attested information, the inconsistencies are resolved. 

When individuals do not provide sufficient documentation within the 

inconsistency period, the FFM “expires” those inconsistencies and 

determines the eligibility based on the existing information from electronic 

data sources. If data are not available, marketplace enrollments may be 

terminated or the individuals may be determined ineligible for advance 

PTC.

We identified deficiencies in CMS’s design of key procedures related to 

resolving eligibility issues and terminating inconsistencies related to 

Social Security numbers and incarceration, as well as the timely 

termination of inconsistencies.

Social Security Number Inconsistencies

CMS did not properly design and implement procedures related to 

preventing advance PTC on behalf of individuals who submitted 

inaccurate or false Social Security numbers. Based on our analysis of the 

CMS inconsistency data for the 2016 open enrollment, we identified about 

82,000 applications with unresolved Social Security number 

inconsistencies as of May 2016. CMS provided about $42 million in 

advance PTC in May 2016 on behalf of these individuals. In February 

Resolving Inconsistencies
Page 28 GAO-17-467 Improper Payments

2016, we reported that unresolved Social Security number 

inconsistencies are indicators of potentially fraudulent applications.47

Unresolved Social Security number inconsistencies may also adversely 

affect IRS’s ability to assess and fully recover advance PTC 

overpayments. In our February 2016 report, we recommended that the 

Secretary of Health and Human Services direct CMS to design and 

implement procedures to resolve Social Security number inconsistencies 

when the marketplace is unable to verify the numbers or individuals do 

not provide them. HHS concurred with our recommendation, and CMS 

officials told us that system functionality upgrades to address Social 

Security number inconsistencies were completed and deployed in March 

2017. In May 2017, CMS established procedures for verifying Social 

Security numbers with documents submitted by the applicants but has not 

developed procedures to terminate advance PTC for applications with 

unresolved Social Security number inconsistencies. CMS officials did 

state that further refinements to the process are likely to occur.

Incarceration Status Inconsistencies

CMS did not properly design and implement procedures related to 

preventing advance PTC paid on behalf of incarcerated individuals or 

individuals who may be using identities of incarcerated individuals, both of 

which would be ineligible for advance PTC. Based on our analysis of the 

CMS inconsistency data for the 2016 open enrollment, we identified about 

30,000 applications with unresolved incarceration inconsistencies as of 

May 2016. CMS provided about $10 million in advance PTC in May 2016 

on behalf of these individuals. We had previously reported in February 

2016 that CMS did not terminate individuals who had inconsistencies 

generated when verifying incarceration statuses with SSA’s Prisoner 

Update Processing System (PUPS) database.48 We reported that CMS 

officials told us that they did not terminate eligibility for incarceration 

inconsistencies because they determined that the PUPS data were 

unreliable for use by the marketplace. However, in the report, we stated 

that CMS did not provide us documentation on how it concluded that the 

PUPS data were unreliable for identifying incarcerated individuals or the 

potential cost associated with not verifying incarceration status. In the 

 47GAO, Patient Protection and Affordable Care Act: CMS Should Act to Strengthen 

Enrollment Controls and Manage Fraud Risk, GAO-16-29 (Washington, D.C.: Feb. 23, 

2016).

48GAO-16-29.
Page 29 GAO-17-467 Improper Payments

report, we recommended that the Secretary of Health and Human 

Services direct CMS to reevaluate the use of PUPS incarceration data in 

the inconsistency process. HHS concurred with our recommendation and 

noted in its comments to our report that PUPS data were not sufficiently 

current and accurate at that time. According to CMS officials, CMS 

continues to work with SSA to improve the quality of incarceration data 

used for verification. In March 2016, CMS officials stated that SSA 

completed developmental changes to improve the reliability of the match 

criteria for the incarceration database and limit the risk of receiving false 

positives. CMS officials stated that they are assessing whether these data 

improvements result in sufficiently reliable incarceration data but did not 

provide us a date on when the assessment will be completed.

Timely Termination or Adjustment of Advance PTC Because of 

Inconsistencies

CMS also did not properly design procedures related to terminating or 

adjusting advance PTC timely when inconsistency periods have expired. 

Specifically, CMS’s procedures call for the processing of all expiration 

activities, including the notifications to issuers regarding the terminations 

or adjustments of advance PTC, at the beginning of the month following 

the month that the inconsistency periods expire. However, the effective 

dates of the terminations or adjustments are the last day of that month, 

which is also the month that notifications are provided to the issuers 

regarding these terminations or adjustments. Thus, by not processing 

terminations or adjustments of advance PTC on a rolling basis based on 

the effective dates of the expirations of the inconsistency periods, CMS 

provides an extra month of advance PTC to issuers on behalf of ineligible 

individuals.49

The aggregate dollar amounts for the extra month of advance PTC that 

CMS pays each month on behalf of ineligible individuals can be 

significant. For example, based on our analysis of CMS inconsistency 

data for the 2016 open enrollment, we identified about 45,000 

applications that were terminated by CMS for lawful presence or 

citizenship inconsistencies. As a result of its practice of processing 

 49For example, if an inconsistency is set to expire in March, then CMS will process the 

expiration and send the notification of termination or adjustment of advance PTC to the 

issuer in early April. Because the effective date of the termination or adjustment is at the 

end of the month (April 30), CMS has provided an extra month of advance PTC to the 

issuer for the month of April.
Page 30 GAO-17-467 Improper Payments

advance PTC terminations, as of May 2016, CMS had paid about $19 

million in extra advance PTC on behalf of these ineligible individuals 

during the 2016 open enrollment.50

According to CMS officials, the current process for terminating 

enrollments based on expired inconsistencies gives individuals the full

inconsistency period to mail in substantiating documents—and allows 

CMS to confirm whether sufficient documentation was provided—prior to 

initiating the termination process. CMS officials also stated that the 

processing of inconsistencies in batches also aligns with issuer 

operations (allowing time to adjust billing for the next month) and allows 

for a more efficient process. In addition, CMS officials told us that 

processing terminations outside of normal system and marketplace rules 

would require additional manual effort on the part of the marketplace and 

issuers. However, we could not determine the validity of the officials’

statements because CMS did not provide us with documentation or 

analyses demonstrating that its current process for terminating policies 

and advance PTC is consistent with applicable statutory requirements, or 

that it is more efficient and cost-effective than processing terminations 

more frequently.

Internal control standards state that management should identify, 

analyze, and respond to risks related to achieving the defined 

objectives.51 These standards also state that management should design 

control activities to achieve objectives and respond to risks. Without 

evaluating its process for terminating inconsistencies, CMS is at risk of 

providing an extra month of benefits to individuals who are eventually 

terminated from coverage because of insufficient documentation to 

resolve the inconsistencies.

Federal regulations require marketplaces to periodically examine certain 

available data sources to determine, among other things, whether 

individuals with advance PTC remain eligible.52 However, CMS has not 

developed procedures to monitor and identify changes in circumstances, 

such as duplicate coverage or death, that may not be reported in a timely 

manner and would affect individuals’ eligibility for advance PTC.

 50Our analysis is based on data that we received from CMS for testing 2016 open 

enrollment period application transactions. 

51GAO-14-704G.

5245 C.F.R. § 155.330(d).

Monitoring Continued Eligibility
Page 31 GAO-17-467 Improper Payments

CMS checks for duplicate coverage from Medicaid in the states of 

individuals’ residencies at the time of initial enrollment, but CMS does not 

have documented procedures to regularly monitor changes in health 

insurance coverage throughout the year. In October 2015, we reported 

that CMS did not have procedures to regularly monitor unreported 

duplicate coverage from Medicaid in FFM states.53 Further, CMS had 

generally not provided FFM states with marketplace enrollment 

information that it would need to identify cases of duplicate coverage. In 

our report, we recommended that CMS establish a schedule for regular 

duplicate coverage checks and ensure that the checks are carried out 

according to schedule. In response to our recommendation, CMS officials 

told us that they completed checks for duplicate coverage. CMS officials 

also stated that the agency intended to perform this check at least twice 

per coverage year on an ongoing basis and will take steps to terminate 

advance PTC for any individuals identified. However, during the course of 

our audit, we found that CMS does not have documented procedures 

instructing its personnel to continue running these checks regularly.54

As mentioned earlier, CMS also did not provide us with documentation on 

the feasibility for using other existing resources and tools for checking for 

Medicaid and CHIP coverage in all FFM states. As such, we were unable 

to evaluate CMS’s assessment to determine whether CMS reviewed the 

feasibility of all existing resources, such as the Public Assistance 

Reporting Information System (PARIS).55 States can use PARIS to 

identify duplicate Medicaid coverage across other states. CMS officials 

told us that they have not studied the feasibility of using PARIS for the 

advance PTC program.

 53GAO, Medicaid and Insurance Exchanges: Additional Federal Controls Needed to 

Minimize Potential for Gaps and Duplication in Coverage, GAO-16-73 (Washington, D.C.: 

Oct. 9, 2015). 

54As previously discussed, we also found deficiencies in the process that CMS uses to 

verify duplicate coverage with Medicaid and CHIP.

55PARIS is a set of computer matches that enables state public assistance agencies and 

federal agencies to share information about applicants for and recipients of certain 

benefits. PARIS allows participating state public assistance agencies to exchange with 

other participants the previous quarter’s eligibility files for the Temporary Assistance for 

Needy Families program, Supplemental Nutrition Assistance Program, and Medicaid 

program. Federal agencies such as the Department of Defense and the Department of 

Veterans Affairs have likewise signed agreements to participate in PARIS. States can use 

the PARIS data match to help assure that individuals enrolled in Medicaid or other public 

assistance benefits in one state do not receive duplicate benefits from that state’s 

Medicaid program or from other public benefit programs in other states.
Page 32 GAO-17-467 Improper Payments

CMS also did not properly design procedures related to (1) periodically 

verifying that individuals with advance PTC provided to issuers on their 

behalf did not begin receiving other government-sponsored health care 

coverage after enrollment, such as Medicare or Department of Veterans 

Affairs health benefits, and (2) terminating advance PTC for individuals 

who have such coverage. CMS officials told us that they have established 

a process to check individuals enrolled in the FFM for Medicare coverage 

and to send notices to them if there is a match. However, CMS officials 

stated that they do not terminate advance PTC for such individuals. In 

addition, CMS officials stated that when individuals update their FFM 

applications, CMS checks those individuals’ marketplace applications for 

duplicate government-sponsored health coverage. However, individuals 

may not update their applications if they elect to auto reenroll into plans. 

In such instances, CMS does not have mechanisms to terminate advance 

PTC for individuals who obtain or gain access to duplicative governmentsponsored coverage.

In addition, CMS does not conduct any periodic checks during the year to 

determine if any individuals have subsequently died. According to CMS 

officials, when individuals stop paying their premiums, such as in the case 

of death, there is a 90-day grace period, as required by PPACA, after 

which the individuals’ policies would be canceled for failure to pay 

premiums. Thus, under the grace periods, CMS pays up to 3 months of 

additional advance PTC after individuals have died unless it is otherwise 

reported to their insurers. CMS officials told us that following the end of 

the grace periods and subsequent issuer terminations for failure to pay 

premiums, CMS retroactively recoups 2 of the 3 months of excess 

advance PTC by adjusting subsequent payments to issuers following the 

normal process that governs grace periods.

Internal control standards state that management should use quality 

information to achieve the entity’s objectives.56 In addition, these 

standards also state that management should design control activities to 

achieve objectives and respond to risks. Without establishing proper 

procedures to periodically check for changes in circumstances, such as 

individuals’ eligibility for government-sponsored coverage or their deaths,

CMS is at increased risk of providing advance PTC on behalf of 

individuals who are not eligible for it.

 56GAO-14-704G.
Page 33 GAO-17-467 Improper Payments

CMS did not properly design procedures related to timely terminating 

advance PTC for individuals who have not filed the required federal 

income tax returns. Under federal regulations, marketplaces must 

discontinue advance PTC for individuals who did not comply with the 

requirement to file a federal income tax return and reconcile the advance 

PTC.

CMS allowed 2014 advance PTC recipients to attest as to whether they 

had filed a 2014 tax return when making FFM eligibility determinations for 

2016. CMS offered individuals the opportunity to attest they made the 

proper tax filing, followed by CMS post-approval checks of IRS data. CMS 

officials stated that they selected this approach in order to prevent 

erroneous advance PTC terminations because of delays in IRS 

processing and availability of filing data from IRS at the time of application 

review. However, CMS’s process for verifying individual attestation and 

termination of individuals who did not file tax returns was not documented 

in its procedures. CMS officials told us that they had terminated advance 

PTC in November 2016 for individuals who IRS indicated had not filed 

2014 tax returns. As a result, the marketplaces continued to pay advance 

PTC on behalf of those individuals for over three-quarters of plan year 

2016 despite their not filing the required tax returns to reconcile their 

advance PTC.

In September 2016, IRS also began sending data to CMS on individuals 

or members of tax households on whose behalf CMS provided advance 

PTC but who did not file the required Form 8962, Premium Tax Credit, 

with their tax returns. The form is used to reconcile advance PTC 

amounts with the final PTC amounts. CMS did not terminate advance 

PTC for individuals who filed their tax returns but did not reconcile using 

Form 8962. However, CMS officials told us that they plan to terminate 

advance PTC for those who file but do not reconcile in the future.

Internal control standards state that management should use quality 

information to achieve the entity’s objectives.57 In addition, these 

standards also state that management should design control activities to 

achieve objectives and respond to risks.

Without designing and implementing policies and procedures related to 

preventing and detecting advance PTC to individuals who do not comply 

 57GAO-14-704G.

Verifying Compliance with Tax 

Filing Requirements
Page 34 GAO-17-467 Improper Payments

with tax filing requirements, including those who do not file Form 8962, 

CMS increases the risk that advance PTC will not be terminated on a 

timely basis. Further, the federal government is missing opportunities to 

recover overpayments of advance PTC as part of the IRS PTC 

reconciliation process. For example, as of October 2016, approximately 1 

million households still had not filed the required Form 8962 with their 

2014 tax returns. However, these households had approximately $2.9

billion in advance PTC paid on their behalf in 2014. Furthermore, without 

the required Form 8962 from individuals who received advance PTC, IRS 

cannot identify potential underpayments or overpayments of advance 

PTC.

Individuals are generally only allowed to enroll in qualified health plans 

during the open enrollment period. However, special enrollment periods 

provide an opportunity for individuals who lose health insurance coverage 

during the year or experience certain major life changes to enroll in a 

qualified health plan through the marketplaces outside of the annual open 

enrollment period. Examples of major life changes include the loss of 

minimum essential coverage, permanent move of residence, birth of a 

child, and marriage.

Beginning in June 2016, individuals who qualified to enroll during special 

enrollment periods were asked to provide documentation to substantiate 

certain life changes. However, during the period of our audit, CMS 

procedures did not require the verification of major life changes using 

applicant-submitted documentation.

CMS officials told us that there is no specific legal provision that requires 

federal and state marketplaces to verify events that trigger special 

enrollment periods. However, in 2016, HHS conducted a study to confirm 

consumers’ eligibility for special enrollment periods based on a review of 

documentation submitted for a sample of special enrollment periods 

granted during coverage year 2016. In April 2017, CMS issued a 

regulation to take effect on June 19, 2017, stating, among other things, 

that the federal marketplace will begin performing pre-enrollment 

verification of life changes for special enrollment periods. In the 

regulation, CMS stated that pre-enrollment verification of special 

enrollment periods will be phased in, focusing first on the categories with 

the highest volume and of most concern—such as loss of minimum 

essential coverage, permanent move, Medicaid or CHIP denial, marriage, 

Verifying Major Life Changes 

That Qualify Individuals to 

Enroll Outside of the Open 

Enrollment Period
Page 35 GAO-17-467 Improper Payments

and adoption.58 However, CMS has not yet designed and implemented 

procedures for its contractor to implement this verification process.

Internal control standards state that management should use quality 

information to achieve the entity’s objectives.59 Accordingly, management 

should obtain relevant data from reliable internal and external sources in 

a timely manner based on the identified information requirements for 

achieving the entity’s objectives and address risks. Management 

evaluates these data for reliability, obtains them on a timely basis so that 

they can be used for effective monitoring, and processes the obtained 

data into quality information to support the internal control system. In 

addition, these standards state that management should design control 

activities to achieve objectives and respond to risks.

Without verifying and documenting events that trigger eligibility for 

enrollments during special enrollment periods, CMS may provide advance 

PTC and health care coverage to individuals who are not eligible to enroll 

outside of the annual open enrollment period. In addition, individuals may 

be able to receive health care coverage for sickness or injuries 

inappropriately because they received coverage outside of the open 

enrollment period by providing false information to the FFM related to a 

special enrollment period event. For example, in November 2016, we 

reported that the FFM and selected state-based marketplaces approved 

health insurance coverage and advance PTC for 9 of 12 of GAO’s 

fictitious applications made during a 2016 special enrollment period. For 5 

applicants, GAO provided no documents to support the special enrollment 

period triggering event, but CMS approved the coverage.60

 5882 Fed. Reg. 18346 (Apr. 18, 2017).

59GAO-14-704G.

60GAO, Patient Protection and Affordable Care Act: Results of Enrollment Testing for the 

2016 Special Enrollment Period, GAO-17-78 (Washington, D.C.: Nov. 17, 2016). 
Page 36 GAO-17-467 Improper Payments

Individuals must meet income requirements in order to qualify for 

advance PTC. Specifically, individuals are expected to have household 

incomes equal to or between 100 and 400 percent of the federal poverty 

level for their given family size to be eligible for advance PTC.61

Although CMS designed procedures related to detecting potentially 

understated income amounts, its procedures do not include verifying 

income amounts that may be overstated. Specifically, CMS does not 

check for potentially overstated income amounts, despite the risk that 

individuals may do so in order to qualify for advance PTC. This risk is 

increased for states that did not expand Medicaid coverage to individuals 

who make less than 100 percent of the federal poverty level. To receive 

subsidized health care coverage in these states, individuals could 

overstate their income to at least 100 percent of the federal poverty level 

to ensure that they qualify for advance PTC. According to CMS officials, 

they did not check for potentially overstated income amounts because 

federal regulations allow CMS to accept individuals’ attestations when 

attested income amounts are higher than those in IRS data. However, by 

not checking potentially overstated income amounts, CMS may be 

improperly providing advance PTC to issuers on behalf of individuals not 

eligible for the benefit.

Along with income, family size has a direct relationship to the amount of 

advance PTC for which enrollees are eligible. As family size increases, 

the percentage of the federal poverty level for that household to be 

eligible for the maximum amount of PTC decreases, thereby affecting the 

advance PTC amount. IRS provides CMS with household income and 

family size information for enrollees requesting eligibility determinations 

for advance PTC. However, when the family size provided by an enrollee 

does not match the family size shown in IRS records, CMS does not 

generate an inconsistency. CMS accepts applicant attestations without 

further verification. CMS officials also told us that it could be challenging 

to verify family size information with documentation from individuals. 

 6126 U.S.C. § 36B(c)(1)(A), as added by PPACA § 1401(a).

CMS’s Key Control 

Activities Related to the 

Accuracy of Advance PTC 

Calculations Based on 

Income and Family Size 

Are Not Properly Designed
Page 37 GAO-17-467 Improper Payments

However, CMS could use federal income tax returns and other supporting 

documentation to substantiate family sizes.62

Internal control standards state that management should use quality 

information to achieve the entity’s objectives.63 Management obtains 

relevant data from reliable sources. Relevant data have a logical 

connection with, or bearing upon, the identified information requirements. 

Reliable sources provide data that are reasonably free from error and 

bias and faithfully represent what they purport to represent. Internal 

control standards also state that management should design control 

activities to achieve objectives and respond to risks.

Without proper procedures for verifying incomes and family sizes, CMS’s 

risk of providing advance PTC on behalf of individuals who do not meet 

the minimum income eligibility requirements—including those who may 

purposefully misstate their incomes or family sizes in order to become 

eligible for advance PTC—is increased. For example, in our testing of 93 

applications, we found 11 applications for individuals residing in states 

that did not expand Medicaid and for which the modified adjusted gross 

incomes for those households64 were less than 100 percent of the federal 

poverty level, according to data that IRS provided to CMS during 

application review.65 While some of these individuals may have earned 

additional income, they may have also overstated their incomes on their 

applications to become eligible for coverage and advance PTC. However, 

CMS did not check for potential overstatements of income amounts and 

generate inconsistencies to resolve such potential overstatements.

 62The Department Health and Human Services Office of Inspector General also previously 

reported findings on federal marketplace’s internal controls related to family size during 

the first open enrollment period (January 1, 2014 through April 19, 2014). For more 

information, see A-09-14-01011.

63GAO-14-704G.

64Household income is the taxpayer’s modified adjusted gross income, plus that of every 

other individual in a family for whom the taxpayer can properly claim a personal exemption 

and who is required to file a federal income tax return.

65We identified 11 cases where an applicant overstated their income and where the 

household income was less than 100 percent of the poverty level from CMS’s population 

of approximately 5.0 million applications during the 2016 open enrollment period from 

November 15, 2015, through January 31, 2016. For an observed number of 11 cases in a 

sample size of 93, we can be 95 percent confident that the population deviation rate is not 

more than 18.82 percent. This is greater than our tolerable deviation rate of 5 percent.
Page 38 GAO-17-467 Improper Payments

Based on our audit work, CMS has properly designed and implemented 

procedures related to the accuracy of advance PTC to reasonably assure 

that payments made to issuers and qualified health plans comply with 

applicable requirements, including procedures to

• generate accurate policy-based payments to issuers based on 

enrollment data;

• properly review and approve of issuer payment calculations and 

reconciliations;

• perform compliance reviews to help ensure that issuers and qualified 

health plans meet applicable requirements of the marketplace; and

• notify issuers of noncompliance and decertify those that do not meet 

key requirements.

As discussed earlier, we did not test whether the control activities for 

making payments to issuers were operating as designed because such 

payments include other aggregated costs and adjustments, such as costsharing reductions and user fees, which were outside the scope of this 

audit.

IRS control activities were not properly designed and implemented to help 

achieve management objectives related to preventing and detecting 

improper payments of PTC. Specifically, we found deficiencies in the 

design of IRS control activities related to determining whether individuals

• met the citizenship or lawful presence requirement for PTC eligibility;

• had access to or enrollment in health care coverage that met 

minimum essential coverage, which would allow individuals to obtain 

PTC for the months that were not covered;

• properly assessed individual shared responsibility payments (SRP) on 

their tax returns; and

• were properly notified of the requirement to file if they did not file their 

tax returns.

IRS faces several challenges that affect its ability to design and 

implement control activities related to PTC. These challenges include the 

timeliness and availability of key income data to verify taxpayers’ PTC 

claims, resource constraints in identifying tax returns for further review, 

CMS Properly Designed 

and Implemented Control 

Activities Related to the 

Accuracy of Advance PTC 

Payments Made to 

Certified Issuers and 

Qualified Health Plans

IRS’s Control 

Activities Related to 

PTC Were Not 

Properly Designed 

and Implemented
Page 39 GAO-17-467 Improper Payments

and statutory limitations for automatically correcting tax returns and 

recovering excess advance PTC repayments.

We did not evaluate whether all control activities related to preventing and 

detecting improper payments of PTC were operating as designed or 

evaluate other internal control components, such as control environment. 

Deficiencies, if any, in the internal control components that were not 

evaluated could further impair the overall effectiveness of IRS’s control 

activities related to preventing and detecting improper payments in the 

PTC program. (See fig. 5.)

Figure 5: IRS Key Control Activities Related to Preventing and Detecting Improper Payments of PTC
Page 40 GAO-17-467 Improper Payments

To qualify for PTC, individuals must be U.S. citizens or nationals, or 

otherwise lawfully present in the United States.66 All advance PTC for 

those not lawfully present must be reported on tax returns and repaid in 

full regardless of income level. As such, individuals are not entitled to 

PTC for any period during which they are not lawfully present in the 

United States.

IRS officials told us that IRS does not perform compliance checks to 

verify eligibility based on individuals’ citizenship or lawful presence status. 

IRS officials stated that they rely on the state and federal marketplaces to 

determine whether the individuals met citizenship or lawful presence 

eligibility requirements. If IRS receives enrollment information from the 

state or federal marketplaces,67 IRS presumes that individuals met 

citizenship or lawful presence requirements.

While information that IRS receives from state and federal marketplaces

may be effective in determining whether individuals met citizenship and 

lawful presence requirements for PTC, it does not address situations 

when state or federal marketplaces conditionally provided advance PTC 

on behalf of individuals but subsequently terminated advance PTC 

payments because of failure to prove citizenship or lawful presence. 

Specifically, PPACA’s implementing regulations allow individuals 95 days 

to provide supporting information to the marketplace when the 

marketplace is unable to verify that the individuals met enrollment or 

advance PTC requirements for citizenship or lawful presence.68

Consequently such individuals’ attested information qualifies them to be 

conditionally eligible for advance PTC during this inconsistency period. At 

the end of the inconsistency period, the marketplace is required to 

terminate advance PTC for individuals who did not resolve their 

inconsistencies related to citizenship or lawful presence.

Treasury regulations do not require the marketplaces to provide IRS with 

the reasons for terminating health care coverage or advance PTC for 

 6645 C.F.R. §§ 155.305(a)(1) and 155.315(c).

67As mentioned earlier, as required by Treasury regulations, CMS and the state 

marketplaces provide enrollment information to IRS each month and an annual summary 

of advance PTC paid on behalf of individuals during the year on Form 1095-A, Health 

Insurance Marketplace Statement.

6845 C.F.R. §155.315(c). 

IRS Is Unable to Design 

and Implement Control 

Activities to Verify Whether 

Individuals Meet the 

Citizenship or Lawful 

Presence Eligibility 

Requirement
Page 41 GAO-17-467 Improper Payments

individuals. Because of this, the marketplaces do not report advance PTC 

payment terminations to IRS for individuals who do not meet the 

citizenship or lawful presence eligibility requirements when the 

marketplaces make final determinations at the end of the inconsistency 

periods.

Internal control standards state that management should externally 

communicate the necessary quality information to achieve the entity’s 

objectives.69 As part of this standard, management should obtain quality 

information to reasonably assure that internal control objectives—such as 

necessary data to verify citizenship information or legal presence 

requirements for PTC—are achieved.

Because Treasury does not require the state or federal marketplaces to 

provide information on individuals who do not meet the citizenship or 

lawful presence requirements, IRS has not established a mechanism to 

identify that individuals claiming PTC meet this key PTC eligibility 

requirement. Further, according to IRS officials, they have not assessed 

the feasibility of obtaining such information from the marketplaces and 

incorporating such information into their processes. The volume and 

dollar amount of advance PTC paid on behalf of individuals whose 

coverage was terminated for citizenship or lawful presence requirements 

can be significant. In our February 2016 report,70 we found that for the 

first enrollment period,71 CMS terminated about 65,000 policies from the 

marketplaces because individuals did not resolve their citizenship or 

lawful presence issues. Over $130 million in advance PTC was paid on 

behalf of these individuals.72 Thus, without access to the data needed to

verify citizenship or lawful presence eligibility requirements for individuals, 

IRS may be missing opportunities to prevent potentially significant 

improper payments of PTC.

 69GAO-14-704G.

70GAO-16-29.

71The first enrollment period was October 1, 2013, to March 31, 2014, and it also included 

a special enrollment extension into April 2014.

72GAO-16-29.
Page 42 GAO-17-467 Improper Payments

IRS has not properly designed and implemented key control activities to 

perform the necessary post-refund checks routinely to identify individuals 

who are not eligible for claimed PTC amounts because of either duplicate 

health care coverage or availability of coverage from employers or 

government-sponsored programs.73 IRS officials stated that IRS 

examiners, using internal and external information systems, may check 

Forms 1095-B, Health Coverage, and 1095-C, Employer-Provided Health 

Insurance Offer and Coverage, filed for the individuals as part of their 

general examination procedures to verify all insurance coverage in and 

out of the marketplace. IRS officials stated that they rely on tax 

examiners’ judgment to evaluate available data and determine whether 

the presence or absence of a particular item on a tax return represents a 

potential issue. IRS developed a checklist that examiners could use in 

reviewing tax returns for duplicate coverage and SRP and included this 

checklist in the program used by the postcompliance units. However, IRS 

did not incorporate the checklist or instructions to use the checklist in the 

IRM to require its use as part of the routine procedures that examiners in 

the postcompliance units perform regularly.

Internal control standards state that management should design control 

activities to achieve objectives and respond to risks.74 Control activities 

are the policies, procedures, and other mechanisms that enforce 

management’s directives to achieve the entity’s objectives and address 

related risks.

IRS officials stated that they are reviewing the potential compliance issue 

related to duplicate health insurance coverage for post-refund compliance 

checks. IRS officials also stated that they have requested research data 

on the level of noncompliance for tax year 2015 and that these data will 

be evaluated to determine what, if any, post-refund actions are needed. 

Without routinely performing post-refund checks on individuals’ health 

insurance coverage from employers or government-sponsored health 

care plans, IRS is vulnerable to improperly providing PTC to ineligible 

 73IRS must rely on post-refund checks because IRS does not receive key health care data 

at the time of tax return processing to identify individuals who are not eligible for claimed 

PTC amounts. Unlike the marketplaces, which are required to report to IRS by the end of 

January, the employers and government-sponsored programs are not required to report 

health care coverage information to IRS until the end of March (if filed electronically), by 

which time IRS has already started processing federal income tax returns as individuals 

submit them in the filing season.

74GAO-14-704G.

IRS Control Activities 

Related to Checking for 

Health Care Coverage 

Were Not Properly 

Designed and 

Implemented
Page 43 GAO-17-467 Improper Payments

recipients. The effect of IRS’s lack of routine post-refund checks on 

individuals’ health insurance coverage from employers or governmentsponsored health care plans was illustrated in our review of a statistical 

sample of 93 tax returns with PTC-related amounts during the first 9 

months of fiscal year 2016. Based on our testing, the number of 

individuals who inappropriately received PTC because of their eligibility 

for or receipt of minimum essential coverage outside of the marketplace 

could be significant. In our statistical sample of 93 PTC-related 

transactions for the first 9 months of fiscal year 2016, we found 7 cases in 

which the individuals or members of their households received subsidized 

coverage from the marketplaces and at the same time also had coverage 

through employer- or government-sponsored health care plans for at least 

1 month during the year.75

IRS also does not have properly designed and implemented key control 

activities to perform the necessary post-refund checks to identify 

individuals who did not have health care coverage for the entire year and 

did not comply with SRP requirements.76 In our statistical sample of 93 

tax returns, we found that in 17 cases the individuals or all the members 

of their tax households did not have qualifying health care coverage for 

the entire year or an exemption from health care coverage for some of the 

 75We identified 7 cases in our statistical random sample of 93 transactions from IRS’s 

population of approximately 6.1 million PTC-related transactions for the period from 

October 1, 2015, to June 18, 2016. For an observed number of 7 cases in a sample size 

of 93, we can be 95 percent confident that the population deviation rate is not more than 

13.67 percent. This is greater than our tolerable deviation rate of 5 percent.

76IRS must rely on post-refund checks to assess compliance for individual SRPs. Similar 

to duplicate coverage discussed earlier, the lack of availability of key data from issuers, 

federal and nonfederal employers, and government-sponsored programs also affected 

IRS’s ability to verify, before issuing tax refunds, whether individuals were complying with 

SRP requirements. According to IRS officials, IRS was planning to implement a new 

process in 2017 to determine whether the individuals owed SRPs by identifying cases in 

which the individuals were silent with respect to health care coverage on their tax returns. 

Specifically, IRS officials stated that IRS intended to identify those individuals who did not 

(1) check the coverage box on the tax return, (2) claim an exemption from the coverage 

requirement, or (3) report an SRP. However, an executive order issued in January 2017 

directs federal agencies to exercise all authority and discretion available to them to reduce 

the potential burden of PPACA. In response to this executive order, IRS stated that it did 

not implement this new process in 2017.

IRS Control Activities 

Related to Verifying SRP 

Compliance Were Not 

Properly Designed and 

Implemented
Page 44 GAO-17-467 Improper Payments

months or for the entire year.77 For those returns, the individuals did not 

pay the required SRP for the months without coverage and IRS did not 

assess SRPs for those individuals who did not have qualifying health care 

coverage or have coverage exemptions for the entire year. Without 

properly designed and implemented key control activities to perform the 

necessary post-refund checks of SRPs, IRS may not always consistently 

and equitably assess and collect the SRP.

IRS’s ability to verify taxpayer-reported income prior to issuing tax refunds 

is limited because some deadlines for third parties to report key aspects 

of taxpayer income fall late in the tax filing season.78 As such, IRS does 

not timely receive complete income information, which impedes IRS’s 

ability to design control activities for verifying PTC calculations prior to 

issuing tax refunds. IRS’s challenge in verifying income before issuing 

refunds is not unique to PTC; it is an inherent risk with the tax 

administration processes in which refunds are issued before all 

compliance checks are completed. While IRS receives some income 

information from third parties—such as wage information from 

employers—by mid-February,79 IRS may not receive other key income 

information returns necessary for verifying income until later in the tax 

filing season. For example, Form 1099-INT, Interest Income, can be filed 

electronically to IRS as late as March 31, which is well into the tax filing 

season and too late for IRS to use for checking income reporting 

compliance during pre-refund processing of tax returns. Because of the 

timing of third parties’ submission of comprehensive information to IRS, 

IRS may not detect taxpayer misreporting of income before issuing 

refunds, which could result in improper PTC payments. As a result, IRS 

 77We identified 17 cases in our statistical random sample of 93 transactions from IRS’s 

population of approximately 6.1 million PTC-related transactions for the period from 

October 1, 2015, to June 18, 2016. For an observed number of 17 cases in a sample size 

of 93, we can be 95 percent confident that the population deviation rate is not more than 

26.15 percent. This is greater than our tolerable deviation rate of 5 percent.

78As mentioned earlier, income is a key element used to calculate PTC on Form 8962.

79Starting with the 2016 tax season, the filing deadlines for employers to furnish IRS with 

Forms W-2, Wage and Tax Statement, and certain Forms 1099-MISC, Miscellaneous 

Income, were moved up to January 31 from March 31.

IRS Is Unable to Design 

and Implement Control 

Activities to Verify 

Individuals’ Income for 

Calculating PTC-Related 

Amounts Prior to Issuing 

Refunds
Page 45 GAO-17-467 Improper Payments

must rely on post-refund checks to identify any taxpayer misreporting of 

income after the filing season.80

IRS is unable to identify all tax returns that contain PTC-related errors for 

further review by its tax examiners. Since 2011, IRS has faced budget 

reductions.81 These budget reductions have heightened the importance of 

determining how best to allocate declining resources for IRS to 

reasonably assure that it can meet agency-wide strategic goals for 

increasing individual compliance, using resources more efficiently, and 

minimizing individual burden. As a result, IRS officials told us that IRS has 

prioritized its limited resources to design and implement cost-effective 

PTC-related key procedures to reasonably assure that it is focused on 

issues that may represent the greatest financial exposure to the 

government. To do this, IRS established dollar thresholds to limit the 

number of tax returns with PTC-related amounts for additional reviews by 

IRS examiners, as it does in other types of tax administration. As a result, 

IRS does not review all tax returns that may contain errors but continues 

to process tax returns that have the PTC exposure amount below certain 

threshold amounts without any adjustments or further reviews by tax 

examiners.

We evaluated IRS’s procedures related to the PTC processing dollar 

thresholds and found that IRS’s use of dollar thresholds was operating as 

designed during the time period of testing.82 However, because IRS uses 

dollar thresholds to limit the number of individual federal income tax 

 80For example, several months after returns have been filed, IRS electronically matches 

information reported by third parties, such as banks or employers, against the information 

that taxpayers report on their tax returns. This process, known as the Automated 

Underreporter program, helps IRS identify potentially underreported income or 

unwarranted deductions or tax credits. 

81IRS’s fiscal year 2016 annual appropriation provided $11.24 billion, which was about 

$900 million (7 percent) less than its fiscal year 2011 annual appropriation of $12.12 

billion. See GAO, 2016 Filing Season: IRS Improved Telephone Service but Needs to 

Better Assist Identity Theft Victims and Prevent Release of Fraudulent Refunds, 

GAO-17-186 (Washington, D.C.: Jan. 31, 2017).

82We evaluated IRS’s procedures related to PTC processing dollar thresholds with a 

statistical random sample of 93 transactions from IRS’s population of approximately 6.1 

million PTC-related transactions on individual federal income tax returns based on the 

IRS-provided data for the period from October 1, 2015, to June 18, 2016, and identified 1 

exception. For an observed number of 1 exception in a sample size of 93, we can be 95 

percent confident that the population deviation rate is not more than 5 percent. This is 

equal to our tolerable deviation rate of 5 percent.

IRS Is Unable to Design 

and Implement Control 

Activities to Identify Tax 

Returns That Contain 

Errors for Further Review
Page 46 GAO-17-467 Improper Payments

returns reviewed by examiners, it does not pursue errors in overstated or 

understated PTC amounts below the thresholds.

Although the focus was not on PTC, we reported in 2016 that IRS lacked 

a comprehensive strategy for its refundable tax credit compliance 

efforts.83 In this report, we stated that IRS was working on a strategy to 

document current compliance efforts and identify and evaluate potential 

new solutions to address improper payments; however, its analysis 

focused on efforts to improve Earned Income Tax Credit compliance and 

did not include other refundable tax credits. As a result, we recommended 

that IRS develop a comprehensive operational strategy that includes all 

refundable tax credits. IRS agreed with the recommendation and stated 

that it is working on developing a comprehensive strategy to address 

compliance and improper payments related to its refundable tax credit 

programs, including PTC.

A key control activity for IRS is correcting inaccuracies in individuals’ PTC 

calculations. IRS does this by corresponding with individuals, suspending 

the tax returns, or using its statutory math error authority. Based on 

statistical sample of 93 individual federal income tax returns with PTCrelated amounts from October 2015 to June 2016, we found that IRS (1) 

appropriately suspended the tax returns and corresponded with 

individuals to resolve PTC-related issues and errors on the tax returns 

and (2) accurately calculated and processed PTC-related amounts in 

cases within its statutory authority.

IRS cannot always correct individuals’ inaccuracies that it identifies while 

processing tax returns. As we previously reported, in cases where 

individuals do not reconcile advance PTC, IRS does not have the 

authority to automatically correct the tax returns and notify the individuals 

of the changes.84 In other circumstances, IRS has statutory math error 

authority to fix easily correctable calculation errors and check for other 

obvious noncompliance in limited circumstances.85 However, in cases of 

 83GAO, Refundable Tax Credits: Comprehensive Compliance Strategy and Expanded 

Use of Data Could Strengthen IRS’s Efforts to Address Noncompliance, GAO-16-475 

(Washington, D.C.: May 27, 2016).

84GAO-17-186. 

85Under IRS’s present math error authority, IRS may correct certain mathematical or 

clerical errors on a return and notify the taxpayer of the proper tax liability based on those 

corrections. 26 U.S.C. § 6213(b). 

IRS Is Unable to Design 

and Implement Control 

Activities to Correct PTCRelated Errors on Tax 

Returns Prior to Issuing 

Refunds
Page 47 GAO-17-467 Improper Payments

a discrepancy with marketplace data, such as differences in amounts of 

advance PTC reported by individuals on their Forms 8962, IRS does not 

have the authority to automatically correct the tax returns and notify 

individuals of the changes. According to IRS officials, having the authority 

to correct PTC errors related to discrepancies with marketplace data 

would allow IRS to process returns more quickly without having to 

correspond with the individuals or expend further resources to audit their 

compliance.

In 2015, we suggested that IRS seek legislative authority to correct tax 

returns at filing based on the marketplace data.86 Correctable-error 

authority could help IRS meet its goals: processing tax returns timely, 

providing individuals with refunds more quickly, and reducing the burden 

on individuals of responding to IRS correspondence. It can also reduce 

the need for IRS to resolve discrepancies in post-filing compliance, which, 

as we previously concluded, is less effective and more costly than at filing 

compliance.87 For each year beginning with fiscal year 2015, Treasury 

has submitted legislative proposals that among other things, would 

establish a category of correctable errors. Under the proposals, Treasury 

would be granted regulatory authority to permit IRS to correct errors in 

cases where information provided by individuals does not match 

corresponding information in government databases.88 As of the 

completion of our audit, Congress has not yet granted this broad 

authority.

The effect of IRS’s lack of authority to correct PTC-related errors on tax 

returns at filing was illustrated in our review of a statistical sample of 93 

tax returns with PTC-related amounts during the first 9 months of fiscal 

year 2016. We found that for 6 of the 93 sample cases, the individuals did 

not submit the required Forms 8962 to reconcile PTC, when marketplace

data indicated that these individuals had advance PTC paid on their 

behalf. In addition, for an additional 2 of the 93 cases, the individuals

 86GAO, Patient Protection and Affordable Care Act: IRS Needs to Strengthen Oversight of 

Tax Provisions for Individuals, GAO-15-540 (Washington, D.C.: July 29, 2015). 

87GAO, Identity Theft: Additional Actions Could Help IRS Combat the Large, Evolving 

Threat of Refund Fraud, GAO-14-633 (Washington, D.C.: Aug. 20, 2014).

88Department of the Treasury, General Explanations of the Administration’s Fiscal Year 

2017 Revenue Proposals (February 2016), 225-226; General Explanations of the 

Administration’s Fiscal Year 2016 Revenue Proposals (February 2015), 245-246; and 

General Explanations of the Administration’s Fiscal Year 2015 Revenue Proposals

(February 2014), 229-230.
Page 48 GAO-17-467 Improper Payments

reported different amounts on their Forms 8962 than what the 

marketplace data indicated. For these 8 out of 93 cases, IRS issued 

refunds to the individuals without adjusting the refund amounts for the 

PTC-related differences.89 Thus, without the ability to automatically 

correct the tax returns, IRS is not able to fully collect excess advance 

PTC overpayments and reimburse PTC underpayments.

IRS cannot design control activities to recover all excess advance PTC 

repayment amounts. Marketplaces determine the amounts of advance 

PTC for which individuals are eligible, in part, based on each applicant’s 

anticipated household income for the year. The PTC amount is based on 

actual income reported when individuals file income tax returns. If the 

amounts of advance PTC paid on behalf of individuals are greater than 

the amounts final PTC claimed on their tax returns, then the individuals 

must repay excess advance PTC. However, federal law limits the amount 

of excess advance PTC overpayments that individuals must repay, based 

on their household incomes as a percentage of the federal poverty level 

and filing status. As a result, IRS is prohibited from recovering the full 

amount of excess advance PTC payments that may otherwise be due 

from individuals. (See table 1.) According to IRS, for fiscal year 2016, 

individuals had over $800 million in excess advance PTC that they were 

not required to repay because of repayment limitations. Under current 

federal law, IRS will continue to only recover the excess advance PTC 

repayment amounts up to the statutory repayment limitation.

 89We identified 8 cases in a statistical random sample of 93 PTC-related transactions from 

IRS’s population of approximately 6.1 million PTC-related transactions from the period 

from October 1, 2015 to June 18, 2016, that occurred during the first 9 months of fiscal 

year 2016. For an observed number of 8 cases in a sample size of 93, we can be 95 

percent confident that the population deviation rate is not more than 14.99 percent. This is 

greater than our tolerable deviation rate of 5 percent.

IRS Is Unable to Design 

and Implement Control 

Activities for Recovering 

Excess Advance PTC 

Repayment Amounts
Page 49 GAO-17-467 Improper Payments

Table 1: Repayment Limits for Excess Advance Premium Tax Credit for Tax Year 

2016

Household income as a 

percentage of the 

federal poverty level 

Repayment limitation for 

single taxpayer filing status 

(dollars) 

Repayment limitation for 

all other filing statuses 

(dollars)

Less than 200 percent 300 600 

At least 200 but less than 

300 percent

750 1,500 

At least 300 but less than 

400 percent

1,275 2,550 

400 or more percent No limitation No limitation 

Source: 26 U.S.C. § 36B(f). | GAO-17-467

Note: The repayment limits apply only to advance premium tax credit (PTC) for coverage of 

individuals who are lawfully present in the United States. All advance PTC to individuals who had 

marketplace coverage but were not lawfully present must be reported by individuals on their tax 

returns and repaid in full.

IRS did not properly design control activities that notified nonfilers of the 

requirement to file tax returns.90 We found that in 2015 and 2016, IRS 

used an ad hoc process to send notices to individuals who had advance 

PTC paid on their behalf during the previous calendar year and failed to 

file tax returns and to those who requested an extension to file. The 

notices alerted the individuals of the requirement to file a tax return and 

reconcile the advance PTC and warned that the failure to file could result 

in the loss of advance PTC for the following calendar year. However, IRS 

did not design policies and procedures for sending these notices 

regularly. According to IRS officials, IRS has not decided whether sending 

notices will be an ongoing process. IRS officials stated that if it becomes 

an ongoing process, then IRS will likely develop policies and procedures 

for sending these notices.

 90Filing a federal income tax return is a key requirement for the PTC program. It provides 

the information individuals use to reconcile the amounts of advance PTC paid on their 

behalf to the actual amounts of PTC to which they are entitled. IRS uses Form 8962, 

which individuals are to file with their tax returns, to identify and recover any advance PTC 

overpayments or reimburse any PTC underpayments. According to IRS reconciliations 

and analysis, about $891 million in advance PTC was paid to issuers during tax year 2014 

on behalf of individuals belonging to over 313,000 tax households that had not filed 

returns for the 2014 tax year as of July 2016.

IRS Control Activities 

Related to Notifying 

Nonfilers of the 

Requirement to File Tax 

Returns Were Not 

Properly Designed and 

Implemented
Page 50 GAO-17-467 Improper Payments

Internal control standards state that management should design control 

activities to achieve objectives and respond to risks.91 Control activities 

are the policies, procedures, and other mechanisms that enforce 

management’s directives to achieve the entity’s objectives and address 

related risks.

Without such policies and procedures in place, there is an increased risk 

that the ad hoc notification process will not be followed consistently in 

each filing season. As a result, individuals may be at risk for losing their 

subsidized health care coverage from the marketplaces in the future 

because they were not aware of the requirement to file their tax returns 

and reconcile the advance PTC since there is a year’s interval between 

when individuals first apply for advance PTC and when they are 

supposed to reconcile it on their tax returns. In addition, without an 

assessment or claim being made by individuals through tax return filing, 

the federal government may not be fully collecting on excess advance 

PTC that may be owed or pay any additional PTC that is due to 

individuals. Individuals’ claims are especially important because, as 

discussed later, IRS currently does not have the system capability to use 

marketplace data to calculate PTC through the Automated Substitute for 

Return (ASFR) program. Until IRS incorporates marketplace data into its 

automated process, this notification process will be key to identifying and 

collecting any overpayments of advance PTC made for individuals who 

did not file their tax returns.

IRS was unable to incorporate PTC information in the ASFR program, a 

key process for preparing substitute tax returns for individuals who did not 

file. IRS has the authority to prepare a tax return for a nonfiling individual 

if the individual appears to be liable for the return and the individual 

required to file the return either does not file it or instead files a false, 

fraudulent, or frivolous return. IRS exercises this authority through its 

ASFR program. If IRS is unable to secure a valid income tax return from 

an individual, the ASFR program automatically estimates the tax liability 

by computing the individual’s tax, penalties, and interest, based on thirdparty and other available information in its systems.

However, IRS officials stated that IRS faces challenges in incorporating 

the PTC program into the ASFR program. Specifically, the ASFR program 

 91GAO-14-704G.

IRS Is Unable to Design 

and Implement Control 

Activities for Preparing Tax 

Returns with PTC 

Information for Nonfilers
Page 51 GAO-17-467 Improper Payments

does not have the PTC calculators necessary to calculate the PTC 

amounts. The program does consider PTC-related information in 

determining whether a substitute for return (SFR) should be created or in 

calculating taxes owed when an SFR is created for an individual for other 

reasons. Thus, IRS cannot automatically prepare the Form 8962 or 

calculate PTC for non-filing individuals who had advance PTC paid on 

their behalf.

IRS officials stated that they recognize the lack of PTC-related 

calculations in the ASFR program as a gap in the collection mechanism. 

However, IRS officials told us that they did not have the budgetary 

resources to incorporate the complex calculations into the agency-wide 

ASFR program in 2016. Without incorporating this important programming 

change, IRS may not be able to recover the full extent of excess advance 

PTC amounts. IRS officials stated that they will consider incorporating this 

programming change in the ASFR program in the future subject to 

budgetary resource availability.

Preventing and detecting improper payments in the PTC programs is a 

complex undertaking. In fiscal year 2016, CMS assessed its PTC 

program as susceptible to significant improper payments, in accordance 

with IPIA and OMB requirements. However, CMS did not provide a 

specific, expeditious time frame for complying with statutory requirements 

to estimate and report on improper payments related to the program. As a 

result, HHS’s overall improper payment estimate will continue to be 

understated. In addition, Congress and other stakeholders will continue to 

lack key payment integrity information for monitoring HHS’s improper 

payments.

IRS did not assess the susceptibility of its PTC program in a manner 

consistent with IPIA requirements. Specifically, IRS did not include all 

types of errors that result in improper payments within the scope of its 

assessment and did not assess whether its PTC program met the 

applicable statutory thresholds for susceptibility to significant improper 

payments, as required by IPIA. Without estimating and reporting improper 

payments, IRS and external stakeholders, such as Congress, may not be 

able to fully assess the extent to which payment integrity objectives for 

the program are achieved.

Although CMS properly designed and implemented control activities 

related to the verification of citizenship and lawful presence and the 

accuracy of advance PTC payments, it did not properly design other 

Conclusions
Page 52 GAO-17-467 Improper Payments

control activities related to preventing and detecting improper payments 

of advance PTC. CMS often relies on insufficient, unreliable, and 

incomplete information for ensuring eligibility for advance PTC and 

accurately calculating the amounts of advance PTC. By not obtaining 

relevant data from reliable sources in a timely manner to meet the 

identified information requirements, and establishing procedures to verify 

eligibility of enrollees and the accuracy of advance PTC, CMS cannot 

reasonably assure that its payment integrity objectives are achieved.

IRS did not properly design and implement certain key control activities 

related to preventing and detecting PTC improper payments, including 

recovering excess advance PTC overpayments. While IRS may not 

receive key information from marketplaces to identify individuals who did 

not demonstrate that they met citizenship or lawful presence 

requirements, IRS has not assessed the feasibility of requiring such 

information from the marketplaces and incorporating such information in 

its processes to recover advance PTC made for those individuals. In 

addition, IRS lacks certain key procedures to verify health care coverage 

on individuals routinely during its post-filing compliance checks. Without 

such checks, IRS may be missing opportunities to identify individuals who 

are not eligible for PTC because they can obtain health care coverage 

outside of the marketplaces or identify individuals who did not properly 

report their SRPs on their income tax returns. Finally, although IRS used 

an ad hoc process for notifying nonfilers of the requirement to file tax 

returns, IRS did not establish procedures for sending these notices 

regularly during each filing season to facilitate compliance. Without 

addressing these key deficiencies in control activities, IRS is at increased 

risk of making improper payments to individuals and may not be fully 

collecting excess advance PTC or reimbursing PTC underpayments.

IRS also faces data limitations, such as the availability of key income 

information from third parties, and statutory challenges that impede its 

ability to prevent improper payments, recover excess payments of 

advance PTC, and reimburse underpayments. For instance, in cases of 

discrepancies with marketplace data, IRS does not have the authority to 

automatically correct the tax returns and notify the taxpayers of the 

changes. In addition, there are statutory repayment limitations on the 

amount of excess advance PTC that taxpayers are required to return to 

the government. As a result, opportunities to recover PTC improper 

payments are limited in these areas unless statutory changes are made. 

In addition, resource constraints necessitate IRS making difficult 

decisions about how best to use its resources to identify taxpayer 

noncompliance and set objectives related to preventing and detecting 
Page 53 GAO-17-467 Improper Payments

improper payments for the PTC program. In 2016, we recommended that 

IRS develop a comprehensive operational strategy that includes all 

refundable tax credits for which IRS is responsible. Implementing our 

2016 recommendation could help IRS determine whether its current 

allocation of resources for PTC is optimal and, if not, what adjustments 

may be needed.

To improve annual reporting on PTC improper payments, control activities 

related to eligibility determinations, and calculations of advance PTC, we 

recommend that the Secretary of Health and Human Services direct the 

Administrator of CMS to take the following 10 actions:

1. Annually report improper payment estimates and error rates for the 

advance PTC program.

2. Until annual reporting of improper payment estimates and error rates 

for the advance PTC program is performed, disclose significant 

matters relating to IPIA estimation, compliance, and reporting 

objectives for the advance PTC program in the agency financial 

report, including CMS’s progress and timeline for expediting the 

achievement of those objectives and the basis for any delays in 

meeting IPIA requirements.

3. Design and implement procedures for verifying the identities of phone 

and mail applicants to reasonably assure that ineligible individuals are 

not enrolled in qualified health plans in the marketplaces or provided 

advance PTC.

4. Assess and document the feasibility and availability of obtaining 

sufficiently reliable data to verify individuals’ residencies and lack of 

minimum essential coverage from nonfederal employers and, if 

appropriate, design and implement procedures for using such data in 

its verification processes.

5. Design and implement procedures for sending notices to nonfederal 

employers routinely and terminating advance PTC for individuals who 

have access to minimum essential coverage from their employers.

6. Assess and document the feasibility of approaches for (1) identifying 

duplicate government-sponsored coverage for individuals receiving 

Medicaid and CHIP coverage in FFM states outside of the states 

where they attest to residing and (2) periodically verifying individuals’

continued eligibility by working with other government agencies to 

identify changes in life circumstances that affect advance PTC 

eligibility—such as commencement of duplicate coverage or deaths—

Recommendations for 

Executive Action
Page 54 GAO-17-467 Improper Payments

that may occur during the plan year and, if appropriate, design and 

implement these verification processes.

7. Assess and document the feasibility of approaches for terminating 

advance PTC on a timelier basis and, as appropriate, design and 

implement procedures for improving the timeliness of terminations.

8. Design and implement procedures for verifying compliance with 

applicable tax filing requirements—including the filing of the federal 

tax return and the Form 8962, Premium Tax Credit—necessary for 

individuals to continue to be eligible for advance PTC.

9. Design and implement procedures for verifying major life changes 

using documentation submitted by applicants enrolling during special 

enrollment periods.

10. Design and implement procedures for verifying with IRS (1) household 

incomes, when attested income amounts significantly exceed income 

amounts reported by IRS or other third-party sources, and (2) family 

sizes.

To comply with improper payments reporting requirements and improve 

procedures related to processing PTC information on tax returns, we 

recommend that the Commissioner of Internal Revenue direct the 

appropriate officials to take the following 5 actions:

1. Assess the program against applicable IPIA-defined thresholds and 

conclude on its susceptibility to significant improper payments, and 

revise the scope of its improper payments susceptibility assessment 

for the PTC program to include instances in which advance PTC is 

greater than or equal to the amount of PTC claimed on the tax return. 

If the program meets the IPIA definition for being susceptible to 

significant improper payments based on this assessment, estimate 

and report improper payments associated with the PTC program 

consistent with IPIA requirements.

2. Assess and document the feasibility of approaches for incorporating 

information from the marketplaces on individuals who did not 

demonstrate that they met the eligibility requirements for citizenship or 

lawful presence in the tax compliance process. If determined feasible, 

IRS should work with Treasury to require marketplaces to periodically 

provide such information on individuals and use such information to 

recover advance PTC made for those individuals.

3. Assess whether IRS should require its examiners to verify health care 

coverage of individuals to determine eligibility for PTC. To do this, IRS 

should complete its evaluation of the level of noncompliance related to 
Page 55 GAO-17-467 Improper Payments

duplicate health insurance coverage. Based on this evaluation and if 

cost effective, IRS should design and implement formal policies and 

procedures to routinely identify individuals inappropriately receiving 

PTC because of their eligibility for or enrollment in health care 

programs outside of the marketplaces and notify such individuals of 

their ineligibility for PTC.

4. Design and implement procedures in the IRM for examiners in the 

post-filing compliance units to review tax returns for health insurance 

coverage for the entire year, and to identify and assess individual 

SRPs from those who are not appropriately reporting SRPs on their 

tax returns.

5. Design and implement procedures in the IRM to regularly notify 

nonfilers of the requirement to file tax returns in order to continue to 

receive advance PTC in the future.

We provided a draft of this report to HHS, IRS, and OMB for comment. In 

its comments, reproduced in appendix III, HHS concurred with seven of 

our recommendations and neither agreed nor disagreed with the 

remaining three recommendations. In its comments, reproduced in 

appendix IV, IRS agreed with two recommendations, partially agreed with 

two other recommendations, and disagreed with the remaining 

recommendation. OMB’s liaison to GAO stated in an e-mail that OMB 

had no comments on the report. HHS and IRS also provided technical 

comments, which we incorporated as appropriate.

In its comments, HHS stated that it is committed to ensuring access to 

high quality healthcare for all Americans by verifying the eligibility of 

consumers who apply for enrollment in qualified health plans through a 

marketplace and providing coverage to eligible individuals. HHS stated 

that it takes seriously its responsibilities to protect taxpayer funds while 

reducing the burden on consumers, employers, and other individuals and 

entities involved in the marketplace and other insurance affordability 

programs. In its response, HHS described its initiatives to enhance the 

integrity of its program, including conducting a fraud risk assessment for 

potential risk in the marketplace and working towards estimating and 

reporting improper payments for advance PTC. In addition, HHS 

described its process for verification of identity, determination of eligibility 

of enrollment through the marketplace, confirmation of individuals’ 

compliance with tax filing requirements, and payments of advance PTC to 

certified issuers. HHS stated that it looked forward to continuing to benefit 

from suggestions from GAO and HHS’s Office of Inspector General on 

Agency Comments

and Our Evaluation

Health and Human 

Services
Page 56 GAO-17-467 Improper Payments

ways to improve its operations so eligible individuals can gain coverage 

through the marketplaces and insurance affordability programs in a way 

that prevents consumer harm and protects taxpayer money.

HHS stated that it concurred with 7 of our 10 recommendations and 

described actions it has taken or plans to take to address these 7 

recommendations. Such actions include (1) reporting on its progress in 

designing and implementing an improper payment estimate for the 

advance PTC program in future agency financial reports, (2) documenting 

the feasibility of modifying certain verification procedures, and (3) 

verifying key eligibility requirements, such as compliance with tax filing 

requirements and changes in life circumstances that qualified applicants 

for enrollment during special enrollment periods. The actions by HHS, if 

implemented effectively, would address our recommendations.

For the remaining three recommendations, HHS did not state whether or 

not they concurred with the recommendations. 

In response to our third recommendation regarding verification of filer 

identity, HHS stated that for individuals starting a new application via 

phone, the call center representatives use verbal attestations for identity 

verifications from individuals. HHS stated that for paper applications, 

individuals must provide names and complete addresses as well as other 

information. In addition, HHS stated that individuals must attest that the 

information they provide on all applications is accurate by signing under 

penalty of perjury. However, we continue to believe that because CMS 

does not validate the identities of individuals who apply by phone or mail, 

CMS is vulnerable to enrolling ineligible individuals in qualified health 

plans with advance PTC. 

For our fifth recommendation on sending notices to nonfederal 

employers, HHS stated that it is evaluating its 2016 employer notice 

program to determine the best approach for notifying employers in the 

future. Such an evaluation may provide useful information; however, we 

continue to believe that designing and implementing procedures for 

sending notices to nonfederal employers and terminating advance PTC to 

individuals with access to employer-sponsored coverage can reduce the 

risk of providing advance PTC to issuers on behalf of ineligible 

individuals. 

In response to our tenth recommendation regarding verification of 

household income and family sizes, HHS stated that as part of its 

eligibility verification requirements, it verifies consumer-reported income 

with data from IRS. However, HHS stated that because household 

incomes may fluctuate year to year, it is difficult for consumers to project 
Page 57 GAO-17-467 Improper Payments

income for the year in advance. According to HHS, in instances where 

applicant-reported income is higher than the IRS data, HHS accepts the 

consumer attestation. However, HHS stated that it will assess the 

feasibility and burden on individuals of setting a reasonable threshold for 

the generation of annual household income inconsistencies that would 

require additional verification for consumer-attested income that 

significantly exceeds income amounts reported by IRS or other third party 

sources. We believe that such an evaluation is a reasonable step to 

address our recommendation to enhance the effectiveness and efficiency 

of the program related to verification of household income. In addition, 

HHS stated that it currently accepts attestation when the family size 

provided by the individual does not match IRS’s records. HHS stated that 

establishing a process to verify family size with IRS would require 

significant operational and privacy complexity. While we recognize that 

there may be certain complexities in the verification of family sizes, it is 

important that CMS develop policies and procedures to reasonably 

assure that such verifications are made on a regular basis. 

In its comments, IRS stated that it faces significant challenges 

administering refundable tax credits given their complex structural design 

and the difficulty in validating eligibility criteria. IRS stated that it also 

faces significant challenges in the use of third party and other data to 

validate information provided by filers because many potential sources 

contain information that is incomplete, out-of-date, or otherwise 

unsuitable for use in tax administration. IRS also stated that the 

complexity of the law means that not every situation is a matter for simple 

adjudication. IRS added that it must take all these factors into account 

when designing and implementing pre-filing and post-filing approaches to 

tax compliance. IRS also stated that its refundable tax credits may have 

compliance-related risks that differ from those associated with other tax 

provisions and that administration of these provisions must address these 

unique risks. According to IRS, it has committed to OMB that it will 

conduct a quantitative analysis of PTC in fiscal year 2018, the first year 

that National Research Program data will be available to perform such 

analysis.

IRS stated that that it agreed with two of our recommendations, partially 

agreed with another two recommendations, and disagreed with the 

remaining recommendation. 

IRS agreed with our second and third recommendations related to 

meeting eligibility requirements for citizenship and identifying individuals 

with duplicate health insurance coverage. IRS outlined several actions it 

Internal Revenue Service
Page 58 GAO-17-467 Improper Payments

plans to take to address those recommendations. These actions, if 

implemented effectively, would address our recommendations. 

IRS partially agreed with our first recommendation related to an improper 

payment assessment for the PTC program. IRS stated that instances in 

which the advance PTC is greater than or equal to the PTC amount 

claimed on the tax return do not result in the IRS increasing the outlay 

related to PTC and so these occurrences are not subject to IPIA. While 

we acknowledge that IRS’s interpretation of the IPIA definition of 

“payments” excludes reductions in tax receipts, we nonetheless believe 

that these instances should be considered within the scope of the IRS 

susceptibility assessment for improper payments. Taxpayers may 

inaccurately complete Form 8962 and erroneously report excess advance 

PTC on their returns instead of claiming net PTC, or they may simply fail 

to report net PTC on their tax returns altogether. Such errors would result 

in underpayments of net PTC and therefore affect program outlays and 

improper payments. In addition, IPIA defines improper payments to 

include both overpayments and underpayments. IRS also stated that it 

conducted its fiscal year 2016 PTC improper payment risk assessment 

consistent with OMB guidance but will discuss with OMB a future change 

to the approach for assessing PTC improper payments as part of a larger 

discussion about the administration of refundable tax credits. However, 

IRS did not conclude whether or not the program may be susceptible to 

significant improper payments. Further, although we found that IRS used 

all of the required qualitative risk factors specified in IPIA and OMB 

guidance within its assessment, IRS did not analyze how each of the risk 

factors affected the susceptibility of the program to significant improper 

payments. Until IRS conducts an appropriate assessment consistent with 

IPIA and OMB guidance, it will continue to be uncertain about whether it 

should estimate the amount of improper PTC payments.

IRS also partially agreed with our fifth recommendation related to 

notifying non-filers of the need to file to continue receiving advance PTC. 

IRS stated that using a research-based approach to evaluate the 2015 

tax filing season, it developed a post-compliance process for sending 

notices to individuals who received advance PTC paid on their behalf in 

the previous calendar year but failed to file a tax return and also to those 

who requested an extension to file. IRS stated that being flexible in its 

approach has allowed IRS to refine the process to improve efficiency and 

effectiveness. IRS further stated that based on the 2017 research 

analysis, IRS will determine whether the information should be included in 

an existing IRM. We agree that IRS should review its process to improve 

the efficiency and effectiveness of its operations. However, we continue 

to believe that designing and implementing procedures to regularly notify 
Page 59 GAO-17-467 Improper Payments

non-filers of the need to file to continue receiving advance PTC 

decreases the risk that the ad hoc notification process will not be followed 

consistently in each filing season.

IRS disagreed with our fourth recommendation related to reviewing tax 

returns to those who are not reporting SRP. However, IRS stated that, 

among other things, it has drafted a new IRM section for examiners who 

are responsible for reviewing tax returns to determine whether health 

insurance is reflected for the taxpayer for the entire year, and for 

identifying and assessing SRP on taxpayers who are not appropriately 

reporting SRP on their tax returns. IRS stated that the IRM section is 

pending approval by Exam Policy. Although IRS stated that it disagreed 

with our recommendation, we believe that the actions that IRS described 

in its response to our draft report would sufficiently address our 

recommendation if implemented effectively. 

We are sending copies of this report to the appropriate congressional 

committees, the Director of the Office of Management and Budget, the 

Secretary of Health and Human Services, the Administrator of the 

Centers for Medicare & Medicaid Services, the Commissioner of Internal 

Revenue, and other interested parties. In addition, the report is available 

at no charge on the GAO website at http://www.gao.gov.

If you or your staff have any questions about this report, please contact 

me at (202) 512-2623 or davisbh@gao.gov. Contact points for our Offices 

of Congressional Relations and Public Affairs may be found on the last 

page of this report. GAO staff who made key contributions to this report 

are listed in appendix V.

Beryl H. Davis

Director

Financial Management and Assurance
Appendix I: Objectives, Scope, and 

Methodology

Page 60 GAO-17-467 Improper Payments

The objectives of this report are to determine the extent to which (1) the 

Centers for Medicare & Medicaid Services (CMS) and the Internal 

Revenue Service (IRS) assessed the susceptibility of their premium tax 

credit (PTC) programs to significant improper payments and, if the 

programs were deemed susceptible, whether CMS and IRS took actions 

required by the Improper Payments Information Act, as amended (IPIA),1

and Office of Management and Budget (OMB) guidance; (2) CMS 

properly designed and implemented key internal control activities related 

to preventing and detecting improper payments of advance PTC; and (3) 

IRS properly designed and implemented key control activities related to 

preventing improper payments of PTC in processing federal income tax 

returns, detecting and recovering advance PTC overpayments made to 

issuers on behalf of policyholders, and reimbursing underpayments made 

to policyholders. Further, for those key control activities assessed that we 

determined were properly designed and implemented, we evaluated the 

extent to which they were operating as designed.

To address our first objective, we reviewed improper payments reporting 

requirements and guidance, such as that in IPIA and the related guidance 

in Appendix C to OMB Circular No. A-123, Requirements for Effective 

Estimation and Remediation of Improper Payments,2 to identify 

requirements that agencies must meet to ascertain whether their 

programs are susceptible to significant improper payments. We 

interviewed key officials from CMS and IRS to gain an understanding of 

their processes for implementing IPIA requirements, including how each 

of their risk assessments were performed and their plans, if any, to 

estimate and report on improper payments related to PTC. We also 

analyzed CMS and IRS risk assessments for fiscal year 2016 to 

determine whether they were consistent with IPIA and OMB guidance. 

Specifically, we examined documentation to determine whether the CMS 

and IRS risk assessments (1) considered the qualitative risk factors 

specified by the improper payments requirements, (2) provided a basis for 

 1

IPIA, Pub. L. No. 107-300, 116 Stat. 2350 (Nov. 26, 2002), as amended by the Improper 

Payments Elimination and Recovery Act of 2010, Pub. L. No. 111-204, 124 Stat. 2224 

(July 22, 2010), and the Improper Payments Elimination and Recovery Improvement Act 

of 2012, Pub. L. No. 112-248, 126 Stat. 2390 (Jan. 10, 2013), and codified as amended at 

31 U.S.C. § 3321 note. In this report, references to IPIA include any amendments made 

thereto.

2

Office of Management and Budget, Appendix C to Circular No. A-123, Requirements for 

Effective Estimation and Remediation of Improper Payments, OMB Memorandum No. M15-02 (Washington, D.C.: Oct. 20, 2014). In this report, references to OMB guidance refer 

to this OMB memorandum and the guidance contained therein.

Appendix I: Objectives, Scope, and 

Methodology
Appendix I: Objectives, Scope, and 

Methodology

Page 61 GAO-17-467 Improper Payments

the risk determination, and (3) sufficiently concluded whether the 

programs met the criteria for susceptibility for significant improper 

payments. In addition, we considered relevant IPIA requirements, OMB 

guidance, and Standards for Internal Control in the Federal Government

to assess whether the Departments of Health and Human Services and 

the Treasury externally communicated necessary quality information in 

their 2016 agency financial reports regarding improper payments for the 

PTC programs.3

To address our second objective, we first reviewed the Patient Protection 

and Affordable Care Act (PPACA),4 its implementing regulations, relevant 

internal control standards,5 and leading practices for measuring fraud 

risks in federal programs.6 Based on this review, we identified CMS’s 

relevant risk areas and the key control activities needed to prevent and 

detect improper payments of advance PTC. These control activities 

included those related to verifying applicants’ eligibility requirements to 

receive advance PTC, accurately determining advance PTC amounts 

based on expected household incomes and family sizes, and making 

accurate PTC payments to certified issuers for qualified health plans. The 

key control activities we selected are those that we viewed as critical for 

addressing the various types of key risks that CMS faces that are likely to 

result in improper payments of advance PTC.

For this objective, we evaluated CMS’s key control activities related to 

CMS’s federally facilitated marketplace (FFM) for plan year 2016. We 

selected the FFM because it represented about two-thirds of the states 

and about 75 percent of all enrollees receiving advance PTC at the time 

of our audit. For our audit, we assessed whether the key control activities 

at CMS, both individually and in combination with other control activities, 

were properly designed to prevent and detect improper payments of 

advance PTC.

 3

GAO, Standards for Internal Control in the Federal Government, GAO-14-704G 

(Washington, D.C.: September 2014).

4

Pub. L. No. 111-148, 124 Stat. 119 (Mar. 23, 2010), as amended by the Health Care and 

Education Reconciliation Act of 2010, Pub. L. No. 111-152, 124 Stat. 1029 (Mar. 30, 

2010).

5

GAO-14-704G.

6

GAO, A Framework for Managing Fraud Risks in Federal Programs, GAO-15-593SP 

(Washington, D.C.: July 2015).
Appendix I: Objectives, Scope, and 

Methodology

Page 62 GAO-17-467 Improper Payments

We then evaluated the design of these key control activities at CMS by 

reviewing CMS policies, procedures, and other relevant documents, such 

as interagency agreements and standard operating procedures for 

eligibility support workers. We evaluated the key control activities to 

determine whether they sufficiently addressed the key risk areas that we 

identified by inspecting and analyzing relevant policies and procedures 

and directly testing the design of certain controls contained therein using 

the sample method described below. For key control activities that we 

determined were properly designed, we then performed walk-throughs 

and reviewed documents related to the control activities to determine 

whether CMS had properly implemented them.

For key control activities that we determined were properly designed and 

implemented, we evaluated whether they were operating as designed by 

testing a statistically random sample of FFM policyholders with advance 

PTC payment transactions from CMS. To evaluate whether such key 

control activities at CMS were operating as designed during the FFM’s 

PPACA’s 2016 open enrollment period, we obtained all 2016 open 

enrollment application transactions, including auto reenrollment 

application transactions that had effectuated medical policies from the 

FFM that were submitted from November 1, 2015, through February 1, 

2016, and resulted in advance PTC. The total population of these 

transactions was approximately 5.0 million records. To assess the 

reliability of the application data, we (1) interviewed knowledgeable CMS 

officials about the quality control procedures the agency had in place 

when collecting and creating the data and (2) electronically tested the 

data. Based on the results of these procedures, we determined that the 

data were sufficiently reliable for our purposes.

From the population of approximately 5.0 million applications, we 

randomly selected 93 applications that had effectuated policies according 

to CMS records. For these 93 applications, we reviewed CMS records to 

determine whether the agency had performed the required internal control 

activities related to verifying key eligibility requirements and determining 

payments of advance PTC. We also used the random sample to provide 

evidence of the effect of providing advance PTC on behalf of individuals 

who did not meet the minimum income eligibility requirements. We did not 

evaluate whether the control activities related to the accuracy of advance 

PTC payments to issuers were operating as designed because such 

payments included aggregated costs and adjustments, such as costsharing reduction subsidies and user fees, which were outside the scope 

of our audit. As a result, the focus of our work in this area was on the 
Appendix I: Objectives, Scope, and 

Methodology

Page 63 GAO-17-467 Improper Payments

design and implementation of key control activities related to preventing 

and detecting improper payments of advance PTC made to issuers.

Similar to our procedures for our second objective, to address our third 

objective, we first reviewed PPACA, its implementing regulations, relevant 

internal control standards,7 and leading practices for managing fraud risks 

in federal programs.8 Based on this review, we identified IRS’s relevant 

risk areas and the key control activities needed to prevent improper 

payments of PTC, including recovering overpayments and reimbursing 

underpayments. These key control activities were related to verifying 

individuals’ eligibility for PTC, accurately calculating PTC claims, 

recovering overpayments (and reimbursing underpayments) related to 

advance PTC, and appropriately resolving PTC-related errors and 

discrepancies on federal income tax returns. The key control activities we 

selected are those that we viewed as critical for addressing the various 

types of key risks that IRS faces that are likely to result in improper 

payments of PTC, including the failure to recover overpayments (and 

reimburse underpayments).We evaluated IRS’s key control activities from 

October 1, 2015, to June 18, 2016. We also did not evaluate whether key 

control activities that we determined were not properly designed and 

implemented were operating as designed because, without proper design 

and implementation, such control activities cannot achieve the control 

objectives.

We assessed whether the key control activities at IRS, both individually 

and in combination with other controls, were properly designed to achieve 

their objectives and address the related risks for preventing and detecting 

improper payments of PTC. Specifically, we reviewed IRS’s processes 

and control activities, evaluated the design of key control activities, and 

identified any gaps and deficiencies. We evaluated the design of key 

control activities at IRS by inspecting and analyzing relevant policies and 

procedures contained in the Internal Revenue Manual and other relevant 

documents and directly testing the design of certain control activities 

contained therein using the sample methodology described below. For 

key control activities we found to be properly designed, we then assessed 

whether IRS properly implemented those key internal control activities. To 

do this, we performed walk-throughs and reviewed documentation of 

those key control activities.

 7

GAO-14-704G.

8

GAO-15-593SP.
Appendix I: Objectives, Scope, and 

Methodology

Page 64 GAO-17-467 Improper Payments

We tested certain key control activities at IRS to determine whether they 

were operating as designed. To do this, we obtained a universe of PTC 

transaction data from federal income tax returns that had PTC-related 

transactions from October 1, 2015, to June 18, 2016, and then identified a 

relevant total population of approximately 6.1 million transactions. To 

assess the reliability of the PTC-related transaction data, we (1) reviewed 

IRS’s Individual Income Tax Credits reports and supporting data extracts, 

(2) interviewed knowledgeable IRS officials about the quality control 

procedures IRS has in place for collecting and creating the data, and (3) 

electronically tested the data. Based on the results of these procedures, 

we determined that the data were sufficiently reliable for our purposes.

From the population of approximately 6.1 million transactions, we 

randomly selected 93 federal income tax returns with PTC transactions 

for our sample. For these 93 items, we reviewed the related federal 

income tax returns, including the Form 8962, Premium Tax Credit, and 

IRS processing reports and financial records on PTC-related transactions 

to determine whether IRS had performed the required internal control 

activities related to processing the credits. We also used this random 

sample to provide evidentiary support and illustrative examples of the 

effect of IRS’s lack of statutory authority to correct PTC-related errors on 

tax returns and certain identified control deficiencies.

Because we followed a probability procedure based on random 

selections, each of our samples (for both CMS and IRS) is only one of a 

large number of samples that we might have drawn from the respective 

sampling populations. Since each sample could have provided different 

estimates, we express our confidence in the precision of our particular 

sample’s results as a 95 percent confidence interval. This is the interval 

that would contain the actual population value for 95 percent of the 

samples we could have drawn. Confidence intervals are provided along 

with each sample estimate in this audit report. The results apply to the 

universes of (1) all FFM application transactions received from November 

1, 2015, through February 1, 2016, with effectuated medical policies9 that 

resulted in payments of advance PTC and (2) PTC transaction data from 

federal income tax returns occurring from October 1, 2015, through June 

18, 2016.

 9

Effectuated policies are when individuals effectuate their enrollments by paying their first 

month’s premiums, meaning that they had active policies as of their policy effectuation 

dates.
Appendix I: Objectives, Scope, and 

Methodology

Page 65 GAO-17-467 Improper Payments

While our second and third audit objectives focused on certain significant 

control activities related to preventing and detecting the improper 

payments of PTC programs at CMS and IRS;10 we did not evaluate all 

control activities and other components of internal control. If we had done 

so, additional deficiencies may have been identified that could impair the 

effectiveness of the control activities evaluated as part of this audit. 

Appendix II provides additional details on standards for internal control in 

the federal government.

We conducted this performance audit from January 2016 to July 2017 in 

accordance with generally accepted government auditing standards. 

Those standards require that we plan and perform the audit to obtain 

sufficient, appropriate evidence to provide a reasonable basis for our 

findings and conclusions based on our audit objectives. We believe that 

the evidence obtained provides a reasonable basis for our findings and 

conclusions based on our audit objectives.

 10In addition, we also used the information and communication component of internal 

control and related principles as a criterion for addressing all three of our audit objectives.
Appendix II: Standards for Internal Control in 

the Federal Government

Page 66 GAO-17-467 Improper Payments

Standards for Internal Control in the Federal Government provides the 

overall framework for establishing and maintaining internal control.1

Internal control should be designed, implemented, and operating 

effectively to provide reasonable assurance that the operations, reporting, 

and compliance objectives of an entity will be achieved. The five 

components of internal control are as follows:

• Control environment: The foundation for an internal control system. It 

provides the discipline and structure to help an entity achieve its 

objectives.

• Risk assessment: Assesses the risks facing the entity as it seeks to 

achieve its objectives. This assessment provides the basis for 

developing appropriate risk responses.

• Control activities: The actions management establishes through 

policies and procedures to achieve objectives and respond to risks in 

the internal control system, which includes the entity’s information 

system.

• Information and communication: The quality information management 

and personnel communicate and use to support the internal control 

system.

• Monitoring: Activities management establishes and operates to 

assess the quality of performance over time and promptly resolve the 

findings of audits and other reviews.

An effective internal control system has each of the five components of 

internal control effectively designed, implemented, and operating and the 

five components operating together in an integrated manner. In this audit, 

we evaluated certain significant control activities at the Centers for 

Medicare & Medicaid Services and the Internal Revenue Service related 

to preventing and detecting improper payments in the premium tax credit 

programs. In addition, we also used the information and communication 

component of internal control and related principles as a criterion for 

addressing our audit objectives.

 1

GAO, Standards for Internal Control in the Federal Government, GAO-14-704G 

(Washington, D.C.: September 2014). 

Appendix II: Standards for Internal Control in 

the Federal Government
Appendix III: Comments from the Department 

of Health and Human Services

Page 67 GAO-17-467 Improper Payments

Appendix III: Comments from the 

Department of Health and Human Services
Appendix III: Comments from the Department 

of Health and Human Services

Page 68 GAO-17-467 Improper Payments
Appendix III: Comments from the Department 

of Health and Human Services

Page 69 GAO-17-467 Improper Payments
Appendix III: Comments from the Department 

of Health and Human Services

Page 70 GAO-17-467 Improper Payments
Appendix III: Comments from the Department 

of Health and Human Services

Page 71 GAO-17-467 Improper Payments
Appendix III: Comments from the Department 

of Health and Human Services

Page 72 GAO-17-467 Improper Payments
Appendix III: Comments from the Department 

of Health and Human Services

Page 73 GAO-17-467 Improper Payments
Appendix III: Comments from the Department 

of Health and Human Services

Page 74 GAO-17-467 Improper Payments
Appendix III: Comments from the Department 

of Health and Human Services

Page 75 GAO-17-467 Improper Payments
Appendix IV: Comments from the Internal 

Revenue Service

Page 76 GAO-17-467 Improper Payments

Appendix IV: Comments from the Internal 

Revenue Service
Appendix IV: Comments from the Internal 

Revenue Service

Page 77 GAO-17-467 Improper Payments
Appendix IV: Comments from the Internal 

Revenue Service

Page 78 GAO-17-467 Improper Payments
Appendix IV: Comments from the Internal 

Revenue Service

Page 79 GAO-17-467 Improper Payments
Appendix IV: Comments from the Internal 

Revenue Service

Page 80 GAO-17-467 Improper Payments
Appendix V: GAO Contact and Staff 

Acknowledgements

Page 81 GAO-17-467 Improper Payments

Beryl H. Davis, Director, (202) 512-2623 or DavisBH@gao.gov

In addition to the contact named above, Matthew Valenta, Assistant 

Director; Maria Hasan, Auditor in Charge; Jeff Arkin; Laura Bednar; 

Marcia Carlsen; Nina Crocker; Francine DelVecchio; Maxine Hattery; 

Wilfred Holloway; Jason Kelly; Jason Kirwan; Heena Patel; Ricky A. 

Perry, Jr.; Kailey Seibert; Monasha Thompson; and Jingxiong Wu made 

key contributions to this report.

Appendix V: GAO Contact and Staff 

Acknowledgements

GAO Contact

Staff 

Acknowledgments

(100574)
The Government Accountability Office, the audit, evaluation, and investigative 

arm of Congress, exists to support Congress in meeting its constitutional 

responsibilities and to help improve the performance and accountability of the 

federal government for the American people. GAO examines the use of public 

funds; evaluates federal programs and policies; and provides analyses, 

recommendations, and other assistance to help Congress make informed 

oversight, policy, and funding decisions. GAO’s commitment to good government 

is reflected in its core values of accountability, integrity, and reliability.

The fastest and easiest way to obtain copies of GAO documents at no cost is 

through GAO’s website (http://www.gao.gov). Each weekday afternoon, GAO 

posts on its website newly released reports, testimony, and correspondence. To 

have GAO e-mail you a list of newly posted products, go to http://www.gao.gov

and select “E-mail Updates.”

The price of each GAO publication reflects GAO’s actual cost of production and 

distribution and depends on the number of pages in the publication and whether 

the publication is printed in color or black and white. Pricing and ordering 

information is posted on GAO’s website, http://www.gao.gov/ordering.htm. 

Place orders by calling (202) 512-6000, toll free (866) 801-7077, or 

TDD (202) 512-2537.

Orders may be paid for using American Express, Discover Card, MasterCard, 

Visa, check, or money order. Call for additional information.

Connect with GAO on Facebook, Flickr, LinkedIn, Twitter, and YouTube.

Subscribe to our RSS Feeds or E-mail Updates. Listen to our Podcasts.

Visit GAO on the web at www.gao.gov and read The Watchblog.

Contact:

Website: http://www.gao.gov/fraudnet/fraudnet.htm

E-mail: fraudnet@gao.gov

Automated answering system: (800) 424-5454 or (202) 512-7470

Katherine Siggerud, Managing Director, siggerudk@gao.gov, (202) 512-4400, 

U.S. Government Accountability Office, 441 G Street NW, Room 7125, 

Washington, DC 20548

Chuck Young, Managing Director, youngc1@gao.gov, (202) 512-4800

U.S. Government Accountability Office, 441 G Street NW, Room 7149 

Washington, DC 20548

James-Christian Blockwood, Managing Director, spel@gao.gov, (202) 512-4707

U.S. Government Accountability Office, 441 G Street NW, Room 7814, 

Washington, DC 20548

GAO’s Mission

Obtaining Copies of 

GAO Reports and 

Testimony

Order by Phone

Connect with GAO

To Report Fraud, 

Waste, and Abuse in 

Federal Programs

Congressional 

Relations

Public Affairs

Strategic Planning and 

External Liaison

Please Print on Recycled Paper.