GOVERNMENT 

EFFICIENCY AND 

EFFECTIVENESS

Opportunities to Address 

Pervasive Management 

Risks and Challenges 

while Reducing Federal 

Costs

Statement of Gene L. Dodaro

Comptroller General of the United States

Testimony 

Before the Committee on the Budget 

U.S. Senate

For Release on Delivery 

Expected at 10:30 a.m. ET

Wednesday, May 17, 2017

GAO-17-631T

United States Government Accountability Office
United States Government Accountability Office

Highlights of GAO-17-631T, a testimony 

before the Committee on the Budget, U.S. 

Senate

May 17, 2017

GOVERNMENT EFFICIENCY AND 

EFFECTIVENESS

Opportunities to Address Pervasive

Management Risks and Challenges while 

Reducing Federal Costs

What GAO Found

GAO’s prior work has resulted in hundreds of billions of dollars in financial 

benefits over the last decade as agencies and Congress acted on its 

recommendations. However, there are significant opportunities for further action 

to address government-wide challenges by implementing GAO’s 

recommendations that would result in billions of dollars in additional benefits. 

• Action Needed to Address Growth in Improper Payments. Reducing 

payments that should not have been made or that were made in an incorrect 

amount could yield significant savings. The reported government-wide

improper payment estimate for fiscal year 2016 was over $144 billion. This 

estimate was attributable to 112 programs spread among 22 agencies. Since 

fiscal year 2003, cumulative estimates have totaled over $1.2 trillion. 

Reported Improper Payment Estimates for Fiscal Year 2016

• Improvements Needed in Information Technology (IT) Acquisition and 

Operation and in Addressing Cybersecurity Challenges. The government 

is projected to invest more than $89 billion on IT in fiscal year 2017. 

However, historically, these investments have frequently failed, incurred cost 

overruns and schedule slippages, or contributed little to mission-related 

outcomes. Better managing IT could result in billions of dollars in savings and 

much more efficient and effective government. Opportunities also exist to 

better ensure the security of federal information systems and cyber critical 

infrastructure and protect the privacy of personally identifiable information.

• Challenges Remain in Reducing Unneeded Federal Facilities and 

Managing the Federal Fleet of Vehicles. Continuing to maintain unneeded 

facilities puts the government at risk for wasting resources due to ongoing 

maintenance costs as well as lost revenue from failing to sell surplus 

property. In addition, in fiscal year 2015, federal agencies spent about $4.3 

billion on over 640,000 vehicles that agencies own or lease. In prior work, 

GAO found that selected agencies were spending over $20 million annually 

on vehicles that may not have been fully utilized. It is likely that additional 

cost savings are possible through enhanced agency practices.

View GAO-17-631T. For more information, 

contact J. Christopher Mihm at (202) 512-

6806 or mihmj@gao.gov, or Susan J. Irving at 

(202) 512-6806 or irvings@gao.gov..

Why GAO Did This Study

The federal government faces a longterm, unsustainable fiscal path based 

on an imbalance between federal 

revenues and spending. To put the 

government on a more sustainable 

long-term path, policymakers will need 

to have a broad fiscal plan that 

considers reducing spending, 

increasing revenue, or more likely, a 

combination of the two. While 

addressing this structural imbalance 

will require fiscal policy changes, in the 

near term, opportunities exist to act in 

a number of areas to improve this 

situation. 

This statement highlights several areas 

in which the federal government is 

facing government-wide management 

challenges and the opportunities to act: 

improper payments; IT acquisitions, 

operations, and cybersecurity; and 

federal real property. This statement 

draws from GAO’s 2017 High-Risk List, 

the 2017 annual report on 

fragmentation, overlap, and 

duplication, and other related work.

Properly managing government 

resources can help address the federal 

government’s fiscal challenges by 

preventing fraud, waste, and abuse 

and ensuring funds are put to the best 

possible use. Although these actions 

alone cannot put the U.S. government 

on a sustainable fiscal path, they would 

improve both the fiscal situation and 

the federal government’s operations.
Letter

Page 1 GAO-17-631T 

Chairman Enzi, Ranking Member Sanders, and Members of the 

Committee:

Thank you for the opportunity to be here today to discuss opportunities to 

improve our nation’s fiscal sustainability by addressing government-wide 

management challenges. The federal government faces a long-term, 

unsustainable fiscal path based on an imbalance between federal 

revenues and spending. At the end of fiscal year 2016, the debt held by 

the public as a share of gross domestic product was 77 percent, the 

highest it has been since 1950.1 Absent policy changes, debt held by the 

public will continue to grow and is projected to surpass its historical high 

of 106 percent within 15 to 25 years.2

To put the government on a more sustainable long-term path, 

policymakers will need to have a broad fiscal plan that considers reducing 

spending, increasing revenue, or more likely, a combination of the two. 

While addressing this structural imbalance will require fiscal policy 

changes, in the near term opportunities exist to act in a number of areas 

to improve this situation. Properly managing government resources can 

help address our fiscal challenges by preventing fraud, waste, and abuse 

and ensuring funds are put to the best possible use. Although these 

actions alone cannot put the U.S. government on a sustainable fiscal 

path, they would improve both the fiscal situation and the federal 

government’s operations.

Today, I will discuss several areas in which the federal government is 

facing government-wide management risks and challenges and 

opportunities to act: improper payments; information technology (IT) 

acquisitions, operations, and cybersecurity; and federal real property. To 

help address these long-standing management weaknesses, we have 

made hundreds of recommendations over the years, including through

our High-Risk List and our work on fragmentation, overlap, and 

duplication. Our High-Risk List brings attention to government operations 

that are at high risk of fraud, waste, abuse, and mismanagement, or that 

need broad-based transformation to address economy, efficiency, or 

 1

Debt held by the public is federal debt held by all investors outside the government, 

including international investors, domestic private investors, the Federal Reserve, and 

state and local governments. 

2

GAO, The Nation’s Fiscal Health: Action is Needed to Address the Federal Government’s 

Fiscal Future, GAO-17-237SP (Washington, D.C.: Jan. 17, 2017).

Letter
Page 2 GAO-17-631T 

effectiveness challenges of government operations.3 In addition, for the 

last 7 years, we have annually presented actions Congress or executive 

branch agencies could take to reduce, eliminate, or better manage 

fragmentation, overlap, or duplication; achieve cost savings; or enhance 

revenue.4 These efforts combined have led to hundreds of billions of 

dollars in financial benefits over the last decade. We estimate tens of 

billions more dollars could be saved by fully implementing our remaining 

open recommendations.5 Congress has acted and executive agencies 

are addressing many of our recommendations and, as a result, progress 

is being made on a number of these challenges. However, there are 

further opportunities for Congress and agencies to take action on 

addressing these management challenges.

My statement is based on our 2017 High-Risk List; the 2017 

fragmentation, overlap, and duplication annual report; and other related 

work. The work upon which this statement is based was conducted in 

accordance with all sections of GAO’s Quality Assurance Framework that 

are relevant to our objectives. The framework requires that we plan and 

perform the engagement to obtain sufficient and appropriate evidence to 

meet our stated objectives and to discuss any limitations in our work. We 

believe that the information and data obtained, and the analysis 

conducted, provide a reasonable basis for any findings and conclusions in 

this product. More details on the scope and methodology for our reports 

can be found in the full reports.6

 3

GAO, High-Risk Series: Progress on Many High-Risk Areas, While Substantial Efforts 

Needed on Others, GAO-17-317 (Washington, D.C.: Feb. 15, 2017).

4

GAO, 2017 Annual Report: Additional Opportunities to Reduce Fragmentation, Overlap, 

and Duplication and Achieve Other Financial Benefits, GAO-17-491SP (Washington, D.C.: 

Apr. 26, 2017).

5

To estimate overall financial benefits and possible savings from actions to address 

fragmentation, overlap, and duplication, we relied on individual estimates from a variety of 

sources, which considered different time periods, and utilized different data sources, 

assumptions, and methodologies. These individual estimates are subject to increased 

uncertainty, depending on whether, how, and when they are addressed.

6

A list of related work is included at the end of this statement.
Page 3 GAO-17-631T 

Improper payments remain a significant and pervasive government-wide 

issue.7 For several years, we have reported improper payments as a 

material weakness in our audit reports on the consolidated financial 

statements of the U.S. government.8 Since fiscal year 2003—when 

certain agencies began reporting improper payments as required by the 

Improper Payments Information Act of 2002 (IPIA)—cumulative reported 

improper payment estimates have totaled over $1.2 trillion, as shown in 

figure 1.9

 7

Under the Improper Payments Information Act of 2002, as amended, an improper 

payment is statutorily defined as any payment that should not have been made or that 

was made in an incorrect amount (including overpayments and underpayments) under 

statutory, contractual, administrative, or other legally applicable requirements. It includes 

any payment to an ineligible recipient, any payment for an ineligible good or service, any 

duplicate payment, any payment for a good or service not received (except for such 

payments where authorized by law), and any payment that does not account for credit for 

applicable discounts. Office of Management and Budget guidance also instructs agencies 

to report as improper payments any payments for which insufficient or no documentation 

was found.

8

GAO, Financial Audit: Fiscal Years 2016 and 2015 Consolidated Financial Statements of 

the U.S. Government, GAO-17-283R (Washington, D.C.: Jan. 12, 2017).

9

IPIA—as amended by the Improper Payments Elimination and Recovery Act of 2010 

(IPERA) and the Improper Payments Elimination and Recovery Improvement Act of 2012 

(IPERIA)—requires executive branch agencies to (1) review all programs and activities, 

(2) identify those that may be susceptible to significant improper payments, (3) estimate 

the annual amount of improper payments for those programs and activities, (4) implement 

actions to reduce improper payments and set reduction targets, and (5) report on the 

results of addressing the foregoing requirements. IPIA, Pub. L. No. 107-300, 116 Stat. 

2350 (Nov. 26, 2002), as amended by IPERA, Pub. L. No. 111-204, 124 Stat. 2224 (July 

22, 2010), and IPERIA, Pub. L. No. 112-248, 126 Stat. 2390 (Jan. 10, 2013), and codified 

as amended at 31 U.S.C. § 3321 note. IPIA, as amended, defines “significant improper 

payments” as gross annual improper payments in a program exceeding (1) both 1.5 

percent of program outlays and $10 million of all program or activity payments during the 

fiscal year reported or (2) $100 million (regardless of the improper payment error rate).

Actions Needed to 

Address Growth in 

Improper Payments
Page 4 GAO-17-631T 

Figure 1: Cumulative Reported Improper Payment Estimates for Fiscal Years 2003 

through 2016

Note: Generally, the specific programs and total number of programs that constitute the governmentwide improper payment estimate vary from year to year. In earlier years, the number of programs 

included in the government-wide estimate generally increased as programs reported improper 

payment estimates for the first time.

For fiscal year 2016, agencies reported improper payment estimates 

totaling $144.3 billion, an increase of over $7 billion from the prior year’s 

estimate of $136.7 billion. The reported estimated government-wide 

improper payment error rate was 5.1 percent of related program outlays.10

These figures do not include the Department of Defense’s (DOD) 

Defense Finance and Accounting Service Commercial Pay program 

because of concerns regarding the reliability of the program’s estimate, 

which I will discuss later in this statement. As shown in figures 2 and 3, 

the reported improper payment estimates—both dollar estimates and 

 10Reported error rates reflect the estimated improper payments as a percentage of total 

program outlays.
Page 5 GAO-17-631T 

error rates—have been increasing over the past 3 years, largely because 

of increases in Medicaid’s reported improper payment estimates.

Figure 2: Reported Improper Payment Estimates for Fiscal Years 2012 through 2016

Note: Improper payment estimate amounts do not include the Department of Defense’s Defense 

Finance and Accounting Service Commercial pay program because of issues related to the reliability 

of the program’s estimate. Figures may not add up to totals due to rounding.
Page 6 GAO-17-631T 

Figure 3: Reported Improper Payment Error Rates for Fiscal Years 2012 through 

2016

Note: Improper payment estimate amounts do not include the Department of Defense’s Defense 

Finance and Accounting Service Commercial pay program because of issues related to the reliability 

of the program’s estimate.

For fiscal year 2016, overpayments accounted for approximately 93 

percent of the improper payment estimate, according to 

www.paymentaccuracy.gov, with underpayments accounting for the 

remaining 7 percent.

Although primarily concentrated in three areas (Medicare, Medicaid, and 

the Earned Income Tax Credit), the reported estimated improper 

payments for fiscal year 2016 were attributable to 112 programs spread 

among 22 agencies (see figure 4).
Page 7 GAO-17-631T 

Figure 4: Reported Improper Payment Estimates Were Primarily Concentrated in 

Three Areas for Fiscal Year 2016

Note: Improper payment estimate amounts do not include the Department of Defense’s Defense 

Finance and Accounting Service Commercial Pay program because of issues related to the reliability 

of the program’s estimate. Due to rounding, numbers may not add up to 100 percent or match the 

government-wide improper payment estimate ($144.3 billion).

Agencies reported improper payment estimates exceeding $1 billion for 

14 programs, as shown in table 1, and error rates exceeding 10 percent 

for 11 programs (see table 2).

Table 1: Programs with Reported Improper Payment Estimates over $1 Billion for Fiscal Year 2016

Program Agency Fiscal year 2016 reported improper 

payment estimates

Dollars 

(in billions)

Error rate 

(percentage of 

outlays)

Medicare Department of Health and Human 

Services (HHS)

59.7 —

Medicare Fee-for-Service HHS 41.1 11.0

Medicare Advantage (Part C) HHS 16.2 10.0

Medicare Prescription Drug Benefit (Part D) HHS 2.4 3.4
Page 8 GAO-17-631T 

Program Agency Fiscal year 2016 reported improper 

payment estimates

Dollars 

(in billions)

Error rate 

(percentage of 

outlays)

Medicaid HHS 36.3 10.5

Earned Income Tax Credit Department of the Treasury 16.8 24.0

Supplemental Security Income Social Security Administration (SSA) 4.2 7.4

Direct Loan Department of Education (Education) 3.9 4.0

Unemployment Insurance Department of Labor 3.9 11.7

Old Age, Survivors, and Disability Insurance SSA 3.7 0.4

VA Community Care Department of Veterans Affairs (VA) 3.6 75.9

Pell Grant Education 2.2 7.9

National School Lunch Program Department of Agriculture 1.8 15.2

Rental Housing Assistance Programs Department of Housing and Urban 

Development

1.7 5.2

Purchased Long-Term Services and Support VA 1.2 69.2

Source: GAO summary of agencies’ data. | GAO-17-631T

Table 2: Programs with Reported Improper Payment Error Rates over 10 Percent for Fiscal Year 2016

Program Agency Reported error rate 

(percentage of outlays)

VA Community Care Department of Veterans Affairs (VA) 75.9

Purchased Long-Term Services and Support VA 69.2

Earned Income Tax Credit Department of the Treasury 24.0

School Breakfast Program Department of Agriculture (USDA) 22.5

National School Lunch Program USDA 15.2

Livestock Indemnity Program USDA 12.9

Unemployment Insurance Department of Labor 11.7

Supplemental Revenue Assistance Payments USDA 11.4

Medicare Fee-for-Service Department of Health and Human Services 

(HHS)

11.0

Medicaid HHS 10.5

Disbursements for Goods and Services Small Business Administration 10.4

Source: GAO summary of agencies’ data. | GAO-17-631T
Page 9 GAO-17-631T 

In our audit report on the fiscal year 2016 consolidated financial 

statements of the U.S. government, we continued to report a material 

weakness in internal control related to improper payments because the 

federal government is unable to determine the full extent to which 

improper payments occur and reasonably assure that appropriate actions 

are taken to reduce them.11 Challenges include programs that do not 

report any improper payment estimates or report unreliable or 

understated estimates, noncompliance issues, fraud, and potentially 

inaccurate risk assessments.

We found that not all agencies had developed improper payment 

estimates for all of the programs and activities they identified as 

susceptible to significant improper payments. Eight agencies did not 

report improper payment estimates for 18 risk-susceptible programs (see 

table 3).

Table 3: Agencies Did Not Report Improper Payment Estimates for Fiscal Year 2016 

for 18 Risk-Susceptible Programs

Program Agency

Supplemental Nutrition Assistance Program Department of Agriculture (USDA)

Child and Adult Food Care Program USDA

Temporary Assistance for Needy Families Department of Health and Human Services 

(HHS)

Advance Premium Tax Credit HHS

Cost-Sharing Reduction HHS

Navy Commercial Bill Pay – Singapore Department of Defense

Single Family Insurance Claims Department of Housing and Urban 

Development (HUD)

Community Planning and Development 

Entitlement Grants

HUD

HOME Investments Program HUD

Additional Child Tax Credit Department of the Treasury (Treasury)

American Opportunity Tax Credit Treasury

Premium Tax Credit Treasury

Communications, Utilities, and Other Rent Department of Veterans Affairs (VA)

Medical Care Contracts and Agreements VA

Prosthetics VA

 11GAO-17-283R.

Multiple Factors Hinder 

Efforts to Determine the 

Full Extent of and Reduce 

Improper Payments

Programs That Do Not Report 

Improper Payment Estimates
Page 10 GAO-17-631T 

Program Agency

VA Community Care Choice payments 

made from the Veterans Choice Fund

VA

Grants Environmental Protection Agency

AmeriCorps Corporation for National and Community 

Service

Source: GAO summary of agencies’ fiscal year 2016 agency financial reports. | GAO-17-631T

Because agencies did not report improper payment estimates for these 

risk-susceptible programs, the government-wide improper payment 

estimate is understated and agencies are hindered in their efforts to 

reduce improper payments in these programs. For example, the 

Department of Health and Human Services (HHS) did not report an 

improper payment estimate for Temporary Assistance for Needy Families, 

a program with outlays of over $15 billion for fiscal year 2016. HHS cited 

statutory limitations prohibiting the agency from requiring states to 

participate in an improper payment measurement for the program.

Another example is the U.S. Department of Agriculture’s (USDA) 

Supplemental Nutrition Assistance Program (SNAP). Although USDA has 

reported improper payment estimates for this program in prior years, the 

agency did not report an estimate for fiscal year 2016.12 In its fiscal year 

2016 agency financial report, USDA stated that it was unable to validate 

data provided by 42 of the 53 state agencies that administer the program. 

USDA stated that it could not adjust for this unreliability and calculate a 

national error rate.

Improper payment estimates for certain programs may be unreliable or 

understated. For example, in May 2013 we reported that DOD had major 

deficiencies in its process for estimating fiscal year 2012 improper 

payments in the Defense Finance and Accounting Service (DFAS) 

Commercial Pay program, including deficiencies in identifying a complete 

and accurate population of payments.13 The foundation of reliable 

statistical sampling estimates is a complete, accurate, and valid 

population from which to sample. As of October 2016, DOD was still 

developing key quality assurance procedures to ensure the completeness 

 12For fiscal year 2015, USDA reported an estimated $2.6 billion—or 3.7 percent of the 

$70.0 billion in related program outlays—in improper payments for SNAP.

13GAO, DOD Financial Management: Significant Improvements Needed in Efforts to 

Address Improper Payment Requirements, GAO-13-227 (Washington, D.C.: May 13, 

2013).

Potentially Unreliable or 

Understated Estimates
Page 11 GAO-17-631T 

and accuracy of sampled populations. Therefore, DOD’s fiscal year 2016 

improper payment estimates, including its estimate for the DFAS 

Commercial Pay program, may not be reliable. DFAS Commercial Pay’s 

reported program outlays are significant—approximately $249 billion for 

fiscal year 2016. Consequently, a small change in the program’s 

estimated error rate could result in a significant change in the dollar value 

of its improper payment estimate.

Also, flexibility in how agencies are permitted to implement improper 

payment estimation requirements can contribute to inconsistent or 

understated estimates. For example, in February 2015, we reported that 

DOD uses a methodology for estimating TRICARE improper payments 

that is less comprehensive than the methodology the Centers for 

Medicare & Medicaid Services (CMS) used for Medicare.14 Though the 

programs are similar in that they pay providers on a fee-for-service basis 

and depend on contractors to process and pay claims, TRICARE’s 

methodology does not examine the underlying medical record 

documentation to discern whether each sampled payment was supported 

or whether the services provided were medically necessary. On the other 

hand, Medicare’s methodology more completely identifies improper 

payments beyond those resulting from claim processing errors, such as 

those related to provider noncompliance with coding, billing, and payment 

rules.

As a result, the estimated improper payment error rates for TRICARE and 

Medicare are not comparable, and TRICARE’s error rate is likely 

understated. In addition, corrective actions for TRICARE improper 

payments do not address issues related to medical necessity errors—a 

significant contributor to Medicare improper payments. We recommended 

that DOD implement a more comprehensive TRICARE improper payment 

methodology and develop more robust corrective action plans that 

address the underlying causes of improper payments. In October 2016, 

DOD requested proposals for claim record reviews—including medical 

record reviews—to begin the process of incorporating medical record 

reviews in its methodology for calculating improper payment rates.

 14GAO, Improper Payments: TRICARE Measurement and Reduction Efforts Could Benefit 

from Adopting Medical Record Reviews, GAO-15-269 (Washington, D.C.: Feb. 18, 2015).
Page 12 GAO-17-631T 

Since fiscal year 2011, the Improper Payments Elimination and Recovery 

Act (IPERA) has required agencies’ inspectors general (IG) to annually 

report on the respective agencies’ compliance under the act.15 IGs at 15 

of the 24 Chief Financial Officers Act (CFO Act) agencies found their 

respective agencies to be noncompliant under IPERA for fiscal years 

2014 and 2015, the highest total since IGs began their annual compliance 

reviews. Although noncompliance has occurred across all six of the 

criteria listed in IPERA, the most common issues are noncompliance 

related to reporting and meeting improper payment reduction targets or 

reporting an error rate below 10 percent. Continued noncompliance 

further highlights the need for additional efforts to reduce improper 

payments.

Fraud is one specific type of improper payment and is particularly difficult 

to identify and estimate. Fraud involves obtaining something of value 

through willful misrepresentation.16 Whether an act is fraudulent is 

determined through the judicial or other adjudicative system, which is one 

reason why fraud is not likely to be part of agencies’ annual improper 

payment estimates. According to Office of Management and Budget 

(OMB) guidance, agencies should refer matters involving possible 

fraudulent activities to the appropriate parties, such as the relevant Office 

of the Inspector General or the Department of Justice (DOJ).

While improper payment estimates are not a measure of fraud, a lack of 

sufficient supporting documentation may mask the true causes of 

improper payments—including fraud. When payments lack the 

appropriate supporting documentation, their validity cannot be 

determined. It is possible that these payments were for valid purposes, 

 15IPERA established a requirement for entity IGs to report annually on entities’ compliance 

with criteria listed in section 3 of IPERA. The six criteria are that the entity has (1) 

published an annual financial statement and accompanying materials in the form and 

content required by the Office of Management and Budget for the most recent fiscal year 

and posted that report on the entity website; (2) conducted a risk assessment for each 

specific program or activity that conforms with IPIA, as amended; (3) published estimates 

of improper payments for all programs and activities identified as susceptible to significant 

improper payments under the entity’s risk assessment; (4) published corrective action 

plans for programs and activities assessed to be at risk for significant improper payments; 

(5) published and met annual reduction targets for all programs and activities assessed to 

be at risk for significant improper payments; and (6) reported a gross improper payment 

rate of less than 10 percent for each program and activity for which an improper payment 

estimate was obtained and published.

16GAO, Government Auditing Standards: 2011 Revision, GAO-12-331G (Washington, 

D.C.: December 2011).

IGs Report Greater Agency 

Noncompliance

Improper Payments Involving 

Fraud
Page 13 GAO-17-631T 

but it is also possible that the lack of documentation could conceal 

fraudulent activities. For fiscal year 2016, HHS cited documentation errors 

as a major contributor to improper payments in its Medicare fee-forservice program, such as durable medical equipment and home health 

claims. We have found that these areas are also vulnerable to fraud, and 

recent cases continue to raise concerns.17

The report on the Health Care Fraud and Abuse Control (HCFAC) 

program for fiscal year 2016 lists several examples of fraud specifically 

related to durable medical equipment and home health claims, including 

one case in which a doctor approved and certified in excess of 11,000 

Medicare beneficiaries, who were not home bound, for home health care 

services between 2006 and 2011, resulting in nearly $375 million in 

fraudulent claims.18 For fiscal year 2016, HHS and DOJ reported that the 

federal government won or negotiated over $2.5 billion in health care 

fraud judgments and settlements through the HCFAC program. In fiscal 

year 2016, DOJ opened 930 new criminal health care fraud 

investigations, and HHS IG investigations resulted in 765 criminal actions 

and 690 civil actions.19 Table 4 lists other examples of fraud in various 

programs.

 17GAO, Health Care Fraud: Types of Providers Involved in Medicare, Medicaid, and the 

Children’s Health Insurance Program Cases, GAO-12-820 (Washington, D.C.: Sept. 7, 

2012).

18The Health Insurance Portability and Accountability Act of 1996 (HIPAA) established the 

HCFAC program to help combat fraud and abuse in health care programs, such as 

Medicare and Medicaid. HCFAC program goals include coordinating federal, state, and 

local law enforcement efforts to control fraud and abuse associated with health plans; 

conducting investigations and audits related to health care; and facilitating the 

enforcement of civil, criminal, and administrative statutes applicable to health care. HHS 

and DOJ jointly administer the program, and HIPAA requires them to issue a joint report 

annually to Congress.

19Department of Health and Human Services and Department of Justice, Health Care 

Fraud and Abuse Control Program Annual Report for Fiscal Year 2016 (Washington, D.C.: 

January 2017).
Page 14 GAO-17-631T 

Table 4: Recent Examples of Reported Fraud in Government Programs

Program Description of reported fraud

Social Security 

Disability

A Kentucky lawyer recently pled guilty to conspiring with a former 

administrative law judge and multiple doctors to falsify medical 

documents and grant disability benefits to claimants, irrespective of 

the claimants’ actual physical or mental conditions. The fraudulent 

submissions as part of this scheme would have resulted in more 

than $550 million in lifetime benefits to the claimants.

Medicare, 

Medicaid, and 

TRICARE

A Florida doctor and his practice recently settled a lawsuit alleging 

that the doctor billed the government for excessive, medically 

unnecessary procedures and waived Medicare copayments to help 

facilitate the false billing scheme.

Earned Income 

Tax Credit

Two North Carolina tax preparers were recently indicted for 

falsifying their clients’ tax returns by including fake and inflated 

sources of income to qualify for and maximize the earned income 

tax credit.

Source: GAO summary of Department of Justice press releases. | GAO-17-631T

Additionally, we have recently reported on antifraud efforts and cases of 

potential fraud in various programs, including the following examples.20

• In April 2017, we reported that the Social Security Administration 

(SSA) needed to develop a comprehensive strategic approach to help 

enhance antifraud activities in its disability programs.21 Although SSA 

has taken steps in this area, its new antifraud office is still evolving. 

SSA has worked to identify and address fraud risks in its disability 

programs, but it has not yet comprehensively assessed these fraud 

risks or developed a strategic approach to help ensure its antifraud 

activities effectively mitigate those risks. Although SSA has several 

prevention and detection activities in place to address known fraud 

risks in its disability programs, the agency has not developed and 

documented an overall antifraud strategy that aligns its antifraud 

activities to its fraud risks.

Without conducting a fraud risk assessment that aligns with leading 

practices and developing an antifraud strategy, SSA’s disability 

programs may remain vulnerable to new fraud schemes, and SSA will 

not be able to effectively prioritize its antifraud activities. Among other 

 20Where appropriate, we referred cases of potential fraud to the appropriate officials for 

further review.

21GAO, SSA Disability Benefits: Comprehensive Strategic Approach Needed to Enhance 

Antifraud Activities, GAO-17-228 (Washington, D.C.: Apr. 17, 2017).
Page 15 GAO-17-631T 

things, we recommended that SSA conduct a comprehensive fraud 

risk assessment for its disability programs and develop a 

corresponding antifraud strategy. SSA agreed with the 

recommendations.

• In August 2014, we identified 28 cases of potential fraud related to 

Supplemental Nutrition Assistance Program benefits (food stamps).22

Over 30 days, we detected 28 postings from one popular e-commerce 

website that advertised the potential sale of food stamp benefits in 

exchange for cash, services, and goods—including places to live, 

vehicles, cooking and cleaning services, phones, and beer. We 

recommended that USDA take steps, such as providing guidance and 

training, to enhance the consistency of state reporting on their 

antifraud efforts. Though it has not yet implemented the new form, 

USDA has revised the form to collect recipient integrity performance 

information and has provided training to state agency and regional 

office personnel on the new form.

• In December 2014, we reported approximately $39 million of 

Hurricane Sandy assistance as at risk for potential fraud or improper 

payments.23 Among other issues, these cases included instances in 

which Social Security numbers were not valid or were used by 

multiple recipients, rental assistance was received while the recipient 

was incarcerated, and duplicate payments were not flagged by the 

Federal Emergency Management Agency (FEMA). Among other 

things, we recommended that FEMA assess the cost and feasibility of 

obtaining SSA’s full death file to help identify potentially fraudulent or 

improper applications for assistance. In June 2016, FEMA reported 

that it was evaluating the cost and feasibility of obtaining the publicly 

available Death Master File. However, our recommendation refers to 

SSA’s full death file, which is a more comprehensive source of death 

data. We continue to believe that FEMA should assess the cost and 

feasibility of obtaining SSA’s full death file.

• In May 2015, we found thousands of Medicaid beneficiaries and 

hundreds of providers involved in potential improper or fraudulent 

payments in four selected states (Arizona, Florida, Michigan, and New 

Jersey) during fiscal year 2011, which at the time of our study was the 

 22GAO, Supplemental Nutrition Assistance Program: Enhanced Detection Tools and 

Reporting Could Improve Efforts to Combat Recipient Fraud, GAO-14-641 (Washington, 

D.C.: Aug. 21, 2014).

23GAO, Hurricane Sandy: FEMA Has Improved Disaster Aid Verification but Could Act to 

Further Limit Improper Assistance, GAO-15-15 (Washington, D.C.: Dec. 12, 2014).
Page 16 GAO-17-631T 

most recent year for which reliable data were available.24 For 

example, people using the identities of about 200 deceased 

beneficiaries received about $9.6 million in Medicaid benefits 

subsequent to the beneficiaries’ deaths, and about 90 providers had 

suspended or revoked licenses in the state where they performed 

Medicaid services yet received a combined total of at least $2.8 

million from those states. We recommended that CMS issue guidance 

for screening beneficiaries who are deceased and supply morecomplete data for screening Medicaid providers. HHS has taken 

certain actions—such as working with states to address data access 

issues—but has not provided guidance to states as we 

recommended.

While fraud can be more difficult to address than other types of improper 

payments, implementing strategies to reduce improper payments in 

general may also help to reduce opportunities for fraud. In July 2015, we 

issued A Framework for Managing Fraud Risks in Federal Programs

(Framework).25 The Framework identifies a comprehensive set of leading 

practices that serve as a guide for program managers to use when 

developing or enhancing efforts to combat fraud in a strategic, risk-based 

manner. The leading practices described in the Framework include 

control activities to prevent, detect, and respond to fraud, with an 

emphasis on prevention, as well as structures and environmental factors 

that influence or help managers achieve their objective to mitigate fraud 

risks. In addition, the Framework calls for managers to conduct 

monitoring and incorporate feedback on an ongoing basis.

Enacted in June 2016, the Fraud Reduction and Data Analytics Act of 

2015 required OMB to establish guidelines for agencies to identify fraud 

risks and design and implement control activities to prevent, detect, and 

respond to fraud. The act required OMB to incorporate the leading 

practices found in the Framework. Further, the act requires agencies to 

report on their fraud risks and their implementation of fraud reduction 

strategies as part of their annual financial reports beginning in fiscal year 

2017. We will assess these efforts to help Congress monitor agencies’

progress in addressing and reducing fraud risks. As stewards of taxpayer 

dollars, federal managers have the ultimate responsibility in overseeing 

 24GAO, Medicaid: Additional Actions Needed to Help Improve Provider and Beneficiary 

Fraud Controls, GAO-15-313 (Washington, D.C.: May 14, 2015).

25GAO, A Framework for Managing Fraud Risks in Federal Programs, GAO-15-593SP 

(Washington, D.C.: July 2015).
Page 17 GAO-17-631T 

how hundreds of billions of dollars are spent annually. Thus, they are well 

positioned to use the leading practices outlined in the Framework, while 

considering the related fraud risks as well as the associated costs and 

benefits of implementing the practices, to help ensure that taxpayer 

resources are spent efficiently and effectively.

Agencies conduct risk assessments to determine which programs need to 

develop improper payment estimates. However, in IPERA compliance 

reports for fiscal year 2015—the most current reports available—various 

IGs reported issues related to agencies’ improper payment risk 

assessments. For example:

• The IG for the General Services Administration (GSA) reported that 

the agency’s risk assessment was flawed because, among other 

things, the questionnaires in the assessment did not ask if programs 

actually experience improper payments and were distributed to 

individuals who did not have direct or specific knowledge of improper 

payments.26 Further, the IG found that the agency did not evaluate 

relevant reports—such as IG reports or our reports—to identify 

relevant findings, and two of the six questionnaires that the IG 

reviewed included incomplete information.

• The IG for the Department of Housing and Urban Development (HUD) 

found that the agency did not assess all of its programs on a 3-year 

cycle and did not consider all nine of the required risk factors in 

conducting its risk assessment.27 The IG also noted instances in 

which the agency did not rate risk factors in accordance with the 

agency’s own policy.

It is also important to note that 9 of the 24 CFO Act agencies either 

reported no improper payment estimates or reported estimates for only 

disaster relief programs funded through the Disaster Relief Appropriations 

Act, 2013 for fiscal year 2016.28 The nine agencies were:

• U.S. Agency for International Development

 26GSA Office of Inspector General, GSA Did Not Fully Comply with the Improper 

Payments Acts in FY 2015, A160018/B/5/F16002 (Washington, D.C.: May 11, 2016).

27HUD Office of Inspector General, Compliance with the Improper Payments Elimination 

and Recovery Act, 2016-FO-0005 (Washington, D.C.: May 13, 2016).

28The Disaster Relief Appropriations Act, 2013, requires agencies to estimate improper 

payments for funds received under the act. 

Potentially Inaccurate Risk 

Assessments
Page 18 GAO-17-631T 

• Department of Energy

• Department of State

• National Science Foundation

• Nuclear Regulatory Commission

• Department of Commerce (disaster relief only)

• Department of the Interior (disaster relief only)

• Department of Justice (disaster relief only)

• National Aeronautics and Space Administration (disaster relief only).

Agencies can use detailed root cause analysis and related corrective 

actions to implement preventive and detective controls to reduce 

improper payments. Collaboration with other relevant entities can also 

assist federal agencies in reducing improper payments.

Root cause analysis is key to understanding why improper payments 

occur and developing effective corrective actions to prevent them. In 

2014, OMB established new guidance to assist agencies in better 

identifying the root causes of improper payments and assessing their 

relevant internal controls. Agencies across the federal government began 

reporting improper payments using these more detailed root cause 

categories for the first time in their fiscal year 2015 financial reports. 

Further identification of the true root causes of improper payments can 

help to determine the potential for fraud. Figure 5 shows the root causes 

of government-wide improper payments for fiscal year 2016, as reported 

by OMB. We will continue to focus on agencies’ efforts to both identify the 

root causes and take appropriate actions to reduce improper payments.

Strategies for Reducing 

Improper Payments

Root Cause Analysis
Page 19 GAO-17-631T 

Figure 5: Reported Root Causes of Improper Payments for Fiscal Year 2016

Implementing strong preventive controls can serve as the frontline 

defense against improper payments. When agencies proactively prevent 

improper payments, they increase public confidence in program 

administration and they avoid the difficulties associated with the “pay and 

chase” aspects of recovering overpayments.29 Examples of preventive 

controls include up-front eligibility validation through data sharing, 

predictive analytic technologies, and program design review and 

refinement.30 For example, we have made the following recommendations 

 29“Pay and chase” refers to the labor-intensive and time-consuming practice of trying to 

recover overpayments once they have already been made rather than preventing 

improper payments in the first place.

30An example of predictive analytic technologies is CMS’s Fraud Prevention System. The 

system uses different types of models to develop alerts on specific claims and providers, 

which are then prioritized for review and investigation as appropriate. Among others, these 

models include anomaly detection models—which identify abnormal provider patterns 

relative to the patterns of their peers—and predictive models—which use historical data to 

identify patterns associated with fraud and then identify providers with these billing 

patterns in current claims data.

Preventive Controls
Page 20 GAO-17-631T 

and matters for congressional consideration to improve preventive 

controls in various programs.

• Using the Do Not Pay (DNP) working system. Established by OMB 

and hosted by the Department of the Treasury (Treasury), the DNP 

working system is a web-based, centralized data-matching service 

that allows agencies to review multiple databases—such as data on 

deceased individuals and entities barred from receiving federal 

awards—before making payments. In October 2016, we found that 

the 10 agencies we reviewed used the DNP working system in limited 

ways, in part because OMB had not provided a clear strategy and 

guidance.31 Only 2 of these 10 agencies used the DNP working

system on a preaward or prepayment basis for certain types of 

payments. Because the DNP working system offers a single point of 

access to multiple databases, agencies may be able to streamline 

their existing data matching processes. Among other things, we

recommended that OMB develop a strategy—and communicate it 

through guidance—for whether and how agencies should use the 

DNP working system to complement or streamline existing data 

matching processes. OMB generally agreed with the concept of 

developing a strategy and said it would explore the concept further.

Further, we found that the death records offered through the DNP 

working system do not include state-reported death data. SSA officials 

stated that sharing its full death file—which includes state-reported 

death data—would require an amendment to the Social Security Act. 

We suggested that Congress amend the Social Security Act to 

explicitly allow SSA to share its full death file with Treasury for use 

through the DNP working system. Sharing the full death file through 

the DNP working system would enhance efforts to identify and 

prevent improper payments.

• Expanding error correction authority. The Internal Revenue 

Service (IRS) has the authority to correct some calculation errors and 

check for other obvious noncompliance such as claims for a deduction 

or credit that exceed statutory limits. We have suggested to Congress 

that such authority be authorized on a broader basis rather than on a 

piecemeal basis and that controls may be needed to help ensure that 

 31GAO, Improper Payments: Strategy and Additional Actions Needed to Help Ensure 

Agencies Use the Do Not Pay Working System as Intended, GAO-17-15 (Washington, 

D.C.: Oct. 14, 2016).
Page 21 GAO-17-631T 

this authority is used properly.32 Also, Treasury has proposed 

expanding IRS’s “math error” authority to “correctible error” authority 

to permit it to correct errors in cases where information provided by 

the taxpayer does not match information in government databases, 

among other things. Providing these authorities could help IRS correct 

additional errors—including some errors with Earned Income Tax 

Credit claims—and avoid burdensome audits and taxpayer penalties.

• Adding prepayment reviews in Medicare fee-for-service. In April 

2016, we found that CMS could improve its claim review programs by 

conducting additional prepayment reviews.33 Using prepayment 

reviews to deny improper claims and prevent overpayments is 

consistent with CMS’s goal to pay claims correctly the first time. It can 

also better protect Medicare funds because not all overpayments can 

be collected. CMS uses recovery auditors (RA)–among other types of 

claim review contractors–and in 2013 and 2014, 85 percent of RA 

claim reviews were postpayment. Because CMS is required by law to 

pay RAs contingency fees from recovered overpayments, the RAs 

can only conduct prepayment reviews under a demonstration.34 From 

2012 through 2014, CMS conducted a demonstration in which the 

RAs conducted prepayment reviews and were paid contingency fees 

based on claim denial amounts. CMS officials considered the 

demonstration a success. However, CMS has not requested 

legislation that would allow for RA prepayment reviews by amending 

existing payment requirements and thus may be missing an 

opportunity to better protect Medicare funds. 

We recommended that CMS seek legislative authority to allow RAs to 

conduct prepayment claim reviews. HHS did not concur with this 

recommendation, stating that CMS has implemented other programs 

as part of its efforts to move away from the “pay and chase” process 

of recovering overpayments. We continue to believe that seeking 

authority to allow RAs to conduct prepayment reviews is consistent 

with CMS’s strategy to pay claims properly the first time.

 32GAO, Recovery Act: IRS Quickly Implemented Tax Provisions, but Reporting and 

Enforcement Improvements Are Needed, GAO-10-349 (Washington, D.C.: Feb. 10, 2010). 

33GAO, Medicare: Claim Review Programs Could Be Improved with Additional 

Prepayment Reviews and Better Data, GAO-16-394 (Washington, D.C.: Apr. 13, 2016).

34CMS uses demonstrations to study the likely effect of new methods of service delivery; 

coverage of new types of service; and new payment approaches on beneficiaries, 

providers, health plans, states, and the Medicare Trust Funds.
Page 22 GAO-17-631T 

Although preventive controls remain the frontline defense against 

improper payments, effective detection techniques can help to quickly 

identify and recover those overpayments that do occur. Detective controls 

play a significant role not only in identifying improper payments but also in 

providing information on why these improper payments were made, 

highlighting areas that need stronger preventive controls. Examples of 

detective controls include data mining and recovery auditing. The 

following are examples of recommendations we have made to improve 

detective controls in various programs.

• Improvements to recovery efforts in Medicare Advantage. In April 

2016, we reported that CMS needs to fundamentally improve its 

efforts to recover substantial amounts of improper payments in the 

Medicare Advantage program.35 CMS conducts two types of risk 

adjustment data validation (RADV) audits to identify and correct 

Medicare Advantage improper payments: national RADV activities 

and contract-level RADV audits. Both types of audits determine 

whether the diagnosis codes submitted by Medicare Advantage 

organizations are supported by a beneficiary’s medical record 

documentation. Contract-level RADV audits seek to identify and 

recover improper payments from Medicare Advantage organizations 

and thus to deter them from submitting inaccurate beneficiary 

diagnoses. However, we found that CMS does not focus its RADV 

audits on the contracts with the highest potential for improper 

payments and has not developed specific plans or a timetable for 

including recovery auditor contractors in the contract-level RADV audit 

process.

We made several recommendations, including that CMS modify the 

selection of contracts for contract-level RADV audits to focus on those 

most likely to have high rates of improper payments and that CMS 

develop specific plans and a timetable for incorporating a recovery 

audit contractor in the Medicare Advantage program. In response to 

our report, HHS concurred with the recommendations and reaffirmed 

its commitment to identifying and correcting Medicare Advantage 

improper payments. By implementing our recommendations, CMS 

could recover hundreds of millions of dollars in improper payments by 

improving its processes for auditing payments to Medicare Advantage 

organizations.

 35GAO, Medicare Advantage: Fundamental Improvements Needed in CMS’s Effort to 

Recover Substantial Amounts of Improper Payments, GAO-16-76 (Washington, D.C.: Apr. 

8, 2016).

Detective Controls
Page 23 GAO-17-631T 

• Review of federal determinations of Medicaid eligibility. In 

October 2015, we reported that additional efforts were needed to 

ensure that state spending is appropriately matched with federal funds 

in Medicaid.36 States and the federal government share in the 

financing of the Medicaid program, with the federal government 

matching most state expenditures for Medicaid services on the basis 

of a statutory formula. CMS has implemented interim measures to 

review the accuracy of state eligibility determinations and examine 

states’ expenditures for different eligibility groups, for which states 

may receive multiple federal matching rates.

However, some states have delegated authority to the federal 

government to make Medicaid eligibility determinations through the 

federally facilitated exchange. CMS has excluded these states from 

the reviews. This creates a gap in efforts to ensure that only eligible 

individuals are enrolled in Medicaid and that state expenditures are 

correctly matched by the federal government. We recommended that 

CMS review federal Medicaid eligibility determinations to ascertain the 

accuracy of these determinations and institute corrective action plans 

where necessary.

HHS has taken some steps to improve the accuracy of Medicaid 

eligibility determinations, as we recommended, but has not conducted 

a systematic review of federal eligibility determinations. For example, 

in March 2017, HHS reported that it is reviewing federal 

determinations of Medicaid eligibility in two of the nine states that 

have delegated eligibility determination authority to the federal 

marketplace. Although the actions HHS has taken have value, they 

are not sufficient to identify erroneous eligibility determinations. 

Specifically, without a systematic review of federal eligibility 

determinations, the agency lacks a mechanism to identify and correct 

errors and associated payments.

Agencies may consider collaborating with relevant entities—such as 

OMB, states, state auditors, and the IG community—to strengthen efforts 

to reduce improper payments. In November 2016, we held a discussion 

with various state auditors and federal agencies to identify potential 

opportunities to strengthen collaboration, focusing on federal and state 

initiatives related to improper payments. Further, in September 2015, we 

reported on the Recovery Operations Center’s (ROC) significant 

 36GAO, Medicaid: Additional Efforts Needed to Ensure that State Spending is 

Appropriately Matches with Federal Funds, GAO-16-53 (Washington, D.C.: Oct. 16, 

2015).

Collaborating with Other 

Entities
Page 24 GAO-17-631T 

analytical services, provided primarily to IGs to support antifraud and 

other activities.37 While funding for the ROC ended in September 2015, 

officials from some small- and medium-sized IGs stated that they do not 

have the capabilities to develop independent data analytics or pay for a 

similar service, thus foregoing the ROC’s capabilities. We suggested that 

Congress may wish to consider directing the Council of the Inspectors 

General on Integrity and Efficiency to develop a legislative proposal to 

reconstitute the essential capabilities of the ROC to help ensure federal 

spending accountability.

The federal government is projected to invest more than $89 billion on IT 

in fiscal year 2017. Our work has found that federal IT investments have 

too frequently failed or incurred cost overruns and schedule slippages 

while contributing little to mission-related outcomes. The federal 

government has spent billions of dollars on failed and poorly performing 

IT investments, which often suffered from ineffective management in 

areas such as project planning, requirements definition, and program 

oversight and governance.38 In many instances, agencies had not 

consistently applied best practices that are critical to successfully 

acquiring IT.

In addition to spending money on new IT development, federal agencies 

reported spending the majority of their IT funds on operating and 

maintaining a large number of legacy (i.e., steady-state) investments. Of 

the more than $80 billion reportedly spent on federal IT in fiscal year 

2015, 26 federal agencies39 spent about $61 billion on operations and 

maintenance, more than three-quarters of the total amount spent. (See 

figure 6).

 37GAO, Federal Spending Accountability: Preserving Capabilities of the Recovery 

Operations Center Could Help Sustain Oversight of Federal Expenditures, GAO-15-814 

(Washington, D.C.: Sept. 14, 2015).

38GAO, Information Technology: OMB and Agencies Need to More Effectively Implement 

Major Initiatives to Save Billions of Dollars, GAO-13-796T (Washington, D.C.: July 25, 

2013). 

39This $80 billion represents what 26 agencies reported to OMB on planned IT spending. 

However, this $80 billion figure is understated. This figure does not include spending for 

Defense classified IT systems; and 58 independent executive branch agencies, including 

the Central Intelligence Agency. Additionally, not all executive branch IT investments are 

included in this estimate because agencies have differed on what they considered an IT 

investment. For example, some have considered research and development systems as 

IT investments, while others have not.

Opportunities Exist to 

Improve the 

Acquisition and 

Operation of IT and to 

Address 

Cybersecurity 

Challenges
Page 25 GAO-17-631T 

Figure 6: Fiscal Year 2015 Federal Spending on IT Operations and Maintenance and 

Development, Modernization, and Enhancement by 26 Federal Agencies

Further, federal legacy IT investments are becoming increasingly 

obsolete; many use outdated software languages and hardware parts that 

are unsupported. Specifically, in May 2016, we reported that many 

agencies were using systems which had components that were, in some 

cases, at least 50 years old.40 For example, we determined that DOD was 

using 8-inch floppy disks in a legacy system that coordinates the 

operational functions of the nation’s nuclear forces. In addition, Treasury 

was using assembly language code—a computer language initially used 

in the 1950s and typically tied to the hardware for which it was developed. 

Table 5 provides examples of legacy systems across the federal 

government that agencies report are 30 years old or older and use 

obsolete software or hardware, and identifies those that do not have 

specific plans with time frames to modernize or replace these 

investments.

 40GAO, Information Technology: Federal Agencies Need to Address Aging Legacy 

Systems, GAO-16-468 (Washington, D.C.: May 25, 2016). 
Page 26 GAO-17-631T 

Table 5: Examples of Legacy Investments and Systems

Agency Investment 

or system

Description Agencyreported 

age

Specific, defined plans for 

modernization or replacement

Department of 

the Treasury

Individual 

Master File

The authoritative data source for individual 

taxpayers where accounts are updated, 

taxes are assessed, and refunds are 

generated. This investment is written in 

assembly language code—a low-level 

computer code that is difficult to write and 

maintain—and operates on an IBM 

mainframe.

~56 No - The agency has general plans 

to replace this investment, but there 

is no firm date associated with the 

transition.

Department of 

the Treasury

Business 

Master File

Retains all tax data pertaining to individual 

business income taxpayers and reflects a 

continuously updated and current record of 

each taxpayer’s account. This investment is 

also written in assembly language code and 

operates on an IBM mainframe.

~56 No - The agency has general plans 

to update this system, but there is 

no time frame established for this 

transition.

Department of 

Defense

Strategic 

Automated 

Command 

and Control

System

Coordinates the operational functions of the 

United States’ nuclear forces, such as 

intercontinental ballistic missiles, nuclear 

bombers, and tanker support aircraft. This 

system runs on an IBM Series/1 Computer—

a 1970s computing system—and uses 8-

inch floppy disks.

53 Yes - The agency plans to update 

its data storage solutions, port 

expansion processors, portable 

terminals, and desktop terminals by 

the end of fiscal year 2017.

Department of 

Veterans Affairs

Personnel 

and 

Accounting 

Integrated 

Data

Automates time and attendance for 

employees, timekeepers, payroll, and 

supervisors. It is written in Common 

Business Oriented Language (COBOL)—a 

programming language developed in the 

1950s and 1960s—and runs on an IBM 

mainframe.

53 Yes - The agency plans to replace it 

with a project called Human 

Resources Information System 

Shared Service Center in 2017.

Department of 

Veterans Affairs

Benefits 

Delivery 

Network

Tracks claims filed by veterans for benefits, 

eligibility, and dates of death. This system is 

a suite of COBOL mainframe applications.

51 No - The agency has general plans 

to roll capabilities into another 

system, but there is no firm time 

frame associated with this transition.

Department of 

Justice

Sentry Provides information regarding security and 

custody levels, inmate program and work 

assignments, and other pertinent information 

about the inmate population. The system 

uses COBOL and Java programming 

languages.

35 Yes - The agency planned to update 

the system through September 

2016. 

Social Security 

Administration

Title II 

Systems

Determines retirement benefits eligibility and 

amounts. The investment is comprised of 

162 subsystems written in COBOL.

31 Yes - The agency has ongoing 

modernization efforts, including one 

that is experiencing cost and 

schedule challenges due to the 

complexities of the legacy software. 

Source: GAO analysis of IT Dashboard data, agency documentation, and interviews. | GAO-17-631T

Note: Age was reported by agencies. Systems and investments may have individual components 

newer than the reported age.
Page 27 GAO-17-631T 

To address this issue, we recommended that 12 agencies identify and 

plan to modernize or replace legacy systems, including establishing time 

frames, activities to be performed, and functions to be replaced or 

enhanced.41 Most agencies agreed with our recommendations or had no 

comment.

The spending on legacy systems has also increased over time. 

Specifically, between fiscal years 2010 and 2017, operations and 

maintenance spending has increased, while the amount invested in 

developing new systems has decreased by about $7.3 billion since fiscal 

year 2010. (See figure 7.)

Figure 7: Summary of IT Spending by Fiscal Year from 2010 through 2017 (Dollars in Billions)

Note: According to Department of Defense officials, the department’s fiscal year 2010 IT expenditures 

reported to the IT Dashboard includes both classified and unclassified spending, whereas its fiscal 

year 2011 to 2017 expenditures only include unclassified spending.

 41These 12 agencies are the Departments of Agriculture, Commerce, Defense, Energy, 

Health and Human Services, Homeland Security, Justice, State, the Treasury, 

Transportation, and Veterans Affairs, and the Social Security Administration.
Page 28 GAO-17-631T 

Recognizing the severity of issues related to the government-wide 

management of IT, in December 2014, Congress enacted IT acquisition 

reform provisions (commonly referred to as the Federal Information 

Technology Acquisition Reform Act or FITARA) as part of the Carl Levin 

and Howard P. ‘Buck’ McKeon National Defense Authorization Act for 

Fiscal Year 2015.

42 Among other things, the law requires action to: (1) 

consolidate federal data centers, (2) enhance transparency and improve 

risk management, (3) enhance agency chief information officer (CIO) 

authority, (4) review IT investment portfolios, (5) expand training and use 

of IT acquisition cadres, (6) purchase software government-wide, and (7) 

maximize the benefit of federal strategic sourcing.

In February 2015, we introduced a new government-wide high-risk area, 

Improving the Management of IT Acquisitions and Operations.43 This area 

highlights several critical IT initiatives in need of additional executive 

branch and congressional oversight, including (1) reviewing troubled 

projects; (2) increasing the use of incremental development; (3) providing 

transparency relative to the cost, schedule, and risk levels for major IT 

investments; (4) reviewing agencies’ operational investments; (5) 

consolidating data centers; and (6) streamlining agencies’ portfolios of IT 

investments. We noted that agencies have inconsistently implemented 

these initiatives and that more work remained to demonstrate progress in 

achieving successful IT acquisitions and operations outcomes.

Further, our February 2015 High-Risk report stressed that, beyond 

implementing FITARA, OMB and agencies needed to continue to 

implement our prior recommendations in order to improve their ability to 

effectively and efficiently invest in IT. Specifically, between fiscal years 

2010 and 2015, we made 803 recommendations to OMB and federal 

agencies to address shortcomings in IT acquisitions and operations, 

including many to improve the implementation of the critical IT initiatives 

mentioned earlier and other government-wide, cross-cutting efforts. We 

noted that OMB and agencies should demonstrate government-wide 

progress in the management of IT investments by, among other things, 

implementing at least 80 percent of our recommendations related to 

managing IT acquisitions and operations within 4 years.

 42Federal Information Technology Acquisition Reform provisions of the Carl Levin and 

Howard P. ‘Buck’ McKeon National Defense Authorization Act for Fiscal Year 2015, Pub. 

L. No. 113-291, div. A, title VIII, subtitle D, 128 Stat. 3292, 3438-3450 (Dec. 19, 2014).

43GAO, High-Risk Series: An Update, GAO-15-290 (Washington, D.C.: Feb. 11, 2015). 
Page 29 GAO-17-631T 

In February 2017, we issued an update to our High-Risk Series and 

reported that, while progress had been made in improving the 

management of IT acquisitions and operations, significant work still 

remained to be completed.44 For example, as of December 2016, OMB 

and the agencies had fully implemented 366 (or about 46 percent) of the 

803 recommendations. This was a 23 percent increase compared to the 

percentage we reported as being fully implemented in 2015. However, in 

fiscal year 2016, we made 202 new recommendations, thus further 

reinforcing the need for OMB and agencies to address the shortcomings 

in IT acquisitions and operations. Our ongoing work has shown that OMB 

and agencies’ implementation of these recommendation will likely result 

in billions of dollars in cost savings.

To better ensure that IT investments are made in the most effective 

manner possible, OMB has established several initiatives to improve the 

acquisition and operations of IT and achieve cost savings. However, 

these efforts have been implemented inconsistently and additional OMB 

and agency progress is needed to more effectively and efficiently invest in 

IT.

• Incremental development. OMB has emphasized the need to deliver 

investments in smaller parts, or increments, in order to reduce risk; 

deliver capabilities more quickly; increase the likelihood that cost, 

schedule, and performance goals will be met; and facilitate the 

adoption of emerging technologies. In 2010, it called for agencies’

major investments to deliver functionality every 12 months and, since 

2012, every 6 months. Subsequently, FITARA codified a requirement 

that agency CIOs certify that IT investments are adequately 

implementing incremental development, as defined in the annual 

capital planning guidance issued by OMB.45 However, in August 

2016, we reported46 that approximately 36 percent of active software 

projects had not planned to deliver usable functionality every 6 

months for fiscal year 2016, as required by OMB guidance.

We also reported that, although OMB had issued guidance requiring 

covered agency CIOs to certify that each major IT investment’s plan 

for the current year adequately implements incremental development, 

 44GAO-17-317. 

4540 U.S.C. § 11319(b)(1)(B)(ii). 

46GAO, Information Technology Reform: Agencies Need to Increase Their Use of 

Incremental Development Practices, GAO-16-469 (Washington, D.C.: Aug. 16, 2016). 
Page 30 GAO-17-631T 

only three of seven agencies47 selected for in-depth GAO review (the 

Departments of Commerce, Homeland Security, and Transportation) 

had defined processes and policies intended to ensure that the 

department CIO certifies that major IT investments are adequately 

implementing incremental development.48 Accordingly, we 

recommended that the remaining four agencies establish a policy and 

process for certifying that major IT investments’ adequately use 

incremental development. Education and HHS agreed with our 

recommendation, while DOD disagreed and stated that its existing 

policies address the use of incremental development. However, we 

noted that the department’s policies did not comply with OMB’s 

guidance and that we continued to believe our recommendation was 

appropriate. Treasury did not comment on the recommendation. In 

total, we have made 23 recommendations to OMB and agencies to 

improve their implementation of incremental development; and as of 

May 2017, 17 of our recommendations remained open.

• Federal data center consolidation. Over time, the federal 

government’s increasing demand for IT has led to a dramatic rise in 

the number of federal data centers (defined as data processing and 

storage facilities over 500 square feet with strict availability 

requirements) and a corresponding increase in operational costs. To 

improve the efficiency, performance, and environmental footprint of 

federal data center activities, OMB established the Federal Data 

Center Consolidation Initiative in February 2010. In a series of reports 

over the past 6 years, we determined that, while data center 

consolidation could potentially save the federal government billions of 

dollars, weaknesses existed in several areas, including agencies’ data 

 47These seven agencies are the Departments of Commerce, Defense, Education, Health 

and Human Services, Homeland Security, Transportation, and the Treasury. These 

agencies were chosen because they reported a minimum of 12 investments that were at 

least 50 percent or more in development on the IT Dashboard for fiscal year 2015. 

48Office of Management and Budget, FY2017 IT Budget – Capital Planning Guidance. 
Page 31 GAO-17-631T 

center consolidation plans and OMB’s tracking and reporting on cost 

savings.49

As of March 2017, the 24 federal agencies participating in OMB’s data 

center consolidation initiative had collectively reported closing 4,679 

of the 10,058 total data centers and achieving approximately $2.8 

billion in cost savings or avoidances from fiscal year 2012 through 

2016. Further, as of December 2016, agencies were planning a total 

of approximately $378 million in cost savings between fiscal years 

2016 and 2018. However, this is significantly less than the 

approximately $4.0 billion in fiscal year 2016 through 2018 planned 

savings that agencies reported to us in November 2015 and OMB’s 

$2.7 billion cost savings goal for agencies to achieve by the end of 

fiscal year 2018. Of the recommendations that we made to 10 

agencies in March 2016 to complete their planned data center cost 

savings targets for fiscal years 2016 through 2018, all remain open.50

In total, we have made 111 recommendations to OMB and agencies 

to improve the federal data center consolidation effort. As of May 

2017, 45 of our recommendations remained open.

• IT investment portfolio management. In March 2012, OMB 

launched an initiative, referred to as PortfolioStat, to maximize the 

return on IT investments across the government’s portfolio. 

PortfolioStat is designed to assist agencies in assessing the current 

maturity of their IT investment management process, making 

decisions on eliminating duplicative investments, and moving to 

shared solutions (such as cloud computing) within and across 

agencies.

In November 2013, we reported that agencies had identified 

duplicative spending as part of PortfolioStat and that this initiative had 

the potential to save at least $5.8 billion through fiscal year 2015; 

however, weaknesses existed in agencies’ implementation of the 

 49GAO, Data Center Consolidation: Agencies Making Progress, but Planned Savings 

Goals Need to Be Established [Reissued on March 4, 2016], GAO-16-323 (Washington, 

D.C.: Mar. 3, 2016); Data Center Consolidation: Reporting Can Be Improved to Reflect 

Substantial Planned Savings, GAO-14-713 (Washington, D.C.: Sept. 25, 2014); Data 

Center Consolidation: Strengthened Oversight Needed to Achieve Cost Savings Goal, 

GAO-13-378 (Washington, D.C.: Apr. 23, 2013); Data Center Consolidation: Agencies 

Making Progress on Efforts, but Inventories and Plans Need to Be Completed, 

GAO-12-742 (Washington, D.C.: July 19, 2012); and Data Center Consolidation: Agencies 

Need to Complete Inventories and Plans to Achieve Expected Savings, GAO-11-565 

(Washington, D.C.: July 19, 2011). 

50GAO-16-323.
Page 32 GAO-17-631T 

initiative, such as limitations in the CIOs’ authority.51 In April 2015, we 

reported that, although agencies had achieved approximately $1.1 

billion in PortfolioStat savings, inconsistencies in OMB’s and 

agencies’ reporting made it difficult to reliably measure progress in 

achieving savings.52 In total, we have made 69 recommendations to 

improve OMB and agencies’ implementation of PortfolioStat; and as 

of May 2017, only 7 of our recommendations had been implemented.

• Management of software licenses. In May 2014, we reported on 

federal agencies’ management of software licenses and determined 

that better management was needed to achieve significant savings 

government-wide.53 In particular, 22 of the 24 major agencies did not 

have comprehensive license policies and only 2 had comprehensive 

license inventories. As a result, agencies’ oversight of software 

license spending was limited or lacking, thus, potentially leading to 

missed savings. The potential savings could be significant considering 

that, in fiscal year 2012, 1 major federal agency reported saving 

approximately $181 million by consolidating its enterprise license 

agreements, even though its oversight process was ad hoc. We 

recommended that OMB issue needed guidance to agencies and 

made 135 recommendations to the agencies to improve their policies 

and practices for managing licenses. As of May 2017, 123 of our 

recommendations have not yet been implemented.

In light of these issues, we convened a forum on September 14, 2016, to 

explore challenges and opportunities for CIOs to improve federal IT 

acquisitions and operations—with the goal of better informing 

policymakers and government leadership.54 Forum participants, including 

13 current and former federal agency CIOs, members of Congress, and 

private sector IT executives, identified key actions related to seven topics: 

(1) strengthening FITARA, (2) improving CIO authorities, (3) budget 

formulation, (4) governance, (5) workforce, (6) operations, and (7) 

transition planning. For example, participants noted that challenges with 

 51GAO, Information Technology: Additional OMB and Agency Actions Are Needed to 

Achieve Portfolio Savings, GAO-14-65 (Washington, D.C.: Nov. 6, 2013). 

52GAO, Information Technology: Additional OMB and Agency Actions Needed to Ensure 

Portfolio Savings Are Realized and Effectively Tracked, GAO-15-296 (Washington, D.C.: 

Apr. 16, 2015). 

53GAO, Federal Software Licenses: Better Management Needed to Achieve Significant 

Savings Government-Wide, GAO-14-413 (Washington, D.C.: May 22, 2014). 

54GAO, Information Technology: Opportunities for Improving Acquisitions and Operations, 

GAO-17-251SP (Washington, D.C.: Apr. 11, 2017).
Page 33 GAO-17-631T 

IT operations, such as the use of increasingly obsolete systems, should 

be addressed by, among other things, using a strategic approach for 

legacy system migration and migrating more services to cloud computing 

services.55 A summary of the key actions, by topic area, identified during 

the forum is provided in figure 8.

 55Cloud computing is a means for enabling on-demand access to shared and scalable 

pools of computing resources with the goal of minimizing management effort or service 

provider interaction. 
Page 34 GAO-17-631T 

Figure 8: Key Actions, by Topic Area, Identified by Forum Participants to Improve IT Acquisitions and Operations

In addition to improving the acquisition and operation of IT, opportunities 

also exist to better ensure the security of federal information systems and 

cyber critical infrastructure and protect the privacy of personally 

Cybersecurity Presents an 

Ongoing Challenge
Page 35 GAO-17-631T 

identifiable information (PII). Safeguarding federal computer systems and 

the systems that support critical infrastructures—referred to as cyber 

critical infrastructure protection—has been a longstanding concern. The 

security of federal cyber assets has been on our High-Risk List since 

1997, the first time we added a government-wide issue to the list. In 2003, 

we expanded this high-risk area to include the protection of critical cyber 

infrastructure. In 2015, we added protecting the privacy of PII that is 

collected, maintained, and shared by both federal and nonfederal entities.

As we reported in our February 2017 High-Risk report, the federal 

government has taken steps intended to improve the security of its cyber 

assets. For example, in July 2016, the President released Presidential 

Policy Directive (PPD)-41, which set forth principles governing the federal 

government’s response to cyber incidents involving government or private 

sector entities.56 Further, in July 2016, OMB issued a revised Circular A130, Managing Information as a Strategic Resource, to reflect changes in 

law and advances in technology and to ensure consistency with executive 

orders, presidential directives, recent OMB policy, and National Institute 

of Standards and Technology (NIST) standards and guidelines.57 Most 

recently, on May 11, 2017, the President issued an executive order titled 

Strengthening the Cybersecurity of Federal Networks and Critical 

Infrastructure. Among other things, the order is intended to hold 

department and agency heads accountable for managing cybersecurity 

risk to their enterprise and support cybersecurity risk management efforts 

of owners and operators of the Nation’s critical infrastructures.58

In addition, the Executive Office of the President (EOP) and the 

Department of Homeland Security (DHS) developed corrective action 

plans intended to improve the protection of cyber assets and PII. DHS 

and EOP also took other steps, such as developing and using metrics for 

 56PPD-41, United States Cyber Incident Coordination, July 26, 2016.

57OMB, OMB Circular A-130, Managing Federal Information as a Strategic Resource 

(Washington, D.C.: July 28, 2016).

58Critical infrastructure includes systems and assets so vital to the United States that 

incapacitating or destroying them would have a debilitating effect on national security. 

These critical infrastructures are grouped by the following industries or “sectors”: 

chemical; commercial facilities; communications; critical manufacturing; dams; defense 

industrial base; emergency services; energy; financial services; food and agriculture; 

government facilities; health care and public health; information technology; nuclear 

reactors, materials, and waste; transportation systems; and water and wastewater 

systems.
Page 36 GAO-17-631T 

measuring agency progress in implementing initiatives on information 

security regarding continuous monitoring, strong authentication, and antiphishing and malware defense.

However, securing cyber assets remains a challenge for federal 

agencies. In prior reports, we made a number of recommendations to 

federal agencies concerning challenges in the following areas:

• Designing and implementing risk-based cybersecurity programs at 

federal agencies.

• Providing government-wide intrusion detection and prevention 

services.

• Strengthening security over industry and public health data at the 

Food and Drug Administration.

• Improving security controls over high-impact systems.59

• Addressing cybersecurity for the nation’s critical infrastructures.

• Protecting the security and privacy of electronic health information.

• Ensuring privacy when face recognition systems are used.

• Protecting the privacy of users’ data on state-based marketplaces.

• Improving consumer privacy protections.

Until the administration and executive branch agencies implement the 

approximately 1,000 open recommendations that we have made to 

address these cyber challenges, resolve identified deficiencies, and fully 

implement effective security programs and privacy practices, a broad 

array of federal assets and operations remain at risk of fraud, misuse, and 

disruption, and the nation’s most critical federal and private sector 

infrastructure systems will remain at increased risk of attack from 

adversaries. As we have previously stated, Congress should also 

consider amending privacy laws to more fully protect the PII collected, 

used, and maintained by the federal government.

 59NIST Federal Information Processing Standards Publication 199, Standards for Security 

Categorization of Federal Information and Information Systems (FIPS Pub 199) defines 

how agencies should determine the security category of their information and information 

systems. Agencies are to consider the potential effect or magnitude of harm that could 

occur should there be a loss in the confidentiality, integrity, or availability of the information 

or information system as low, moderate, or high. For high-impact systems, the loss could 

be expected to have a severe or catastrophic adverse effect on organizational operations, 

organizational assets, or individuals.
Page 37 GAO-17-631T 

In 2003, we added Federal Real Property to our High-Risk List, in part 

due to long-standing challenges federal agencies face in managing 

federally owned real property, including disposal of excess and 

underutilized property.60 Continuing to maintain these unneeded facilities 

puts the government at risk for wasting resources due to ongoing 

maintenance costs as well as lost revenue from failing to sell surplus 

property. Despite past and ongoing efforts, the federal government 

continues to maintain excess and underutilized property.

Our work has found that significant challenges persist in managing real 

property in general and underutilized property in particular, including a 

lack of reliable data to measure the extent of the problem, a complex 

disposal process, costly environmental requirements, competing 

stakeholder interests, and limited accessibility of some federal properties. 

As of May 2017, we have 32 open recommendations to the General 

Services Administration (GSA) to address these challenges. The 

experiences of the Department of Veterans Affairs (VA), DOD, DHS, and 

the GSA illustrate some of these challenges.

• VA facility alignment. VA operates one of the largest health care

systems in the United States, with 168 medical centers and more than 

1,000 outpatient facilities, totaling over 6,000 reported buildings in its 

portfolio. Of these buildings, VA reported in February 2016 that over 

1,000 are unneeded or underutilized, representing 11.5 million square 

feet of space, requiring an estimated $26 million annually to operate 

and maintain according to VA (see figure 9). As VA’s care model 

shifts over time from inpatient to outpatient care, this will likely result 

in additional underutilized space. However, VA has found it difficult 

and costly to modernize existing facilities. A previous VA effort aimed 

at modernizing and better aligning facilities was not fully implemented 

due in part to stakeholder opposition. We recommended in April 2017 

that VA improve guidance to effectively communicate with 

stakeholders and evaluate those efforts.61 VA agreed with the 

recommendations.

 60GAO, High-Risk Series: Federal Real Property, GAO-03-122 (Washington, D.C.: Jan. 1, 

2003). 

61GAO, VA Real Property: VA Should Improve Its Efforts to Align Facilities with Veterans’

Needs, GAO-17-349 (Washington, D.C.: Apr. 5, 2017).

Challenges Remain in 

Reducing Unneeded 

Federal Facilities and 

Managing the Federal 

Fleet of Vehicles
Page 38 GAO-17-631T 

Figure 9: Example of Deteriorating Historic Vacant Buildings at the Kerrville VA Medical Center in Texas

• DHS reuse of St. Elizabeths. DHS efforts to consolidate its 

headquarters on the west campus of St. Elizabeths has faced 

numerous delays and cost increases. The west campus of St. 

Elizabeths, a National Historic Landmark in Washington, D.C., is 

made up of 61 buildings on about 182 acres. Many of the buildings 

have been vacant for extended periods of time and are in badly 

deteriorated condition. (See figure 10.) The Coast Guard has moved 

into a newly constructed building on the campus, but most of the 

project has been delayed. The estimated timeline for completing the 

project has been extended multiple times, from an initial estimated 

completion date of 2016, to an estimated completion date of 2021 

based on a scaled back plan.62

 62GAO, Federal Real Property: Efforts Made, but Challenges Remain in Reducing 

Unneeded Facilities, GAO-16-869T (Washington, D.C.: Sept. 23, 2016).
Page 39 GAO-17-631T 

Figure 10: Images of Vacant Buildings on the St. Elizabeths Campus

• DOD support infrastructure. DOD manages a global real property 

portfolio that consists of more than 562,000 facilities. In 1997, we 

added DOD’s support infrastructure management to the High-Risk List 

and since then, have reported on various obstacles DOD has 

experienced in reducing excess infrastructure, more efficiently using 

facilities, reducing base support costs, and achieving efficiencies by 
Page 40 GAO-17-631T 

consolidating or eliminating duplicative support services.63 DOD has 

shown some improvement in managing its infrastructure to better 

achieve reductions and efficiencies, but challenges remain.

DOD continues to maintain excess facilities, and needs to ensure 

accuracy of its real property data to better identify potential areas to 

reduce and consolidate facilities. For example, in March 2016 we 

found DOD lacked reliable data to effectively assess how it uses 

leases. We recommended actions to improve the accuracy and 

completeness of these data, such as breaking out the cost and square 

footage information on multiple properties included in a single lease. 

DOD agreed with our findings, but did not agree with our 

recommendation and has not taken action to implement it. If DOD 

does not improve the reliability of its data, the department will 

continue to be limited in its ability to monitor its reduction of excess 

infrastructure, identify opportunities to consolidate underutilized 

facilities, and identify opportunities to reduce reliance on costly leased 

space by moving DOD organizations into excess facilities.

• GSA warehouses. In 2014, we found that some GSA warehouses 

listed as “used” had been vacant for as long as 10 years.64 GSA only 

lists warehouses as unused if they are in the process of being 

disposed, making it difficult to identify which warehouses are actually 

underutilized or vacant. Two examples located in Washington, D.C. 

are shown in figure 11. We recommended that GSA improve its data 

related to warehouses. GSA agreed with the recommendations.

GSA, however, continues to lack a strategic approach to prioritize 

warehouses and make long-term, informed decisions about 

government warehouse space. As a result, GSA may have limited 

ability to address this potentially growing gap as well as the unique 

challenges facing GSA’s warehouse portfolio. Such a strategy would 

enable GSA and tenant agencies to prioritize their needs and take a 

 63GAO, Defense Infrastructure: More Accurate Data Would Allow DOD to Improve the 

Tracking, Management, and Security of Its Leased Facilities, GAO-16-101 (Washington, 

D.C.: Mar. 15, 2016); DOD Joint Bases: Implementation Challenges Demonstrate Need to 

Reevaluate the Program, GAO-14-577 (Washington, D.C.: Sept. 19, 2014); Defense 

Infrastructure: DOD Needs to Improve Its Efforts to Identify Unutilized and Underutilized 

Facilities, GAO-14-538 (Washington, D.C.: Sept. 8, 2014); and Excess Facilities: DOD 

Needs More Complete Information and a Strategy to Guide Its Future Disposal Efforts, 

GAO-11-814 (Washington, D.C.: Sept. 19, 2011).

64GAO, Federal Real Property: Strategic Focus Needed to Help Manage Vast and Diverse 

Warehouse Portfolio, GAO-15-41 (Washington, D.C.: Nov. 12, 2014). 
Page 41 GAO-17-631T 

long-term view of the warehouse inventory to support better informed 

decisions.

• GSA high-value leases. To reduce its overreliance on costly leases, 

we recommended in September 2013 that GSA develop a long-term, 

cross-agency strategy that facilitates consideration of targeted 

investments in ownership.65 GSA agreed with our recommendation 

and has taken steps to prioritize lease purchases, but has not yet 

developed a strategy that considers its full portfolio of high-value 

leases. Such a strategy would strengthen the business case for 

stakeholders to increase ownership investments in high-value leased 

properties—a necessary step for fully addressing GSA’s overreliance 

on leasing in situations where ownership would be more cost effective 

in the long run.

Figure 11: Vacant GSA warehouses identified as Active and Utilized that had been vacant since 2009 (left) and 2004 (right)

The administration and Congress have taken recent steps to reform real 

property management and address the long-standing challenge of 

reducing excess and underutilized property. For example, in 2015, OMB 

implemented our recommendation by issuing government-wide 

guidance—the National Strategy for the Efficient Use of Real Property—

which aligns with many of the desirable characteristics of effective 

 65GAO, Federal Real Property: Greater Transparency and Strategic Focus Needed for 

High-Value GSA Leases, GAO-13-744 (Washington, D.C.: Sept. 19, 2013).
Page 42 GAO-17-631T 

national strategies that we have previously identified.66 In December 

2016, two real property reform laws were also enacted that could address 

the long-standing problem of federal excess and underutilized property.

The Federal Assets Sale and Transfer Act of 2016 may help address 

stakeholder influence by establishing an independent board to identify 

and recommend civilian federal buildings for disposal.67 The President 

has not yet appointed the board, but GSA has started gathering 

information from the agencies to support the board once it is constituted. 

In addition, the Federal Property Management Reform Act of 2016 

codified the Federal Real Property Council (FRPC)—a group of senior 

real property officers from each federal agency— to collaborate to 

improve real property management and reduce costs to the federal 

government.68 For example, the act requires that the FRPC, in 

consultation with OMB and GSA, update annually a property 

management plan template with government-wide performance measures 

to reduce surplus property and achieve better utilization of underutilized 

property.

In fiscal year 2015, federal agencies spent about $4.3 billion on over 

640,000 vehicles that agencies own or lease. Agencies are responsible 

for managing their vehicle fleet, which includes making decisions about 

the number of vehicles the agency needs and deciding when to dispose 

of a vehicle. In two reviews we conducted between 2015 and 2017, we 

found that selected agencies were spending over $20 million annually on 

vehicles that may not have been fully utilized. At six agencies, we found 

that agencies either had no criteria to determine if a vehicle was used, 

could not document that the agency applied their utilization criteria, or 

retained vehicles that did not meet the agency’s criteria.

In January 2016 and April 2017, we recommended that specific agencies 

take actions to identify and eliminate unnecessary vehicles from their 

 66GAO, Federal Real Property: National Strategy and Better Data Needed to Improve 

Management of Excess and Underutilized Property, GAO-12-645 (Washington, D.C: June 

20, 2012).

67Pub. L. No. 114-287, 130 Stat. 1463 (2016). The act excludes properties on military 

installations among others. 

68Pub. L. No. 114-318, 130 Stat. 1608 (2016).

Challenges to Managing 

the Federal Vehicle Fleet
Page 43 GAO-17-631T 

respective fleets.69 In response to our recommendations, some agencies 

have taken steps to identify underutilized vehicles in their fleets. However, 

given the decentralized nature of federal fleets and our analysis of a small 

sample of agencies, it is likely that additional cost savings are possible 

through enhanced agency practices.

I recently met with the Director of OMB to discuss a range of issues, 

including those discussed today. Following that meeting, I sent the 

Director a letter highlighting open priority recommendations to OMB on 

important issues. I am also meeting with the heads of the major agencies 

to discuss the pressing management risks and challenges that confront 

their agencies, as well as sending them individual letters identifying the 

priority GAO open recommendations that need their personal attention. 

We have found in recent years that such letters are helpful in focusing 

attention on the most important issues.

Ultimately, addressing the federal government’s long-term unsustainable 

fiscal path will require broad fiscal policy changes to address the 

imbalance between federal revenues and spending. However, by taking 

immediate action on government-wide management challenges, 

Congress and the executive branch can begin to address our fiscal 

situation by preventing fraud, waste, and abuse and ensuring funds are 

put to the best possible use.

Thank you, Chairman Enzi, Ranking Member Sanders, and members of 

the Committee, this concludes my prepared statement. I would be 

pleased to answer questions.

For further information on this testimony, please contact J. Christopher 

Mihm, Managing Director, Strategic Issues, who may be reached at (202) 

512-6806 or mihmj@gao.gov, or Susan J. Irving, Director for Federal 

Budget Analysis, Strategic Issues, who may be reached at (202) 512-

6806 or irvings@gao.gov. Contact points for the individual areas listed in 

our 2017 Fragmentation, Overlap, and Duplication annual report can be 

found on the first page of each area in GAO-17-491SP. Contact points for 

 69GAO, Federally Owned Vehicles: Agencies Should Improve Processes to Identify 

Underutilized Vehicles, GAO-17-426 (Washington, D.C.: Apr. 25, 2017); and Federally 

Leased Vehicles: Agencies Should Strengthen Processes to Reduce Underutilized 

Vehicles, GAO-16-136 (Washington, D.C.: Jan. 14, 2016).

GAO Contacts
Page 44 GAO-17-631T 

the individual high-risk areas are listed in GAO-17-317 and on our highrisk website. Contact points for our Congressional Relations and Public 

Affairs offices may be found on the last page of this statement.
Related GAO Products

Page 45 GAO-17-631T 

• 2017 Annual Report: Additional Opportunities to Reduce 

Fragmentation, Overlap, and Duplication and Achieve Other Financial 

Benefits. GAO-17-491SP. Washington, D.C.: April 26, 2017.

• High-Risk Series: Progress on Many High-Risk Areas, While 

Substantial Efforts Needed on Others. GAO-17-317. Washington, 

D.C.: February 15, 2017.

• High-Risk Series: An Update. GAO-15-290. Washington, D.C.: 

February 11, 2015.

• SSA Disability Benefits: Comprehensive Strategic Approach Needed 

to Enhance Antifraud Activities. GAO-17-228. Washington, D.C.: April 

17, 2017.

• Financial Audit: Fiscal Years 2016 and 2015 Consolidated Financial 

Statements of the U.S. Government. GAO-17-283R. Washington, 

D.C.: January 12, 2017.

• Improper Payments: Strategy and Additional Actions Needed to Help 

Ensure Agencies Use the Do Not Pay Working System as Intended. 

GAO-17-15. Washington, D.C.: October 14, 2016.

• Medicare: Claim Review Programs Could Be Improved with Additional 

Prepayment Reviews and Better Data. GAO-16-394. Washington, 

D.C.: April 13, 2016.

• Medicare Advantage: Fundamental Improvements Needed in CMS’s 

Effort to Recover Substantial Amounts of Improper Payments. 

GAO-16-76. Washington, D.C.: April 8, 2016.

• Medicaid: Additional Efforts Needed to Ensure that State Spending is 

Appropriately Matched with Federal Funds. GAO-16-53. Washington, 

D.C.: October 16, 2015.

• Federal Spending Accountability: Preserving Capabilities of Recovery 

Operations Center Could Help Sustain Oversight of Federal 

Expenditures. GAO-15-814. Washington, D.C.: September 14, 2015.

• A Framework for Managing Fraud Risks in Federal Programs. 

GAO-15-593SP. Washington, D.C.: July 2015.

• Medicaid: Additional Actions Needed to Help Improve Provider and 

Beneficiary Fraud Controls. GAO-15-313. Washington, D.C.: May 14, 

2015.

Related GAO Products

Government-wide 

Management Challenges

Improper Payments
Related GAO Products

Page 46 GAO-17-631T 

• Improper Payments: TRICARE Measurement and Reduction Efforts 

Could Benefit from Adopting Medical Record Reviews. GAO-15-269. 

Washington, D.C.: February 18, 2015.

• Supplemental Nutrition Assistance Program: Enhanced Detection 

Tools and Reporting Could Improve Efforts to Combat Recipient 

Fraud. GAO-14-641. Washington, D.C.: August 21, 2014.

• DOD Financial Management: Significant Improvements Needed in 

Efforts to Address Improper Payment Requirements. GAO-13-227. 

Washington, D.C.: May 13, 2013.

• Health Care Fraud: Types of Providers Involved in Medicare, 

Medicaid, and the Children’s Health Insurance Program Cases. 

GAO-12-820. Washington, D.C.: September 7, 2012.

• Recovery Act: IRS Quickly Implemented Tax Provisions, but 

Reporting and Enforcement Improvements Are Needed. GAO-10-349. 

Washington, D.C.: February 10, 2010.

• Information Technology: Opportunities for Improving Acquisitions and 

Operations. GAO-17-251SP. Washington, D.C.: April 11, 2017.

• Information Technology Reform: Agencies Need to Increase Their 

Use of Incremental Development Practices. GAO-16-469. 

Washington, D.C.: August 16, 2016.

• Information Technology: Federal Agencies Need to Address Aging 

Legacy Systems. GAO-16-468. Washington, D.C.: May 25, 2016.

• Data Center Consolidation: Agencies Making Progress, but Planned 

Savings Goals Need to Be Established [Reissued on March 4, 2016]. 

GAO-16-323. Washington, D.C.: March 3, 2016.

• Information Technology: Additional OMB and Agency Actions Needed 

to Ensure Portfolio Savings Are Realized and Effectively Tracked. 

GAO-15-296. Washington, D.C.: April 16, 2015.

• Data Center Consolidation: Reporting Can Be Improved to Reflect 

Substantial Planned Savings. GAO-14-713. Washington, D.C.: 

September 25, 2014.

• Federal Software Licenses: Better Management Needed to Achieve 

Significant Savings Government-Wide. GAO-14-413. Washington, 

D.C.: May 22, 2014.

• Information Technology: Additional OMB and Agency Actions Are 

Needed to Achieve Portfolio Savings. GAO-14-65. Washington, D.C.: 

November 6, 2013.

Information Technology
Related GAO Products

Page 47 GAO-17-631T 

• Information Technology: OMB and Agencies Need to More Effectively 

Implement Major Initiatives to Save Billions of Dollars. GAO-13-796T. 

Washington, D.C.: July 25, 2013.

• Data Center Consolidation: Strengthened Oversight Needed to 

Achieve Cost Savings Goal. GAO-13-378. Washington, D.C.: April 23, 

3013.

• Data Center Consolidation: Agencies Making Progress on Efforts, but 

Inventories and Plans Need to Be Completed. GAO-12-742. 

Washington, D.C.: July 19, 2012.

• Data Center Consolidation: Agencies Need to Complete Inventories 

and Plans to Achieve Expected Savings. GAO-11-565. Washington, 

D.C.: July 19, 2011.

• Federally Owned Vehicles: Agencies Should Improve Processes to 

Identify Underutilized Vehicles. GAO-17-426. Washington, D.C.: April 

25, 2017.

• VA Real Property: VA Should Improve Its Efforts to Align Facilities 

with Veterans’ Needs. GAO-17-349. Washington, D.C.: April 5, 2017.

• Federal Real Property: Efforts Made, but Challenges Remain in 

Reducing Unneeded Facilities. GAO-16-869T. Washington, D.C.: 

September 23, 2016.

• Defense Infrastructure: More Accurate Data Would Allow DOD to 

Improve the Tracking, Management, and Security of Its Leased 

Facilities. GAO-16-101. Washington, D.C.: March 15, 2016.

• Federally Leased Vehicles: Agencies Should Strengthen Processes to 

Reduce Underutilized Vehicles. GAO-16-136. Washington, D.C.: 

January 14, 2016.

• Federal Real Property: Strategic Focus Needed to Help Manage Vast 

and Diverse Warehouse Portfolio. GAO-15-41. Washington, D.C.: 

November 12, 2014.

• DOD Joint Bases: Implementation Challenges Demonstrate Need to 

Reevaluate the Program. GAO-14-577. Washington, D.C.: September 

19, 2014.

• Defense Infrastructure: DOD Needs to Improve Its Efforts to Identify 

Unutilized and Underutilized Facilities. GAO-14-538. Washington, 

D.C.: September 8, 2014.

Federal Real Property and 

Vehicles
Related GAO Products

Page 48 GAO-17-631T 

• Federal Real Property: Greater Transparency and Strategic Focus 

Needed for High-Value GSA Leases. GAO-13-744. Washington, D.C.: 

Sept. 19, 2013.

• Federal Real Property: National Strategy and Better Data Needed to 

Improve Management of Excess and Underutilized Property. 

GAO-12-645. Washington, D.C.: June 20, 2012.

• Excess Facilities: DOD Needs More Complete Information and a 

Strategy to Guide Its Future Disposal Efforts. GAO-11-814. 

Washington, D.C.: September 19, 2011.

• The Nation’s Fiscal Health: Action is Needed to Address the Federal 

Government’s Fiscal Future. GAO-17-237SP. Washington, D.C.: 

January 17, 2017.

• Fiscal Outlook & The Debt Key Issues Page, accessed April 28, 2017, 

http://www.gao.gov/fiscal_outlook/overview

• Social Security’s Future: Answers to Key Questions. GAO-16-75SP. 

Washington, D.C.: October 27, 2015.

• Fiscal Outlook: Addressing Improper Payments and the Tax Gap 

Would Improve the Government’s Fiscal Position. GAO-16-92T. 

Washington, D.C.: October 1, 2015.

Long-Term Fiscal Outlook

(102055)
This is a work of the U.S. government and is not subject to copyright protection in the 

United States. The published product may be reproduced and distributed in its entirety 

without further permission from GAO. However, because this work may contain 

copyrighted images or other material, permission from the copyright holder may be 

necessary if you wish to reproduce this material separately.
The Government Accountability Office, the audit, evaluation, and investigative 

arm of Congress, exists to support Congress in meeting its constitutional 

responsibilities and to help improve the performance and accountability of the 

federal government for the American people. GAO examines the use of public 

funds; evaluates federal programs and policies; and provides analyses, 

recommendations, and other assistance to help Congress make informed 

oversight, policy, and funding decisions. GAO’s commitment to good government 

is reflected in its core values of accountability, integrity, and reliability.

The fastest and easiest way to obtain copies of GAO documents at no cost is 

through GAO’s website (http://www.gao.gov). Each weekday afternoon, GAO 

posts on its website newly released reports, testimony, and correspondence. To 

have GAO e-mail you a list of newly posted products, go to http://www.gao.gov

and select “E-mail Updates.”

The price of each GAO publication reflects GAO’s actual cost of production and 

distribution and depends on the number of pages in the publication and whether 

the publication is printed in color or black and white. Pricing and ordering 

information is posted on GAO’s website, http://www.gao.gov/ordering.htm. 

Place orders by calling (202) 512-6000, toll free (866) 801-7077, or 

TDD (202) 512-2537.

Orders may be paid for using American Express, Discover Card, MasterCard, 

Visa, check, or money order. Call for additional information.

Connect with GAO on Facebook, Flickr, LinkedIn, Twitter, and YouTube.

Subscribe to our RSS Feeds or E-mail Updates. Listen to our Podcasts.

Visit GAO on the web at www.gao.gov and read The Watchblog.

Contact:

Website: http://www.gao.gov/fraudnet/fraudnet.htm

E-mail: fraudnet@gao.gov

Automated answering system: (800) 424-5454 or (202) 512-7470

Katherine Siggerud, Managing Director, siggerudk@gao.gov, (202) 512-4400, 

U.S. Government Accountability Office, 441 G Street NW, Room 7125, 

Washington, DC 20548

Chuck Young, Managing Director, youngc1@gao.gov, (202) 512-4800

U.S. Government Accountability Office, 441 G Street NW, Room 7149 

Washington, DC 20548

James-Christian Blockwood, Managing Director, spel@gao.gov, (202) 512-4707

U.S. Government Accountability Office, 441 G Street NW, Room 7814, 

Washington, DC 20548

GAO’s Mission

Obtaining Copies of 

GAO Reports and 

Testimony

Order by Phone

Connect with GAO

To Report Fraud, 

Waste, and Abuse in 

Federal Programs

Congressional 

Relations

Public Affairs

Strategic Planning and 

External Liaison

Please Print on Recycled Paper.