DEPARTMENT OF 

ENERGY

Use of Leading 

Practices Could Help 

Manage the Risk of 

Fraud and Other 

Improper Payments

Report to the Ranking Member, 

Committee on Homeland Security and 

Governmental Affairs, U.S. Senate

March 2017

GAO-17-235

United States Government Accountability Office
United States Government Accountability Office

Highlights of GAO-17-235, a report to the

Ranking Member, Committee on Homeland 

Security and Governmental Affairs, 

U.S. Senate

March 2017

DEPARTMENT OF ENERGY

Use of Leading Practices Could Help Manage the Risk 

of Fraud and Other Improper Payments

What GAO Found

The Department of Energy (DOE) manages the risk of fraud and improper 

payments through its internal controls program, which includes, among other 

things, prepayment invoice reviews and post payment audits. However, several 

challenges limit the effectiveness of this approach. For example, DOE does not 

have a department-wide invoice review policy or well-documented procedures at 

five of the six sites with invoice review responsibilities. Consequently, DOE has 

no assurance that control activities at these sites are operating as intended. 

Time constraints also limit the effectiveness of invoice reviews. For example, 

some invoices can have numerous associated transactions and the reviews must 

be completed within a limited time frame before payment, which may be as short 

as 10 days. 

DOE’s approach to managing fraud risk does not incorporate leading practices

such as creating a dedicated antifraud entity to lead fraud risk management 

activities; conducting regular fraud risk assessments that are tailored to the 

program; developing and documenting a strategy to mitigate assessed fraud 

risks; or designing and implementing specific control activities, such as data

analytic activities, to prevent and detect fraud. By not implementing leading 

practices, DOE is missing an opportunity to organize and focus its resources in a 

way that would allow it to mitigate the likelihood and impact of fraud. Moreover, 

the Fraud Reduction and Data Analytics Act of 2015 establishes requirements 

aimed at improving federal agencies’ controls and procedures for assessing and 

mitigating fraud risks through the use of data analytics. The legislation also 

directs the Office of Management and Budget (OMB) to, among other things,

establish implementation guidelines that incorporate fraud risk management 

leading practices. DOE officials told GAO that they plan to meet the 

requirements of the act but should not be expected to implement private industry 

leading practices prior to the issuance of OMB guidance. Incorporating leading 

practices could also help DOE more effectively implement the act’s requirements 

once OMB guidance is available. 

It is not possible to fully employ data analytics as a tool to identify potential 

indicators of fraud or other improper payments at DOE because of limitations in 

contractor-maintained cost data. Much of the cost data maintained by the two 

DOE contractors GAO selected for data analytic purposes could not be used 

because these data did not include a complete universe of transactions that was

reconcilable with amounts billed to DOE or did not contain details necessary to 

determine the nature of costs charged to DOE. Because DOE does not require 

its contractors to maintain sufficiently detailed transaction-level cost data that are 

reconcilable with amounts charged to DOE, it is not well positioned to employ 

data analytics as a fraud detection tool. Effective fraud risk managers collect and 

analyze data and identify fraud trends and use them to improve fraud risk 

management activities, according to leading practices that GAO has previously 

identified. Without the detailed data necessary to conduct such analysis, DOE is 

missing an opportunity to develop, refine, and improve its experience with data 

analytic tools and techniques, and better position itself to meet the requirements 

of the Fraud Reduction and Data Analytics Act.

View GAO-17-235. For more information, 

contact David C. Trimble at (202) 512-3841 or 

trimbled@gao.gov.

Why GAO Did This Study

Over the past decade, incidents of

fraud by DOE contractors have 

occurred. From 2003 through 2008, 

employees of one contractor at DOE’s

Hanford site in Washington state made 

hundreds of fraudulent purchases and 

solicited and received kickbacks. In 

another case, Hanford contractors 

agreed to pay a combined $125 million 

to settle disputed claims regarding 

federal dollars spent on nonnuclearcompliant parts. To help federal 

program managers combat fraud, in 

July 2015, GAO issued leading 

practices for managing fraud risks.

GAO was asked to review DOE’s 

processes, programs, and practices for 

managing its risk of fraud. This report 

examines (1) DOE’s approach to 

managing its risk of fraud and other 

improper payments and challenges, if 

any, that may limit the effectiveness of

this approach; (2) the extent to which 

DOE’s approach incorporates leading 

practices; and (3) the application of

data analytics in identifying potential

indicators of fraud or other improper 

payments associated with selected 

DOE contracts.

What GAO Recommends

GAO is making six recommendations, 

including that DOE establish invoice 

review policies and procedures,

employ leading practices such as data

analytics to help manage fraud risk,

and require that its contractors 

maintain sufficiently detailed cost data 

for reconciling with amounts charged.

DOE generally concurred with five of 

GAO’s six recommendations but did 

not agree to require contractors to 

maintain detailed data. GAO continues 

to believe that the recommendation is 

valid, as discussed in the report. 
Page i GAO-17-235 Department of Energy

Letter 1

Background 6

DOE Uses Cost-Surveillance Procedures to Manage Its Risk of 

Fraud and Other Improper Payments, but Challenges Limit the 

Effectiveness of This Approach 14

DOE Has Not Used Leading Practices to Manage Its Risk of 

Fraud and Other Improper Payments 22

Data Analytics Helped Identify Potentially Improper Charges, but 

Billions in Costs Could Not Be Analyzed Because Contractor 

Data Were Not Sufficiently Detailed 28

Conclusions 35

Recommendations for Executive Action 36

Agency Comments and Our Evaluation 38

Appendix I Scope and Methodology 42

Appendix II Details of Issues Identified with the Data Provided by the 

M&O Contractor 46

Appendix III Comments from the Department of Energy 49

Appendix IV Comments from the Department of Energy Office of 

Inspector General 54

Appendix V GAO Contact and Staff Acknowledgments 56

Table

Table 1: Procedures Used by Six Department of Energy Site 

Offices for Technical and Financial Reviews of Invoices 

from Non-M&O Contractors 17

Contents
Page ii GAO-17-235 Department of Energy

Figure

Figure 1: Costs Incurred by Two Contractors during Fiscal Years 

2013 through 2015 That Were Not Sufficiently Detailed 

for Data Analytics 30

Abbreviations

CFO Chief Financial Officer

DCAA Defense Contract Audit Agency

DOE Department of Energy

OIG Office of Inspector General

FAR Federal Acquisition Regulation

M&O management and operating

NNSA National Nuclear Security Administration

OMB Office of Management and Budget

This is a work of the U.S. government and is not subject to copyright protection in the 

United States. The published product may be reproduced and distributed in its entirety 

without further permission from GAO. However, because this work may contain 

copyrighted images or other material, permission from the copyright holder may be 

necessary if you wish to reproduce this material separately.
Page 1 GAO-17-235 Department of Energy

441 G St. N.W.

Washington, DC 20548

March 30, 2017

The Honorable Claire McCaskill

Ranking Member

Committee on Homeland Security and Governmental Affairs

United States Senate

Dear Senator McCaskill:

As the largest contracting agency in the federal government outside of the 

Department of Defense, the Department of Energy (DOE) relies primarily 

on contractors to carry out its diverse missions and operate its 

laboratories and other facilities, spending approximately 90 percent of its 

annual budget of $27 billion on contracts and major capital asset projects 

(i.e., those with an estimated cost of $750 million or more). DOE’s history 

of inadequate management and oversight of its contractors led us in 1990 

to designate DOE’s contract management, including both contract 

administration and project management, as a high-risk area vulnerable to 

fraud, waste, abuse, and mismanagement. In our 2013 High-Risk Update, 

to acknowledge progress DOE had made in managing nonmajor projects 

(i.e., those costing less than $750 million), we narrowed the focus of 

DOE’s high-risk designation to major contracts and projects but noted that 

we would continue to monitor nonmajor projects to ensure that progress 

in this area was sustained.1

Improper payments, which include fraudulent payments, are a significant 

problem in the federal government, and over the past decade, there have 

been a number of high-profile incidents involving fraudulent activity by 

contractors at DOE.2 For example, from 2003 through 2008, contractor 

employees at DOE’s Hanford site in Washington State made hundreds of 

fraudulent purchases using government purchase cards and solicited, 

 1

GAO, High-Risk Series: An Update, GAO-13-283 (Washington, D.C.: February 2013). 

2

An improper payment is defined as any payment that should not have been made or that 

was made in an incorrect amount (including overpayments and underpayments) under 

statutory, contractual, administrative, or other legally applicable requirements. It includes 

any payment to an ineligible recipient, any payment for an ineligible good or service, any 

duplicate payment, any payment for a good or service not received (except for such 

payments where authorized by law), and any payment that does not account for credit for 

applicable discounts. 

Letter
Page 2 GAO-17-235 Department of Energy

received, and accepted kickbacks.3 In this case, the contractor had been 

alerted to weaknesses in its purchase card controls but failed to address 

these weaknesses. In addition, the DOE Office of Inspector General 

(OIG) has reported on numerous cases of fraud, including a case in which 

a subcontractor and former state grants administrator conspired to submit 

fraudulent documents and make false claims to obtain approximately $2 

million in funds DOE had received under the 2009 American Recovery 

and Reinvestment Act.4 More recently, in November 2016, DOE 

contractors responsible for designing and constructing the Hanford Waste 

Treatment Plant in Richland, Washington, agreed to pay a combined 

$125 million to settle part of a lawsuit alleging, among other things, that 

the contractors failed to comply with the nuclear quality requirements of 

the Waste Treatment Plant contract in connection with the procurement, 

fabrication, and installation of certain of its components. The settlement 

also covers claims that one contractor improperly used federal funds for 

lobbying purposes.5

To address the problem of improper payments, legislation enacted since 

2002 requires, among other things, that federal agencies review their 

programs and identify those that are susceptible to significant improper 

payments—a process known as risk assessment.6 In December 2014, we 

 3

In 2011 the contractor agreed to pay the United States $4 million to resolve allegations 

that it knowingly submitted false claims and paid and received kickbacks. Between 2003 

and 2008, three contractor employees made hundreds of fraudulent purchases using 

government purchase cards, using their positions and exploiting weaknesses in the 

contractor's internal control system to funnel DOE funds to themselves. Additionally, 

between 2005 and 2008, at least 14 contractor employees solicited, received and 

accepted kickbacks from a Hanford-area vendor. Texas-Based Fluor Corporation to Pay 

U.S. $4 Million to Resolve False Claims Act and Anti-Kickback Act Liability, Department of 

Justice press release (June 17, 2011), (https://www.justice.gov/opa/pr/texas-based-fluorcorporation-pay-us-4-million-resolve-false-claims-act-and-anti-kickback-act, last visited 

March 21, 2017).

4

The American Recovery and Reinvestment Act of 2009, Pub. L. No. 111-5 123 Stat.115 

(2009).

5

As part of the settlement, the contractors admitted no wrongdoing, and the United States 

did not concede that its claims were not well founded.

6

The Improper Payments Information Act of 2002, as amended by the Improper Payments 

Elimination and Recovery Act of 2010 and the Improper Payments Elimination and 

Recovery Improvement Act of 2012, requires federal executive-branch agencies to, 

among other activities, identify programs and activities that may be susceptible to 

significant improper payments, estimate the annual amount of improper payments for 

those programs and activities, and report on actions taken to reduce improper payments. 

Hereafter, we refer to these acts collectively as “improper payment legislation.”
Page 3 GAO-17-235 Department of Energy

found that DOE had developed a process to assess its programs’ risk of 

improper payments, but that the process was not followed by all DOE 

programs.7 For example, 26 of DOE’s 55 programs did not prepare risk 

assessments in 2011.8 DOE, nonetheless, reported that it did not have 

any programs susceptible to significant improper payments. We 

recommended that DOE take steps to improve its risk assessments, 

including revising guidance for its programs. DOE concurred with our 

recommendations and has taken some steps to improve its guidance for 

assessing its risk of improper payments.

While legislation has focused federal managers’ attention on addressing 

improper payments, including such payments made as a result of fraud, 

the deceptive nature of fraud makes it difficult to measure in a reliable 

way. In addition, standards for internal control in the federal government 

require managers to consider the potential for fraud when identifying, 

analyzing, and responding to risks.9 In July 2015, to help federal program 

managers combat fraud and ensure integrity in government agencies and 

programs, we issued A Framework for Managing Fraud Risks in Federal 

Programs.

10 In this guide, we identified leading practices for managing 

fraud risks and organized them into a conceptual framework called the 

Fraud Risk Framework. One of the leading practices we identified was the 

use of data analytics to prevent and detect fraud. Data analytics enable 

an organization to analyze transactional data to obtain insights into the 

operating effectiveness of internal controls and to identify improper cost 

charges, potential indicators of fraud, or actual fraudulent payments or 

activities. In June 2016, Congress passed the Fraud Reduction and Data 

Analytics Act of 2015, which established requirements aimed at improving 

 7

GAO, Improper Payments: DOE’s Risk Assessments Should Be Strengthened,

GAO-15-36 (Washington, D.C.: Dec. 23, 2014).

8

Agencies were required to conduct improper payments risk assessments for all federal 

programs in fiscal year 2011, and at least once every 3 years thereafter for programs and 

activities deemed not susceptible to significant improper payments.

9

GAO, Standards for Internal Control in the Federal Government, GAO-14-704G 

(Washington, D.C.: September 2014). See Principle 8, “Assess Fraud Risks.” The 2014 

version of the federal internal control standards went into effect beginning with fiscal year 

2016 (Oct. 1, 2015). The Committee of Sponsoring Organizations of the Treadway 

Commission updated its internal control guidance in 2013 with the issuance of a revised 

Internal Control—Integrated Framework. The federal internal control standards adapted 

principles in this guidance for the government environment.

10GAO, A Framework for Managing Fraud Risks in Federal Programs, GAO-15-593SP 

(Washington, D.C.: July 28, 2015).
Page 4 GAO-17-235 Department of Energy

federal agencies’ controls and procedures for assessing and mitigating 

fraud risks and capabilities to identify, prevent, and respond to fraud, 

including improper payments, through the development and use of data 

analytics. Furthermore, this legislation directed the Office of Management 

and Budget (OMB) to, among other things, establish guidelines for 

agencies for implementing control activities to prevent, detect, and 

respond to fraud, including improper payments; these guidelines are to 

incorporate the leading practices identified in the Fraud Risk Framework.

You requested that we review DOE’s processes, programs, and practices 

for managing its risk of fraud. This report examines (1) DOE’s approach 

to managing its risk of fraud and other improper payments and 

challenges, if any, that may limit the effectiveness of this approach; (2) 

the extent to which DOE’s approach incorporates leading practices, such 

as the use of data analytics; and (3) the application of data analytics in 

identifying potential indicators of fraud or other improper payments 

associated with selected DOE contracts.

To examine DOE’s approach to managing its risk of fraud and other 

improper payments, as well as any challenges that may affect the 

effectiveness of this approach, we reviewed federal requirements and 

DOE regulations, directives, and guidance for internal controls over 

financial and accounting operations and for contractor oversight. In 

addition, we interviewed DOE officials from headquarters organizations, 

including the Office of the Chief Financial Officer (CFO), the Office of the 

Chief Risk Officer, and the Office of Inspector General (OIG). We 

interviewed DOE’s field CFOs and contracting officers at 10 DOE site 

offices and DOE’s contractors at each site, and we determined that 6 of 

those sites oversaw at least one non-M&O contractor. In addition, we 

collected DOE policies and procedures for oversight and review of 

contractor costs from each site office. We reviewed and analyzed DOE 

and contractor responses and information provided through the interview 

process. We visited DOE’s Hanford office in Richland, Washington, and 

the National Nuclear Security Administration’s (NNSA) Office of Financial 

Performance in Albuquerque, New Mexico, to gain an in-depth 

understanding of the local DOE processes for oversight of contractors’

costs.11

 11Established by the National Defense Authorization Act for Fiscal Year 2000, NNSA is a 

separate, semi-autonomous agency within DOE with responsibility for the United States’

nuclear weapons and nonproliferation programs, among other things.
Page 5 GAO-17-235 Department of Energy

To examine the extent to which DOE’s approach incorporates leading 

practices, we reviewed the standards and guidance of the Institute of 

Internal Auditors and our Fraud Risk Framework to identify leading 

practices for managing the risk of fraud and improper payments in the 

federal government,12 and we compared DOE’s policies and procedures 

with selected leading practices. To ensure that we had a cross section of 

leading practices, we selected at least one leading practice from each of 

the following components of the Fraud Risk Framework: commit to 

combating fraud, assess fraud risk, and design and implement a strategy 

for mitigating risk. The leading practices we selected from each 

component were chosen because the use of these practices could be 

objectively verified.

To examine the application of data analytics in identifying potential 

indicators of fraud or other improper payments for selected DOE 

contracts, we selected data from Sandia Corporation, the management 

and operating (M&O) contractor responsible for managing and operating 

Sandia National Laboratories, and Bechtel National, Inc., the non-M&O 

contractor responsible for the design and construction of the Waste 

Treatment Plant at DOE’s Hanford site, for transaction-level cost data for 

fiscal years 2013 through 2015. We selected these contractors for indepth review based on type of contractor (M&O and non-M&O), contract 

size in dollars, and geographic location (for ease of access to contractor 

data).To assess the reliability of the data we obtained, we interviewed 

DOE officials responsible for the data to understand how the data were 

maintained and performed data testing, including checking totals in the 

data against control totals provided by DOE, and examining, among other 

things, outliers and missing data. We found the data to be sufficiently 

reliable for the purposes of our engagement.

We conducted this performance audit from June 2015 to March 2017 in 

accordance with generally accepted government auditing standards. 

Those standards require that we plan and perform the audit to obtain 

sufficient, appropriate evidence to provide a reasonable basis for our 

findings and conclusions based on our audit objectives. We believe that 

the evidence obtained provides a reasonable basis for our findings and 

conclusions based on our audit objectives.

 12Established in 1941, the Institute of Internal Auditors is an international professional 

association whose members generally work in internal auditing, risk management, 

governance, internal control, information technology audit, education, and security. 

Globally, the Institute has more than 185,000 members. 
Page 6 GAO-17-235 Department of Energy

This section discusses DOE’s use of M&O and non-M&O contracts, costreimbursement contracts and cost-surveillance procedures, DOE 

headquarters and field office responsibilities for cost-surveillance and 

financial management policies and activities, leading practices for 

managing the risk of fraud and other improper payments, and data 

analytic tools and techniques to prevent and detect fraud.

Since the Manhattan Project produced the first atomic bomb during World 

War II, DOE and its predecessor agencies have depended on the 

expertise of private firms, universities, and others with the scientific, 

manufacturing, and engineering expertise needed to carry out research 

and development work and manage the government-owned, contractoroperated facilities where the bulk of the department’s mission activities 

are carried out. DOE relies on contracts in general, and M&O contracts in 

particular, to do much of this work.13

The Federal Acquisition Regulation (FAR) authorizes DOE and other 

agencies with sufficient statutory authority and the need for contracts to 

manage and operate their facilities to use the M&O form of contract, but, 

according to DOE, it is the only agency using such contracts. An M&O 

contract is characterized both by its purpose and by the special 

relationship it creates between government and contractor. For example, 

the FAR recognizes that because of the nature of M&O contract work, or 

because it is to be performed in government facilities, the government 

must maintain special, close relationships with its M&O contractors and 

the contractors’ personnel in various important areas (e.g., safety, 

security, cost control, and site conditions).

DOE’s use of M&O contracts has changed over time. Beginning in the 

1990s, DOE undertook a detailed review of the then-existing M&O 

contracts to determine if the mission requirements remained appropriate 

for using such contracts. As a result of that review, DOE reduced the 

number of M&O contracts from approximately 52 to 29 and began using 

more non-M&O contracts, particularly for its environmental management 

activities and for some large capital asset construction projects. Although 

 13M&O contracts are agreements under which the government contracts for the operation, 

maintenance, or support, on its behalf, of a government-owned or -controlled research, 

development, special production, or testing establishment wholly or principally devoted to 

one or more of the major programs of the contracting federal agency. Federal Acquisition 

Regulation, 48 C.F.R. § 17.601.

Background

DOE’s Use of M&O and 

Non-M&O Contracts
Page 7 GAO-17-235 Department of Energy

DOE uses fewer M&O contracts today than it did in the 1990s, they 

remain the primary contract form it uses, in terms of contract spending. In 

fiscal year 2015, for example, DOE had almost 6,700 non-M&O contracts 

and 22 M&O contracts. That year, DOE spent almost $19 billion on its 

M&O contracts—three-quarters of its total $25 billion in spending.14

Regardless of the contract form used—M&O or non-M&O—the majority of 

DOE’s contracts are cost-reimbursement contracts.15 Under costreimbursement contracts, the government primarily pays the contractor’s 

allowable costs incurred, rather than paying for the delivery of an end 

product or service; the government also pays a fee that is either fixed at 

the outset of the contract or adjustable based on objective or subjective 

performance criteria set out in the contract. This type of contract is 

considered high risk for the government because the primary risk of cost 

overruns is placed on the government. Cost-reimbursement contracts 

also require significantly more government oversight than do fixed-price 

contracts. For example, for cost-reimbursement contracts, the 

government must determine that the contractor’s accounting system is 

adequate for determining costs related to the contract and update this 

determination periodically. In addition, the government needs to monitor 

contractor costs—known as cost surveillance—to provide reasonable 

assurance that the contractor is using efficient methods and effective cost 

controls.16

By employing cost-surveillance procedures under cost-reimbursement 

contracts, the government can help ensure that the contractor is 

performing efficiently and effectively and that the government pays only 

for allowable, allocable, and reasonable costs applicable to the contract. 

As we reported in September 2009, federal agencies use a range of 

 14The amount spent generally includes funds from DOE as well as from non-DOE 

customers. Work for non-DOE customers averages about $3 billion per year, according to 

DOE. 

15Federal agencies can choose among a number of different types of contracts to procure 

goods and services, including fixed-price, time-and-materials, and cost-reimbursement 

contracts. Under a fixed-price contract, the government pays a fixed price to the contractor 

even if the actual total cost of a product or service falls short of or exceeds the contract 

price. The government may also pay an award or incentive fee related to performance.

16Unless specifically noted otherwise, all references in this report to contracts are to costreimbursement contracts.

Cost-Reimbursement 

Contracts and CostSurveillance Procedures
Page 8 GAO-17-235 Department of Energy

procedures for monitoring contractor cost controls.17 The procedures 

generally used by the civilian agencies we reviewed called for invoice 

reviews. Invoice reviews help to ensure that the goods and services for 

which the government is being billed were actually received, that the 

amounts billed are allowable, and that the government is not incurring 

costs that are inadequately supported. In addition, some agencies 

followed alternative procedures for monitoring costs and supplemented 

their cost monitoring with audits for the purpose of testing whether 

invoiced costs are allowable—known as incurred cost audits.

The responsibility for establishing policies and performing costsurveillance activities is split between DOE headquarters and field offices. 

The following DOE headquarters offices are responsible for establishing 

department-wide policies and guidance related to cost surveillance and 

financial management.

• DOE’s Office of Acquisition Management is responsible for 

establishing procurement-related policies and guidance.18 Among 

other things, the office is responsible for establishing cost-surveillance 

policies and guidance that help ensure that DOE pays only for 

allowable, allocable, and reasonable costs applicable to the contract. 

This includes updates to the DOE FAR Supplement (Department of 

Energy Acquisition Regulation), DOE Acquisition Letters, DOE 

procurement related Orders and Directives, and DOE’s Acquisition 

Guide.19

 17GAO, Contract Management: Extent of Federal Spending on Cost-Reimbursement 

Contracts Unclear and Key Controls Not Always Used, GAO-09-921 (Washington, D.C.: 

Sept. 30, 2009).

18The FAR establishes uniform policies and procedures for acquisition by all executive 

agencies. Agencies may issue acquisition regulations that implement or supplement the 

FAR.

19Regulatory requirements for the acquisition process are set forth in the FAR and are 

supplemented in the Department of Energy Acquisition Regulation. FAR 1.301 provides 

for the issuance of additional internal agency guidance, including designations and 

delegations of authority, assignments of responsibilities, work flow procedures, and 

internal reporting requirements. The DOE Acquisition Guide serves this purpose by 

identifying relevant internal standard operating procedures to be followed by both 

procurement and program personnel who are involved in various aspects of the 

acquisition process. The Guide also is intended to be a repository of best practices found 

throughout the agency that reflect specific techniques that might be helpful to all readers. 

Additionally, the Guide includes subject matter that was issued previously through other 

media, such as Acquisition Letters.

DOE Headquarters and 

Field Office 

Responsibilities for 

Financial Management 

and Cost-Surveillance 

Policies and Activities
Page 9 GAO-17-235 Department of Energy

• According to DOE Order 520.1A, DOE’s Office of the CFO is 

responsible for establishing, maintaining, and interpreting policy and

general procedures for accounting and related reporting.20 In addition, 

the Office of the CFO is responsible for establishing policies and 

guidance for assessing DOE’s internal controls over contractor 

payments and assessing the risk of fraud and improper payments.

Procurement and financial management components at DOE’s field 

offices are responsible for overseeing DOE contractors to include carrying 

out cost-surveillance and financial management activities. These include 

the following officials:

• DOE contracting officers are responsible for, among other things, 

determining the allowability of costs incurred by contractors under 

cost-reimbursement contracts. They are also responsible for ensuring 

that contract invoices are properly reviewed and analyzed before 

payment. In exercising this responsibility, a contracting officer may 

designate other qualified personnel to be the contracting officer’s 

representative for the purpose of performing certain technical 

functions in administering a contract, including conducting invoice 

reviews.

• DOE’s field office CFOs, in cooperation with DOE contracting officers 

and other field office staff, are responsible for overseeing contactor 

costs and conducting other financial management activities, such as 

internal control and improper payment risk assessments. For 

example, invoice reviews require close coordination among the 

contracting officer, contracting officer’s representatives, and the field 

CFO.

 20Department of Energy, Chief Financial Officer Responsibilities, DOE Order 520.1A

(Washington, D.C.: Nov. 21, 2006). 
Page 10 GAO-17-235 Department of Energy

In September 2014, we issued revised federal internal control standards 

that went into effect at the start of fiscal year 2016.21 These revised 

standards, along with our Fraud Risk Framework,22 OMB guidance,23 and 

the Fraud Reduction and Data Analytics Act of 201524 have placed an 

increased focus on the need for federal program managers to take a 

strategic approach to managing improper payments and risks, including 

fraud risk.

Our Fraud Risk Framework provides comprehensive guidance for 

conducting fraud risk assessments and using the results as part of the 

development of a robust antifraud strategy. It also describes concepts 

and leading practices for establishing an organizational structure and 

culture that are conducive to fraud risk management, designing and 

implementing controls to prevent and detect potential fraud, and 

monitoring and evaluating fraud risk management activities.25 The leading 

practices described in the Fraud Risk Framework are meant to provide 

additional guidance for implementing requirements contained in federal 

internal control standards and OMB circulars. Our Fraud Risk Framework 

also states that practices in the Framework are not necessarily meant to 

be sequential or interpreted as a step-by-step process.

The Fraud Risk Framework consists of the following four components:

• Commit. Commit to combating fraud by creating an organizational 

culture and structure conducive to fraud risk management.

 21GAO-14-704G.

22GAO-15-593SP.

23OMB issues guidance in the form of OMB circulars. OMB Circular No. A-123 defines 

management’s responsibility for internal control in federal agencies. Office of Management 

and Budget, Management’s Responsibility for Enterprise Risk Management and Internal 

Control, OMB Circular No. A-123 (Washington, D.C.: July 15, 2016).

24The act requires agencies to conduct an evaluation of fraud risks and, using a riskbased approach, to design and implement financial and administrative control activities to 

mitigate identified fraud risks; collect and analyze data from reporting mechanisms on 

detected fraud to monitor fraud trends and use those data and information to continuously 

improve fraud prevention controls; and use the results of monitoring, evaluation, audits, 

and investigations to improve fraud prevention, detection, and response.

25The Fraud Risk Framework is consistent with the leading practices in the standards and 

guidance of the Institute of Internal Auditors. Therefore, in this report, we refer to both the 

Fraud Risk Framework’s concepts and leading practices as leading practices. 

Leading Practices for 

Managing the Risk of 

Fraud and Other Improper 

Payments
Page 11 GAO-17-235 Department of Energy

• Assess. Plan regular fraud risk assessments and assess risks to 

determine a fraud risk profile.

• Design and implement. Design and implement a strategy with 

specific control activities to mitigate assessed fraud risks and 

collaborate to help ensure effective implementation.

• Evaluate and adapt. Evaluate outcomes using a risk-based approach 

and adapt activities to improve fraud risk management.

Each component includes overarching fraud risk management concepts 

and leading practices for carrying out the concepts. These concepts 

include creating a structure with a dedicated entity to lead fraud risk 

management activities; conducting regular fraud risk assessments that 

are tailored to the program to determine the program’s fraud risk profile; 

design and implement a strategy to mitigate assessed fraud risks; and 

designing and implementing specific control activities, such as data 

analytic activities, to prevent and detect fraud. Leading practices for 

carrying out the concepts include:

• Designated antifraud entity. A designated entity to design and 

oversee fraud risk management activities serves as the repository of 

knowledge on fraud risks and controls, manages the fraud risk 

assessment process, and leads or assists with training and other 

fraud awareness activities. The dedicated entity could be an individual 

or a team, depending on the needs of the agency.

• Tailored fraud risk assessments and profiles. An effective 

antifraud entity tailors the approach for carrying out fraud risk 

assessments to the program. More specifically, antifraud entities that 

effectively plan fraud risk assessments identify specific tools, 

methods, and sources for gathering information about fraud risks. This 

information includes data on fraud schemes and trends from 

monitoring and detection activities. This approach allows the agency 

to develop a fraud risk profile that fully considers the specific fraud 

risks the agency or program faces, analyze the potential likelihood 

and impact of fraud schemes, and then ultimately document prioritized 

fraud risks.

• Develop and document an antifraud strategy. Managers who 

effectively manage fraud risks develop and document an antifraud 

strategy that describes the program’s activities for preventing, 

detecting, and responding to fraud.

• Data analytic activities. Data analytic activities can include a variety 

of techniques. For example, data matching and data mining 

techniques can enable programs to identify potential fraud or improper 
Page 12 GAO-17-235 Department of Energy

payments that have already been awarded, thus assisting programs in 

recovering these dollars, and predictive analytics can identify potential 

fraud before payments are made.26

• Fraud awareness initiatives. Increasing managers’ and employees’

awareness of potential fraud schemes through training and education 

can serve a preventive purpose by helping to create a culture of 

integrity and compliance within the program. Further, increasing fraud 

awareness can enable managers and employees to better detect 

potential fraud. In addition, increasing fraud awareness through 

training and education of external stakeholders, such as contractors, 

can help prevent and deter fraud.

Our Fraud Risk Framework incorporates long-standing industry practices 

related to the use of data analytics. In addition to the information included 

in the Fraud Risk Framework, the Institute of Internal Auditors, the 

American Institute of Certified Public Accountants,27 and the Association 

of Certified Fraud Examiners28 have issued practice guides and other 

materials that explain how data analytics can be used to help manage 

fraud risk.29 Selected information from these guides is discussed below.

According to the Institute of Internal Auditors, data analytics enables an 

organization to analyze transactional data to obtain insights into the 

 26Data matching is a process in which information from one source is compared with 

information from another, such as government and third-party databases, to identify any 

inconsistencies. Data mining involves analyzing data for relationships that have not 

previously been discovered. Predictive analytics technologies include a variety of 

automated systems and tools that can be used to identify particular types of behavior, 

including potential fraud, before transactions are completed.

27The American Institute of Certified Public Accountants is the world’s largest member 

association representing the accounting profession, with more than 418,000 members in 

143 countries and a history of serving the public interest since 1887. The organization sets 

ethical standards for the profession and U.S. auditing standards for private companies; 

nonprofit organizations; and federal, state, and local governments.

28According to its website, the Association of Certified Fraud Examiners is the world’s 

largest antifraud organization and premier provider of antifraud training education and 

certification.

29For instance, Institute of Internal Auditors, Internal Auditing and Fraud (Altamonte 

Springs, Florida: Dec. 2009); Institute of Internal Auditors, Fraud Prevention and Detection 

in an Automated World (Altamonte Springs, Florida: Dec. 2009); and Institute of Internal 

Auditors, American Institute of Certified Public Accountants, and Association of Certified 

Fraud Examiners, Managing the Business Risk of Fraud: A Practical Guide (Austin, 

Texas: n.d.). 

Data Analytic Tools and 

Techniques to Prevent and 

Detect Fraud
Page 13 GAO-17-235 Department of Energy

operating effectiveness of internal controls and to identify indicators of 

improper cost charges, fraud risk or actual fraudulent activities. In 

addition, because automated checks are less labor-intensive than 

traditional control mechanisms, such as manual checks, automating data 

analytic tests can allow managers to monitor large amounts of data more 

efficiently. Data analytics is used to identify activities or transactions that 

deviate from expected patterns. It can be used, for example, to review 

payroll records for fictitious employees or accounts payable transactions 

for duplicate invoices. The tools and techniques used may vary and range 

from simple data mining techniques, such as sorting and filtering, to using 

sophisticated algorithms to analyze multiple data sets. Examples of the 

type of data analytic tests that can be performed include the following.

• Calculation of statistical parameters (e.g., averages, standard 

deviations, highest and lowest values)—to identify outlying 

transactions that could be indicative of fraudulent activity.

• Classification—to find patterns and associations among groups of 

data elements.

• Stratification of numeric values—to identify unusual (i.e., excessively 

high or low) values.

• Joining different data sources—to identify inappropriately matching 

values, such as names, addresses, and account numbers in disparate 

systems.

• Duplicate testing—to identify simple and/or complex duplications of 

business transactions, such as payments, payroll, claims, or expense 

report line items.

• Gap testing—to identify missing numbers in sequential data.

• Validating data entry dates—to identify postings or data entry times 

that are inappropriate or suspicious.

According to the Institute of Internal Auditors, for fraud detection data 

analytics programs to be effective, the fraud detection techniques listed 

above must be performed against full data populations. Although the use 

of sampling data is a valid and effective audit approach, it is not 

necessarily appropriate for fraud detection purposes. When only partial 

data are analyzed, it is likely that a number of control breaches and 

suspicious transactions will be missed, the impact of control failures may 

not be quantified fully, and smaller anomalies may be overlooked. It is 

often these small anomalies that point to weaknesses that can be 

exploited, causing a material breach. Analyzing the data against full data 

populations provides a more complete picture of potential anomalies. 
Page 14 GAO-17-235 Department of Energy

Random sampling is most effective for identifying problems that are 

relatively consistent throughout the data population; fraudulent 

transactions, by nature, do not occur randomly.

DOE uses prepayment invoice reviews to monitor the costs of non-M&O 

contracts but has shortcomings in its control activities at the six site 

offices that oversee them, as well as resource challenges that limit the 

effectiveness of these reviews. DOE uses post payment incurred cost 

audits to detect fraud and other improper payments for both its M&O and 

non-M&O contracts, but resource constraints and other challenges limit 

the audits’ effectiveness.

DOE uses prepayment invoice reviews to monitor non-M&O contract 

costs. Under such reviews, non-M&O contractors submit invoices to DOE 

for items delivered or services performed before the contractors receive 

payment.30 Invoice reviews help to ensure that the goods and services for 

which the government is being billed were actually received, the amounts 

billed are allowable, and the government is not incurring claimed costs 

that are inadequately supported. DOE contracting officers are responsible 

for ensuring that contract invoices are properly reviewed and analyzed 

prior to payment. In exercising this responsibility, contracting officers may 

delegate invoice review and analysis functions to other government 

personnel, such as technical and financial representatives. For the six 

DOE sites that oversee non-M&O contractors, invoice reviews generally 

included a technical review—to ensure that the costs billed were for 

services performed or goods delivered—and a financial review—to 

ensure that the costs billed conformed with the terms of the contract.

However, the control activities at the six site offices that oversee nonM&O contracts have limitations. Specifically, DOE does not have a 

department-wide invoice review policy or well-documented procedures at 

 30Contract terms and conditions spell out the specific instructions to contractors for 

submitting and substantiating their invoices.

DOE Uses CostSurveillance 

Procedures to 

Manage Its Risk of 

Fraud and Other 

Improper Payments, 

but Challenges Limit 

the Effectiveness of 

This Approach

DOE Uses Prepayment 

Invoice Reviews to 

Monitor Non-M&O 

Contract Costs, but 

Shortcomings in Its 

Control Activities and 

Resource Challenges 

Limit the Effectiveness of 

These Reviews
Page 15 GAO-17-235 Department of Energy

most of these site offices, and DOE officials face challenges in reviewing 

invoices prior to payment.

According to federal internal control standards, management should 

implement control activities through policies.31 However, officials with the 

Office of the CFO at DOE headquarters told us that DOE does not have 

department-wide invoice review policies and procedures. Instead, 

according to these officials, field CFOs and contracting officials are 

responsible for developing appropriate invoice review policies and 

procedures. Headquarters CFO officials said that they provide tools and 

guidance to field CFOs for things such as assessing internal controls and 

contractors’ accounting and purchasing systems, but they do not 

prescribe or assess payment procedures at DOE field offices. Similarly, 

DOE’s Office of Acquisition Management has issued invoice review 

guidance but does not prescribe specific policies and procedures. 

Specifically, DOE’s Acquisition Guide contains a chapter on contract 

financing that discusses reviewing and approving invoices. The guide 

states, for example, that prior to payment the responsible approving 

official must, among other things, ensure that

• all invoiced costs are allowable and allocable to the contract,

• items or services included on previously paid invoices are not also 

included on the current invoice,

• labor hours are billed at appropriate rates, and

• all other direct costs have been properly substantiated and are 

consistent with the requirements in the contract.

According to DOE’s Acquisition Guide, however, these are general 

guiding principles for approving officials to consider when reviewing and 

analyzing cost elements included in contract invoices; they are not 

intended to repeat or conflict with local procedures. Unlike other chapters 

of the guide that contain relevant internal standard operating procedures 

to be followed by both procurement and program personnel, the invoice 

review and approval discussion is not considered an operating procedure, 

according to DOE’s Acquisition Guide. Moreover, our analysis of the 

invoice review and approval discussion contained in DOE’s Acquisition 

Guide found that it does not contain the detail necessary to serve as an 

operating procedure.

 31GAO-14-704G, Principle 12.

DOE Does Not Have a 

Department-Wide Invoice 

Review Policy, and Invoice 

Review Procedures Are Not 

Well-Documented at Most 

Sites
Page 16 GAO-17-235 Department of Energy

We have reported previously on DOE’s invoice review policies and 

procedures at one of DOE’s largest clean-up sites.32 Specifically, in July 

2007 we found that DOE’s Hanford Office was not adequately reviewing 

invoices for a multibillion-dollar cost-reimbursement contract to design 

and construct the Hanford Waste Treatment Plant, risking hundreds of 

millions of dollars in improper payments. Instead, DOE relied primarily on 

the Defense Contract Audit Agency (DCAA), an independent third party 

that has traditionally been the primary auditor for non-M&O contracts, to 

review and approve the contractor’s financial systems and relied on the 

contractor’s review and approval of subcontractor charges. DOE’s heavy 

reliance on others, with little oversight of its own, exposed the hundreds 

of millions of dollars it spent annually on the Waste Treatment Plant to an 

unnecessarily high risk of improper payments. Our July 2007 report 

recommended, among other things, that DOE perform an assessment of 

the risks associated with contract payments and establish appropriate 

policies and procedures for effective review and approval of the prime 

contractor’s invoices related to the Hanford Waste Treatment Plant. DOE 

agreed with the recommendation, and in 2007 the Hanford Office 

conducted a risk assessment and developed a revised invoice review 

policy that applies to contractor invoices that it reviews. However, it is not 

a department-wide policy.

In the absence of DOE-wide policy and procedures, the six sites reported 

following different procedures. As discussed previously, invoice reviews 

generally include a technical review—to ensure that the costs billed were 

for services performed or goods delivered—and a financial review—to 

ensure that the costs billed conform to the terms of the contract. On the 

basis of questionnaire responses and documents provided by each of the 

six sites responsible for reviewing non-M&O contractor invoices, we 

determined that the procedures sites used for the technical and financial 

reviews varied—with some sites reporting that they used locally 

developed, site-specific procedures and others reporting that they relied 

on the general guidance provided in DOE’s Acquisition Guide (see table 

1).

 32GAO, Hanford Waste Treatment Plant: Department of Energy Needs to Strengthen 

Controls over Contractor Payments and Project Assets, GAO-07-888 (Washington, D.C.: 

July 20, 2007).
Page 17 GAO-17-235 Department of Energy

Table 1: Procedures Used by Six Department of Energy Site Offices for Technical 

and Financial Reviews of Invoices from Non-M&O Contractors

Site offices that oversee nonM&O contractorsLocal procedures DOE Acquisition 

Guide procedures

Financial 

review

Technical 

review

Financial 

review

Technical 

review

Environmental Management 

Consolidated Business Center Y Y Y N

Hanford Office Y Y Y Y

Idaho Operations Office Y Y N Y

NNSA Office of Financial 

Performance N Y N N

Oak Ridge Office N N Y Y

Savannah River Operations 

Field Office N Y N Y

Source: GAO analysis of DOE site invoice review procedures. | GAO-17-235

In addition, on the basis of our review of site office policies and 

procedures, we determined that five of the six sites did not have welldocumented policies or procedures. According to federal internal control 

standards, management should implement control activities through 

policies and document them in the appropriate level of detail to allow 

management to effectively monitor the control activity. Federal internal 

control standards also state that effective documentation assists in 

management’s design of internal control by establishing and 

communicating the who, what, when, where, and why of internal control 

execution to personnel. However, only one site—the Hanford Office—had 

detailed, well-documented operating procedures. The invoice review 

procedures for this site, for example, specified the number of transactions 

to be reviewed and included step-by-step instructions for selecting the 

transactions and the transactions’ component items to be reviewed and 

verified. None of the other sites’ local procedures contained detailed 

instructions for conducting the reviews. That is, they did not contain the 

who, what, when, where, and why of internal control execution. Instead, 

the procedures included general statements such as “the financial 

reviewer is to perform the necessary financial responsibilities in 

determining the adequacy of contractor cost invoices” or “the level of 

review should be based on risk as determined by risk assessment” but 

did not provide any specific detail or steps on how to perform the reviews. 

Moreover, several sites referenced DOE’s Acquisition Guide as their 

invoice review policy or procedure. However, as discussed above, DOE’s 

Acquisition Guide does not contain the details necessary to be an 

operating procedure. Without a DOE-wide invoice review policy that 
Page 18 GAO-17-235 Department of Energy

requires sites to establish well-documented invoice review operating 

procedures, DOE management has no assurance that the six offices are 

effectively conducting invoice reviews or that this control activity is 

operating as intended.

Regarding the capacity and time officials have to devote to oversight 

duties, including invoice reviews, DOE faces significant challenges. 

According to a 2013 DOE Acquisition Workforce Study commissioned by 

DOE, insufficient capacity to properly administer contracts raises the risk 

of fraud, waste, and abuse, which could result in extra cost and delay.33

The core challenge facing DOE’s acquisition community, according to the 

study, is the pervasive lack of sufficient staffing in the majority of DOE 

field procurement offices. As we have reported previously, having the 

capacity to perform contractor oversight duties is an important criterion for 

demonstrating progress toward addressing DOE’s contract and project 

management challenges—an area we have designated as at high risk for 

fraud, waste, and abuse.34 Because contracting officers and their 

delegates play an important role in ensuring that the government makes 

payments to contractors only for goods and services received and 

accepted pursuant to contractual terms, these challenges also impact 

DOE’s ability to properly review contractor invoices.

DOE’s ability to perform comprehensive invoice reviews is also limited by 

the large number of transactions associated with individual invoices and 

the limited amount of time DOE has to submit payment after receipt of an 

invoice. For example, the contractor responsible for the design and 

construction of the Hanford Waste Treatment Plant submits biweekly 

invoices for $20 million or more that average over 10,000 transactions 

each. Upon receipt of the contractor’s invoice, according to the terms of 

the contract, DOE has 10 business days to submit its payment. 

Consequently, officials responsible for performing invoice reviews may 

not be able to determine, prior to payment, if the amounts billed to DOE 

are allowable. For example, a reviewing official at the Hanford site 

included a disclaimer on invoices he reviewed, stating that “the 

appropriateness of the invoiced costs could not be determined in the time 

allotted.”

 33Golden Key Group for the Department of Energy, DOE Acquisition Human Capital 

Staffing Model (Reston, VA: July 18, 2013).

34GAO, High-Risk Series: An Update, GAO-15-290 (Washington, D.C.: Feb. 11, 2015).

DOE Officials Face Challenges 

Reviewing Invoices Prior to 

Payment
Page 19 GAO-17-235 Department of Energy

Given the time constraints associated with prepayment review of invoices, 

DOE’s Hanford Office also selectively performs post payment invoice 

review; it is the only one of the six site offices to do so. Specifically, 

DOE’s Hanford Office selects a non-statistical sample of between 75 and 

100 invoiced transactions to review on a quarterly basis after the invoices 

have been paid, according to the site’s local procedures. Officials from 

the Hanford Office told us that the items sampled are selected based on 

risk and that risk is determined based on a variety of factors, such as the 

results of internal and external audits. Using this approach, the Hanford 

Office was able to select and review less than 1 percent of the 

contractor’s costs for fiscal years 2013 through 2015. DOE disallowed a 

total of $9,078 of the contractor’s invoiced costs as a result of these 

reviews.

For both its M&O and non-M&O contracts, DOE uses post payment 

incurred cost audits to detect fraud and other improper payments. 

However, resource constraints limit the effectiveness of these audits. For 

non-M&O contracts, DOE relies on DCAA to perform audits of 

contractors’ invoiced costs. However, resource issues and a backlog of 

audits at DCAA have resulted in audit delays.35 According to a 2015 DOE 

OIG report, some of DOE’s non-M&O contracts have not been audited in 

over 8 years.36 To try to address the DCAA audit backlog, DOE has used 

independent public accounting firms, expanded internal audit functions, 

and relied more heavily on invoice reviews and OIG audits and 

assessments. However, DOE’s OIG reported that these methods have 

not been completely effective and do not meet audit standards in some 

cases.

For the 22 M&O contracts DOE had in fiscal year 2015, which accounted 

for about 75 percent of DOE’s spending, DOE did not perform post 

payment reviews of contractor costs. We reported in August 2016 that 

DOE officials told us they were able to monitor the appropriateness of 

M&O contractors’ withdrawal of funds in near real time.37 DOE officials 

 35To address the long-standing backlog of DCAA audits, the fiscal year 2016 National 

Defense Authorization Act prohibits DCAA from providing nondefense audit support until 

DCAA addresses its backlog of Defense Department incurred cost audits.

36Department of Energy, Office of Inspector General, Special Report: Incurred Cost Audit 

Coverage of Non-Management and Operating Contractors, DOE/IG-0934 (Washington, 

D.C.: February 2015).

37GAO, Department of Energy: Actions Needed to Strengthen Acquisition Planning for 

Management and Operating Contracts, GAO-16-529 (Washington, D.C.: Aug. 9, 2016).

DOE Uses Post Payment 

Incurred Cost Audits for 

M&O and Non-M&O 

Contracts, but Resource 

Constraints and Other 

Challenges Limit Their 

Effectiveness
Page 20 GAO-17-235 Department of Energy

said that this was possible because M&O contractors are required to 

integrate their accounting systems with DOE’s accounts each month, 

which provides DOE with visibility into contractor accounts. However, with 

the exception of monitoring aggregate spending to ensure that costs do 

not exceed budgetary limits, DOE policies and procedures do not require 

that sites monitor M&O contractor withdrawals to determine the 

appropriateness of costs incurred by the contractor. Specifically, none of 

the cost-surveillance policies, procedures, or guidance used by DOE sites 

discusses real-time monitoring of contractor withdrawals. Moreover, there 

are logistical issues at some sites that make it unlikely that such 

monitoring is occurring on a routine basis. According to DOE officials, not 

all sites have direct access to or visibility into M&O contractors’ systems. 

For example, to monitor withdrawals, DOE officials at one site said that 

they would need to gain access to the contractor’s system by traveling to 

the contractor’s site to obtain information about specific cost transactions. 

In addition, DOE does not require M&O contractors to submit invoices 

before receiving payment and instead requires a “payments cleared 

financing arrangement,” which is the authority for contractors to draw 

funds directly from federal accounts to pay for contract performance. 

Under this arrangement, DOE does not use prepayment reviews to 

determine the appropriateness of M&O contract costs.

Moreover, for its M&O contracts, DOE does not use an independent third 

party to audit contractors’ costs and ensure that invoiced costs are 

allowable under the contract. Instead, incurred cost audits are performed 

by the M&O contractors’ internal audit staff under a process known as the 

“cooperative audit strategy.” Specifically, the M&O contractors’ internal 

audit organization is responsible for performing operational and financial 

audits, assessing the adequacy of management control systems, and 

conducting an audit of the M&O contractors’ incurred cost statements. In 

addition, M&O contractors are required to conduct or arrange for audits of 

their subcontractors when subcontracts are structured as cost 

reimbursement-type contracts, including time and materials and cost 

reimbursable subcontracts. According to the OIG’s audit manual, under 

the cooperative audit strategy, each year DOE’s OIG performs an 

assessment of incurred cost statements for the 10 M&O contractors that 

incurred and claimed the most costs that year. 38 For the remaining M&O 

contractors, the OIG performs assessments based on risk. If not 

 38Department of Energy, Office of Inspector General, Office of Audits, Audit Manual 

Release 8 (Washington, D.C.: Revised 2014).
Page 21 GAO-17-235 Department of Energy

considered high-risk, the OIG assesses the contractor at least once every 

four years. The OIG assessments, however, do not represent 

independent third-party audits. Although the OIG is an independent third 

party, according to the DOE OIG audit manual, cost statement work 

under the cooperative audit strategy is not an audit but instead follows

standards for review-level engagements, which are substantially less 

broad in scope.39 According to the OIG, the framework of the Cooperative 

Audit Strategy ensures the integrity and reliability of the review-level 

engagements by confirming the independence of the M&O internal audit 

organizations and through various oversite procedures. We did not 

perform work to substantiate the effectiveness of the OIG’s oversight 

procedures. 

DOE’s OIG has reported on the following challenges that impact the 

effectiveness of both M&O contractor cost audits and subcontractor 

audits.

• Regarding M&O contractor cost audits, a 2015 DOE OIG report noted 

delays in completing audits, and, in some cases, audits that did not 

comply with professional audit standards.40 For example, as of the 

end of fiscal year 2014, there were more than 22 open M&O 

contractor cost audits with a total of $1.1 billion in unresolved 

questioned contractor costs.

• Regarding subcontract audits, from 2010 to 2012, subcontracts 

valued in excess of $906 million had not been audited or were 

reviewed in a manner that did not meet audit standards, according to 

 39The DOE OIG’s assessments are to determine, for the period(s) covered by the cost 

statement(s), whether (1) the internal audit organization conducted cost allowability audits 

that complied with professional standards and could be relied upon, (2) the contractor 

conducted or arranged for audits of its subcontractors when costs incurred were a factor in 

determining the amount payable to a subcontractor, and (3) questioned costs and internal 

control weaknesses impacting allowable costs that were identified in prior audits and 

reviews have been adequately resolved. Government audit standards state that a review 

consists of sufficient testing to express a conclusion about whether any information came 

to the auditors’ attention on the basis of the work performed that indicates the subject 

matter is not based on the criteria. In contrast, an examination, or audit, consists of 

obtaining sufficient, appropriate evidence to express an opinion on whether the subject 

matter is based on (or in conformity with) the criteria in all material aspects. GAO, 

Government Auditing Standards, GAO-12-331G (Washington, D.C.: December 2011).

40DOE/IG-0934.
Page 22 GAO-17-235 Department of Energy

a 2013 OIG report.41 According to the report, the subcontract costs 

were not audited because the department did not ensure that its M&O 

contractors developed and implemented procedures to meet their 

contractual requirements.

As discussed previously, the Fraud Reduction and Data Analytics Act of 

2015 establishes requirements aimed at improving federal agencies’

controls and procedures for assessing and mitigating fraud risks and 

capabilities to identify, prevent, and respond to fraud, including improper 

payments, through the development and use of data analytics. 

Implementation of these requirements could help mitigate some of the 

resource challenges DOE is currently facing in overseeing payments to its 

contractors. DOE officials told us they plan to meet all requirements for 

managing the risk of fraud and improper payments, which should include 

requirements of the Fraud Reduction and Data Analytics Act of 2015.

DOE has not used leading practices in its approach to managing its risk 

of fraud and other improper payments. In particular, DOE has not (1) 

created a structure with a dedicated entity to lead fraud risk management 

activities; (2) conducted fraud risk assessments that are tailored to its 

programs in order to develop a fraud risk profile; (3) documented a 

strategy to mitigate assessed fraud risks; or (4) designed and 

implemented specific control activities, such as data analytics, to prevent 

and detect fraud and other improper payments.42 The Fraud Reduction 

and Data Analytics Act of 2015, which Congress passed in June 2016, 

establishes requirements aimed at improving federal agencies’ controls 

and procedures for assessing and mitigating fraud risks and directs OMB 

 41Specifically, the subcontract reviews did not meet audit standards for organizational 

independence and work paper preparation because they were performed by a nonaudit 

organization rather than an internal audit organization. The M&O internal audit function

subsequently examined these reviews and found that they were generally consistent with 

what would be done under generally accepted government auditing standards. 

Department of Energy, Office of Inspector General, Special Report Management and 

Operating Contractors’ Subcontract Audit Coverage, DOE/IG-0885 (Washington, D.C.: 

April 2013). 

42As discussed previously, our Fraud Risk Framework consists of four components—

commit, assess, design and implement, and evaluate and adapt—each of which includes 

overarching fraud risk management concepts and leading practices for carrying them out. 

After determining that DOE had not adopted fraud risk management activities that 

incorporated leading practices from the first three components, we did not assess whether 

DOE was evaluating and adapting its use of leading fraud risk management practices.

DOE Has Not Used 

Leading Practices to 

Manage Its Risk of 

Fraud and Other 

Improper Payments
Page 23 GAO-17-235 Department of Energy

to establish implementation guidelines that incorporate the leading 

practices identified in the Fraud Risk Framework.

We compared the following leading practices in the standards and 

guidance of the Institute of Internal Auditors and our Fraud Risk 

Framework with DOE’s policies and procedures.

• Dedicated entity to manage fraud risk. A leading practice for 

managing fraud risk and demonstrating management’s commitment to 

combating fraud is to designate an entity to design and oversee fraud 

risk management activities. DOE has not created a structure with a 

dedicated antifraud entity to lead fraud risk management activities. In 

August 2015, DOE established its first Chief Risk Officer to advance 

department-wide approaches to enterprise risk management, which 

may include fraud risk management. However, the Chief Risk Officer 

has a broad focus on general risks to the department, and the specific 

responsibilities of the position have yet to be defined. As a result, it is 

not clear whether the position will include leading practices related to 

an antifraud entity’s responsibilities, such as serving as the repository 

of knowledge on fraud risks and controls, managing the fraud risk 

assessment process, and leading or assisting with training and other 

fraud awareness activities.

• Fraud risk assessments and profile. According to our Fraud Risk 

Framework, an effective antifraud entity tailors the approach for 

carrying out regular fraud risk assessments to its programs. This 

allows the agency to develop a fraud risk profile that fully considers 

the specific fraud risks the agency or program faces, analyze the 

potential likelihood and impact of fraud schemes, and then ultimately 

document prioritized fraud risks. DOE has not conducted fraud risk 

assessments that are tailored to its programs and that would allow the 

department to create a fraud risk profile, which is considered a leading 

practice for managing the risk of fraud.43 In March 2016, DOE revised 

its internal control evaluation guidance with the stated purpose of

updating its focus on the identification of improper payment risks and 

fraud risks, among other things. According to DOE’s revised 

 43A program’s fraud risk profile is the end result of effectively assessing fraud risks, which 

involves documenting the key findings and conclusions from examining the suitability of 

existing fraud controls and prioritizing residual fraud risks, including the analysis of the 

types of internal and external fraud risks, their perceived likelihood and impact, managers’

risk tolerance, and the prioritization of risks. The fraud risk profile is an essential piece of 

an overall antifraud strategy and can inform the specific control activities managers design 

and implement. 
Page 24 GAO-17-235 Department of Energy

guidance, DOE updated its internal control assessment tools to allow 

its offices to identify and manage fraud risks.44 DOE provided us with 

a list of fraud risks that they had identified for fiscal year 2016 using 

the revised assessment tools. Examples of risks identified include 

statements such as “if costs are inaccurately reported, then 

mischarging could occur, impacting budgets and financial statements”

and “if requisitions are not approved by the appropriate personnel, 

then inappropriate purchases may be made.” DOE’s approach was 

not tailored to DOE programs; instead, it provided all sites with the 

same list of potential risks. According to our Fraud Risk Framework, 

an effective antifraud entity tailors the approach for carrying out fraud 

risk assessments to the program. More specifically, antifraud entities 

that effectively plan fraud risk assessments identify specific tools, 

methods, and sources for gathering information about fraud risks. This 

information includes data on fraud schemes and trends from 

monitoring and detection activities. Because DOE’s approach to 

assessing its fraud risk is not tailored to its programs, DOE is not 

positioned to determine each program’s fraud risk profile.

• Strategy to mitigate fraud risk. Managers who effectively manage 

fraud risk, according to our Fraud Risk Framework, develop and 

document an antifraud strategy that describes the program’s 

approach for addressing the prioritized fraud risks identified during the 

fraud risk assessment. An effective antifraud strategy describes the 

program’s activities for preventing, detecting, and responding to fraud. 

DOE has not developed or documented a DOE-wide antifraud 

strategy or directed individual programs to develop program-specific 

strategies, according to DOE officials. As discussed previously, 

federal internal control standards require managers to design a 

response to analyzed risks. Managers should consider the likelihood 

and impact of the risks, as well as their defined risk tolerance. These 

are key elements of a program’s fraud risk profile. According our 

Fraud Risk Framework, effective managers of fraud risks use the 

program’s fraud risk profile to help decide how to allocate resources to 

respond to fraud risks.

• Specific control activities to prevent or detect fraud or improper 

payments. Managers who effectively manage fraud risks design and 

implement specific control activities, such as fraud awareness and 

data analytic activities, according to our Fraud Risk Framework. DOE 

has not designed and implemented specific control activities to 

 44DOE updated its financial management assessment tool and entity assessment tool.
Page 25 GAO-17-235 Department of Energy

prevent and detect fraud and other improper payments. Of the 10 field 

offices responsible for overseeing contractor costs, none required 

employees responsible for reviewing contractor costs to attend fraud 

awareness training. Moreover, DOE does not routinely use data 

analytic techniques. Data analytics is a type of control activity that can 

be effective in detecting fraudulent spending or other improper 

payments. Of the 10 field offices responsible for reviewing contractor 

costs, officials from 4 reported in their questionnaire responses that 

they employed data analytic techniques to help detect fraudulent or 

other improper costs in contractor invoices or charges. On the basis of 

the description of the specific data analytic methods they reported 

using, we determined that only one field office—the Hanford Office—

had reported that it was performing analysis that could be considered 

data analytics.45 According to their response to our questionnaire, 

officials at the Hanford Office reported that they use data trending, risk 

matrixes, cost data graphing, and key word searches to look for 

anomalies. However, Hanford officials did not provide documentation 

to illustrate their use of these data analytic techniques as we had 

requested. In addition, the office’s invoice review procedures do not 

discuss the application of the data analytic techniques Hanford 

officials reported using. As a result, we could not substantiate the 

site’s reported use of data analytic techniques. We discuss the use of 

data analytics in more detail in the next section.

According to DOE officials, they do not use leading practices for 

managing the department’s risk of fraud because they consider the risk of 

fraud to be low. DOE officials told us that, unlike other federal agencies, 

DOE is not at the highest risk for fraud and improper payments and 

therefore cannot be expected to commit the resources necessary to 

independently identify, evaluate, adapt, and implement private industry 

leading practices. According to DOE officials, “a lack of widespread 

implementation of private sector fraud prevention and detection leading 

practices at DOE is not indicative of a management failure to 

appropriately manage the risk of fraud.” These officials told us that DOE 

manages the risk of fraud and improper payments through its internal 

 45We provided each site with the following definition of data analytics: A data analytic 

technique is a systematic algorithm that monitors data for indicators of fraud or other 

improper costs. Data analytic techniques include, for example, data mining (identifying 

patterns and relationships in large sets of data) and data matching (comparing two or 

more sets of data for matches such as names, numbers, or addresses). Nonetheless, two 

sites described audit work performed by contractor internal auditors as an example of data 

analytic methods they used, and a third site described system edit checks, such as those 

that determine if costs exceed amounts obligated, as data analytic methods used.
Page 26 GAO-17-235 Department of Energy

controls program; DOE OIG efforts to prevent, detect, and make 

recommendations related to fraud; and implementation of requirements of 

the Improper Payments Elimination and Recovery Act.

DOE’s approach for managing its risk of fraud and improper payments, 

however, may not be sufficient. According to the DOE OIG’s Fiscal Year 

2015 Performance Report and Fiscal Year 2016-2017 Performance 

Plan,46 the opportunity for fraud to occur or exist within various 

department programs is significant. Moreover, given that DOE has not 

conducted fraud risk assessments that are tailored to its programs, it is 

unclear how DOE officials reached the conclusion that the department’s 

risk of fraud is low. As discussed previously, the deceptive nature of fraud 

makes it difficult to measure in a reliable way. For example, the alleged 

fraudulent activity discussed previously, which involved contractors at 

DOE’s Hanford site and resulted in a $125 million settlement, was 

identified and reported by whistleblowers.47 It was not prevented or

detected through any strategic fraud risk management effort on DOE’s 

part.48 In the absence of such a framework, DOE has little assurance that 

the types of conduct reported by these whistleblowers are not 

widespread.

The leading practices contained in our Fraud Risk Framework are 

designed to help federal program managers take a more strategic 

approach to assessing and managing fraud risks. Although our Fraud 

 46Department of Energy, U.S. Department of Energy Office of Inspector General, FY2015 

Performance Report, FYs 2016 & 2017 Performance Plan (Washington, D.C.: n.d.).

47Two contractors together agreed to pay $125 million and specified interest. The first 

contractor agreed to pay $67,500,000, while the second agreed to pay $57,500,000. 

Settlement Agreement at 4, United States of America ex. rel. Brunson, et. al., v. Bechtel 

National Inc., et al. (E.D. Wash., Dec. 23, 2016) (Civ. No. 13-05013). The court dismissed 

the case by agreement of the parties on March 22, 2017, but retained jurisdiction to 

enforce the terms of the settlement. Order Dismissing Case at 2.

48In commenting on a draft of this report, DOE stated that prior to intervening in the 

lawsuit, it had taken several audit, enforcement, and contract actions related to some of 

the contractor conduct covered by the settlement. While we applaud these actions, we 

note that GAO's Fraud Risk Framework recognizes that there are three interdependent 

and mutually reinforcing categories of fraud control activities: (1) prevention; (2) detection; 

and (3) response. Preventive activities generally offer the most cost-efficient use of 

resources, since they enable managers to avoid a costly and inefficient “pay-and-chase” 

model, which refers to the practice of detecting fraudulent transactions and attempting to 

recover funds after payments have been made. Accordingly, the specific detection and 

response actions cited by DOE do not, by themselves, provide assurance that it has an 

effective fraud risk management framework in place.
Page 27 GAO-17-235 Department of Energy

Risk Framework may be new to DOE and other federal agencies, many of 

the leading practices contained in it are based on long-standing industry 

practices. Other frameworks and guides related to fraud risk management 

and integrity have existed for some time, including publications by the 

Institute of Internal Auditors, American Institute of Certified Public 

Accountants, and Association of Certified Fraud Examiners, as well as 

the Australian National Audit Office, the Committee of Sponsoring 

Organizations of the Treadway Commission, and the Organisation for

Economic Co-operation and Development.49 The Fraud Risk Framework 

allows for flexibility in how these leading practices are implemented. 

Effectively mitigating fraud risks by adopting these leading practices can 

help DOE to meet its mission by helping to ensure that funds are used 

only for approved purposes.

DOE officials told us that they plan to meet the requirements of the Fraud 

Reduction and Data Analytics Act of 2015 but should not be expected to 

implement private industry leading practices prior to the issuance of OMB 

guidance. Without implementing these selected leading practices for 

managing its risk of fraud, DOE is missing an opportunity to better 

position itself to meet the requirements of the Fraud Reduction and Data 

Analytics Act of 2015 and to organize and focus its resources in a way 

that would allow the department to mitigate the likelihood and impact of 

fraud.

• Without a dedicated entity within DOE to design and oversee fraud 

risk management activities, DOE is missing an opportunity to create a 

structure that is more conducive to fraud risk management.

• Without tailored risk assessments that result in an accurate fraud risk 

profile, DOE is not equipped to understand its fraud risk and take 

steps to mitigate it.

• Because DOE has not developed and documented an antifraud 

strategy that describes its programs’ approaches for addressing fraud 

 49For instance, see Australian National Audit Office, Fraud Control in Australian 

Government Entities: Better Practice Guide (March 2011); Committee of Sponsoring 

Organizations of the Treadway Commission, Internal Control—Integrated Framework 

(New York, NY: American Institute of Certified Public Accountants, 2013); Organisation for 

Economic Co-operation and Development, Towards a Sound Integrity Framework: 

Instruments, Processes, Structures and Conditions for Implementation, 

GOV/PGC/GF(2009)1 (Apr. 23, 2009); and Institute of Internal Auditors, American Institute 

of Certified Public Accountants, and Association of Certified Fraud Examiners, Managing 

the Business Risk of Fraud: A Practical Guide (Austin, Texas: n.d.).
Page 28 GAO-17-235 Department of Energy

risks, DOE is missing an opportunity to allocate resources more 

effectively to respond to fraud risks.

• Because DOE has not designed and implemented specific control 

activities, such as fraud awareness training and data analytics, it does 

not have assurance that its managers and employees are fully aware 

of potential fraud schemes. Such awareness can enable managers 

and employees to better detect potential fraud. Moreover, DOE is 

missing an opportunity to allow managers to monitor large amounts of 

data more efficiently. Finally, because DOE has not employed data 

analytics, and therefore has not benefitted from the experience of 

designing, implementing, and improving its analytic procedures, the 

department is not well positioned to implement the requirements of 

the Fraud Reduction and Data Analytics Act of 2015.

In applying data analytics to identify potential indicators of fraud or other 

improper payments associated with selected DOE contracts, we found 

that much of the cost data we requested from two DOE contractors for the 

purpose of performing data analytics was not suitable for analysis. The 

data were not suitable either because they were not for a complete 

universe of transactions that was reconcilable with amounts billed to DOE 

or because they were not sufficiently detailed. Sufficiently detailed data 

include identifiers such as transaction date, dollar amount, item or service 

description, and transaction codes to indicate the type of cost represented 

(e.g., construction materials, property lease, and office supplies). 

However, for those subsets of DOE contractor data that were complete 

and sufficiently detailed, we were able to apply data analytics, and we 

identified potential indicators of improper charges that could be used to 

guide further investigation of these charges.

Much of the transaction-level cost data for fiscal years 2013 through 2015 

that we requested from one M&O contractor and one non-M&O contractor 

were not suitable for use with data analytic techniques. We requested 

data from two contractors—the M&O contractor that operates Sandia 

National Laboratories and the non-M&O contractor responsible for the 

design and construction of the Hanford Waste Treatment Plant. The M&O 

contractor at Sandia, however, was unable to produce a full data 

population of sufficiently detailed transaction-level data for any of the over 

$8 billion in costs it incurred and claimed during the 3-year time frame we 

examined (see fig. 1). More specifically, the contractor was unable to 

provide data files that could be used to compile a data set in which the 

total of all cost transactions could be reconciled with the total amount paid 

by DOE. According to representatives of the M&O contractor and 

Data Analytics Helped 

Identify Potentially 

Improper Charges, 

but Billions in Costs 

Could Not Be 

Analyzed Because 

Contractor Data Were 

Not Sufficiently 

Detailed

Much of the Cost Data 

Maintained in Two 

Contractors’ Accounting 

Systems Were Not 

Suitable for Data Analytic 

Techniques to Produce 

Meaningful Results
Page 29 GAO-17-235 Department of Energy

documents they provided, the contractor’s core accounting system 

generates financial information for both internal and external use through 

the use of project accounting and general ledger modules. Specifically, 

the contractor’s project accounting module generates information for 

internal management use, and the general ledger module generates 

information for external reporting purposes. However, neither the project 

accounting nor the general ledger module contains transaction-level cost 

data suitable for data analytics (see app. II for more detail on issues with 

the data provided by the M&O contractor). Having a data set that 

reconciles with the amount charged to the government is important 

because it ensures that the data set represents a complete universe of 

cost transactions.

Regarding the non-M&O contractor, we requested and received a data 

set of cost transactions for the nearly $1.8 billion it charged DOE over the 

3-year period. Of the nearly $1.8 billion in costs, $1.342 billion were 

sufficiently detailed for the purpose of employing data analytics (see fig. 

1). However, about $437 million in subcontractor costs were not 

sufficiently detailed. Payments to subcontractors accounted for almost 25 

percent of all expenses billed by the non-M&O contractor to DOE for this 

period, but these transactions did not contain specific information 

regarding the types of services or materials purchased from the 

subcontractor. Without detailed cost data for the entire population of 

subcontractor-related costs, analyses of these costs were not possible. 

According to DOE officials, they review most types of costs as part of 

their quarterly post payment invoice review process. However, our 

analysis of all costs DOE sampled and tested from fiscal year 2013 

through 2015 found that DOE sampled about 1 percent (50 transactions 

totaling $3.7 million) of the nearly $437 million in subcontractor-related 

costs. As discussed previously, fraudulent transactions, by nature, do not 

occur randomly and, therefore, are not effectively identified through 

sampling. When only partial data are tested, it is likely that a number of 

control breaches and suspicious transactions will be missed, the impact 

of control failures may not be quantified fully, and smaller anomalies may 

be overlooked. It is often these small anomalies that point to weaknesses 

that can be exploited, causing a material breach.

Of the nearly $10 billion of costs these two contractors incurred during 

fiscal years 2013 through 2015, only $1.3 billion was suitable for analysis 

using data analytic techniques. (See fig. 1.)
Page 30 GAO-17-235 Department of Energy

Figure 1: Costs Incurred by Two Contractors during Fiscal Years 2013 through 2015 

That Were Not Sufficiently Detailed for Data Analytics

Notes: The data that were not sufficiently detailed did not include identifiers necessary to determine 

the nature of each cost transaction.

DOE has not required that these contractors maintain sufficiently detailed 

transaction-level cost data that are reconcilable with amounts charged to 

the government. Under federal internal control standards, managers 

should use quality information to achieve the entity’s objectives. To do

this, managers may identify information requirements, obtain relevant 

data from reliable internal and external sources, and process data into 

information that is appropriate, current, complete, accurate, accessible, 

and provided on a timely basis. In addition, as discussed previously, the 

Fraud Reduction and Data Analytics Act of 2015 established new 

requirements aimed at mitigating fraud risk through the development and 

use of data analytics, among other things. Without requiring contractors to 

maintain sufficiently detailed transaction-level cost data that are 

reconcilable with amounts charged to the government, DOE will not be 

well positioned to meet the requirements of the Fraud Reduction and 

Data Analytics Act of 2015.
Page 31 GAO-17-235 Department of Energy

Using simple analytic techniques (such as sorting and classifying), we 

reviewed costs charged to DOE for fiscal years 2013 through 2015 by the 

non-M&O contractor and identified indicators of potential improper cost 

charging that could be useful to guide further investigation of these 

charges.50 The purpose of employing data analytics was to identify costs 

that appeared unusual or out of the ordinary. Unusual costs are not 

necessarily fraudulent or improper but instead serve as red flags or 

possible indicators of improper cost charging that may warrant further 

review.

Using data analytics, we identified unusual costs that we believe warrant 

further review by DOE.51 Examples of the costs we identified include the 

following.

• Relocation and temporary assignment costs. We identified 

employee permanent relocation and temporary assignment costs of 

nearly $26 million for the 3-year period we examined. In total, these 

costs were spread across 16 different cost codes in the other direct 

cost and labor files and seemed high. Furthermore, in reviewing the 

cost transactions associated with these 16 different cost codes, we 

identified a subset of transactions totaling $7.8 million that were 

unusual because they appeared to be per-diem payments but were 

not directly tied to an individual employee—an attribute normally 

associated with per-diem payments.52 Specifically, the transactions 

we identified were weekly lump-sum payments—averaging about 

$50,000 weekly—that were coded “temporary assignment per-diem 

paid by payroll.” None of the transactions contained information 

 50We reviewed 72 invoices containing over 769,000 lines of cost transaction data, totaling 

nearly $1.8 billion. As discussed previously, $437 million in subcontractor-related costs 

were not sufficiently detailed to employ data-analytic techniques. The cost data from the 

non-M&O contractor we reviewed was organized into two categories: labor (678,551 

transactions for over $820 million) and other direct costs (91,069 transactions for over 

$948 million). Each line of cost data typically included identifiers such as transaction date, 

dollar amount, item or service description, and a transaction cost code that indicated the 

type of cost represented (e.g., construction labor and materials, property lease, and office 

supplies).

51By sorting and summarizing labor and other direct cost transactions by their cost codes 

and further reviewing cost categories or transactions that deviated from expected patterns, 

we identified categories of costs that warrant further review by DOE to determine if they 

are allowable.

52According to the General Services Administration, per diem payments are daily 

allowances for lodging, meals, and incidental expenses. See 

http://www.gsa.gov/portal/content/104208#1.

Simple Analytic 

Techniques Identified 

Potentially Improper 

Charges for Non-M&O 

Contractor Costs for Fiscal 

Years 2013 through 2015
Page 32 GAO-17-235 Department of Energy

necessary to link them to the individual employees receiving payment. 

We also identified other transactions totaling over $2.5 million that 

were unusual because they did not appear to be reimbursements to 

employees for relocation expenses, but instead appeared to be 

relocation bonuses. For example, 68 payments of $25,600 each (total 

about $1.741 million) and 34 payments of $19,300 each (total about 

$656,000) were made to individual, named employees.53 Each 

transaction was connected to a permanent relocation and temporary 

assignment cost code and contained the cost description 

“miscellaneous other payments or reimbursements.”

• Christmas Day purchases. We identified four purchases of varying 

amounts ($400, $137, $81, and $11) totaling over $600 that were 

made from Amazon, an online retailer, on Christmas Day. There may 

be a valid reason for purchases that occur on a holiday, but in 

general, holiday purchases are considered red flags and should be 

scrutinized.

• Payments to an affiliate. We identified 455 affiliated subcontractor 

transactions totaling over $6.8 million. Specifically, these transactions 

reflect costs charged to DOE for services provided to the non-M&O 

prime contractor by a subcontractor that was affiliated with the prime 

contractor. The subcontractor, according to its website, is responsible 

for, among other things, monitoring supplier quality and on-time 

delivery for the prime contractor’s projects. Given the affiliation 

between the prime and subcontractor, additional scrutiny may be 

needed to ensure that goods and services provided by the 

subcontractor affiliate are competitively priced.54

• Labor costs. We identified nearly 10,000 transactions totaling over 

$241 million in payroll costs that were included in the “other direct 

costs” data file instead of the labor cost data file. These transactions 

did not contain an earnings code (a code that indicates the type of 

cost, such as “straight time,” “overtime,” or other type of labor 

expense) that is typically assigned to labor costs.

In July 2016, we provided the results of our analysis to DOE Hanford site 

officials, and in August 2016 we provided additional detailed information 

on our methodology to allow them to replicate our analysis. DOE Hanford 

 53Seven other payments of differing amounts bring the total to 109 transactions totaling 

over $2.5 million.

54For M&O contracts, DOE acquisition regulations place limits on profits or fees earned in 

association with subcontractor affiliate transactions.
Page 33 GAO-17-235 Department of Energy

site officials initially declined to respond to our questions about the results 

of our analysis. However, in December 2016, they provided a written 

response to our November 30, 2016, request to confirm facts about the 

data in which they disagreed with our observations and analysis and 

provided explanations for the cost charges we identified. Their specific 

explanations follow.

• Regarding relocation and temporary assignment costs, according to 

the Hanford site’s written response, appendix A of the Hanford Site 

Stabilization Agreement establishes daily travel pay rates for 

construction employees. The lump-sum per-diem payments totaling 

$7.8 million were “travel-to-the-site payments,” which are authorized 

by the Hanford Site Stabilization Agreement and are charged to DOE 

in lump-sum amounts because charging for individual (or daily) trips 

for hundreds of workers would be too onerous and inefficient. The 

transactions totaling over $2.5 million, which were identified as 

“miscellaneous other payments or reimbursements” were “livingaway-from-home-option” costs, which are consistent with the Advance 

Understanding on Costs agreement that DOE has with the contractor. 

The site’s written response also states that Hanford officials expected 

relocation and temporary assignment costs to be significant because 

the Advance Understanding on Costs agreement authorizes these 

significant costs. As evidence that these charges were appropriate, 

Hanford officials provided us with a copy of the Advance 

Understanding on Costs agreement and the Hanford Site Stabilization 

Agreement. Hanford officials did not provide other documentation to 

support the appropriateness of these charges, and it is unclear how 

the site can substantiate per-diem payments if they are not associated 

with individual employees.

• Regarding the Christmas day purchases on Amazon, according to the 

written response, the contractor’s accounting software, which uses 

batch processing, generates transaction posting dates that may 

appear to be on a holiday when in fact the purchases were made 

before the holiday. For example, the transaction date for the Amazon 

purchases we identified was December 25, but these purchases were 

actually made on October 29 and November 4, according to the 

documentation DOE provided. However, DOE did not provide 

information regarding how it might isolate holiday purchases, given 

that transaction dates in the contractor’s system did not necessarily 

reflect the date of purchase. On the basis of our review of the site’s 

invoice review procedures, the Hanford Office does not specifically 

target for review transactions that fall on or around holidays. 

Moreover, if the contractor’s use of batch processing overrides the 
Page 34 GAO-17-235 Department of Energy

transaction date of a purchase, it is unclear how DOE can reliably 

determine the validity of costs charged to the government.

• Regarding each of the cost categories we identified, according to its 

written response, the Hanford Office has reviewed each of “these 

type” of expenses as part of its post payment invoice review process 

and found them to be proper. However, our review of all the 

transactions the Hanford Office reported sampling and reviewing for 

fiscal years 2013 through 2015 found that the Hanford Office had 

reviewed very few of the transactions we identified through our use of 

data analytics. Specifically, as part of its regular selective invoice 

reviews, the Hanford Office reviewed 4 relocation and temporary 

assignment transactions identified as “miscellaneous other payments 

or reimbursements,” 4 of the subcontractor affiliated transactions, and 

1 of the nearly 10,000 payroll cost transactions that were included in 

the “other direct costs” data file instead of the “labor” file. The Hanford 

Office did not review any of the $7.8 million in lump-sum per-diem 

payments or the Christmas Day purchases on Amazon.

In addition to the costs we identified above, we had initially identified $2 

million in costs for equipment depreciation expenses billed to DOE that 

we thought were unusual until DOE officials provided us with information 

that clarified our understanding of the contractor’s data.55 Specifically, 

DOE officials explained that the entire description of the account we were 

examining was “depreciation or purchase” and that, in response to our 

observations, the Hanford office reviewed two transactions from this 

account and found that they were purchases and not depreciation. 

Although DOE’s clarification resolved our initial reason for flagging these 

costs, the new information raised other questions regarding the use of a 

single cost code to track dissimilar costs. The FAR requires that costs be 

allowable, reasonable, and allocable to the contract. Unless contractor 

costs are submitted in a manner that allows DOE to distinguish between 

depreciation expenses and purchases without having to review every cost 

submitted under a single cost code, it is unclear how DOE can ensure 

 55Depreciation is a commonly used accounting method used to allocate the cost of an 

asset, or property, over its useful life. According to the FAR, the government acquires title 

to all property for which the contractor is entitled to reimbursement. Specifically, under 

cost-reimbursable contracts, the government has reimbursed the contractor for the 

purchase cost of the property and therefore the property purchased by the contractor is 

considered government-owned contractor-held property. Consequently, it would not be 

appropriate for the contractor to charge the government for the cost of depreciation for 

government-owned property. Doing so would result in the government paying twice for the 

cost of the property—once when the contractor is reimbursed for the full purchase cost of 

the property and again when the contractor is reimbursed for the depreciation expense.
Page 35 GAO-17-235 Department of Energy

that costs are allowable and allocable. In addition, the contractor’s use of 

a single cost code to track dissimilar costs undermines DOE’s ability to 

identify potentially improper cost charges using data analytics.

Data analytics, as discussed previously, enable an organization to 

analyze transactional data to obtain insights into the operating 

effectiveness of internal controls and to identify improper cost charges, 

indicators of fraud, or actual fraudulent activities. Because automated 

checks are less labor-intensive than traditional control mechanisms, such 

as manual checks, automating data analytic tests can allow managers to 

monitor large amounts of data more efficiently. Regarding the usefulness 

of performing data analytics, DOE officials told us that a data analytic 

analysis would not be cost-effective because it produced too many false 

positives—that is, unusual transactions that are later determined to be 

legitimate. In addition, they said that until recently there was no 

requirement to perform data analytics and, because it has not been 

required, they have not devoted the time or manpower to developing and 

implementing data analytic tools and techniques.

DOE officials said that they agreed that our review may have helped 

identify how the use of data analytics can be expanded at DOE but said 

that performing data analytics would require DOE to complete “other 

steps” in our Fraud Risk Framework before deciding to design and 

implement additional analytics. However, practices in the Fraud Risk 

Framework are not necessarily meant to be sequential or interpreted as a 

step-by-step process. According to the Fraud Risk Framework, effective 

fraud risk managers collect and analyze data on identified fraud trends 

and use them to improve fraud risk management activities. For instance, 

managers may revise data analytic tests based on identified fraud 

schemes to better identify these schemes in the future. However, 

because DOE has not employed data analytics, as discussed previously, 

the department has not benefitted from the experience of designing, 

implementing, and improving its analytic procedures. As a result, the 

department is not well positioned to implement the requirements of the 

Fraud Reduction and Data Analytics Act of 2015.

DOE’s approach to managing its risk of fraud and other improper 

payments relies on traditional cost-surveillance procedures, which include 

prepayment invoice reviews for its non-M&O contracts and post payment 

incurred cost audits for both its M&O and non-M&O contracts. The 

effectiveness of DOE’s approach, however, is hampered by shortcomings 

in control activities (policies and procedures). Without a department-wide 

Conclusions
Page 36 GAO-17-235 Department of Energy

invoice review policy or well-documented procedures, DOE management 

does not have assurance that invoice reviews are being performed or that 

these control activities are operating as intended.

In addition, DOE has not used leading practices in its approach to 

managing its risk of fraud and other improper payments. In particular, 

DOE has not (1) created a structure with a dedicated entity to lead fraud 

risk management activities; (2) conducted fraud risk assessments that are 

tailored to its programs in order to develop a fraud risk profile; (3) 

developed and documented a strategy to mitigate assessed fraud risks; 

or (4) designed and implemented specific control activities, such as data 

analytics, to prevent and detect fraud and other improper payments. 

Without implementing these selected leading practices for managing its 

risk of fraud, DOE is missing an opportunity to organize and focus its 

resources in a way that would allow the department to mitigate the 

likelihood and impact of fraud.

Finally, in applying data analytics to data from selected DOE contracts, 

our work demonstrated that with complete data that are sufficiently 

detailed, data analytics can be used to efficiently and more 

comprehensively monitor contractor costs. However, much of the cost 

data we requested from one DOE contractor and some data from the 

other were not sufficiently detailed for applying data analytics. DOE has 

not required that its contractors maintain sufficiently detailed transactionlevel cost data that are reconcilable with amounts charged to the 

government. Without requiring contractors to maintain such data—

including cost data that, at a minimum, represent a full data population 

and contain the details necessary to determine the nature of each cost 

transaction—DOE will not be well positioned to meet the requirements of 

the Fraud Reduction and Data Analytics Act of 2015 and employ data 

analytic techniques as a means to more efficiently monitor contractor 

costs and manage its risk of fraud and other improper payments.

We recommend that the Secretary of Energy take the following six 

actions.

To allow DOE management to effectively monitor invoice reviews and 

have assurance that this control activity is operating as intended, 

establish a DOE-wide invoice review policy that includes requirements for 

sites to establish well-documented invoice review operating procedures.

Recommendations for 

Executive Action
Page 37 GAO-17-235 Department of Energy

To help DOE take a more strategic approach to managing improper 

payments and risk, including fraud risk, implement the following leading 

practices for managing the department’s risk of fraud:

• create a structure with a dedicated entity within DOE to design and 

oversee fraud risk management activities;

• conduct fraud risk assessments that are tailored to each program and 

use the assessments to develop a fraud risk profile;

• develop and document an antifraud strategy that describes the 

programs’ approaches for addressing the prioritized fraud risks 

identified during the fraud risk assessment; and

• design and implement specific control activities, including fraud 

awareness training and data analytics, to prevent and detect fraud 

and other improper payments.

To help ensure that necessary data are available to employ data analytics 

as a tool to perform contractor cost-surveillance activities, require 

contractors to maintain sufficiently detailed transaction-level cost data that 

are reconcilable with amounts charged to the government, including

• cost data that, at a minimum, represent a full data population and

• the details necessary to determine the nature of each cost 

transaction, with such identifiers as transaction date, dollar amount, 

item or service description, and transaction codes to indicate the type 

of cost represented (e.g., construction materials, property lease, and 

office supplies).
Page 38 GAO-17-235 Department of Energy

We provided DOE with a draft of this report for its review and comment. 

DOE provided written comments, which are reproduced in appendix III, 

and technical comments that were incorporated as appropriate. In its 

written comments, DOE generally concurred in principle with five 

recommendations but did not concur with the sixth, which is aimed at 

ensuring that DOE has the necessary data available to employ data 

analytics. DOE’s Office of Inspector General (OIG) also provided written 

comments, which are reproduced in appendix IV. We incorporated some 

of the OIG’s suggested language regarding their role in the Cooperative 

Audit Strategy.

DOE generally concurred in principle with five of our

recommendations. In its letter, DOE agreed to (1) establish a DOE-wide 

invoice review policy that includes requirements for sites to establish welldocumented invoice review operating procedures; (2) create a structure 

with a dedicated entity within DOE to design and oversee fraud risk 

management activities—but stated that it will have to consider the cost, 

benefits, and need for a separate organization before implementing a 

dedicated antifraud entity to design and oversee fraud risk management 

activities; (3) conduct fraud risk assessments that are tailored to each 

program and use the assessments to develop a fraud risk profile; (4) 

develop and document an antifraud strategy that describes the programs’ 

approaches for addressing the prioritized fraud risks identified during the 

fraud risk assessment; and (5) design and implement specific control 

activities, including fraud awareness training and data analytics, to 

prevent and detect fraud and other improper payments. DOE states that it 

has already, or is in the process of, implementing each of these five 

recommendations. We will continue to monitor DOE’s efforts to implement 

these changes and address our recommendations.

In its letter, DOE did not concur with our sixth recommendation to require 

contractors to maintain sufficiently detailed transaction-level cost data that 

are reconcilable with amounts charged to the government. In its letter, 

DOE states that it does not concur with this recommendation because the 

recommendation establishes agency-specific requirements for DOE 

contractors that are more prescriptive than current federal requirements 

and that its M&O contractors, not DOE, are responsible for performing 

data analytics and determining what data are needed to do so. Based on 

DOE’s response we are concerned that it does not fully appreciate its 

responsibility for overseeing contractor costs. Specifically: 

• DOE disagreed with our recommendation because it asserted that 

implementing the recommendation would require DOE to establish

Agency Comments 

and Our Evaluation
Page 39 GAO-17-235 Department of Energy

agency-specific requirements for DOE contractors that are more 

prescriptive than current federal requirements. However, under the 

FAR agencies are authorized to establish their own agency-specific 

requirements governing contracts. Under federal internal control 

standards, managers should use quality information to achieve the 

entity’s objectives. To do this, managers may identify information 

requirements, obtain relevant data from reliable internal and external 

sources, and process data into information that is appropriate, current, 

complete, accurate, accessible, and provided on a timely basis.

• DOE also stated that its fiscal year 2017 internal control evaluations 

guidance requires M&O contractors to apply data-analytics, as 

appropriate, and that federal employees assess the contractors’ 

implementation of fraud risk activities, such as the use of data analytic 

tools to identify fraud risk factors. DOE’s letter, however, does not 

acknowledge that it has a responsibility for employing data-analytics 

under the Fraud Reduction and Data Analytics Act of 2015. Instead, 

DOE’s letter states that under the M&O contracting model, the 

contractor is responsible for performing data-analytics. The act—

which is intended to improve federal agencies' development and use 

of data analytics for the purpose of identifying, preventing, and 

responding to fraud, including improper payments—does not 

specifically authorize DOE (or any other agency) to delegate its fraud 

management responsibilities to a contractor or any other nonfederal 

entity. The use of some data analytic techniques by its contractors 

does not relieve DOE of its responsibility to establish and maintain an 

effective fraud risk management framework. In addition, as we 

discuss in our report, the one M&O contractor we examined was 

unable to produce data that were suitable for data-analytic techniques 

to produce meaningful results. We continue to believe that the use of 

data-analytic techniques by DOE employees could help mitigate some 

of the challenges that limit the effectiveness of DOE’s approach for 

overseeing M&O contractor costs. However, effectively applying dataanalytics is dependent upon the availability of complete and 

sufficiently detailed contractor data. Therefore, we continue to believe 

that DOE needs to implement our recommendation and require 

contractors to maintain sufficiently detailed transaction-level cost data 

that are reconcilable with amounts charged to the government.

Although DOE did not concur with our sixth recommendation, DOE’s 

letter states that it will discuss the merits of government-wide guidance for 

applying data-analytics to contract costs with the data-analytics working 

group that OMB is required to establish as part of the Fraud Reduction 

and Data Analytics Act of 2015. DOE stated that if the working group 

determines that there is a need for contractors to retain and provide 
Page 40 GAO-17-235 Department of Energy

additional data to support data analytic procedures, any proposed new 

requirement should be discussed with the FAR Council; the OMB Office 

of Federal Procurement Policy; and potentially, the OMB Office of 

Intergovernmental and Regulatory Affairs. However, the purpose of the 

working group is to share "financial and administrative controls" and 

"data-analytics techniques". In other words, this is an information sharing 

entity to facilitate the sharing of fraud management best practices. It is not 

an implementing body, and agencies do not need its permission before 

proceeding with fraud risk reduction efforts. The law does not prohibit 

DOE (or any other agency) from acting unless and until there is 

interagency consensus on an issue.

In addition to DOE’s response to our recommendations, DOE’s letter 

states that the department is concerned with the accuracy of statements 

throughout the report. Specifically, DOE states that it has invoice review 

procedures and uses data analytics in its internal control processes. We 

disagree. As we discuss in our report, officials with the Office of the CFO 

at DOE headquarters told us that DOE does not have department-wide 

invoice review policies and procedures. Instead, according to these 

officials, field CFOs and contracting officials are responsible for 

developing appropriate invoice review policies and procedures. Notably, 

in our query of all DOE sites, we found that most did not have welldocumented invoice review procedures. Regarding the use of dataanalytics, DOE officials stated that DOE’s contractors use some dataanalytic techniques. However, as we discuss in our report, most DOE 

sites in our query of all sites do not use data-analytics. Further, as 

discussed in the report, we reviewed one of DOE’s large M&O contractors 

and found that cost data is not maintained in a way to support 

comprehensive data analysis and neither the contractor nor DOE was 

doing such analyses. 

In its letter, DOE also states that the report should acknowledge DOE’s 

compliance with requirements in effect at the time of our review. Our work 

was not designed as a compliance audit to test the effectiveness of 

DOE’s internal financial controls. Our report examined the extent to which 

DOE’s approach to managing its risk of fraud and other improper 

payments incorporates leading practices, such as the use of data 

analytics. We do not assert in our report that the leading practices 

included in GAO’s Fraud Risk Framework are requirements. However, as 

we discuss in our report, by not incorporating these leading practices, 

DOE is missing an opportunity to organize and focus its resources in a 

way that would allow the department to mitigate the likelihood and impact 

of fraud. 
Page 41 GAO-17-235 Department of Energy

As agreed to with your offices, unless you publicly announce the contents 

of this report earlier, we plan no further distribution until 30 days from the 

report date. At that time, we will send copies of this report to the 

appropriate congressional committees, the Secretary of Energy, the 

Administrator of NNSA, and other interested parties. In addition, the 

report will be available at no charge on the GAO website at

http://www.gao.gov.

If you or your staff members have any questions about this report, please 

contact me at (202) 512-3841 or trimbled@gao.gov. Contact points for 

our Offices of Congressional Relations and Public Affairs may be found 

on the last page of this report. GAO staff who made major contributions to 

this report are listed in appendix V.

Sincerely yours,

David C. Trimble

Director, Natural Resources and Environment 
Appendix I: Scope and Methodology

Page 42 GAO-17-235 Department of Energy

To examine the Department of Energy’s (DOE) approach to managing its 

risk of fraud and other improper payments and challenges, if any, that 

may limit the effectiveness of this approach, we took the following steps.

• We reviewed the Federal Acquisition Regulation (FAR), Office of 

Management and Budget (OMB) requirements and Presidential 

memorandums, federal legislation regarding improper payments, our 

Standards for Internal Control in the Federal Government,

1 our A 

Framework for Managing Fraud Risk in Federal Programs,

2 and 

standards and guidance of the Institute of Internal Auditors to identify 

federal requirements and best practices for prevention and detection 

of fraud and other improper payments. To identify DOE’s agency-wide 

approach to managing its risk of fraud and improper payments, 

including key internal controls over financial and accounting 

operations and for contractor oversight, we reviewed DOE 

regulations, directives, procedures, and guidance, and we interviewed 

DOE officials from headquarters organizations, including the Office of 

the Chief Financial Officer (CFO), the office of the Chief Risk Officer, 

the Office of Acquisition Management, and the Office of Inspector 

General (OIG).

• To identify DOE’s approach to managing its risk of fraud and improper 

payments in its field locations, we developed a semi structured 

interview, which was administered to officials at DOE field locations 

that oversee at least one prime contractor. Through review of DOE 

documents and discussions with officials in the Office of the CFO, we 

identified 10 field office locations responsible for oversight of at least 

one prime contractor; and we determined that 6 of those sites 

oversaw at least one non-M&O contractor. To develop the interview 

questions, we reviewed OMB Circular A-123, federal internal control 

standards, and the Fraud Risk Framework provided in and identified 

key controls and leading practices for prevention and detection of 

fraud and other improper payments.3 We pretested interview 

questions and made changes to the interview guide as appropriate; 

we conducted these semi structured interviews with DOE’s field 

 1

GAO, Standards for Internal Control in the Federal Government, GAO-14-704G 

(Washington, D.C.: September 2014).

2

GAO, A Framework for Managing Fraud Risks in Federal Programs, GAO-15-593SP 

(Washington, D.C.: July 28, 2015). 

3

Office of Management and Budget, Management’s Responsibility for Risk Management 

and Internal Control, OMB Circular No. A-123 (Washington, D.C.: May 19, 2015).

Appendix I: Scope and Methodology
Appendix I: Scope and Methodology

Page 43 GAO-17-235 Department of Energy

CFOs, contracting officers, and major contractors at each site. We 

also collected DOE policies and procedures for oversight and review 

of contractor costs from each site. We analyzed DOE and contractor 

responses and information provided through the semi structured 

interview process and summarized DOE’s approach to managing its 

risk of fraud and improper payments in its field locations.

• To gain an in-depth understanding of the local DOE processes for 

oversight of contractors’ costs, we visited DOE’s Hanford Office in 

Washington State and the National Nuclear Security Administration’s 

(NNSA) Office of Financial Performance in Albuquerque, New Mexico, 

and held discussions with DOE officials responsible for financial and 

administrative oversight of prime contractors at the sites. To identify 

challenges to DOE’s approach, we reviewed DOE internal 

assessments, OIG reports, and a DOE-commissioned study on DOE’s 

contract administration practices.4 We also interviewed officials from 

the DOE OIG audit and investigations units in headquarters and in the 

field to further identify and discuss additional challenges DOE faces in 

using its approach.

To examine the extent to which DOE’s approach incorporates leading 

practices, such as the use of data analytics, through our review of 

standards and guidance of the Institute of Internal Auditors, federal 

internal control standards, and our Fraud Risk Framework, we identified 

key leading practices for managing the risk of fraud and improper 

payments in the federal government. The Fraud Risk Framework consists 

of four components—commit, assess, design and implement, and 

evaluate and adapt—each of which are overarching fraud risk 

management concepts and leading practices for carrying out the 

overarching concept. To ensure that we had a cross section of leading 

practices, we selected at least one leading practice from each component 

of the Fraud Risk Framework: commit to combating fraud by creating an 

organizational culture and structure that is conducive to fraud risk 

management, plan regular fraud risk assessments and assess risks to 

determine a fraud risk profile, and design and implement a strategy with 

specific control activities to mitigate assessed fraud risks. After 

determining that DOE had not adopted fraud risk management activities 

that incorporated leading practices from the first three components, we 

did not assess whether DOE was evaluating and adapting its use of 

leading fraud risk management practices. The leading practices we 

 4

Golden Key Group for the Department of Energy, DOE Acquisition Human Capital 

Staffing Model (Reston, VA: July 18, 2013).
Appendix I: Scope and Methodology

Page 44 GAO-17-235 Department of Energy

selected from each component were selected because the use of these 

practices could be objectively verified. We then compared DOE’s 

approach to managing its risk of fraud and improper payments, including 

our analyses and summary of its policies and procedures for oversight of 

its contractors, with the key leading practices and identified similarities 

and differences between these practices and DOE’s approach.

To examine the application of data analytics in identifying potential 

indicators of fraud or other improper payments associated with selected 

DOE contracts, we planned to review costs charged to DOE by one 

management and operating (M&O) contractor and one non-M&O 

contractor. We selected these contractors for in-depth review based on 

type of contractor, contract size in dollars, and ease of access of 

contractor data. Specifically, we selected one M&O and one non-M&O 

contract to review because these types of contracts charge costs to DOE 

differently and we wanted to capture this variation in our review. We 

chose two contracts that were large in terms of dollars charged to DOE in 

order to have two large data sets with many types of expenses to 

analyze. We selected the non-M&O contractor at the Hanford Site for 

ease of access to the data and proximity to our offices for follow-up on 

data questions and issues. We selected the M&O contractor because it is 

co-located with DOE’s NNSA Office of Financial Performance, the field 

office responsible for oversight of all NNSA contractors, also making it 

much easier to follow up on data questions and issues.

We requested 3 years of cost data charged to DOE by each contractor 

during fiscal years 2013 through 2015.

• Non-M&O contractor analysis. We requested data from Bechtel 

National, Inc., the non-M&O contractor responsible for the design and 

construction of the Waste Treatment Plant at DOE’s Hanford site. 

DOE provided the requested cost data for the non-M&O contractor in 

72 files, and each file was separated into two types of costs: labor 

costs and other direct costs. These files contained fields regarding the 

natural class, source reference number and descriptions, cost 

accounting code, control account description, and others. We 

combined these data into two data sets, one set for labor costs and 

one set for other direct costs. To determine the reliability of these 

data, we (1) conducted a series of interviews with DOE officials 

responsible for the data to understand how the data are maintained 

and verified; (2) performed data testing, including checking totals in 

the data against control totals provided by the agency, as well as 

examination of outliers and missing data, and (3) reviewed the data 
Appendix I: Scope and Methodology

Page 45 GAO-17-235 Department of Energy

dictionary. We determined the data were sufficiently reliable for the 

purposes of this engagement. We performed a variety of analyses of 

these data, including examining distributions of variables, 

classification of costs into categories, cross-tabulation, and trend 

analysis. For example, we summarized both the labor and other direct 

costs data by type of cost. We reviewed the results of these analyses 

and identified certain costs that could potentially be unallowable as 

defined in the FAR and that warranted further review. For some of the 

potentially unallowable costs we identified, we examined the details of 

the transactions to help us to identify the type and/or purpose of the 

costs represented. To validate our findings, we provided a detailed 

briefing to DOE on the results of our analyses and at that time we 

requested additional information about the purpose and allowability of 

the potentially unallowable costs we identified. DOE did not respond 

to our request to provide us with this information.

DOE did, however, provide us with a file of individual cost transactions 

that it examined in connection with its review of the 72 invoice files from 

fiscal years 2013 through 2015. We performed a variety of analyses of 

these data, including, for example, classification of the costs into 

categories and cross-tabulating this information with the labor and other 

direct costs data summaries.

M&O contractor analysis. We requested data from Sandia Corporation, 

the M&O contractor responsible for managing and operating Sandia 

National Laboratories. DOE was unable to provide us with the requested 

data in a format that was suitable for analysis. Specifically, DOE was 

unable to provide the data because the contractor tracked costs by 

project in several sub-accounting systems, and the contractor could not 

produce a full data population of sufficiently detailed transaction-level 

data for the costs it incurred and claimed during the fiscal years 2013 

through 2015 time frame we examined. In addition, the contractor did not 

identify costs by the cost types identified in the FAR.5

 5

48 C.F.R. § 31.205. Section 31.205 does not cover every element of cost. The 

determination of allowability shall be based on the principles and standards in this subpart 

and the treatment of similar or related selected items. 48 C.F.R. § 31.204(d).
Appendix II: Details of Issues Identified with 

the Data Provided by the M&O Contractor

Page 46 GAO-17-235 Department of Energy

The M&O contractor that operates Sandia National Laboratories was 

unable to produce a full data population of sufficiently detailed 

transaction-level data for any of the over $8 billion in costs it incurred and 

claimed during the fiscal years 2013 through 2015 time frame we 

examined. According to representatives of the M&O contractor and 

documents it provided, the contractor’s core accounting system generates 

financial information for both internal and external use through the use of 

project accounting and general ledger modules. Specifically, the 

contractor’s project accounting module generates information for internal 

management use, and the general ledger module generates information 

for external reporting purposes. However, neither the project accounting 

nor the general ledger module contained transaction-level cost data 

suitable for data analytics.

• The information contained in the contractor’s project accounting 

module did not have the expenditure detail needed to effectively 

perform data analytics, according to documents provided by the 

contractor. The contractor’s project accounting module tracks four 

cost categories: labor, chargebacks, travel, and purchases. Costs 

within each of these cost categories were not further identified by 

expense type, such as construction materials, property lease, or office 

supplies.

• The information contained within the contractor’s general ledger 

module also did not contain the expenditure detail needed to 

effectively perform data analytics. According to representatives of the 

M&O contractor and documents they provided, the contractor’s 

general ledger system is not set up to function like the ledgers used 

by nongovernmental businesses. A general ledger system, according 

to the contractor, would normally contain detailed information that 

would define the expenditure type and associated detail of the 

expenditure that could then allow analytics to be performed. 

Furthermore, the contractor told us that it does not produce financial 

statements and DOE does not require its contractors to report 

transactional detail to support the agency’s preparation of 

consolidated financial statements. Consequently, the contractor’s 

general ledger system does not contain the detailed information 

needed to allow analytics to be performed.

According to representatives of the M&O contractor and documents they 

provided, although transaction-level cost data are not maintained in the 

project accounting or general ledger modules, detailed cost information is 

found in several of the contractor’s sub-accounting systems. Specifically, 

they said that the M&O contractor maintains several sub-accounting 

Appendix II: Details of Issues Identified with 

the Data Provided by the M&O Contractor
Appendix II: Details of Issues Identified with 

the Data Provided by the M&O Contractor

Page 47 GAO-17-235 Department of Energy

systems that separately process and capture transactions by type, such 

as travel, purchase card, and employee expense voucher systems. Data 

from the sub-accounting systems are summarized and used to populate 

the contractor’s project accounting and general ledger modules, 

according to contractor representatives and documents provided.1

Notably, the M&O contractor at Sandia does not meet the financial 

management system standards it sets for prospective subcontractors. 

According to the M&O contractor’s guidance for prospective 

subcontractors, an adequate accounting system must be able to collect, 

process, and report costs. It should be able to break out costs by cost 

element, and cost elements used should be easily traceable to the 

general ledger and the financial statements. As discussed above, the 

M&O contractor’s financial system does not enable cost elements to be 

easily traceable to the contractor’s general ledger, and the contractor 

does not produce corporate financial statements.

Representatives of the contractor told us that they have processes and 

controls in place that ensure that cost information from their subsystems 

reconciles with amounts charged to DOE. However, documentation the 

contractor provided us regarding costs contained in each subsystem did 

not reconcile with amounts included on the contractor’s statement of 

costs incurred and claimed, and contractor officials could not confirm that 

the transactional expenditures pulled from the sub-accounting systems 

were reconciled with amounts charged to DOE. Instead, these officials 

suggested that we use data analytics on the subset of data contained in 

each of the sub-accounting systems—an approach they told us they use 

to ensure that the financial information they are reporting to DOE is 

proper. Unless the transactional expenditures pulled from the contractor’s 

sub-accounting systems are reconciled with amounts charged to DOE, 

however, there is no assurance that the data are complete. Without 

complete data, meaningful analysis using data analytics is not possible.

According to DOE’s contract with the M&O contractor, the contractor’s 

financial management systems are to be responsive to the responsibilities 

of sound financial stewardship and public accountability. The overall 

system is to include an integrated accounting system suitable to collect, 

record, and report all financial activities; a budgeting system for the 

formulation and execution of resource requirements; a disbursements 

 1

The project accounting module contains information that is summarized by project and 

task, and the general ledger module contains information that is summarized by budget 

code.
Appendix II: Details of Issues Identified with 

the Data Provided by the M&O Contractor

Page 48 GAO-17-235 Department of Energy

system for employee payroll and supplier payments; and an effective 

internal control system for all expenditures. Given the difficulty in 

producing transaction-level cost data that are reconcilable to the amounts 

charged to DOE, it is unclear how DOE ensures that the M&O contractor 

at Sandia meets these requirements.
Appendix III: Comments from the Department 

of Energy

Page 49 GAO-17-235 Department of Energy

Appendix III: Comments from the 

Department of Energy
Appendix III: Comments from the Department 

of Energy

Page 50 GAO-17-235 Department of Energy
Appendix III: Comments from the Department 

of Energy

Page 51 GAO-17-235 Department of Energy
Appendix III: Comments from the Department 

of Energy

Page 52 GAO-17-235 Department of Energy
Appendix III: Comments from the Department 

of Energy

Page 53 GAO-17-235 Department of Energy
Appendix IV: Comments from the Department 

of Energy Office of Inspector General

Page 54 GAO-17-235 Department of Energy

Appendix IV: Comments from the 

Department of Energy Office of Inspector 

General
Appendix IV: Comments from the Department 

of Energy Office of Inspector General

Page 55 GAO-17-235 Department of Energy
Appendix V: GAO Contact and Staff

Acknowledgments

Page 56 GAO-17-235 Department of Energy

David C. Trimble, (202) 512-3841 or trimbled@gao.gov

In addition to the contact named above, Diane LoFaro (Assistant 

Director), David Dornish, Farrah Graham, Mark Keenan, Courtney 

Liesener, Andrew Moore, and Kathryn Pedalino made key contributions to 

this report.

Appendix V: GAO Contact and Staff 

Acknowledgments

GAO Contact

Staff 

Acknowledgments

(361651)
The Government Accountability Office, the audit, evaluation, and investigative 

arm of Congress, exists to support Congress in meeting its constitutional 

responsibilities and to help improve the performance and accountability of the 

federal government for the American people. GAO examines the use of public 

funds; evaluates federal programs and policies; and provides analyses, 

recommendations, and other assistance to help Congress make informed 

oversight, policy, and funding decisions. GAO’s commitment to good government 

is reflected in its core values of accountability, integrity, and reliability.

The fastest and easiest way to obtain copies of GAO documents at no cost is 

through GAO’s website (http://www.gao.gov). Each weekday afternoon, GAO 

posts on its website newly released reports, testimony, and correspondence. To 

have GAO e-mail you a list of newly posted products, go to http://www.gao.gov

and select “E-mail Updates.”

The price of each GAO publication reflects GAO’s actual cost of production and 

distribution and depends on the number of pages in the publication and whether 

the publication is printed in color or black and white. Pricing and ordering 

information is posted on GAO’s website, http://www.gao.gov/ordering.htm. 

Place orders by calling (202) 512-6000, toll free (866) 801-7077, or 

TDD (202) 512-2537.

Orders may be paid for using American Express, Discover Card, MasterCard, 

Visa, check, or money order. Call for additional information.

Connect with GAO on Facebook, Flickr, LinkedIn, Twitter, and YouTube.

Subscribe to our RSS Feeds or E-mail Updates. Listen to our Podcasts.

Visit GAO on the web at www.gao.gov and read The Watchblog.

Contact:

Website: http://www.gao.gov/fraudnet/fraudnet.htm

E-mail: fraudnet@gao.gov

Automated answering system: (800) 424-5454 or (202) 512-7470

Katherine Siggerud, Managing Director, siggerudk@gao.gov, (202) 512-4400, 

U.S. Government Accountability Office, 441 G Street NW, Room 7125, 

Washington, DC 20548

Chuck Young, Managing Director, youngc1@gao.gov, (202) 512-4800

U.S. Government Accountability Office, 441 G Street NW, Room 7149 

Washington, DC 20548

James-Christian Blockwood, Managing Director, spel@gao.gov, (202) 512-4707

U.S. Government Accountability Office, 441 G Street NW, Room 7814, 

Washington, DC 20548

GAO’s Mission

Obtaining Copies of 

GAO Reports and 

Testimony

Order by Phone

Connect with GAO

To Report Fraud, 

Waste, and Abuse in 

Federal Programs

Congressional 

Relations

Public Affairs

Strategic Planning and 

External Liaison

Please Print on Recycled Paper.