Department of Homeland Security
 

Department of Homeland Security’s FY 2012 


Compliance with the Improper Payments 


Elimination and Recovery Act of 2010 


OIG-13-47 March 2013
 
 

Assistant Inspector General for Audits 

 OFFICE OF INSPECTOR GENERAL 

 Department of Homeland Security 

 Washington, DC 20528 / www.oig.dhs.gov

MAR 12 2013 

MEMORANDUM FOR: Stacy Marcott 

Deputy Chief Financial Officer 

Office of Chief Financial Officer 

FROM: Anne L. Richards 

SUBJECT: DepartmentfoffHomelandfSecurity’sfFYf2012fCompliancef

withfthefImproper Payments Elimination and Recovery Act 

of 2010 

ff

Attached for your action is our final report, DepartmentfoffHomelandfSecurity’sfFYf2012f

CompliancefwithfthefImproper Payments Elimination and Recovery Act of 2010.ffWe 

incorporated the formal comments from the Departmental GAO-OIG Liaison Office in 

the final report. 

The report contains eight recommendations aimed at improving the overall effectiveness 

of the improper payment reduction program. The Departmental GAO-OIG Liaison Office 

concurred with all the recommendations. Based on information provided in the 

Department’s response to the draft report, we consider all recommendations resolved. 

Once your office has fully implemented the recommendations, please submit a formal 

closeout letter to us within 30 days so that we may close the recommendations. The 

memorandum should be accompanied by evidence of completion of agreed-upon 

corrective actions and of the disposition of any monetary amounts. 

Consistent with our responsibility under the InspectorfGeneralfAct, we are providing 

copies of our report to appropriate congressional committees with oversight and 

appropriation responsibility over the Department of Homeland Security. We will post 

the report on our website for public dissemination. 

 

Please call me with any questions, or your staff may contact Mark Bell, Deputy Assistant 

Inspector General for Audits, at (202) 254-4100. 

Attachment 
 

 

 

 

 

 

 

 

 

OFFICE OF INSPECTOR GENERAL 

Department of Homeland Security 

Table of Contents 

Executive Summary ............................................................................................................ 1
 

Background ........................................................................................................................ 2
 

Results of Audit .................................................................................................................. 6
 

DHS’ Compliance with IPERA .................................................................................. 6
 

DHS’ Controls over Improper Payment Testing and Reporting ............................. 6
 

Recommendations ............................................................................................... 11 

Management Comments and OIG Analysis ......................................................... 12 

Appendixes 

Appendix A: Objectives, Scope, and Methodology............................................ 15 

Appendix B: Management Comments to the Draft Report............................... 17 

Appendix C: Major Contributors to This Report ................................................ 22 

Appendix D: Report Distribution ........................................................................ 23 

Abbreviations

AFR Annual Financial Report

CBP U.S. Customs and Border Protection 

CFO Chief Financial Officer 

DHS Department of Homeland Security 

ePMO electronic Program Management Office 

FEMA Federal Emergency Management Agency 

FY fiscal year

ICE U.S. Immigration and Customs Enforcement

IPERA ImproperfPaymentsfandfEliminationfRecoveryfActfoff2010f

IPIA ImproperfPaymentsfInformationfActfoff2002

NPPD National Protection and Programs Directorate 

OIG Office of Inspector General

OMB Office of Management and Budget 

PAR Performance and Accountability Report 

RM&A Risk Management and Assurance 

TSA Transportation Security Administration

USCG United States Coast Guard 

www.oig.dhs.gov OIG-13-47
 

OFFICE OF INSPECTOR GENERAL 

Department of Homeland Security 

Executive Summary 

In fiscal year 2010, the Federal Government’s total improper payment amount was at a 

high of $121 billion. In that same year, Congress passed the ImproperfPaymentsf

EliminationfandfRecoveryfActfoff2010 in an effort to reduce improper payments. Since 

fiscal year 2010, the Federal Government’s total improper payment rate has declined to 

$115 and $108 billion for fiscal years 2011 and 2012, respectively. In addition to 

reducing improper payments, the Act requires each agency’s Inspector General to 

annually determine if the agency is in compliance with the Act. 

Our audit objective was to determine whether the Department of Homeland Security 

(DHS) complied with the Act. In addition, we also evaluated the accuracy and 

completeness of DHS’ improper payment reporting and its efforts to reduce and recover 

improper payments for fiscal year 2012. 

We contracted with the independent public account firm, KPMG LLP, to determine 

whether DHS complied with the Act. KPMG LLP did not find any instances of 

noncompliance with the Act. 

We reviewed the accuracy and completeness of DHS’ improper payment reporting and 

its efforts to reduce and recover improper payments. DHS needs to improve internal 

controls to ensure the accuracy and completeness of improper payment reporting. 

Specifically, it needs to improve its review processes to ensure that the risk assessments 

properly support the components’ determination of programs susceptible to significant 

improper payments. Furthermore, DHS needs to adequately segregate duties and 

improve its policies and procedures to identify, reduce, and report improper payments. 

We made eight recommendations that if implemented would improve the accuracy and 

completeness of DHS’ improper payment reporting and improve its efforts to recover 

any overpayments. The Department concurred with all of the recommendations. 

www.oig.dhs.gov 1 OIG-13-47
 
 

 

 

OFFICE OF INSPECTOR GENERAL 

Department of Homeland Security 

Background 

DHS’ mission is to counter terrorism and enhance U.S. security; secure and manage U.S. 

borders; enforce and administer U.S. immigration laws; protect cyber networks and 

critical infrastructure; and ensure resilience from disasters. In fiscal years (FY) 2011 and 

2012, DHS paid $63.6 billion and $68.1 billion, respectively, in support of its mission. 

DHS identified 12 programs as high risk for improper payments based on FY 2012 risk 

assessments and FY 2011 payment sample testing. Out of the $11.2 billion payments 

for these high-risk programs, DHS estimates it made a total of $203 million in improper 

payments, a 1.82 percent error rate.

On July 22, 2010, the President signed Public Law 111-204, ImproperfPaymentsf

EliminationfandfRecoveryfActfoff2010 (IPERA). The term improper payment— 

A.	 means any payment that DHS should not have made or that DHS made in an 

incorrect amount under statutory, contractual, administrative, or other legally 

applicable requirements; and 

B.	 includes any payment to an ineligible recipient, any payment for an ineligible 

service, any duplicate payment, payments for services not received, and any 

payment that does not account for credit for applicable discounts.1

IPERA requires that the head of each agency periodically review all programs and 

activities administered, and identify the programs and activities that may be susceptible 

to significant improper payments. These reviews shall take into account risk factors 

likely to contribute to the susceptibility of significant improper payments. IPERA 

considers a program susceptible to improper payments if improper payments in the 

program or activity in the preceding fiscal year exceeded $10 million and account for 

2.5 percent of program outlays. 

With respect to each program identified as susceptible to significant improper 

payments, the head of the relevant agency shall produce a statistically valid estimate of 

the improper payments made by each program and activity, and include those estimates 

in the accompanying materials to the annual financial statements. For FY 2012, DHS 

reported an improper payment estimate of $203 million from 12 programs across 4 

components. 

1

 The Office of Management and Budget (OMB) Circular A-123, Appendix C, “RequirementsfforfEffectivef

MeasurementfandfRemediationfoffImproperfPayments,”fApril 14, 2011, also requires a payment to be

considered an improper payment when an agency’s review is unable to discern whether a payment was 

proper as a result of insufficient or lack of documentation.

www.oig.dhs.gov 2	 OIG-13-47
 
 

 

OFFICE OF INSPECTOR GENERAL 

Department of Homeland Security 

Table 1. DHS FY 2012 Estimated Improper Payment Amounts and Rates 

DHS Component Estimated 

Payment 

Population

($ millions)

Improper 

Payments 

($ millions)

Improper 

Payment 

Rate (%)

U.S. Customs and Border Protection 

Border Security Fencing $197 $0 0.03% 

Refund and Drawback $1,343 $0 0.01% 

Federal Emergency Management Agency 

Disaster Relief Program – Individuals and 

Households Program 

$880 $3 0.29% 

Disaster Relief Program – Vendor Payments $494 $15 3.09% 

Insurance – National Flood Insurance 

Program 

$794 $6 0.75% 

Grants – Public Assistance Programs $2,990 $9 0.31% 

Grants – Homeland Security Grant Program $1,472 $15 1.00% 

Grants – Assistance to Firefighters Grants $471 $8 1.60% 

Grants – Transit Security Grants Program $196 $3 1.77% 

Grants – Emergency Food and Shelter 

Program 

$45 $1 2.51% 

U.S. Immigration and Customs Enforcement

Enforcement and Removal Operations $1,570 $133 8.47% 

National Protection and Programs Directorate 

Federal Protective Service $733 $10 1.37% 

DHS-All Programs $11,185 $203 1.82% 

Source:f Data from DHS FY 2012 Annual Financial Report. DHS calculated its FY 2012 estimated improper 

payment rates using FY 2011 payment data.

The Office of Management and Budget (OMB) issued Circular A-123, Appendix C, 

“RequirementsfforfEffectivefMeasurementfandfRemediationfoffImproperfPayments,” 

parts I and II, April 14, 2011, as guidance for agencies to implement the requirements of 

IPERA. This guidance includes responsibilities for the DHS Inspector General to 

determine DHS’ compliance with IPERA. To determine compliance with IPERA, the DHS 

Inspector General should review the agency’s Performance and Accountability Report

(PAR) or Annual Financial Report (AFR) and any accompanying information to ensure 

that DHS has met IPERA reporting requirements.

In addition, the DHS Inspector General should also evaluate the accuracy and 

completeness of agency reporting, and evaluate agency performance in reducing and 

recapturing improper payments. 

www.oig.dhs.gov 3 OIG-13-47
 
 

 

 

 

OFFICE OF INSPECTOR GENERAL 

Department of Homeland Security 

We reviewed the processes and procedures for DHS and the following DHS components: 

• United States Coast Guard (USCG); 

• U.S. Customs and Border Protection (CBP); 

• Federal Emergency Management Agency (FEMA); 

• U.S. Immigration and Customs Enforcement (ICE); 

• National Protection and Programs Directorate (NPPD); and 

• Transportation Security Administration (TSA). 

On February 25, 2012, the DHS Risk Management and Assurance Division (RM&A 

Division) issued version 2.0 of its ImproperfPaymentsfReductionfGuidebook (Guidebook).2

This Guidebook supports the Department’s efforts to identify, reduce, report, and 

recoup improper payments. It also provides DHS components with instructions for 

complying with IPERA, Executive Order 13520, and OMB guidance for the 

implementation of IPERA. 

2

 Previously known as DHS Office of Chief Financial Officer, Internal Control Program Management Office 

or as DHS Office of Chief Financial Officer, Internal Control and Risk Management.

www.oig.dhs.gov 4 OIG-13-47
 
 

OFFICE OF INSPECTOR GENERAL 

Department of Homeland Security 

The diagram below shows the process DHS components are required to follow to 

identify, estimate, report, and recover improper payments.

Source: Information obtained from the DHS ImproperfPaymentsfReductionfGuidebook, Office of 

Chief Financial Officer, Risk Management and Assurance Division Office.

www.oig.dhs.gov 5 OIG-13-47
 
 

 

OFFICE OF INSPECTOR GENERAL 

Department of Homeland Security 

Results of Audit 

To comply with IPERA, an agency is required to conduct risk assessments and report and 

publish the results of selected program testing in its AFR.3 It must also achieve and 

report improper payment rates of less than 10 percent for each program. KPMG LLP 

(KPMG) did not find any instances of noncompliance with IPERA. 

Additionally, we reviewed the processes and procedures by which DHS estimates its 

annual improper payment rates. Based on our review, we determined that DHS needs 

to improve controls to ensure the accuracy and completeness of improper payment 

reporting. 

DHS’ Compliance with IPERA 

We contracted with KPMG to determine whether DHS complied with IPERA in 

FY 2012. KPMG audited DHS to determine whether it met the following 

requirements prescribed by IPERA: 

•	 Published an AFR and accompanying materials required by OMB on the

agency website; 

•	 Conducted required program-specific risk assessments; 

•	 Published improper payment estimates for high-risk programs; 

•	 Published programmatic corrective action plans; 

•	 Published, and has met, annual reduction targets for programs at risk; 

•	 Achieved and reported a gross improper payment rate of less than 

10 percent for all programs tested; and 

•	 Reported on its efforts to recover improper payments. 

KPMG did not find any instances of noncompliance with the IPERA. 

DHS’ Controls over Improper Payment Testing and Reporting 

DHS needs to improve its controls over improper payment testing and reporting. 

Specifically, it needs to improve its review processes to ensure that the risk 

assessments properly support the components’ determination of programs 

susceptible to significant improper payments. Furthermore, DHS needs to 

adequately segregate duties and improve its policies and procedures to identify, 

3

 The risk assessments are annual reviews of all DHS-administered programs to identify programs 

susceptible to significant improper payments. 

www.oig.dhs.gov 6	 OIG-13-47
 
 

 

 

OFFICE OF INSPECTOR GENERAL 

Department of Homeland Security 

reduce, and report improper payments. These conditions occurred because DHS 

guidance was unclear and DHS RM&A Division’s review was not comprehensive. 

Components’ Risk Assessments 

Components did not properly support the conclusions made in the risk 

assessments. Specifically, they did not perform interviews, properly support 

their risk templates, or obtain proper approval of the risk assessments. The DHS 

Guidebook requires the components to perform comprehensive risk 

assessments to identify programs susceptible to significant improper payments. 

To accomplish this task, DHS designed a detailed methodology that requires the 

components to perform the following activities: 

1.	 Identify programs and determine population and scope of the 

component programs assessed. 

2.	 Conduct and document interviews. 

3.	 Populate a risk template.4

4.	 Validate risk elements and weights for each component program 

evaluated. 

5.	 Identify programs at significant risk of improper payments.

CBP and USCG officials stated that they did not conduct and document risk 

assessment interviews to gain a full understanding of the payment risks each 

program faced. According to a CBP official, they did not perform any interviews 

with the program offices to complete the risk assessments. USCG officials stated 

that they primarily relied on previous years’ risk assessments to complete the 

FY 2012 risk assessments. FEMA performed interviews but did not interview 

program managers or senior management as required by the DHS Guidebook. 

CBP, TSA, and FEMA did not properly support the conclusions made in the risk 

template. The DHS Guidebook requires the components to assign a weight (risk 

weight) to reflect the level of importance and influence of established risk 

conditions and a score (risk score) to the risk conditions to reflect the degree of 

risk present. The risk weight and risk score explanations should be included in 

the risk template and understandable to an outside reviewer.

4

 The risk template is populated with quantitative values (program disbursements) and qualitative values 

(degree of risk) to determine programs susceptible to improper payments. 

www.oig.dhs.gov 7	 OIG-13-47
 
 

OFFICE OF INSPECTOR GENERAL 

Department of Homeland Security 

CBP, TSA, and FEMA risk weight explanations did not provide enough 

information to be understandable to a DHS reviewer. Specifically: 

•	 CBP’s risk template explained that it populated each risk condition based 

on the perceived risk it concluded corresponded to each applicable 

condition. 

•	 TSA explained that the USCG Finance Center processed TSA payments 

and contracts. TSA determined the weight of each risk condition based 

on prior issues found during external audits, internal reviews, and input 

from each program office. 

•	 FEMA, with the exception of grants, did not provide any explanation 

because it used the standard risk condition weights provided in the risk 

templates. 

The explanations did not support why they gave certain weights for each risk 

condition or why risk weight distributions varied by program. In addition, FEMA 

and CBP changed the risk scores for some risk conditions but used the same 

explanation as FY 2011 to support the new score. 

The CBP Chief Financial Officer (CFO) or Deputy CFO did not review and sign off 

on CBP’s final risk assessment. According to the DHS Guidebook, risk assessments 

that are reviewed and approved by the DHS RM&A Division will undergo a last 

step before they are considered final: component CFO or Deputy CFO review 

and sign-off. According to CBP officials, the highest level of review and approval 

given to CBP’s risk assessment was by the Director, Financial Management 

Division, who is neither the CFO nor the Deputy CFO. 

Independence 

CBP did not have independent personnel developing and conducting the sample 

test plans. The DHS Guidebook indicates that payment reviewers should not 

have a role in processing or approving the specific payments under review. To 

the extent possible, payment reviewers should not have explicit annual 

performance goals related to reducing improper payments. OMB Circular A-123 

provides that control activities include policies, procedures, and mechanisms in 

place to ensure that agencies meet their objectives. This includes proper 

segregation of duties designed to reduce improper payments, and test payment 

files for improper payments. This segregation will promote independence and 

reduce the risk of inaccurate or incomplete improper payment data. 

www.oig.dhs.gov 8	 OIG-13-47
 
 

 

OFFICE OF INSPECTOR GENERAL 

Department of Homeland Security 

CBP has two high-risk programs that required sample testing, Border Security 

Fencing and Refunds and Drawbacks.5

 The Accounts Payable Directorate, who is 

directly responsible for reducing improper payments, oversaw the sample 

testing. The Accounts Payable Directorate designed the testing plan, distributed 

the sample to the testing teams, and reviewed the testing teams’ results prior to 

submitting the information to the DHS RM&A Division. In addition, the testing 

team for one of the high-risk programs was the original approving authority for 

the disbursements under review. This is a repeat finding and recommendation 

previously reported in FY 2011.6

DHS Guidebook

The DHS Guidebook provided components with background of applicable IPERA 

guidance and instructions to help the Department meet IPERA requirements. 

However, the components often needed to rely on additional instructions to 

complete the Guidebook requirements because of the inconsistency of its 

instructions. For example, the Guidebook devotes one section to discussing how 

the components determine the risk elements for evaluating each program. 

According to the Guidebook, the DHS RM&A Division provides components with 

a risk template, which they need to support with specific risk documentation. 

However, the DHS Guidebook does not explain what documentation the RM&A 

Division expected from the components to support the risk template. From 

other sections of the Guidebook, it can be inferred that because the risk 

template should be based on existing documentation and management 

knowledge, the results of program office and management interviews, the 

results of audit findings and review findings, and from other improper payment 

work, that this information should be properly documented as support for the 

risk template. The Guidebook does not specifically state RM&A Division’s 

expectations of specific risk documentation for the risk template. The DHS OIG 

also noted issues with the Guidebook during the FY 2011 DHS OIG IPERA audit. 

The RM&A Division made some improvements to the Guidebook in October 

2012, based on feedback from the components. 

DHS RM&A Division’s Reviews 

DHS RM&A Division’s reviews should have found that the components did not 

properly support their risk assessments. The Division’s responsibilities included 

5

 Reimbursement of duty paid for imported goods if exporting or returning goods to the supplier. 

6

 DHS OIG, “Department of Homeland Security’s Compliance with the ImproperfPaymentsfEliminationfandf

RecoveryfActfoff2010,” OIG-12-48, March 2012.

www.oig.dhs.gov 9 OIG-13-47
 
 

OFFICE OF INSPECTOR GENERAL 

Department of Homeland Security 

issuing the DHS Guidebook; reviewing and approving the components’ 

comprehensive risk assessment and sample test plans; and performing an 

independent review of the sample test results. It reviewed all of the 

components’ IPERA deliverables, which included risk assessments. The RM&A 

Division’s risk assessment review consisted of comparing the FY 2011 and 

FY 2012 risk weight and risk score narratives to identify differences. If the 

Division identified a difference between fiscal year information, it occasionally 

requested additional clarification from the component to understand the 

change. The Division review did not include obtaining and reviewing the 

summary interviews to ensure that the components properly supported the risk 

weights and risk scores. Reviewing the summaries would have also identified 

that CBP and USCG did not perform the required interviews. 

Because the DHS RM&A Division only analyzed the differences between FYs 2011 

and 2012 risk weight and risk score narratives, it did not identify that the risk 

weights and risk scores were not properly supported. It did identify some errors 

during their review; however, it approved the risk assessment without requiring 

the components to complete the corrections. 

The DHS RM&A Division also did not always follow the instructions or guidance 

that it issued. The Division’s DHS Guidebook required the components to submit 

a summary write-up of the interviews to the RM&A Division for review and the 

component CFO or Deputy CFO to review and sign off on the risk assessments 

before they were considered final. During the FY 2012 IPERA review, the RM&A 

Division determined that it would not request the summary interviews and that 

CFO approval was not a specific requirement of the DHS Guidebook. In addition, 

the Division required the components to use DHS’ electronic Program 

Management Office (ePMO) as a method for DHS RM&A to store, share, review, 

and approve IPERA documents online. However, the RM&A Division frequently 

reviewed and approved IPERA deliverables using email instead of using ePMO. 

For example, USCG received an email message from the RM&A Division 

approving the test plan in May, but the ePMO did not document RM&A 

Division’s approval until September. 

www.oig.dhs.gov 10 OIG-13-47
 
 

 

 

 

OFFICE OF INSPECTOR GENERAL 

Department of Homeland Security 

Recommendations 

We recommend that the Chief Financial Officer, Department of Homeland 

Security ensure that—

Recommendation #1:

DHS Risk Management and Assurance Division obtains and reviews the 

components’ interviews to ensure that the risk weights and risk scores are 

accurate and supported. 

Recommendation #2: 

DHS Risk Management and Assurance Division requires all components to 

provide detailed explanations and references to supporting documentation as to 

how they determined each risk weight and risk score. 

Recommendation #3: 

U.S. Customs and Border Protection and the United States Coast Guard perform 

interviews as part of the risk assessment process. 

Recommendation #4: 

Federal Emergency Management Agency performs interviews of the program 

managers or senior management.

Recommendation #5: 

U.S. Customs and Border Protection’s risk assessment is reviewed and approved 

by the Chief Financial Officer.

We also recommend that the Chief Financial Officer, Department of Homeland 

Security: 

Recommendation #6:

Modify the DHS Guidebook to add clarification that explicitly describes how to 

complete the components’ risk assessments. 

www.oig.dhs.gov 11 OIG-13-47
 
 

 

OFFICE OF INSPECTOR GENERAL 

Department of Homeland Security 

Recommendation #7: 

Develop and implement procedures to ensure the approval of risk templates 

only after the components have made all corrections. 

Recommendation #8: 

Develop standard operating procedures that clearly identify how the IPERA 

reviews and approvals will be coordinated with the components. 

Management Comments and OIG Analysis 

A copy of DHS’ response in its entirety is included as Appendix B. The 

components also provided technical comments and suggested revisions to our 

report in a separate document. We reviewed the technical comments and made 

changes in the report when appropriate. 

DHS acknowledged that it is still working to close the two remaining 

recommendations from the FY 2011 audit. Those recommendations required 

DHS to improve personnel independence in the testing phase and enhance the 

Department’s recovery auditing efforts.7 DHS plans to have FY 2011 corrective 

actions completed by September 30, 2013. For the FY 2012 audit, DHS 

concurred with all eight recommendations and has begun to formulate plans to 

implement the recommendations contained in the report. A summary of the 

responses and our analysis follows. 

Management Response to Recommendation #1: DHS concurs. DHS has begun 

action to address this recommendation. In February 2013, as part of its FY 2013 

risk assessment reviews, the RM&A Division formally requested the interview 

materials from all components. The RM&A Division will review the interview 

material to ensure that risk weights and scores submitted by the components 

are accurate and appropriately supported. DHS estimates that the RM&A 

Division will have all reviews completed by March 29, 2013. 

OIG Analysis: The recommendation will remain open and resolved until we have 

reviewed the risk weights and risk scores with the supporting interviews.

7

 DHS OIG, “Department of Homeland Security’s Compliance with the ImproperfPaymentsfEliminationfandf

RecoveryfActfoff2010” OIG-12-48, March 2012.

www.oig.dhs.gov 12 OIG-13-47
 
 

 

OFFICE OF INSPECTOR GENERAL 

Department of Homeland Security 

Management Response to Recommendation #2: DHS concurs. To address this 

recommendation, the RM&A Division has begun to review the submissions and 

coordinated with the components when necessary to ensure that submitted risk 

weights and scores are accurate and adequately supported. DHS estimates that 

the RM&A Division will have all reviews completed by March 29, 2013.

OIG Analysis: The recommendation will remain open and resolved until we have 

reviewed the risk weights and risk scores with the supporting documentation.

Management Response to Recommendation #3: DHS concurs. DHS has already 

taken action to address this recommendation. Specifically, CBP will keep 

separate interview notes, which will be available to independent reviewers, 

rather than directly integrating interview findings into the risk assessment, as 

was done in FY 2012. USCG will conduct interviews, validate data, and update 

the risk conditions. DHS estimates that the interviews will be completed by 

March 29, 2013.

OIG Analysis: The recommendation will remain open and resolved until we have 

reviewed the CBP and USCG interviews.

Management Response to Recommendation #4: DHS concurs. DHS estimates 

that FEMA will perform interviews of program managers and/or senior

management by March 29, 2013. 

OIG Analysis: The recommendation will remain open and resolved until we have 

reviewed the FEMA interviews.

Management Response to Recommendation #5: DHS concurs. DHS estimates 

that the CBP CFO will review and approve the FY 2013 risk assessment submission

by March 29, 2013. 

OIG Analysis: The recommendation will remain open and resolved until we have 

reviewed the CBP risk assessment. 

Management Response to Recommendation #6: DHS concurs. DHS estimates 

that by March 29, 2013, the RM&A Division will update the DHS Guidebook to 

clarify what documentation is adequate and required to support the risk template. 

OIG Analysis: The recommendation will remain open and resolved until we have 

reviewed the DHS Guidebook. 

www.oig.dhs.gov 13 OIG-13-47
 
 

 

OFFICE OF INSPECTOR GENERAL 

Department of Homeland Security 

Management Response to Recommendation #7: DHS concurs. DHS is taking 

actions to address this recommendation. Specifically, the RM&A Division has 

developed procedures to ensure that requested corrections and adjustments are 

addressed before final approval and acceptance of risk assessments. DHS 

estimates that the procedures will be implemented by March 29, 2013. 

OIG Analysis: The recommendation will remain open and resolved until we have 

reviewed the procedures. 

Management Response to Recommendation #8: DHS concurs. DHS estimates 

that by March 29, 2013, the RM&A Division will have implemented additional 

standard operating procedures for the review and final approval of risk 

assessments. 

OIG Analysis: The recommendation will remain open and resolved until we have 

reviewed the procedures. 

www.oig.dhs.gov 14 OIG-13-47
 
 

OFFICE OF INSPECTOR GENERAL 

Department of Homeland Security 

Appendix A 

Objectives, Scope, and Methodology 

The Department of Homeland Security (DHS) Office of Inspector General (OIG) was 

established by the HomelandfSecurityfActfoff2002 (Public Law 107-296) by amendment 

to the InspectorfGeneralfActfoff1978. This is one of a series of audit, inspection, and 

special reports prepared as part of our oversight responsibilities to promote economy, 

efficiency, and effectiveness within the Department. 

The audit objective was to determine whether DHS complied with the Improperf

PaymentsfEliminationfandfRecoveryfActfoff2010. In addition, we also evaluated the 

accuracy and completeness of DHS’ improper payment reporting and its efforts in 

reducing and recovering improper payments for FY 2012. 

The scope of the audit is DHS’ FY 2012 efforts to comply with IPERA. We limited our 

scope to certain DHS components. We reviewed all components identified in DHS’ AFR 

for FY 2011 as vulnerable to significant improper payments based on the FY 2011 risk 

assessments and prior year payment sample testing. The components reviewed were 

the United States Coast Guard, U.S. Customs and Border Protection, Federal Emergency 

Management Agency, U.S. Immigration and Customs Enforcement, Transportation 

Security Administration, and National Protection and Programs Directorate. 

To understand DHS’ requirements under IPERA and DHS’ policies and procedures to 

meet those requirements, we obtained and reviewed relevant authorities and guidance 

including IPERA, OMB’s memorandum on implementing IPERA, and the DHS Improperf

PaymentsfReductionfGuidebook. We also interviewed officials in DHS’ Office of Chief 

Financial Officer and the various components directly involved with IPERA 

implementation.

We contracted with independent auditor KPMG LLP to determine DHS compliance with 

IPERA. The contract required that KPMG perform its audit in accordance with generally 

accepted government auditing standards. Those standards require that the auditors 

plan and perform the audit to obtain sufficient, appropriate evidence to provide a 

reasonable basis for their findings and conclusions based upon the audit objectives. 

At each component, KPMG performed the following: 

• Obtained and read relevant authorities and guidance; 

• Interviewed component management; 

• Reviewed component policies; 

www.oig.dhs.gov 15 OIG-13-47
 
 

 

OFFICE OF INSPECTOR GENERAL 

Department of Homeland Security 

•	 Reviewed components’ risk assessment processes; 

•	 Reviewed components’ sampling plans and methodologies; and 

•	 Reviewed components’ corrective action plans.

At DHS, KPMG reviewed DHS’ FY 2012 AFR to determine compliance with reporting 

requirements. 

To evaluate the accuracy and completeness of DHS’ improper payment reporting, we 

performed the following procedures: 

•	 Reviewed components’ risk assessments; 

•	 Reconciled components’ risk assessments with FY 2011 gross disbursement data; 

•	 Reviewed sample test plans and results; and 

•	 Reviewed DHS’ internal controls over the processes and procedures used to 

estimate the improper payment rate, including the risk assessment process, 

testing, and reporting. 

We did not conduct any sample payment testing to validate DHS’ estimated improper 

payment rates reported in the FY 2012 AFR. 

To evaluate DHS’ performance in reducing and recapturing improper payments, we 

performed the following procedures: 

•	 Reviewed DHS’ corrective action plans; and 

•	 Determined recovery audits performed. 

We conducted this performance audit between August 2012 and January 2013 pursuant 

to the InspectorfGeneralfActfoff1978, as amended, and according to generally accepted 

government auditing standards. Those standards require that we plan and perform the 

audit to obtain sufficient, appropriate evidence to provide a reasonable basis for our

findings and conclusions based upon our audit objectives. We believe that the evidence 

obtained provides a reasonable basis for our findings and conclusions based upon our 

audit objectives. 

www.oig.dhs.gov 16 	 OIG-13-47
 
OFFICE OF INSPECTOR GENERAL 

 Department of Homeland Security 

Appendix B 

Management Comments to the Draft Report 

u.s. Dtpartnltnl of lIorndand S«urity WasblnjttOtl, DC lOS18 

(I Homeland ~" .. ,i<t Security 

March 4, 2013 

MEMORANDUM FOR; Anne L. Richards 

Assistant Inspector General for Audit 

FROM; Jim H. Crumpacker \~fI . ~ Director 

Departmental GAO-OIG 

\1' 

Liaison 

~ 

Office 

SUBJECT: Department of Homeland Security's FY 2012 Compliance with the 

Improper Payments Elimination and Recovery Act of2010 

(Project No. 12-002-AUD-MGMT) 

Thank you for the opportunity to review nnd comment on this draft report. We appreciate the 

Office of Inspector General 's (010'5) work in conducting this statutorily required annual review 

and issuing this report. 

We are pleased to note that for the fourth year in a row, KPMG LLP, U,e Department's 

independent auditor, has not identified any instances of noncompliance with the Improper 

Payments Elimination and Recovery Act of2010 (lPERA), as amended. With respect to your i Fiscal Year (FY) 2011 audit recommendations, we aCknowledge closure offourofU,e six 

recommendations and advancement to closure on the remaining two. 

Specificall y, the fi rst open recommendation relates to improving personnel independence in the 

testing phase. We note the finding relnted to this recommendation has been partially addressed. 

Last year's report identified independence issues for Headquarters and two Components; this 

yea r's report identified only one Component. The second open recommendation relates to 

enhancing the Department's recovery auditing efforts, where cost effective. We have found that 

recovery auditing is not cost effective at the U.S. Secret Service because of security restrictions 

that necessitate all recovery audit work be perfonnerl on-site, the rel atively small size of the U.S. 

Secret Service, and vendor feedback . We are working to improve our targeted rccovery audit 

efforts for the U.S. Coast Guard (USCG) and its eross~serviced Components (Le., the 

Transportation Security Administration and the Domestic Nuclear Detection Office), and these 

efforts will be completed by September 30, 2013. 

The Department has enhanced its efforts to eliminate improper payments. For example, the 

Federal Emergency Management Agency (FEMA), working closely with the DHS Chief 

Financial Officer's Risk Management and Assurance Division (RM&A), continues to 

t Department 0/ HOIIIl'lmuf Secun"I)J'S Compliance with the Impropl!r Parmems ElimintJIion lind Rl'CO\'ery Act of 

lOIO(OIG· 12-48. March 20 12). 

www.oig.dhs.gov 17 OIG-13-47
 
 Department of Homeland Security 

consistently reduce the estimated error rate for FEMA 's high-risk programs. Specifically, the 

overall error rate dropped from 8.0 percent reported in FY 2009 to 1.7 percent in FY 2010. The 

error rnte fell below the reduced agency target rate of 1.5 percent in FY 2011 and FY 2012, 

2 years in adva nce of the FY 2014 requirement. This improvement is a result of continuous 

focus and efforts by the RM&A and FEMA slaffs, who led and completed corrective action plans 

to eliminate improper payments. Other FEMA improvements include adding applicant eligibility 

edit checks, standardizing documentation requirements, and providing training on the root causes 

of errors and steps to address payment risks. 

The Department has also enhanced its efforts to eliminate improper payments above and beyond 

the statutory and regulatory requirements. In FY 2012, RM&A stafT completed independent 

reviews of Component payment sample test results. The resulting reports allowed us to confinn 

findings and provide Component-specific and general recommendations to further improve the 

accuracy and efficiency of payment testing. The Department has instituted severnl efforts to 

improve payment controls and processes, and implemented the statutorily required "Do Not Pay 

Portal" databases. This portal will allow DHS to leverage existing government databases to 

identify and prevent potential improper payments. In addition, we have organized a Payment 

Center Work Group, bringing together Department and Component experts in payment 

management and processing, internal controls, and procurement to identify sources and causes of 

improper payments and existing best practices, as well as to promote the implementation of those 

practices. 

OFFICE OF INSPECTOR GENERAL 

Your FY 20 12 report contained eight recommendations with which the Department concurs. 

Several of the recommendations require similar actions to close. The attached chart summarizes 

the completed and planned actions we have identified to address each rccommendation. We 

request that al l the recommendations be considered resolved and open. 

SpecificalJy. 0 10 recommended that the Chief Financial Officer, Depanmcnt of Homeland 

Security ensure that the: 

Recommendation I: DHS Risk Management and Assurance Division obtains and reviews the 

components' interviews to ensure the risk weights and risk scores are nceuratc and supported. 

Estimated Completion Date (ECD): March 29, 2013. 

Response: Concur. DH has already taken action to address this recommendation. 

Specifically. Components were provided notice of this requirement during an Oclober 17, 2012 

Workshop on the Departmcnt's FY 2013 update to the Improper Payments Reduction Guidebook 

(Guidebook). Subsequently, RM&A requcsted interview materials from all Components on 

February 4, 2013, as part of its FY 2013 risk assessment review. These materials are being 

examined by RM&A staff to ensure risk weights and scores submitted by Components arc 

accurate and appropriately supported. 

Recommendation 2: DHS Risk Management and Assurance Division requires all components 

to provide dctailed explanations and references to supporting documentation as to how they 

detcnnined each risk weight nnd risk scorc. 

2 

 

www.oig.dhs.gov 18 OIG-13-47
 
 

OFFICE OF INSPECTOR GENERAL 

 Department of Homeland Security 

Response: Concur. DHS has already taken action to address this recommendation. 

Specifically, the RM&A staff have reviewed the submissions and have extensively discussed 

with and made additional requests to Components where necessary to ensure submitted risk 

weights Dnd scores are accurate and adequately supponed. ECD: March 29, 20 13. 

Recommendation 3: U.S. Customs and Border Protection [CBP] and the u.s. Coast Guard 

perfonn interviews as pan of the risk assessment process. 

Response: Concur. DHS has already taken action to address this recommendation. 

Specifically. the Internal Controls Branch within the CBP Offiee of the Chief Financial Officer 

(OCFO) will keep separate intelVicw notes, which will be available to independent reviewers, 

rather than directly integrating intclView findings into the risk assessment, as was done in FY 

2012. The USCG OCFO will conduct intcrviews, validate data, and update risk conditions. 

ECD: March 29, 2013. 

Recommelldnlion4: Federal Emergency Managemenl Agency [FEMA] perfonns intclVicws of 

the program managers or senior management. 

Response: Concur. The FEMA OCFO will perfonn intelViews of program managers and/or 

senior managemcnt. ECO: March 29, 2013. 

Recommendntion 5: U.S. Customs and Border Protection's risk assessment is reviewed and 

approved, at a minimum, by the Deputy Chief Financial Officer. 

Response: Concur. CBP's Chief Financial Officer will sign the risk assessment submission 

after RM&A's final review and approval. ECO: March 29, 2013. 

Recommendation 6: Modify the DHS Guidcbook 10 add clarification Ihal explicitly describes 

how to complete the components' risk assessments. 

Res ponse: Concur. RM&A will update the Guidebook to ensure clarification of what 

documentation is adcqurltc and required to suppon the risk tcmplatc. ECO: March 29, 2013. 

Rccommcndalioll 7: Dcvelop and implcment procedures to ensure the approval of risk 

templates only after the components have made all corrections. 

Res ponse: Concur. OHS is taking action to address this recommendation. Specifi cally, RM&A 

devclopl."<I proct."<iurcs in support of the Guidebook. These proccdurl.'S will ensure that requested 

corrections and adjustmcnts are addressed before finalllpproval and acceptance of risk 

assessments. ECD: March 29, 2013. 

Rccommendalioll 8: Develop standard operating procedures that clearly identify how the 

IPERA reviews and approvals will be coordinated with thc components. 

Response: Concur. RM&A will include additional standard operating procedures related to lhe 

coordination of review and final approval of risk assessments. ECO: March 29, 2013. 

3 

 

www.oig.dhs.gov 19 OIG-13-47
 
OFFICE OF INSPECTOR GENERAL 

 Department of Homeland Security 

Again, thank you for the opportunity to review and comment on this druft report. Technical 

comments were previously submitted under separate cover. Please feci free to contact me if you 

have any questions. We look forward to working with you in the future. 

A ttachmcnt 

4 

 

www.oig.dhs.gov 20 OIG-13-47
 
 

 

OFFICE OF INSPECTOR GENERAL 

Department of Homeland Security 

www.oig.dhs.gov 21 OIG-13-47
 
 

OFFICE OF INSPECTOR GENERAL 

Department of Homeland Security 

Appendix C 

Major Contributors to This Report 

Sandra John, Director 

Devon R. Houston, Audit Manager 

Hope E. Franklin, Auditor 

Kendra L. Loper, Auditor 

Irene Aultman, Auditor 

Natalie K. Fussell, Program Analyst 

Roger W. Thoet, Auditor 

John D. Kohler, Program Analyst 

Jeff H. Mun, Auditor 

Brian D. Smythe, Program Analyst 

Heidi Y. Adams, Intern 

Kevin Dolloson, Communications Analyst 

Ralleisha Dean, Independent Referencer 

www.oig.dhs.gov 22 OIG-13-47
 
 

OFFICE OF INSPECTOR GENERAL 

Department of Homeland Security 

Appendix D

Report Distribution 

Department of Homeland Security

Secretary 

Deputy Secretary 

Chief of Staff 

Deputy Chief of Staff

General Counsel 

Executive Secretary 

Director, GAO/OIG Liaison Office 

Assistant Secretary for Office of Policy 

Assistant Secretary for Office of Public Affairs

Assistant Secretary for Office of Legislative Affairs 

Component Liaison, U.S. Coast Guard 

Component Liaison, Customs and Border Protection 

Component Liaison, Federal Emergency Management Agency 

Component Liaison, Immigration and Customs Enforcement 

Component Liaison, National Protection and Programs Directorate 

Component Liaison, Transportation Security Administration 

Acting Chief Privacy Officer 

Office of Management and Budget

Chief, Homeland Security Branch 

DHS OIG Budget Examiner 

Congress

Committee on Homeland Security and Governmental Affairs of the Senate 

Committee on Oversight and Governmental Reform of the House of Representatives 

www.oig.dhs.gov 23 OIG-13-47
 
 

ADDITIONAL INFORMATION AND COPIES 

To obtain additional copies of this document, please call us at (202) 254-4100, fax your 

request to (202) 254-4305, or e-mail your request to our Office of Inspector General 

(OIG) Office of Public Affairs at: DHS-OIG.OfficePublicAffairs@oig.dhs.gov. 

For additional information, visit our website at: www.oig.dhs.gov, or follow us on Twitter 

at: @dhsoig. 

OIG HOTLINE 

To expedite the reporting of alleged fraud, waste, abuse or mismanagement, or any 

other kinds of criminal or noncriminal misconduct relative to Department of Homeland 

Security (DHS) programs and operations, please visit our website at www.oig.dhs.gov 

and click on the red tab titled "Hotline" to report. You will be directed to complete and 

submit an automated DHS OIG Investigative Referral Submission Form. Submission 

through our website ensures that your complaint will be promptly received and 

reviewed by DHS OIG. 

Should you be unable to access our website, you may submit your complaint in writing 

to: DHS Office of Inspector General, Attention: Office of Investigations Hotline, 245 

Murray Drive, SW, Building 410/Mail Stop 2600, Washington, DC, 20528; or you may 

call 1 (800) 323-8603; or fax it directly to us at (202) 254-4297. 

The OIG seeks to protect the identity of each writer and caller.