National Flood Insurance 

Program's Management Letter 

for DHS' FY 2015 Financial 

Statements Audit (Redacted) 

June 9, 2016 

OIG-16-101
 
 

 

 

 

 

FOR OFFICIAL USE ONLY 

 DHS OIG HIGHLIGHTS
 

National Flood Insurance Program’s

Management Letter for

DHS’ FY 2015 Financial Statements Audit 


 

June 9, 2016 

Why We Did 

This Audit 

The Chief Financial Officers 

Act of 1990 (Public Law 101-

576) and the Department Of 

Homeland Security Financial 

Accountability Act (Public 

Law 108-330) require us to 

conduct an annual audit of 

the Department of Homeland

Security’s (DHS) 

consolidated financial 

statements and internal 

control over financial 

reporting. 

For Further Information: 

Contact our Office of Public Affairs at 

(202) 254-4100, or email us at 

DHS-OIG.OfficePublicAffairs@oig.dhs.gov 

What We Found

KPMG LLP, under contract with the DHS Office 

of Inspector General, audited the National Flood 

Insurance Program’s financial statements and 

internal control over financial reporting for fiscal 

year (FY) 2015. The resulting management letter 

contains two observations related to internal 

controls and other operational matters for 

management’s consideration. KPMG LLP noted 

internal control deficiencies and the need for 

improvement in system calculated premiums, 

and system calculated case loss reserves. These 

deficiencies are not considered significant and 

were not required to be reported in the 

Independent Auditors’ Report on DHS’ FY 2015 

Financial Statements and Internal Control over 

Financial Reporting, dated November 13, 2015, 

included in the DHS FY 2015 Agency Financial 

Report. These observations are intended to 

improve internal control or result in other 

operating efficiencies. 

FEMA Response 

FEMA concurred with all of the 

recommendations and has begun implementing 

corrective actions. 


 

www.oig.dhs.gov OIG-16-101 

FOR OFFICIAL USE ONLY 
6¢M7

x ~" 

~~~+NO =~.~` 

OFFICE OF INSPECTOR GENERAL

Department of Homeland Security

Washington, DC 20528 / www.oig.dhs.gov

JUN 9 2016

MEMORl~NDUM FOR: Roy Wright

Associate Administrator

Federal Insurance Mitigation Administration

Federal Emergency Mana ement ge y

FROM: Mark Bell ✓ - t

Assistant Inspector General for Audits

SUBJECT: National Flood Insurance Program's Management Letter

for DHS' FY 2015 Financial Statements Audit

Attached for your action is our final report, National Flood Insurance Program's

Management Letter for DHS' FY 2015 Financial Statements Audit. This report

contains two observations related to internal control deficiencies that were not

required to be reported in our Independent Auditors' Report on DHS' FY 2015

Financial Statements and Internal Control over Financial Reporting, dated

November 13, 2015, which was included in the Department of Homeland

Security's (DHS) fiscal year (FY) 2015 Agency Financial Report. We do not

require management's response to the recommendations.

The independent public accounting firm KPMG LLP conducted the audit of

DHS' FY 2015 financial statements and is responsible for the attached

management letter and the conclusions expressed in it.

Consistent with our responsibility under the Inspector General Act, we will

provide copies of our report to congressional committees with oversight and

appropriation responsibility over the Department of Homeland Security. In a

June 1, 2016, request, the Federal Emergency Management Agency's Office of

Chief Financial Officer requested that we redact certain information from the

report. Specifically, the flood insurance policy numbers and date of loss are

considered Sensitive Personally Identifiable Information as defined in the

Privacy Office's Handbook for Safeguarding Sensitive Personally Identifiable

Information at the Department of Homeland Security. As a result, we have

redacted the policy numbers and date of loss information from the report and

will post a redacted version of the report on our website for public

dissemination.

Please call me with any questions, or your staff may contact Maureen Duddy,

Deputy Assistant Inspector General for Audits, at (617) 565-8723.

Attachment
 

 

FOR OFFICIAL USE ONLY
 

KPMG LLP 

1676 International Drive 

McLean, VA 22102 

December 15, 2015 

Office of Inspector General and Chief Financial Officer, 

U.S. Department of Homeland Security, and 

Associate Administrator, Federal Insurance and Mitigation Administration,
 

U.S. Department of Homeland Security, Federal Emergency Management Agency
 

Washington, DC
 

Ladies and Gentlemen: 

In planning and performing our audit of the consolidated financial statements of the U.S. Department 

of Homeland Security (DHS or Department), as of and for the year ended September 30, 2015, in 

accordance with auditing standards generally accepted in the United States of America; the standards 

applicable to financial audits contained in Government Auditing Standards issued by the Comptroller 

General of the United States; and Office of Management and Budget (OMB) Bulletin No. 15-02, 

Audit Requirements for Federal Financial Statements, we considered the Department’s internal 

control over financial reporting (internal control) as a basis for designing audit procedures that are 

appropriate in the circumstances for the purpose of expressing our opinion on the consolidated 

financial statements. In conjunction with our audit of the consolidated financial statements, we also 

performed an audit of internal control over financial reporting in accordance with attestation 

standards established by the American Institute of Certified Public Accountants. 

During our audit, we noted certain matters involving the Federal Emergency Management Agency’s 

(FEMA) National Flood Insurance Program (NFIP) internal control and other operational matters that 

are presented for your consideration. These comments and recommendations, all of which have been 

discussed with the appropriate members of management of the named insurance companies (where 

applicable), FEMA’s Office of the Chief Financial Officer (OCFO), FEMA’s Federal Insurance and 

Mitigation Administration (FIMA), and communicated through a Notice of Finding and 

Recommendation, are intended to improve internal control or result in operating efficiencies. These 

observations and recommendations are summarized in Exhibit I of this letter and are not considered 

significant deficiencies or material weaknesses in internal control over financial reporting. 

Significant deficiencies and material weaknesses in internal control over financial reporting have 

been previously communicated to the DHS Office of Inspector General (OIG) and management in 

our Independent Auditors’ Report, dated November 13, 2015, included in the fiscal year 2015 DHS 

Agency Financial Report. 

Deficiencies related to FEMA information technology (IT) controls will be presented in a separate 

letter to the DHS OIG and the FEMA Chief Information Officer (CIO). In addition, certain other 

deficiencies related to FEMA’s internal control exclusive of our IT findings will be presented in a 

separate letter to the DHS OIG and the FEMA Chief Financial Officer. 

KPMG LLP is a Delaware limited liability partnership, 

the U.S. member firm of KPMG International Cooperative 

(“KPMG International”), a Swiss entity. 

FOR OFFICIAL USE ONLY
 
FOR OFFICIAL USE ONLY
 

Our audit procedures are designed primarily to enable us to form opinions on the financial statements 

and on the effectiveness of internal control over financial reporting, and therefore may not bring to 

light all weaknesses in policies or procedures that may exist. We aim, however, to use our knowledge 

of the NFIP organization gained during our work to make comments and suggestions that we hope 

will be useful to you. 

We would be pleased to discuss these comments and recommendations with you at any time. 

The purpose of this letter is solely to describe comments and recommendations intended to improve 

internal control or result in other operating efficiencies. Accordingly, this letter is not suitable for 

any other purpose. )(0$
VUHVSRQVHWRWKHGHILFLHQFLHVLGHQWLILHGLQRXUDXGLWLVLQFOXGHGLQ([KLELW

,,)(0$
VUHVSRQVHZDVQRWVXEMHFWHGWRWKHDXGLWLQJSURFHGXUHVDSSOLHGLQWKHDXGLWRIWKH

FRQVROLGDWHGILQDQFLDOVWDWHPHQWVDQGDFFRUGLQJO\ZHH[SUHVVQRRSLQLRQRQLW

Very truly yours, 

FOR OFFICIAL USE ONLY
 
 

 

Exhibit I 

FOR OFFICIAL USE ONLY
 

I.	 BACKGROUND 

The Federal Insurance & Mitigation Administration (FIMA) of U.S. Department of Homeland 

Security Federal Emergency Management Agency (FEMA) manages the National Flood Insurance 

Program (NFIP). Private insurance companies and the Direct Servicing Agent (DSA) (NFIP insurers) 

administer the flood insurance policies issued through the NFIP. The NFIP insurers write NFIP 

policies, adjust flood claims, process and distribute claim payments to policyholders, and establish 

and maintain loss reserves. The NFIP has contracted with a third-party service provider to assist the 

NFIP in managing the program. The NFIP insurers submit NFIP data to the third-party service 

provider via the Transaction Record Reporting and Processing (TRRP) system. The service provider 

uses underwriting transactions (i.e., written premiums) data associated with flood policies to 

calculate the deferred revenue liability for the actual NFIP financial statements and the deferred 

revenue liability estimate for the year-end estimated NFIP financial statements, which is recorded in 

the year-end FEMA financial statements. The estimated financial statements are based on two 

months of actual data and one month of forecasted data, due to the timing of available data versus 

financial reporting deadlines. Once the actual data is available, FEMA compares the recorded 

estimated financial statements to the actual statements to determine whether any large or unusual 

differences exist to identify whether an on-top adjustment is necessary. The service provider’s 

actuary uses the NFIP paid losses (i.e., claim payments) data for the current year and historical data 

to calculate the year-end actuarial liability for the NFIP financial statements, which is also recorded 

in the year-end FEMA financial statements. The case loss reserve data associated with flood claims 

may marginally and indirectly be used in this process, but is not separately disclosed in the NFIP 

financial statements. The consistency of this reserve from period to period is most important. Thus, 

the precision of the estimate to reflect actual events is dependent upon the accuracy and consistency 

of the underlying data submitted by the NFIP insurers on a monthly basis. 

II.	 INTERNAL CONTROL DEFICIENCIES RELATED TO WRITTEN PREMIUMS 

Observation (No formal NFR issued for deficiencies- verbal and written communication): 

We selected six vendors or insurance companies at which to perform audit procedures over the 

operating effectiveness of controls related to written premiums for the periods October 1, 2014 

through March 31, 2015; April 1, 2015 through June 30, 2015; and July 1, 2015 through August 31, 

2015. For the six vendors/companies selected, we tested a sample of written premiums totaling 252 

items covering the three testing periods identified above. During this testing, we noted the following 

internal control deficiency and error: 

1.	 Based on our March 31, 2015 testwork, for one sample item, we noted there was a difference 

in the recalculation of the premium versus what is recorded in the population as of March 31, 

2015. There was a system limitation in the calculation of premium amount due to a mid-term 

endorsement that caused an incorrect amount to be recorded as of March 31, 2015. The way 

in which the system calculated the premium amount did not prorate the endorsement amount 

for the applicable portion of the year, thus causing a difference in the premium. 

FOR OFFICIAL USE ONLY
 I.1
 
 

Reserve Reserve 

Sample Month of Amount per Amount per (Under)/Over 

Company No. Policy No. Loss Sample KPMG Statement 

Selective #11 $23,130 $38,130 $(15,000) Insurance Co. 

Exhibit I 

FOR OFFICIAL USE ONLY 

Company 

Sample 

No. Policy # 

Premium 

Receipt 

Date 

Premium 

Amount per 

Population 

Premium 

Amount per 

KPMG 

(Under)/Over 

Statement 

Nationwide 

Mutual Fire Ins. 19 $14,908 $16,538 $(1,630) 

Recommendations: 

We recommend that the Federal Insurance and Mitigation Administration: 

1.	 Follow-up with the insurance company identified above to determine if appropriate
 

corrective action has been implemented to address the exceptions identified.
 

2.	 Provide increased oversight to insurance companies participating in the NFIP to ensure they 

process and review underwriting files in accordance with the NFIP guidelines. 

III. INTERNAL CONTROL DEFICIENCIES RELATED TO PAID CLAIMS 

A.	 Internal Control Deficiencies and Errors Identified over Claims’ Case Loss Reserves 

Observation (NFR FEMA 15-19): 

We selected five vendors or insurance companies at which to perform audit procedures over the 

operating effectiveness of controls related to the establishment and closure of case loss reserves for 

the periods October 1, 2014 through March 31, 2015; April 1, 2015 through June 30, 2015; and July 

1, 2015 through August 31, 2015. For the five vendors/companies selected, we tested a sample of 

paid claims totaling 210 items covering the three testing periods identified above. We also performed 

substantive audit procedures over the completeness and accuracy of case loss reserves reported as of 

February 28, 2015 and August 31, 2015 for all insurance companies participating in the NFIP 

through a sample of 130 case loss reserve balances. During this testing, we noted the following 

internal control deficiencies and errors: 

1.	 The insurance company’s IT system improperly calculated the case loss reserve balance. The 

Increase Cost of Compliance (ICC) reserves were improperly closed based on the system’s 

limitations to process several transactions in the order in which they occur during the course 

of one day. The system limitation caused the case reserve balance to be understated as of 

February 28, 2015. 

FOR OFFICIAL USE ONLY
 I.2
 
Company 

Sample 

No. Policy No. 

Month of 

Loss 

Reserve 

Amount per 

Sample 

Reserve 

Amount per 

KPMG 

(Under)/Over 

Statement 

Allstate Insurance 

Co. #48 $8,700 $0 $8,700 

Allstate Insurance 

Co. #49 $26,300 $0 $26,300

June 30, 2015 Claims: 

American Bankers 

Insurance Co. #1 $0.47 $0 $0.47 

 

Company 

Sample 

No. 

Policy 

No. 

Month of 

Loss 

Reserve 

Amount per 

Sample 

Reserve 

Amount per 

KPMG 

(Under)/Over 

Statement 

Wright Flood #9 $12,000 $16,000 $(4,000) 

Fire Insurance 

Exchange #25 $10,300 $7,500 $2,800 

Nationwide 

Mutual Fire 

Insurance 

#26 $104,631.29 $101,015.34 $3,615.95 

American Bankers 

Insurance #29 $84,912.52 $94,912.52 $(10,000) 

National Lloyds 

Insurance #35 $21,500 $4,500 $17,000 

Hartford Fire 

Insurance 

Company 

#36 $10,000 $2,169.23 $7,830.77

Exhibit I 

FOR OFFICIAL USE ONLY
 

2.	 In three instances, the policies and associated claims were cancelled and re-written as new 

policies with the associated claims and case reserves. At that time the case reserves were not 

properly closed. The error was identified and a TRRP reserve correction change was 

processed; however, the correction was not properly processed. Consequently, the case 

reserve balance remained open as of the dates listed below. 

February 28, 2015: 

3.	 In eight instances, the amount recorded for case reserves in the case reserve population was 

not properly updated as additional claim information was obtained, creating a net 

overstatement of $6,870 as of August 31, 2015. 

FOR OFFICIAL USE ONLY
 I.3
 
Exhibit I 

FOR OFFICIAL USE ONLY 

Nationwide 

Mutual Fire 

Insurance

 #39 $135,691.29 $140,068.02 $(4,376.73) 

Nationwide 

Mutual Fire 

Insurance

 #40 $100,363.49 $106,363.49 $(6,000) 

Cause: 

Condition 1: WYO Companies or vendor IT systems were not properly monitored for errors created 

by IT system limitations, which prevented case loss reserves from being closed or properly updated 

based on the claim activity. 

Condition 2: Management at NFIP insurers have not fully developed and implemented adequate 

policies and procedures to monitor open case loss reserves to ensure final claim payments properly 

reduce the related reserve to zero. 

Condition 3: Management at the NFIP insurers did not update the open case loss reserve balance 

based on new information received or document in the claim file whether the reserve information 

was considered by the claims examiner. 

Recommendations: 

We recommend that the Federal Insurance and Mitigation Administration: 

1.	 Follow up with the NIFP insurer identified to determine if appropriate corrective action 

has been implemented to address the exception identified. 

2.	 Continue to monitor and address exceptions on the Monthly Loss and Reserves Report 

and ensure that all open reserves on closed claims are reduced to zero in a timely manner. 

3.	 Develop a requirement for NFIP insurers to review case loss reserve transactions for 

accuracy prior to submission of the data to the third-party service provided. 

FOR OFFICIAL USE ONLY
 I.4
 
FOR OFFICIAL USE ONLY	 Exhibit ,I 

U.S. Department of Homeland Security

 Washington, DC 20472 

Assistant Inspector General for Audits 

Office of Inspector General 

Roy E. Wright 

Deputy Associate Administrator 

Federal Insurance and Mitigation Administration 

June 1, 2016 

MEMORANDUM FOR:	 Mark Bell 

FROM: 

SUBJECT:	 National Flood Insurance Program’s Management Letter
 

for DHS’ FY 2015 Financial Statements Audit – For 

Official Use Only
 

OIG Project No. 16-026-AUD-FEMA
 

Thank you for the opportunity to review and comment on this Final Report, “National Flood 

Insurance Program’s Management Letter for DHS’ FY 2015 Financial Statements Audit.” This 

memorandum addresses our responses to the five recommendations contained in the report with 

which the Federal Emergency Management Agency (FEMA) concurred. 

In the fall of 2015 FEMA’s Federal Insurance and Mitigation Administration (FIMA) embarked 

on an effort to restructure its National Flood Insurance Program (NFIP) enterprise focusing on 

increased oversight of the NFIP Write Your Own (WYO) insurance company partners, improved 

program delivery, and improved customer experience for NFIP policyholders. In February 2016, 

FEMA implemented the new enterprise structure which resulted in the establishment of new 

branches including an Industry Management Branch with the primary focus on WYO oversight 

responsible for WYO account management. 

Recommendations 1 and 2 relate to INTERNAL CONTROL DEFICIENCIES RELATED 

TO WRITTEN PREMIUMS. 

Recommendation 1: Follow-up with the insurance company identified above to determine if 

appropriate corrective action has been implemented to address the exceptions identified. 

Response: Concur. FEMA followed up with the identified insurer. The insurer took 

appropriate corrective action. 

Recommendation 2: Provide increased oversight to insurance companies participating in the 

NFIP to ensure they process and review underwriting files in accordance with the NFIP 

guidelines. 

1 

FOR OFFICIAL USE ONLY 
 

 

 

 

 

 

Exhibit ,I FOR OFFICIAL USE ONLY 

Response: Concur. By December, 30, 2016, FEMA will evaluate the WYO Financial Control 

Plan review process and will make recommendations on the data needed to improve WYO 

company oversight. FEMA has assembled a team to look comprehensively at oversight to 

include improved ways to measure performance and provide oversight of underwriting, claims, 

financial, and litigation aspects of WYOs. This team will implement new processes, test those in 

pilots, and codify the new procedures by December 30, 2016. 

Recommendation 3, 4 and 5 relate to INTERNAL CONTROL DEFICIENCIES RELATED 

TO PAID CLAIMS. 

Recommendation 3: Follow up with the NFIP insurer identified to determine if appropriate 

corrective action has been implemented to address the exception identified. 

Response: Concur. FEMA followed up with the identified insurer. The insurer took appropriate 

corrective action. 

Recommendation 4: Continue to monitor and address exceptions on the Monthly Loss and 

Reserves Report and ensure that all open reserves on closed claims are reduced to zero in a timely 

manner. 

Response: Concur. FEMA will monitor and address WYO company case reserve exceptions on 

closed claims. To bolster our WYO oversight, we are in the process of staffing our Industry 

Management Branch with a team of WYO Account Managers by the end of this fiscal year 

(September 30, 2016). Each WYO Account Manager will track, manage and monitor the 

financial components of the Transaction Record Reporting and Processing Plan (TRRP). The 

Account Managers will engage in continuous and ongoing dialogue with their assigned 

companies and monitor company performance in critical Program delivery areas, including case 

reserving. 

Recommendation 5: Develop a requirement for NFIP insurers to review case loss reserve 

transactions for accuracy prior to submission of the data to the third-party service provided. 

Response: Concur. Using the case loss reserve report, the Legacy System of Record will 

continue the monthly task of reporting to the WYO companies any open reserve appearing to be 

ready for closure or adjustment. The WYO companies must reply that the reserve was closed 

(zeroed out) or explain why it should not be closed. The WYO companies have been notified via 

FIMA bulletin (W-10100) of the requirement for established case reserve procedures and the 

importance of consistency. FEMA has informed the companies that reserve errors are critical 

errors for the WYO Operation Review audits. The FEMA Industry Relations Account Managers 

will regularly monitor and report on the case loss reserves of their designated WYO companies 

Again, thank you for the opportunity to comment on this Final Report. Please direct any 

questions regarding this response to Gary McKeon, Director of FEMA’s GAO/OIG Audit 

Liaison Office, at (202) 646-1308. We look forward to working with you in the future. 

2
 

FOR OFFICIAL USE ONLY
 
 

 

 

FOR OFFICIAL USE ONLY 

OFFICE OF INSPECTOR GENERAL 

Department of Homeland Security 

Report Distribution 

Department of Homeland Security 

Secretary 

Deputy Secretary 

Chief of Staff 

General Counsel 

Executive Secretary 

Director, GAO/OIG Liaison Office 

Assistant Secretary for Office of Policy 

Assistant Secretary for Office of Public Affairs 

Assistant Secretary for Office of Legislative Affairs 

Chief Financial Officer 

Federal Emergency Management Agency 

Administrator 

Chief Financial Officer 

Audit Liaison 

Deputy Associate Administrator for Insurance 

Director, Risk Insurance Division 

Office of Management and Budget 

Chief, Homeland Security Branch 

DHS OIG Budget Examiner 

Congress 

Congressional Oversight and Appropriations Committees 


 

www.oig.dhs.gov OIG-16-101 

FOR OFFICIAL USE ONLY
 
 

 

 

 

 

 

 

ADDITIONAL INFORMATION AND COPIES 

To view this and any of our other reports, please visit our website at: www.oig.dhs.gov. 

For further information or questions, please contact Office of Inspector General Public Affairs 

at: DHS-OIG.OfficePublicAffairs@oig.dhs.gov. Follow us on Twitter at: @dhsoig. 

OIG HOTLINE 

To report fraud, waste, or abuse, visit our website at www.oig.dhs.gov and click on the red 

"Hotline" tab. If you cannot access our website, call our hotline at (800) 323-8603, fax our 

hotline at (202) 254-4297, or write to us at: 

Department of Homeland Security 

Office of Inspector General, Mail Stop 0305 

Attention: Hotline 

245 Murray Drive, SW 

Washington, DC 20528-0305