National Flood Insurance 

Program's Management 

Letter for DHS' FY 2014 

Financial Statements 

Audit 

(Redacted)
 

March 25, 2015 

OIG-15-52 
 

   

 

 

 

 

HIGHLIGHTS
 

National Flood Insurance Program’s

Management Letter for DHS’ FY 2014

Financial Statements Audit 

March 25, 2015 

Why We 

Did This 

The Federal Government has a 

fundamental responsibility to 

be an effective steward of 

taxpayers’ dollars. Sound 

financial practices and related 

management operations, 

reliable financial systems, and 

effective internal control are 

essential for reliable, timely 

financial information that 

supports management decision 

making needed to achieve the 

Department of Homeland 

Security’s (DHS) mission. 

For Further Information: 

Contact our Office of Public Affairs at 

 (202) 254-4100, or email us at 

DHS-OIG.OfficePublicAffairs@oig.dhs.gov 

What We Found 

KPMG LLP reviewed National Flood 

Insurance Program’s internal control over 

financial reporting. The resulting 

management letter contains four 

observations related to internal controls and 

other operational matters for management’s 

consideration. KPMG LLP noted deficiencies 

and the need for improvements in certain 

National Flood Insurance Program (NFIP) 

processes. These deficiencies did not meet 

the criteria to be reported in the Independent 

Auditors’ Report on DHS’ FY 2014 Financial 

Statements and Internal Control over 

Financial Reporting, dated November 14, 

2014, included in DHS’ fiscal year (FY) 2014 

Agency Financial Report. These observations 

are intended to improve internal control or 

result in other operating efficiencies. 

FEMA Response

FEMA will continue to communicate with the 

insurance companies and NFIP Direct 

Servicing Agent regarding the observations 

reported by KPMG LLP. Specifically, FEMA 

will (1) ensure that reported errors are 

corrected; (2) continue to provide guidance 

and clarification of procedures, ratings and 

rules; and (3) host training seminars. FEMA 

will also continue remediation efforts by 

developing a corrective action plan in 

FY 2015. 

www.oig.dhs.gov OIG-15-52 
VEp~\F os~O~ OFFICE OF INSPECTOR GENERAL

+•~5~°' Department of Homeland Security

MAR 25 2015

TO: Brad Kieserman

Deputy Associate Administrator for Federal Insurance

Federal Insurance and Mitigation Administration

FROM: Mark Bell ~ ~~

Assistant Inspector General for Audits

SUBJECT: National Flood Insurance Program's Management Letter for

DHS' FY 2014 Financial Statements Audit

Attached for your information is our final report, National Flood

Insurance Program's Management Letter for DHS' FY 2014 Financial

Statements Audit. The report contains observations related to internal

controls for management consideration. The observations did not meet

the criteria to be reported in the Independent Auditors' Report on DHS' FY

2014 Financial Statements and Internal Control over Financial Reporting,

dated November 14, 2014, which was included in the Department of

Homeland Security's (DHS) fiscal year (FY) 2014 Agency Financial Report.

The independent public accounting firm KPMG LLP conducted the audit

of DHS' FY 2014 financial statements and is responsible for the attached

management letter and the conclusions expressed in it.

Consistent with our responsibility under the Inspector General Act, we

will provide copies of our report to appropriate congressional committees

with oversight and appropriation responsibility over the Department of

Homeland Security. In a February 10, 2014, request, the Federal

Emergency Management Agency's Chief Financial Officer requested that

we redact certain information from the report. Specifically, the flood

insurance policy numbers and date of loss are considered Sensitive

Personally Identifiable Information as defined in the Privacy Office's

Handbook for Safeguarding Sensitive Personally Identifiable Information at

the Department of Homeland Security. As a result, we have redacted the

policy numbers and date of loss information from the report and will post

a redacted version of the report on our website.

Please call me with any questions, or your staff may contact Paul Wood,

Acting Deputy Assistant Inspector General for Audits, at (202) 254-4100.

Attachment
 

KPMG LLP 

Suite 12000 

1801 K Street, NW 

Washington, DC 20006 

December 19, 2014 

Office of Inspector General and Chief Financial Officer, 

U.S. Department of Homeland Security, and 

Associate Administrator, Federal Insurance and Mitigation Administration,
 

U.S. Department of Homeland Security, Federal Emergency Management Agency 

Washington, DC 

Ladies and Gentlemen: 

In planning and performing our audit of the consolidated financial statements of the U.S. Department 

of Homeland Security (DHS or Department), as of and for the year ended September 30, 2014, in 

accordance with auditing standards generally accepted in the United States of America; the standards 

applicable to financial audits contained in Government Auditing Standards issued by the Comptroller 

General of the United States; and Office of Management and Budget (OMB) Bulletin No. 14-02, Audit 

Requirements for Federal Financial Statements, we considered the Department’s internal control over 

financial reporting (internal control) as a basis for designing audit procedures that are appropriate in 

the circumstances for the purpose of expressing our opinion on the consolidated financial statements. 

In conjunction with our audit of the consolidated financial statements, we also performed an audit of 

internal control over financial reporting in accordance with attestation standards established by the 

American Institute of Certified Public Accountants. 

During our audit, we noted certain matters involving the Federal Emergency Management Agency’s 

(FEMA) National Flood Insurance Program (NFIP) internal control and other operational matters that 

are presented for your consideration. These comments and recommendations have been discussed with 

the appropriate members of management of the named insurance companies (where applicable), 

FEMA’s Office of the Chief Financial Officer (OCFO), FEMA’s Federal Insurance and Mitigation 

Administration (FIMA), and communicated through a Notice of Finding and Recommendation. These 

observations and recommendations are intended to improve internal control or result in other operating 

efficiencies; are summarized in Exhibit I of this letter; and are not considered significant deficiencies 

or material weaknesses in internal control over financial reporting. Significant deficiencies and 

material weaknesses in internal control over financial reporting have been previously communicated 

to the DHS Office of Inspector General (OIG) and management in our Independent Auditors’ Report, 

dated November 13, 2014, included in the fiscal year 2014 DHS Agency Financial Report. 

Deficiencies related to FEMA information technology (IT) controls will be presented in a separate 

letter to the DHS OIG and the FEMA Chief Information Officer (CIO). In addition, certain other 

deficiencies related to FEMA’s internal control exclusive of our IT findings will be presented in a 

separate letter to the DHS OIG and the FEMA Chief Financial Officer. 

KPMG LLP is a Delaware limited liability partnership, 

the U.S. member firm of KPMG International Cooperative 

(“KPMG International”), a Swiss entity. 
Our audit procedures are designed primarily to enable us to form opinions on the financial statements 

and on the effectiveness of internal control over financial reporting, and therefore may not bring to 

light all weaknesses in policies or procedures that may exist. We aim, however, to use our knowledge 

of the NFIP organization gained during our work to make comments and suggestions that we hope will 

be useful to you. 

We would be pleased to discuss these comments and recommendations with you at any time. 

The purpose of this letter is solely to describe comments and recommendations intended to improve 

internal control or result in other operating efficiencies. Accordingly, this letter is not suitable for any 

other purpose. 

FEMA’s response to the deficiencies identified in our audit is included in Exhibit II. FEMA’s response 

was not subjected to the auditing procedures applied in the audit of the consolidated financial 

statements and, accordingly, we express no opinion on it. Our auditors’ response is presented in 

Exhibit III. 

Very truly yours, 
 

 

 

Exhibit I 

I.	 BACKGROUND 

The Federal Insurance & Mitigation Administration (FIMA) of U.S. Department of Homeland 

Security Federal Emergency Management Agency (FEMA) manages the National Flood Insurance 

Program (NFIP). Private insurance companies and the Direct Servicing Agent (DSA) (NFIP insurers) 

administer the flood insurance policies issued through the NFIP. The NFIP insurers write NFIP 

policies, adjust flood claims, process and distribute claim payments to policyholders, and establish 

and maintain loss reserves. The NFIP has contracted with a third-party service provider to assist the 

NFIP in managing the program. The NFIP insurers submit NFIP data to the third-party service 

provider via the Transaction Record Reporting and Processing (TRRP) system. The service provider 

uses underwriting transactions (i.e., written premiums) data associated with flood policies to 

calculate the deferred revenue liability for the actual NFIP financial statements and the deferred 

revenue liability estimate for the year-end estimated NFIP financial statements, which is recorded in 

the year-end FEMA financial statements. The estimated financial statements are based on two 

months of actual data and one month of forecasted data, due to the timing of available data versus 

financial reporting deadlines. Once the actual data is available, FEMA compares the recorded 

estimated financial statements to the actual statements to identify any large or unusual differences to 

determine whether an on-top adjustment is necessary. The NFIP paid losses (i.e., claim payments) 

data for the current year and historical data are used by the service provider actuary to calculate the 

year-end actuarial liability for the NFIP financial statements, which is also recorded in the year-end 

FEMA financial statements. The case loss reserve data associated with flood claims may marginally 

and indirectly be used in this process, but is not separately disclosed in the NFIP financial statements. 

The consistency of this reserve from period to period is most important. Thus the precision of the 

estimate to reflect actual events is dependent upon the accuracy and consistency of the underlying 

data submitted by the NFIP insurers on a monthly basis. 

II.	 INTERNAL CONTROL DEFICIENCIES RELATED TO WRITTEN PREMIUMS 

Observation (NFR FEMA 14-01): 

We selected five vendors or insurance companies at which to perform audit procedures over the 

operating effectiveness of controls related to written premiums for the periods October 1, 2013 

through March 31, 2014; April 1, 2014 through June 30, 2014; and July 1, 2014 through August 31, 

2014. For the five vendors/companies selected, we tested a sample of written premiums totaling 258 

items covering the three testing periods identified above. During this testing, we noted the following 

internal control deficiencies and errors: 

1.	 Based on our March 31, 2014 testwork, for one sample item, we noted a refund was issued 

to the agent for reimbursement to the insured, which is not allowed under FEMA’s 

reimbursement policy: 

Company Policy # Premium 

Receipt Date 

Refund 

Amount 

Hartford Fire Ins. Co. 10/29/2013 $ 6.00 

I.1
 
Exhibit I 

2.	 Based on our March 31, 2014 testwork, for one sample item, we were unable to verify the 

historical flood zone and calculated the following premium variance based on the current, 

verifiable flood zone: 

Company Policy # 

Policy 

Effective 

Date 

Sample 

Premium 

Amount 

KPMG 

Calculated 

Premium 

Premium 

Difference 

(Under)/Over 

NFIP DSA 1/15/2014 $ 2,034.00 $ 3,408.00 ($ 1,374.00) 

3.	 Based on our March 31, 2014 testwork, for one sample item, we noted the policy was 

incorrectly rated using post-Flood Insurance Rate Map (FIRM) rating, creating the following 

premium variance: 

Company Policy # 

Policy 

Effective 

Date 

Sample 

Premium 

Amount 

KPMG 

Calculated 

Premium 

Premium 

Difference 

(Under)/Over 

Selective Ins. 11/12/2013 $ 566.00 $ 353.00 $ 213.00 

4. Based on our March 31, 2014 testwork, for one sample item, we noted the policy effective 

date was incorrectly calculated and did not adhere to the standard 30-day wait period: 

Company Policy # Transaction 

Type 

Policy 

Effective 

Date 

Correct 

Effective Date 

Selective Ins. New Business 3/11/2014 3/12/2014 

Federal Insurance and Mitigation Administration did not provide adequate oversight to ensure 

premium refunds and premiums written were properly reviewed prior to issuance to confirm 

compliance with the NFIP Flood Insurance Manual. Additionally, FEMA’s NFIP Flood Insurance 

Manual does not require all flood zones included in insurance policy applications to be verified by 

the underwriter. 

Recommendations: 

We recommend that the Federal Insurance and Mitigation Administration: 

1.	 Follow-up with each insurance company identified above to determine that appropriate 

corrective action has been implemented to address the exceptions identified. 

2.	 Provide increased oversight to insurance companies participating in the NFIP to ensure they 

process and review underwriting files in accordance with the NFIP guidelines. 

I.2
 
Exhibit I 

III. INTERNAL CONTROL DEFICIENCIES RELATED TO PAID CLAIMS 

A.	 Internal Control Deficiencies and Errors Identified over Claims’ Payments 

Observation (NFR FEMA 14-03): 

We selected five vendors or insurance companies at which to perform audit procedures over the 

operating effectiveness of controls related to claims’ payments for the periods October 1, 2013 

through March 31, 2014; April 1, 2014 through June 30, 2014; and July 1, 2014 through August 31, 

2014. For the five vendors/companies selected, we tested a sample of paid claims totaling 234 items 

covering the three testing periods identified above. During this testing, we noted the following 

internal control deficiencies and errors: 

1.	 Based on our March 31, 2014 testwork, for one sample item, we noted the insurance 

company did not obtain a Proof of Loss (POL) or Final Report prior to issuing the claim 

payment. 

Company Policy No. Date of 

Loss 

Payment 

Amount 

Payment 

Date 

Farmers Ins. Group $ 6,567.34 2/27/2014 

2. Based on our March 31, 2014 testwork, for two sample items, we noted the claims were paid 

without a signed POL. 

Date of Payment Payment Company Policy No. Loss Amount Date 

Wright National Flood $ 9,387.00 3/6/2014 

Wright National Flood $ 32,324.65 11/7/2013 

3. Based on our March 31, 2014 testwork, for one sample item, we noted the claim was paid 

without a 60-day POL waiver from FEMA. 

Company Policy No. Date of 

Loss 

Payment 

Amount 

Payment 

Date 

NFIP DSA $13,542.37 1/6/2014 

4. Based on our March 31, 2014 testwork, for one sample item, we noted the claim payment was 

issued 91 days after receipt of the POL. 

Date of Approval Payment Company Policy No. Loss Date Date 

Farmers Ins. Group 9/11/2013 11/27/2013 

I.3
 
Exhibit I 

5.	 Based on our March 31, 2014 testwork, for one sample item, we noted the claim payment was 

reported to the NFIP with the incorrect payment date. 

Company Policy # Date of 

Loss 

Payment 

Amount 

Sample 

Payment 

Date 

Correct 

Payment 

Date 

Selective Ins. $ 13,278.27 10/29/2013 10/31/2013 

Federal Insurance and Mitigation Administration did not provide adequate oversight to ensure claim 

files were processed and reviewed in accordance with the NFIP guidelines prior to the approval and 

issuance of claim payments. 

Recommendations: 

We recommend that the Federal Insurance and Mitigation Administration: 

1.	 Follow up with each NFIP insurer identified above to determine that appropriate corrective 

action has been implemented to ensure compliance with the Standard Flood Insurance 

Policy’s Proof of Loss requirements. 

2.	 Enhance monitoring and oversight of the NFIP insurers to ensure claims files are processed 

and reviewed in accordance with NFIP guidelines before approval and issuance of claims. 

B.	 Internal Control Deficiencies and Errors Identified over Claims’ Case Loss Reserves 

Observation (NFRs FEMA 14-02 and FEMA 14-02a): 

We selected five vendors or insurance companies at which to perform audit procedures over the 

operating effectiveness of controls related to the establishment and closure of case loss reserves for 

the periods October 1, 2013 through March 31, 2014; April 1, 2014 through June 30, 2014; and July 

1, 2014 through August 31, 2014. For the five vendors/companies selected, we tested a sample of 

paid claims totaling 234 items covering the three testing periods identified above. We also performed 

substantive audit procedures over the accuracy and completeness of case loss reserves reported as of 

February 28, 2014 and August 31, 2014 over all insurance companies participating in the NFIP 

through a sample of 130 case loss reserve balances. During this testing, we noted the following 

internal control deficiencies and errors: 

1.	 Based on our February 28, 2014 and August 31, 2014 testwork, for six sample items, the 

case reserve balance was not reduced to zero when the claim was closed (either paid or 

closed without payment). 

I.4
 
 

As of August 31, 2014: 

Company Policy No. Month of 

Loss 

Month 

Claim 

Closed 

Reserve 

Balance 

Per System 

Correct 

Reserve 

Calculation 

Over 

Statement 

USAA 9/2013 $ 1,500.00 $ 0.00 $ 1,500.00 

NFIP DSA 1/2014 $ 22,000.00 $ 0.00 $ 22,000.00 

USAA 6/2009 $ 21,400.00 $ 0.00 $ 21,400.00 

As of February 28, 2014: 

Reserve Correct Month of Month Over Company Policy No. Balance Reserve Loss Claim Statement Per System Calculation Closed 

USAA 06/2009 $ 4,000.00 $ 0.00 $ 4,000.00 

National 12/2013 $ 0.55 $ 0.00 $ 0.55 Lloyds
 

Wright Flood
 01/2013 $ 4,487.33 $ 0.00 $ 4,487.33 

Company Policy No. Month of 

Loss 

Reserve 

Balance 

Per System 

Correct 

Reserve 

Calculation 

Over 

Statement 

Travelers $ 9,787.21 $ 0.00 $ 9,787.21 

Exhibit I 

2.	 Based on our February 28, 2014 testwork, for one sample item, FEMA was unable to 

determine what company was responsible for the open claim, and had not closed the claim or 

case reserve from 1988 for inactivity. 

Company Policy No. Month of 

Loss 

Reserve 

Balance 

Per System 

Correct 

Reserve 

Calculation 

Over 

Statement 

Continental 

Ins. Group $ 7,600.00 $ 0.00 $ 7,600.00 

3. Based on our February 28, 2014 testwork, for one sample item, a previous overpayment on a 

claim was incorrectly applied to the open Increased Cost of Compliance (ICC) reserves. 

I.5
 
Company Policy No. Month of 

Loss 

Reserve 

Balance 

Per System 

Correct 

Reserve 

Calculation 

Over 

Statement 

Selective $ 30,000.00 $ 15,000.00 $ 15,000.00 

Selective $ 30,000.00 $ 15,000.00 $ 15,000.00 

Company Policy No. Month of 

Loss 

Reserve 

Balance 

Per System 

Correct 

Reserve 

Calculation 

Over 

Statement 

USAA $ 17,035.92 $ 2,419.55 $ 14,616.37 

Company Policy No. Month of 

Loss 

Reserve 

Balance 

Per System 

Correct 

Reserve 

Calculation 

Over 

Statement 

USAA $ 10,011.63 $ 0.00 $ 10,011.63 

Company Policy No. Month of 

Loss 

Reserve 

Balance 

Per System 

Correct 

Reserve 

Calculation 

Over 

Statement 

Selective $ 166.99 $ 0.00 $ 166.99 

Selective $ 16,121.77 $ 15,000.00 $ 1,121.77 

Company Policy No. Loss 

Month 

Reserve 

Balance 

Per System 

Correct 

Reserve 

Calculation 

Over 

Statement 

NFIP DSA $ 22,000.00 $ 0.00 $ 22,000.00 

Exhibit I 

4. Based on our August 31, 2014 testwork, for two sample items, the case reserve balance was 

not properly reduced when an advance payment was issued. 

5. Based on our August 31, 2014 testwork, for one sample item, the case reserve balance was 

not updated to reflect the updated amount of the Final Report or Proof of Loss (POL). 

6. Based on our February 28, 2014 testwork, for one sample item, the insurance company’s IT 

system prevented the claim file from closing after the final payment was issued. 

7. Based on our February 28, 2014 testwork, for two sample items, reserves were re-populated 

by the Company’s IT system after the Building claim was closed. 

8. Based on our February 28, 2014 testwork, for one sample item, the transaction was 

incorrectly submitted with zeroes instead of asterisks in the reserve fields. 

Adequate policies and procedures have not been fully developed and implemented to monitor open 

case loss reserves and ensure claim payments properly reduce the related reserve. 

I.6
 
 

Exhibit I 

NFIP insurer IT systems were not properly monitored for errors created by IT system limitations 

which prevented individual case loss reserves related to closed claims from being accurately reported 

to the third-party service provider. 

TRRP transactions were not adequately reviewed prior to submission by the NFIP insurers to the 

third-party service provider. 

Recommendations: 

We recommend that the Federal Insurance and Mitigation Administration: 

1.	 Follow up with each NFIP insurer identified above to determine that appropriate corrective 

actions have been implemented to address the exceptions identified. 

2.	 Implement policies and procedures over the review of the TRRP report of closed claims with 

outstanding case loss reserves to ensure all open reserves on closed claims are reduced to 

zero in a timely manner which may include an automated logic edit in TRRP to reject the 

closure of a claim with an outstanding case loss reserve balance (i.e., verify the reserves are 

properly at zero before a claim can be closed). 

3.	 Require NFIP insurers develop and implement procedures to review transactions prior to 

submission to the third-party service provider. 

I.7
 
Exhibit II
 

MANAGEMENT’S RESPONSE 

II.1
 
Exhibit II
 

II.2
 
Exhibit II
 

II.3
 
 

 

Exhibit III 

AUDITORS’ RESPONSE 

FEMA’s response to the draft of this letter discussed several specific observations noted in the 

letter. As such, we provide the following additional information. 

Regarding Observation II (NFR FEMA-14-01), we acknowledge FEMA’s continued efforts to 

effectively monitor the Write Your Own (WYO) companies, including follow-up regarding our 

findings communicated in this letter. Additionally, we acknowledge FEMA’s remediation 

efforts, including updates to rules and procedures published by the NFIP, including WYO 

Bulletins. 

Regarding Observation III.A (NFR FEMA-14-03), we acknowledge FEMA’s efforts to monitor 

claims through their implemented policies and procedures. 

Regarding Observation III.B (NFRs FEMA-14-02 and FEMA-14-02a), we received during our 

audit procedures, a letter from the FEMA contracted actuary describing the data elements 

utilized in computing the actuarial insurance liability estimate as of September 30, 2014. This 

letter, which guided our testing approach related to the insurance liability estimate, included case 

reserves as one of the data elements used in the calculation. Our testing of data elements 

occurred throughout fiscal year 2014. FEMA’s year-end analysis demonstrated that case reserves 

were not a significant factor in the calculation of the insurance liability estimate as of September 

30, 2014; we took this information into consideration in determining the severity of the 

conditions identified, which were concluded to be no more severe than control deficiencies at the 

Department level. 

Additionally, our recommendations related to Observation III.B were intended to focus on the 

accurate reporting of case reserves to the third party provider and the process of properly 

opening and closing case reserves based on the life of the claim. We understand that case 

reserving is a normal business practice for all property and casualty insurers and that FEMA 

must consider the costs versus benefits of implementing changes to such a disaggregated 

process. However, each participating insurance company should consistently adhere to its own 

policies and procedures related to case reserving, which should be documented as part of the 

company’s internal control structure. 

III.1
 
 

OFFICE OF INSPECTOR GENERAL 

Department of Homeland Security 

Appendix A 

Report Distribution 

Department of Homeland Security 

Secretary 

Deputy Secretary 

Chief of Staff 

General Counsel 

Executive Secretary 

Director, GAO/OIG Liaison Office 

Assistant Secretary for Office of Policy 

Assistant Secretary for Office of Public Affairs 

Assistant Secretary for Office of Legislative Affairs 

Chief Financial Officer 

Federal Emergency Management Agency 

Administrator 

Chief Financial Officer 

Audit Liaison 

Deputy Associate Administrator for Insurance 

Director, Risk Insurance Division 

Office of Management and Budget 

Chief, Homeland Security Branch 

DHS OIG Budget Examiner 

Congress 

Congressional Oversight and Appropriations Committees 

www.oig.dhs.gov OIG-15-52 
 

 

 

 

 

 

ADDITIONAL INFORMATION AND COPIES 

To view this and any of our other reports, please visit our website at: www.oig.dhs.gov. 

For further information or questions, please contact Office of Inspector General Public Affairs 

at: DHS-OIG.OfficePublicAffairs@oig.dhs.gov. Follow us on Twitter at: @dhsoig. 

OIG HOTLINE 

To report fraud, waste, or abuse, visit our website at www.oig.dhs.gov and click on the red 

"Hotline" tab. If you cannot access our website, call our hotline at (800) 323-8603, fax our 

hotline at (202) 254-4297, or write to us at: 

Department of Homeland Security 

Office of Inspector General, Mail Stop 0305 

Attention: Hotline 

245 Murray Drive, SW 

Washington, DC 20528-0305