Department of Homeland Security

2IÀFHRI,QVSHFWRU*HQHUDO
 

National Flood Insurance Program’s Management 

Letter for FY 2013 DHS Financial Statements Audit 

(Redacted)
 

OIG-14-92 May 2014
 
 

OFFICE OF INSPECTOR GENERAL 

 Department of Homeland Security 

 Washington, DC 20528 / www.oig.dhs.gov 

MAY 5 2014

MEMORANDUM FOR: David Miller

Associate Administrator

Federal Insurance and Mitigation Administration

Federal Emergency Management Agency

FROM: Anne L. rds

ector General for Audits

Richa

Assistant Insp

SUBJECT: 	 National Flood Insurance Program’s Management Letter

for FY 2013 DHS Financial Statements Audit

Attached for your information is our final report, National Flood Insurance Program’s

Management Letter for FY 2013 DHS Financial Statements Audit. This report contains

4 observations and 12 recommendations related to internal control for management’s

consideration. The observations did not meet the criteria to be reported in the

Independent Auditors’ Report on DHS’ FY 2013 Financial Statements and Internal Control

over Financial Reporting dated December 11, 2013, which was included in the

Department of Homeland Security’s (DHS) fiscal year (FY) 2013 Agency Financial Report.

We do not require management’s response to the recommendations.

We contracted with the independent public accounting firm KPMG LLP (KPMG) to

conduct the audit of the DHS’ FY 2013 financial statements and internal control over

financial reporting. The contract required that KPMG perform its audit according to

generally accepted government auditing standards and guidance from the Office of

Management and Budget and the Government Accountability Office. KPMG is

responsible for the attached management letter dated December 11, 2013, and the

conclusions expressed in it.

Consistent with our responsibility under the Inspector General Act, we will provide

copies of our report to appropriate congressional committees with oversight and

appropriation responsibility over the Department of Homeland Security. In a February

18, 2014, memorandum to the OIG, the DHS Chief Privacy Officer requested that we

redact certain information from the report. Specifically, the flood insurance policy

numbers and date of loss are considered Sensitive Personally Identifiable Information as

defined in the Privacy Office’s Handbook for Safeguarding Sensitive Personally

Identifiable Information at the Department of Homeland Security.As a result, we have

redacted the policy numbers and date of loss information from the report and will post

a redacted version of the report on our website for public dissemination.
 

 

 

OFFICE OF INSPECTOR GENERAL 

Department of Homeland Security 

Please call me with any questions, or your staff may contact Mark Bell, Deputy Assistant 

Inspector General for Audits, at (202) 254-4100. 

Attachment 

www.oig.dhs.gov 2 OIG-14-92 
 

KPMG LLP 

Suite 12000 

1801 K Street, NW 

Washington, DC 20006 

December 11, 2013 

Office of Inspector General 

U.S. Department of Homeland Security, and 

Associate Administrator, Federal Insurance and Mitigation Administration 

U.S. Department of Homeland Security Federal Emergency Management Agency 

Washington, DC 

Ladies and Gentlemen: 

We have audited the financial statements of the U.S. Department of Homeland Security (DHS or 

Department) for the year ended September 30, 2013, and have issued our report thereon dated 

December 11, 2013. In planning and performing our audit of the financial statements of DHS, in 

accordance with auditing standards generally accepted in the United States of America and Government 

Auditing Standards, we considered internal control over financial reporting (internal control) as a basis for 

designing our auditing procedures for the purpose of expressing our opinion on the financial statements. 

In conjunction with our audit of the financial statements, we also performed an audit of internal control 

over financial reporting in accordance with attestation standards established by the American Institute of 

Certified Public Accountants. 

During our audit, we noted certain matters involving the Federal Emergency Management Agency’s 

(FEMA) National Flood Insurance Program (NFIP) internal control and other operational matters that are 

presented for your consideration. These observations and recommendations have been discussed with the 

appropriate members of management of the named insurance companies (where applicable), FEMA’s 

Office of the Chief Financial Officer, and FEMA’s Federal Insurance and Mitigation Administration and 

communicated through a Notice of Finding and Recommendation. These observations and 

recommendations are intended to improve internal control or result in other operating efficiencies, are 

summarized in Exhibit I of this letter, and are not considered to reflect significant deficiencies or material 

weaknesses in internal control over financial reporting. Significant deficiencies and material weaknesses 

in internal control over financial reporting have been previously communicated to the DHS Office of 

Inspector General and management in our Independent Auditors’ Report, dated December 11, 2013, 

included in the fiscal year 2013 DHS Annual Financial Report. 

Certain deficiencies related to FEMA information technology (IT) controls will be presented in a separate 

letter to the DHS Office of Inspector General and the FEMA Chief Information Officer. In addition, 

certain other deficiencies related to FEMA’s internal control exclusive of our IT findings will be 

presented in a separate letter to the DHS Office of Inspector General and the FEMA Chief Financial 

Officer. 

Our audit procedures are designed primarily to enable us to form opinions on the financial statements and 

on the effectiveness of internal control over financial reporting, and therefore may not bring to light all 

weaknesses in policies or procedures that may exist. We aim, however, to use our knowledge of the NFIP 

gained during our work to make observations and suggestions that we hope will be useful to you. 

We would be pleased to discuss these observations and recommendations with you at any time. 

KPMG LLP is a Delaware limited liability partnership, 

the U.S. member firm of KPMG International Cooperative 

(“KPMG International”), a Swiss entity. 
 

 

FEMA’s response to the observations and recommendations identified in this communication is presented 

in Exhibit II. FEMA’s response was not subjected to auditing procedures applied in the audit of the 

financial statements and, accordingly, we express no opinion on the response. Our auditors’ response is 

presented in Exhibit III. 

The purpose of this letter is solely to describe observations and recommendations intended to improve 

internal control or result in other operating efficiencies. Accordingly, this letter is not suitable for any other 

purpose. 

Very truly yours, 
2 

3 

Exhibit I 

I. BACKGROUND 

The Federal Insurance and Mitigation Administration of the Department of Homeland Security (DHS) 

Federal Emergency Management Agency (FEMA) manages the National Flood Insurance Program 

(NFIP). Private insurance companies and the Direct Servicing Agent (DSA) administer the flood 

insurance policies issued through the NFIP. The insurance companies and DSA write NFIP policies, 

adjust flood claims, process and distribute claim payments to policyholders, and establish and maintain 

loss reserves. To assist in the management of the program, the Federal Insurance and Mitigation 

Administration has contracted with a third-party service provider. NFIP data is submitted from the 

insurance companies and the DSA to the third-party service provider via the Transaction Record 

Reporting and Processing (TRRP) system. The data associated with flood policies and claims are used to 

calculate estimates included in the year-end NFIP financial statements, which are recorded in the year-end 

DHS financial statements. Thus, the precision of the estimates used to reflect actual events is dependent 

upon the accuracy and consistency of the underlying data submitted by the insurance companies and the 

DSA on a monthly basis. 

II. INTERNAL CONTROL DEFICIENCIES RELATED TO CLAIMS 

A. Internal Control Deficiencies and Errors Identified over Claims Paid 

Observation (NFR FEMA-13-07):
 

We selected nine insurance companies at which to perform audit procedures over the operating
 

effectiveness of controls related to claims paid for the periods October 1, 2012, through March 31, 2013, 

April 1 through June 30, 2013, and July 1 through August 31, 2013. For the nine companies selected, we
 

tested a sample of claims paid totaling 450 items covering the three testing periods identified above.
 

During this testing, we noted the following internal control deficiencies and errors:
 

1 Based on March 31, 2013, testwork, for one sample item, the claim was paid without a signed Proof 

of Loss from the insured. 

Company Policy No. Date of Loss Payment Date 

Allstate 02/10/2013 

Based on March 31, 2013, testwork, for one sample item, the original Proof of Loss obtained for the 

supplemental payment was not available. 

Company Policy No. Date of Loss Payment Date 

USAA 02/13/2013 

Based on March 31, 2013, testwork, for one sample item, the insurance company did not request a 60­

day Proof of Loss waiver prior to making the claim payment. 

Company Policy No. Date of Loss Payment Date 

Southern Farm Bureau 03/22/2013 

I.1
 
 

 

 

 

4 

Exhibit I 

Based on March 31, 2013, testwork, for three sample items, the amount paid to the insured was 

calculated incorrectly. 

Over/ (Under) 

Company Policy No. Date of Loss Payment 

Southern Farm Bureau $(6.46) 

Hartford $(727.79) 

Travelers $413.58 

FEMA’s Federal Insurance and Mitigation Administration did not provide adequate oversight to ensure 

claim files were processed and reviewed in accordance with NFIP guidelines before the approval and 

issuance of claim payments. 

Recommendations: 

We recommend that FEMA’s Federal Insurance and Mitigation Administration: 

1)	 Follow-up with each of the insurance companies identified above to determine if appropriate 

corrective action has been implemented to ensure compliance with the Standard Flood Insurance 

Policy’s Proof of Loss Requirement. 

2)	 Enhance monitoring and oversight of the insurance companies participating in the NFIP to 

ensure claims files are being processed and reviewed in accordance with NFIP guidelines before 

approval and issuance of claims. 

3)	 Identify and implement systemic solutions to ensure the accuracy of claim payments based on 

the information documented in the claim file. 

B.	 Internal Control Deficiencies and Errors Identified over Claims’ Loss Reserves 

Observation (NFRs FEMA-13-15 and FEMA-13-29): 

We selected nine insurance companies at which to perform audit procedures over the operating 

effectiveness of controls related to the establishment and maintenance of loss reserves for the periods 

October 1, 2012, through March 31, 2013, April 1through June 30, 2013, and July 1 through August 31, 

2013. For the nine companies selected, we tested a sample of claims paid totaling 450 items covering the 

three testing periods identified above to ensure proper establishment and closure of loss reserves. We also 

performed substantive audit procedures over the accuracy and completeness of loss reserves reported as 

of February 28, 2013, and August 31, 2013, over all insurance companies. As of these dates, we tested a 

total sample of 130 loss reserves reported. During these audit procedures, we noted the following internal 

control deficiencies and errors: 

1)	 Based on our February 28, 2013, and August 31, 2013, substantive testwork, for three sample items, 

the insurance company did not close the claim and/or related loss reserve when the claim was closed 

(paid or closed without payment). 

February 28, 2013, Substantive Testwork Results: 

Company Policy No. Date of Loss Overstatement 

USAA $1,005 

Allstate $1,000 

I.2
 
Company Policy No. Date of Loss Overstatement 

Fidelity National $21,895 Indemnity 

Nationwide $2,500 

 

Exhibit I 

August 31, 2013, Substantive Testwork Results: 

Company Policy No. Date of Loss Overstatement 

Allstate $15,000 

2)	 Based on our February 28, 2013, substantive testwork, for two sample items, the loss reserve related 

to the claim transaction was not properly updated to reflect advance payments or additional adjuster 

reports. 

3) Based on our February 28, 2013, substantive testwork, for one sample item, a claim was opened with 

two separate dates of loss, resulting in duplicate loss reserves. 

Company Policy No. 

Correct 

Date of Loss 

Over/(Under) 

Statement 

American Bankers $13,500 

4) Based on our August 31, 2013, substantive testwork, for one sample item, a claim was reopened to 

correct an overpayment, and reserves were established and remained open in error. 

Company Policy No. Date of Loss Overstatement 

Travelers $10,000 

5) Based on our August 31, 2013, substantive testwork, for one sample item, the loss reserve was 

calculated incorrectly. 

Company Policy No. Date of Loss Overstatement 

NFIP Direct Servicing 

Agent $95 

6)	 Based on our August 31, 2013, substantive testwork, for one sample item, the loss reserve remained 

open on a claim with a date of loss older than 20 years which should have been closed due to 

inactivity. 

Company Policy No. Date of Loss Overstatement 

Continental $7,600 

7)	 Based on our February 28, 2013 and August 31, 2013, substantive testwork, for two sample items, a 

loss reserve transaction was submitted via TRRP with a formatting error, causing loss reserves to be 

overstated. 

February 28, 2013, Substantive Testwork Results: 

Company Policy No. Date of Loss Overstatement 

Fidelity National 

Indemnity $7,500 

I.3
 
Company Policy No. Date of Loss Overstatement 

NFIP Direct Servicing $2,618 Agent 

Allstate $0.11 

 

Exhibit I 

August 31, 2013, Substantive Testwork Results: 

Company Policy No. Date of Loss Overstatement 

Fidelity National 

Indemnity $1,485,000 

8)	 Based on our February 28, 2013, substantive testwork, for two sample items, a 37A (Change 

Reserves) transaction was submitted to update the reserves for an advance payment. As advance 

payments automatically decrease reserves, this transaction double-counted the advance. 

Company Policy No. Date of Loss (Understatement) 

Hartford Fire $(15,000) 

Harleysville Mutual $(6,000) 

9)	 Based on our February 28, 2013 and August 31, 2013, substantive testwork, for four sample items, a 

close loss transaction was not submitted upon issuance of claim payment; therefore, the loss reserve 

remained opened after claim payment. 

February 28, 2013, Substantive Testwork Results: 

August 31, 2013, Substantive Testwork Results: 

Company Policy No. Date of Loss Overstatement 

Selective $2 

Selective $974 

10) Based on our fiscal year 2013 process walkthroughs with Federal Insurance and Mitigation 

Administration personnel, we determined that the insurance companies participating in the NFIP did 

not consistently update loss reserves following the receipt of additional claims adjuster information. 

For example, insurance companies and the DSA are not required to: 

a.	 Update loss reserves within a certain timeframe, or note in claims documentation why loss 

reserves were not updated, after new information is provided by the adjuster, or 

b.	 Review and update loss reserves, or note in claims documentation why loss reserves were not 

updated, as of specific period ends to ensure accurate reporting of loss reserve information to 

FEMA. 

Loss reserves were improperly managed based on additional claims-related information received (e.g., 

advanced payments, subsequent adjuster reports, and final payments) or when claims were closed, 

improperly created, or incorrectly calculated based on claims-related information received. 

TRRP transactions were not adequately reviewed prior to submission by the insurance companies to the 

third-party service provider. Additionally, controls were not in place to ensure all required TRRP 

transactions were submitted timely. 

I.4
 
 

 

 

 

Exhibit I 

FEMA’s guidance to participating insurance companies and the DSA did not include policies and 

procedures that require participating companies to adjust loss reserves according to specific guidelines. 

Recommendations: 

We recommend that FEMA’s Federal Insurance and Mitigation Administration: 

1)	 Follow-up with each of the insurance companies identified above to determine if appropriate 

corrective action has been implemented to address the exceptions noted. 

2)	 Provide increased oversight to insurance companies participating in the NFIP to ensure the 

specific and consistent establishment and reporting of loss reserves and subsequent adjustments to 

the loss reserves. 

3)	 Require insurance companies and the DSA to develop and implement procedures to review 

transactions prior to submission to the third-party service provider and to ensure such transactions 

are submitted timely. 

4)	 Require insurance companies and the DSA to formally document their loss reserving policies and 

procedures at the company level. 

5)	 Perform a regular (e.g., monthly) review of the total outstanding NFIP loss reserve balance for all 

insurance companies and the DSA. 

III. INTERNAL CONTROL DEFICIENCIES RELATED TO PREMIUMS WRITTEN 

Observation (NFRs FEMA-13-08 and FEMA-13-08a):
 

We selected nine insurance companies at which to perform audit procedures over the operating
 

effectiveness of controls related to premiums written for the periods October 1, 2012, through March 31, 

2013, April 1 through June 30, 2013, and July 1 through August 31, 2013. For the nine companies 

selected, we tested a sample of premiums written totaling 450 items covering the three testing periods 

identified above. During this testing, we noted the following internal control deficiencies and errors:
 

1)	 Based on our March 31, 2013, testwork, for one sample item, we noted the policy effective date 

was incorrectly calculated from the policy quote date and did not adhere to the standard 30-day 

wait period from the endorsement request date. 

Company Policy No. 

Policy 

Endorsement 

Effective Date 

Correct 

Endorsement 

Effective Date 

Travelers 02/17/2013 02/28/2013 

2)	 Based on our March 31, 2013, and August 31, 2013, testwork, for two sample items, the property 

was not rated using the flood zone identified via the policy’s DHS Standard Flood Hazard 

Determination form. 

March 31, 2013, Control Testwork Results: 

Company Policy No. Correct Zone Rated Zone 

Nationwide X A 

I.5
 
 

 

 

Exhibit I 

August 31, 2013, Control Testwork Results: 

Company Policy No. Correct 

Zone Rated Zone 

Hartford Fire AE V21 

3)	 Based on our June 30, 2013 and August 31, 2013, control testwork, for two sample items, we 

were unable to verify the rated flood zone per the FEMA flood maps. 

June 30, 2013, Control Testwork Results: 

Company Policy No. Rated Zone 

Address 

Description per 

Policy 

NFIP Direct Servicing 

Agent AE Rural Route 

August 31, 2013, Control Testwork Results: 

Company Policy No. Rated Zone 

Address 

Description per 

Policy 

NFIP Direct Servicing 

Agent A 1⁄4 of Sec 20 

Township 398 

FEMA’s Federal Insurance and Mitigation Administration did not provide adequate oversight to ensure 

premiums written were properly reviewed prior to issuance. 

FEMA’s NFIP Flood Insurance Manual allows flood insurance applicants to provide a legal description 

or geographic location of the insured property in lieu of a street address. The submitted property location 

was not verified as FEMA’s NFIP Flood Insurance Manual does not require all flood zones included in 

insurance policy applications to be verified by the underwriter. 

Recommendations: 

We recommend that FEMA’s Federal Insurance and Mitigation Administration: 

1)	 Follow-up with each of the insurance companies identified above to determine if they have 

implemented the appropriate corrective action to address the exceptions noted. 

2)	 Provide increased oversight to insurance companies participating in the NFIP to ensure they 

process and review underwriting files in accordance with NFIP guidelines. 

3)	 Revise the NFIP Flood Insurance Manual to require that all flood zones included in insurance 

policy applications are subject to verification by an underwriter through the use of risk-based 

sampling techniques. 

I.6
 
Exhibit I 

IV. OTHER INTERNAL CONTROL DEFICIENCY 

A. Deficiency Identified Related to the National Flood Insurance Program Standards Committee 

Observation (NFR FEMA-13-05): 

Based on process walkthroughs, we determined the NFIP Standards Committee had not met since 

April 2012. Additionally, we determined five vacant positions existed on the Standards Committee as of 

July 31, 2013, and had existed for over two months. The five vacant positions represent members of the 

designated insurance companies, pools, or other entities. 

Additionally, we determined Federal Insurance and Mitigation Administration personnel did not provide 

an accurate listing of the current NFIP Standards Committee members in May 2013 upon our request. 

Recommendation: 

We recommend that FEMA’s Federal Insurance and Mitigation Administration develop and implement 

policies and procedures which require the Standards Committee to meet on a periodic basis and ensure 

vacancies are filled in a timely manner. 

I.7
 
Exhibit II
 

MANAGEMENT’S RESPONSE
 

t :.!>. Oeputment of llomel1nd Security 

500 C Street, SW 

Washmgton, DC 20-172 

FEMA 

March 19.2014 

Memorandum ror: David Kaufman 

Associate Administrator 

Policy. Program Anal) sis a~ I A fTairs 

From: 

Associate 

Edward L.C~~ Administrator 

rlood Insurance and Mitigation Administration 

'ubjcct: r iMA ·s Response to OIG Draft Report: NFIP '.\ ;\!tma!-!emelll 

Lellerjbr the F)' 20 I J DI/S Consolidated Financial Statement A uc/il 

!'hank you for the opportunity to comment on the FY 2013 draft FIP Management letter for the 

FY 20 I 3 Consolidated audit. Our comments arc keyed to speci fie NFRs. 

FEMA 13-08ll: Internal Control Deficiencies Related to Premium Written 

The NFI P rules do not require policies to be re-undcr.,..rittcn when they arc moved from one 

insurer to another, since those policies arc considered having continuous coverage. When a 

polic) conYersion takes place. the polic) is aiiO\\ed to continue v.ith the rating based on the prior 

undcnHiting information from the prior insurer. The Write Your Ov.n (WYO) companies arc 

responsible lor rating the policies correctly as required in th~: WYO Arrangement, 44 CFR 62. 

The WYO is responsible lor collecting and forwarding the proper premium to the NFIP as \>\ell 

as making corrections to the polic). 

With regards to the usc of legal description as a pro pert) address. the NFI P rules allow a legal 

description since there arc man) flood applications for buildings in the course of construction 

that do not usc a standard street addresses \\ hen applying lor flood insurance coverage. 

FL:.M/\ ''ill continue remediation ellorts by developing a corrective action plan lor FY 2014. 

subject to resource availability. \\hich will prioriti1..e risk consistcnc) "'ith other FRs and 

recognize the progress on cl'lorts already initiated and complewd. 

FEMA 13-15 and FEMA 13-29: Deficiencies Identified over Claim's Loss Reserves at 

Selected Insurance Companies that Participate in FEMA's National Flood Insurance 

Program 

1'1 IIA bclic\cS the auditor's concerns mer the current case loss reserve procedures is misplaced 

s1nce the case reserves they haYe anal)t.ed arc not directly reported on the linancial statement. 

And \\hill.: the loss reserve estimate that is carried on the financial statement is. in part. 

II.1
 
Exhibit II
 

FIMA's Response to OIG Draft Repor1: NfiP" s Management 

Leller for the FY 20 13 OilS Consolidated Financial Statemcnt/\udit 

Page 2 

inOucnced by the case reserves, the NFIP actuaries have demonstrated. in analyses that have 

been shared with the auditors, that even a large change in the adequacy of the case loss reserves 

from the historical pattern has only a very small inlluence on the year-end estimated loss reserve. 

The actuaries that develop the sensitivity tests and loss reserve estimate that is carried on the 

financial statement have repcatetlly assured us that case loss reserves do not have to be 

"accurate .. in order for them to make a reasonable loss reserve estimate. What the actuary needs 

is a rcasonabl) stabk pattern of total case loss reserves. And the analysis referenced earlier 

demonstrates that even when that condition deteriorates it has only minor impact on the loss 

reserve that the actuary estimates. 

There is no FEM/\ case loss reserving process between FEMA and the Write Your Program. 

lhc regulation at 44 C.:FR Part 62. Appcndix A. the Arrangement. requires the insurers to use 

their normal business practices. Rescn ing is one business practice that all property and casualty 

insurers arc involved with. With respect to proper!) reserves. the rescrve may be handled in 

tli rrercnt ways by di !Tercnt companies at di fTc rent t imcs. In one case just a few years ago. a 

WYO only bulked rcscrvcd catastrophe property losses. I hesc short-tail property reserves 

(claim is typically paid within a year) arc I) pica II) not the precise concern as the longer tail 

reserves. such as Workers' Compensation, auto bodily injury. or othcr catastrophic bodily injury 

liability claims. The first reserving rule is the company staff managing the case loss reserving 

process is given great latitude as to when and how much a reserve should be adjusted. 

Reserving. especially case loss reserving is not a science and each individual setting a reserve 

may have a different approach. Whether or not a reserve is increased or decreased and when 

should be len to the individual setting the reserve, not the adjuster. The adjuster has no authority 

other than to recommend. Each insurer can have dirlcrent reserving procedures lor Lhe various 

lines of business (i.e .. worker's compensation. liability. homeowners. wind. nood. and such). 

FhM/\ recognizes that those rescn ing practiccs that do not take dov. n signi licant reserves to 

zero when the claim file is paid and permanently closed with no runher exposure possible should 

be notcd. 

For the vast majority of N Fl P claims. the maxi mum reserve pay mcnt is $250.000 for the 

dwelling and $ 1 00,000 lor dwelling con Lents. However. the average paymenl for all claims after 

Sand) was only about $55.000 and in Ncw York onl) the avcrage was $62.000. 1\ very high 

percentage or claims are paid on average in less than 60 days unless the proof or loss time 

rcquircmcnt is cxtcnded as it was at'ler Sandy lo 18 months. ·1 o setup a comrlicatcd reserving 

schemc for each flood claim when the majority v. ill be paid and/or closed in less than a year. will 

he expensive to imrlcmcnt and is not eiTcctive or practical. The reports recommended by the 

auditors can be an cflcctive tool. but Lhc cost of such review and working with each insurer or 

through each com pan) 's 'cndor on each individual rcscrve will also be expensive to implement. 

rhis process v..ill also be expensive lor the NFIP insurers and FEMA could be faced with 

requests for increases in their expense allowance to reimbursc them l(>r such additional expenses. 

FEM/\ i:. concerned that the cost vcrsus bcm.:fit ursuch rcvic'v\ and worl-.. may \o\cigh cxtn.:mdy 

heavily on the cost side. for rhc true benefit. as described above. is negligible. 

II.2
 
Exhibit II
 

FIMA's Response to OIG Draft Report: NFIP's Management 

Letter lor the FY 2013 DI IS Consolidated Finnncial Slatcment/\udit 

Page 3 

It is importnnt to note that FEM/\ has already taken the step to have theN Fl P insurers' review all 

outstanding pre-Sandy reserves and close out those that have been fully paid and no further 

exposure exist and to justify the othe rs. In addition. a systematic process to review reported open 

reserves when there is an indication that all payments h:l\e been made is in dcvclopmcnt. 

Finally. a bulletin is in process to rcqm:stthat a ll WYO Companies provide FI:MA 'Aith their 

case loss reserving rractices and procedures. FEMA understnnds that outstanding ICC claims. 

those dairns in itig<.~lion. and an) claims imolved in investigation by OIG. GAO or other 

investigative agencies may be open for an extended period or time. 

FEMA 13-05: Lack of Oversight by the National Flood Insurance Program Standards 

Committee 

There is no requirement for the WYO Standards Committee to meet. The Committee oversees 

the performance of WYO companies and recommends appropriate remedial actions when 

companies lailto comply v. ith the n.:quircrnents or the WYO Financial Control Plan. No WYO 

Company's perlormance required referral to the WYO Standnrds Commiuee lor remedial or 

other action during FY 2013. During the time period under rcviev.. FEMJ\ ovcrsa'A Company 

performance through its annual WYO Financial Control Plan rcvie'\ activities. These oversight 

activities were deemed to provide sufTicient oversight to nllow G/\0 to close recommendations 

in Financial A!ana~ement: lmpro11ements Needed in Notional Flood ln,·urmlc:e Pro ram 's 

Financial Contrnl.1· and Oversi~ht. GAO-l 0-66 regarding FEMA 's oversight of the WYO 

companies. The WYO Standards Commillec met on October 30. 20 13 and 'Aill mcet again in 

April. 20 14. FEMA has filled all of the vacant industry positions. 

I hank you again for the opportunit) lo comment on the drali report. 

II.3
 
 

 

 

 

 

 

Exhibit III 

AUDITORS’ RESPONSE
 

FEMA’s response to the draft of this letter discussed several specific observations noted in the letter. As 

such, we provide the following additional information. 

Regarding Observation III.3 (NFR FEMA-13-08a), we specifically noted two instances during our fiscal 

year 2013 testing in which the addresses were documented legal descriptions of the property. Although in 

compliance with FEMA policy, this specific condition prevented a conclusion regarding the proper flood 

zone rating of the policies, including whether the appropriate premiums were collected from the insured. 

Regarding Observation II.B (NFRs FEMA-13-15 and FEMA-13-29), in conjunction with our audit 

procedures, we received a letter from the FEMA contracted actuary describing the data elements utilized 

in computing the actuarial insurance liability estimate as of September 30, 2013. This letter, which guided 

our testing approach related to the insurance liability estimate, included case reserves as one of the data 

elements used in the calculation. Our testing of data elements occurred throughout fiscal year 2013. 

FEMA’s year-end analysis demonstrated that case reserves were not a significant factor in the calculation 

of the insurance liability estimate as of September 30, 2013; we took this information into consideration 

in determining the severity of the conditions identified, which we concluded to be control deficiencies, 

not more severe significant deficiencies. 

Additionally, our recommendations related to Observation II.B are not intended to suggest that FEMA 

specify a uniform case reserving practice/procedure for all insurance companies participating in the NFIP. 

We understand that case reserving is a normal business practice for all property and casualty insurers and 

that FEMA must consider the costs versus benefits of implementing changes to such a disaggregated 

process. However, each participating insurance company should consistently adhere to its own policies 

and procedures related to case reserving, which should be documented as part of the company’s internal 

control structure. 

Regarding Observation IV.A (NFR FEMA-13-05), we acknowledge the functions of the NFIP Standards 

Committee outside of holding meetings. However, we recommend in our letter that the Committee meet 

on a periodic basis, in addition to the other review activities it performs, in order to strengthen this 

oversight process. 

III.1
 
OFFICE OF INSPECTOR GENERAL 

 Department of Homeland Security 

Appendix A

Report Distribution

Department of Homeland Security

Secretary

Deputy Secretary

Chief of Staff

Deputy Chief of Staff

General Counsel

Executive Secretary

Director, GAO/OIG Liaison Office

Assistant Secretary for Office of Policy

Assistant Secretary for Office of Public Affairs

Assistant Secretary for Office of Legislative Affairs

Chief Financial Officer

Chief Information Officer

Chief Privacy Officer

Federal Emergency Management Agency

FEMA Administrator

Chief Financial Officer

FEMA Audit Liaison

Deputy Associate Administrator for Insurance

Director, Risk Insurance Division

Office of Management and Budget

Chief, Homeland Security Branch

DHS OIG Budget Examiner

Congress

Congressional Oversight and Appropriations Committees, as appropriate

www.oig.dhs.gov OIG-14-92 
 

 

ADDITIONAL INFORMATION 

To view this and any of our other reports, please visit our website at: www.oig.dhs.gov. 

For further information or questions, please contact Office of Inspector General (OIG) 

Office of Public Affairs at: DHS-OIG.OfficePublicAffairs@oig.dhs.gov, or follow us on 

Twitter at: @dhsoig. 

OIG HOTLINE 

To expedite the reporting of alleged fraud, waste, abuse or mismanagement, or any 

other kinds of criminal or noncriminal misconduct relative to Department of Homeland 

Security (DHS) programs and operations, please visit our website at www.oig.dhs.gov 

and click on the red tab titled "Hotline" to report. You will be directed to complete and 

submit an automated DHS OIG Investigative Referral Submission Form. Submission 

through our website ensures that your complaint will be promptly received and 

reviewed by DHS OIG. 

Should you be unable to access our website, you may submit your complaint in writing 

to: 

Department of Homeland Security 

Office of Inspector General, Mail Stop 0305 

Attention: Office of Investigations Hotline 

245 Murray Drive, SW 

Washington, DC 20528-0305 

You may also call 1(800) 323-8603 or fax the complaint directly to us at 

(202) 254-4297. 

The OIG seeks to protect the identity of each writer and caller.