National Flood Insurance 

Program's Management 

Letter for DHS' Fiscal Year 

2016 Financial 

Statements Audit 

May 8, 2017 

OIG-17-53 
 

 

 

DHS OIG HIGHLIGHTS
 

National Flood Insurance Program’s

Management Letter for DHS’ Fiscal Year 2016

Financial Statements Audit
 

May 8, 2017 

Why We Did 

This Report 

The Chief Financial Officers Act 

of 1990 (Public Law 101-576) 

and the Department Of 

Homeland Security Financial 

Accountability Act (Public Law 

108-330) require us to 

conduct an annual audit of the 

Department of Homeland 

Security’s (DHS) consolidated 

financial statements and 

internal control over financial 

reporting. 

During the FY 2016 audit of 

DHS’ consolidated financial 

statements and internal 

control over financial 

reporting, KPMG LLP noted 

certain matters involving the 

Federal Emergency 

Management Agency’s National 

Flood Insurance Program 

internal control and other 

operational matters, which are 

presented in this report for 

management’s consideration. 

For Further Information: 

Contact our Office of Public Affairs at 

(202) 254-4100, or email us at 

DHS-OIG.OfficePublicAffairs@oig.dhs.gov 

What We Found 

The independent public accounting firm KPMG LLP 

(KPMG), under contract with the DHS Office of 

Inspector General, audited the National Flood 

Insurance Program’s internal control over financial 

reporting for fiscal year (FY) 2016. The resulting 

management letter contains nine observations related 

to internal controls and other operational matters for 

management’s consideration. KPMG identified internal 

control deficiencies and the need for improvement in 

calculating written premiums, reviewing paid claims, 

monitoring third party service providers, and recording 

investments. These deficiencies are not considered 

significant and were not required to be reported in the 

Independent Auditors’ Report on DHS’ FY 2016 Financial 

Statements and Internal Control over Financial 

Reporting, dated November 14, 2016, included in the 

DHS FY 2016 Agency Financial Report. These 

observations are intended to improve internal control or 

result in other operating efficiencies. 

FEMA Response 

FEMA concurred with all of the observations and has 

begun implementing corrective actions. 

www.oig.dhs.gov OIG-17-53 
OFFICE OF INSPECTOR GENERAL 

Department of Homeland Security 

Washington, DC 20528 / www.oig.dhs.gov 

May 8, 2017 

MEMORANDUM FOR: The Honorable Roy Wright 

Deputy Associate Administrator 

Federal Insurance and Mitigation Administration 

Federal Emergency Management Agency 

FROM: John 

Deputy 

V. 

Inspector 

Kelly Y~ General 

SUBJECT: National Flood Insurance Program's Management Letter 

for DHS' Fiscal Year 2016 Financial Statements Audit 

Attached for your information is our final report, National Flood Insurance 

Program's Management Letterfor DHS' Fiscal Year 2016 Financial Statements 

Audit. This report contains nine observations related to internal control 

deficiencies that were not required to be reported in our Independent Auditors' 

Report on DHS' FY 2016 Financial Statements and Internal Control over 

Financial Reporting, dated November 14, 2016, which was included in the 

Department of Homeland Security's (DHS) fiscal year (FY) 2016 Agency 

Financial Report. We do not require management's response to the 

recommendations. 

The independent public accounting firm KPMG LLP conducted the audit of 

DHS' FY 2016 financial statements and is responsible for the attached 

management letter and the conclusions expressed in it. 

Consistent with our responsibility under the Inspector General Act, we will 

provide copies of our report to congressional committees with oversight and 

appropriation responsibility over the Department of Homeland Security. We will 

post the report on our website for public dissemination. 

Please call me with any questions, or your staff may contact Maureen Duddy, 

Deputy Assistant Inspector General for Audits, at (617) 565-8723. 

Attachment 
 

 

KPMG LLP 

Suite 12000 

1801 K Street, NW 

Washington, DC 20006 

January 25, 2017 

Office of Inspector General and Chief Financial Officer, 

U.S. Department of Homeland Security, and
 

Associate Administrator, Federal Insurance and Mitigation Administration,
 

U.S. Department of Homeland Security, Federal Emergency Management Agency
 

Washington, DC 

Ladies and Gentlemen: 

We planned and performed our audit of the consolidated financial statements of the U.S. Department of 

Homeland Security (DHS or Department), as of and for the year ended September 30, 2016, in accordance with 

auditing standards generally accepted in the United States of America; the standards applicable to financial 

audits contained in Government Auditing Standards issued by the Comptroller General of the United States; 

and Office of Management and Budget (OMB) Bulletin No. 15-02, Audit Requirements for Federal Financial 

Statements. We considered the Department’s internal control over financial reporting (internal control) as a 

basis for designing audit procedures that are appropriate in the circumstances for the purpose of expressing our 

opinion on the consolidated financial statements. In conjunction with our audit of the consolidated financial 

statements, we also performed an audit of internal control over financial reporting in accordance with 

attestation standards established by the American Institute of Certified Public Accountants; the standards 

applicable to attestation standards contained in Government Auditing Standards issued by the Comptroller 

General of the United States; and the internal control requirements included in OMB Bulletin No. 15-02. 

During our audits, we noted certain matters involving the Federal Emergency Management Agency’s (FEMA) 

National Flood Insurance Program (NFIP) internal control and other operational matters that are presented for 

your consideration. These comments and recommendations, all of which have been discussed with the 

appropriate members of management of the named insurance companies (where applicable), FEMA’s Office of 

the Chief Financial Officer (OCFO), FEMA’s Federal Insurance and Mitigation Administration (FIMA), and 

communicated through a Notice of Finding and Recommendation, are intended to improve internal control or 

result in operating efficiencies. These observations and recommendations are summarized in Exhibit I of this 

letter and are not considered significant deficiencies or material weaknesses in internal control over financial 

reporting. Significant deficiencies and material weaknesses in internal control over financial reporting have 

been previously communicated to the DHS Office of Inspector General (OIG) and management in our 

Independent Auditors’ Report, dated November 14, 2016, included in the fiscal year 2016 DHS Agency 

Financial Report. 

Deficiencies related to FEMA information technology (IT) controls will be presented in a separate letter to the 

DHS OIG and the FEMA Chief Information Officer (CIO). In addition, certain other deficiencies related to 

FEMA’s internal control exclusive of our IT findings will be presented in a separate letter to the DHS OIG and 

the FEMA Chief Financial Officer. 

Our audit procedures are designed primarily to enable us to form opinions on the financial statements and on 

the effectiveness of internal control over financial reporting, and therefore may not bring to light all weaknesses 

in policies or procedures that may exist. We aim, however, to use our knowledge of the NFIP organization 

gained during our work to make comments and suggestions that we hope will be useful to you. 

KPMG LLP is a Delaware limited liability partnership and the U.S. member 

firm of the KPMG network of independent member firms affiliated with 

KPMG International Cooperative (“KPMG International”), a Swiss entity. 
We would be pleased to discuss these comments and recommendations with you at any time. 

The purpose of this letter is solely to describe comments and recommendations intended to improve internal 

control or result in other operating efficiencies. Accordingly, this letter is not suitable for any other purpose. 

Very truly yours, 
TABLE OF CONTENTS 

Section/NFR Reference Subject Page 

I. BACKGROUND 2 

II. INTERNAL CONTROL DEFICIENCIES RELATED TO WRITTEN PREMIUMS 2 

III. 

NFR FEMA 16-29 Ineffective Review over National Flood Insurance Program’s Premium Rating and 

Receipt Process 

INTERNAL CONTROL DEFICIENCIES RELATED TO PAID CLAIMS 3 

IV. 

NFR FEMA 16-19 Ineffective Review over National Flood Insurance Program’s Claim Payments Process 

INTERNAL CONTROL DEFICIENCIES RELATED TO CASE LOSS RESERVES 3 

V. 

NFR FEMA 16-28 Deficiencies Identified over Claims’ Case Reserves at Write Your Own Companies 

Participating in FEMA’s National Flood Insurance Program 

INTERNAL CONTROL DEFICIENCIES RELATED TO NFIP SERVICE 

PROVIDER 

4 

VI. 

NFR FEMA 16-01 Ineffective Monitoring of Controls at National Flood Insurance Program Service 

Provider 

NFR FEMA 16-07 Lack of Documentation to Support the Statistical and Financial Variance Analysis 

NFR FEMA 16-17 Failure to Reconcile National Flood Insurance Program Financial Data Information in 

the Preparation of the National Flood Insurance Program Financial Statements 

INTERNAL CONTROL DEFICIENCIES RELATED TO INVESTMENTS 6 

VII. 

NFR FEMA 16-32 Improper Design and Implementation of Investment Amortization Reconciliation 

Procedures 

INTERNAL CONTROL DEFICIENCIES RELATED TO MISCELLANEOUS NFIP 

ACTIVITY 

6 

NFR FEMA 16-04 

NFR FEMA 16-26 

APPENDIX 

Lack of Oversight by the National Flood Insurance Programs Standards Committee 

Ineffective Utilization of the Results of Federal Insurance and Mitigation 

Administration Operational Reviews 

Appendix Subject Page 

A Management Response to the Management Letter 8 

1
 
I. BACKGROUND
 

The Federal Insurance & Mitigation Administration (FIMA) of U.S. Department of Homeland Security Federal 

Emergency Management Agency (FEMA) manages the National Flood Insurance Program (NFIP). Private 

insurance companies, known as Write your Own (WYO) companies, and the Direct Servicing Agent (DSA) 

(NFIP insurers) administer the flood insurance policies issued through the NFIP. The NFIP insurers write 

NFIP policies, adjust flood claims, process and distribute claim payments to policyholders, and establish and 

maintain loss reserves. The NFIP has contracted with a third-party service provider to assist the NFIP in 

managing the program. The NFIP insurers submit NFIP data to the third-party service provider via the 

Transaction Record Reporting and Processing (TRRP) system. The service provider uses underwriting 

transactions (i.e., written premiums) data associated with flood policies to calculate the deferred revenue 

liability for the actual NFIP financial statements and the deferred revenue liability estimate for the year-end 

estimated NFIP financial statements, which is recorded in the year-end FEMA financial statements. The 

estimated financial statements are based on two months of actual data and one month of forecasted data, due to 

the timing of available data versus financial reporting deadlines. Once the actual data is available, FEMA 

compares the recorded estimated financial statements to the actual statements to determine whether any large or 

unusual differences exist to identify whether an on-top adjustment is necessary. The service provider’s actuary 

uses the NFIP paid losses (i.e., claim payments) data for the current year and historical data to calculate the 

year-end actuarial liability for the NFIP financial statements, which is also recorded in the year-end FEMA 

financial statements. The case loss reserve data associated with flood claims may marginally and indirectly be 

used in this process, but is not separately disclosed in the NFIP financial statements. The consistency of this 

reserve from period to period is most important. Thus, the precision of the estimate to reflect actual events is 

dependent upon the accuracy and consistency of the underlying data submitted by the NFIP insurers on a 

monthly basis. 

II.	 INTERNAL CONTROL DEFICIENCIES RELATED TO WRITTEN PREMIUMS 

Observation #1 (Communicated in Notice of Finding and Recommendation (NFR) FEMA 16-29): 

Controls over calculating net written premium amounts did not operate effectively in fiscal year (FY) 2016. 

During testwork over written premiums for the period October 1, 2015 to August 31, 2016, we identified one 

exception in which the Community Rating System (CRS) Discount was understated as applied to the policy 

resulting in an overstated premium of $99.12 charged to the insured. 

Cause: 

The WYO company did not properly review and approve the premium policies when applying the related CRS 

Discount as required in the NFIP manual. 

Recommendations: 

We recommend that FEMA: 

1.	 Follow-up with the insurance company to determine that they have implemented the appropriate 

corrective action to address the exception identified. 

2.	 Provide increased oversight to the insurance company participating in the NFIP to ensure they process 

and review underwriting files in accordance with NFIP guidelines. 

3.	 Include specific file review samples for verification by the underwriter that the proper CRS discount is 

being applied during the Operation Review. 

2
 
III. INTERNAL CONTROL DEFICIENCIES RELATED TO PAID CLAIMS
 

Observation #2 (Communicated in NFR FEMA 16-19): 

Controls over claims payments did not operate effectively in FY 2016. During testwork over 180 claims paid 

transactions for the period October 1, 2015 to June 30, 2016, we identified the following exceptions: 

1.	 Eleven instances in which FIMA was unable to provide supporting documentation to evidence that the 

claims examiner was authorized to review the claim and issue payment. 

2.	 One instance in which the amount of claim paid to the insured was greater than the amount listed on the 

Final Adjusters Report and Proof of Loss. 

Cause: 

1.	 The WYO insurance company did not properly maintain supporting documentation. 

2.	 Personnel at the WYO did not adhere to established policies and procedures regarding review of 

claims. 

Recommendations: 

We recommend that FEMA: 

1.	 Follow up with the NFIP WYO companies to ensure that appropriate corrective action has been taken to 

address the exception noted. 

2.	 Enhance monitoring and oversight of the NFIP insurers to ensure: 

a.	 Claim files are processed and reviewed in accordance with NFIP guidelines between issuance of 

claim payments. 

b.	 WYO companies have established policies and procedures surrounding the authorization of the 

claims reviews performed by the WYO claims examiners. 

IV. INTERNAL CONTROL DEFICIENCIES RELATED TO CASE LOSS RESERVES 

Observation #3 (Communicated in NFR FEMA 16-28): 

Controls to ensure case loss reserves are accurately recorded did not operate effectively in FY 2016. KPMG 

selected a total of 48 case reserve balances for the period October 1, 2015 to August 31, 2016 for substantive 

testwork purposes. In two instances, the amount recorded for case reserves in the August 31, 2016 population 

was not properly updated as additional claim information was obtained resulting in an understatement of 

$30,000. In one instance, case reserves in the August 31, 2016 population was not properly updated as 

additional claim information was obtained resulting in an overstatement. Thus, the overall impact of the 3 

misstatements, created a net $28,000 understatement. 

3
 
Company Month of Loss Reserve 

Amount per 

Sample 

Reserve 

Amount per 

KPMG 

Difference 

Southern Farm 

Bureau 

August 2016 $45,000.00 $65,000.00 $20,000.00 

Southern Farm 

Bureau 

August 2016 $38,000.00 $48,000.00 $10,000.00 

First Insurance 

Co of Hawaii 

July 2016 $52,000.00 $50,000.00 $(2,000.00) 

Cause: 

Personnel at the WYO insurance companies did not adhere to policies and procedures related to updating open 

case-loss reserve balances. 

Recommendations: 

We recommend that FEMA: 

1.	 Follow up with the NFIP insurer to determine that appropriate corrective action has been implemented 

to address the exception identified. 

2.	 Develop a requirement for NFIP insurers to review case reserve transactions for accuracy prior to 

submission of the data to the third-party service provider. 

V. INTERNAL CONTROL DEFICIENCIES RELATED TO NFIP SERVICE PROVIDER 

Observation #4 (Communicated in NFR FEMA 16-01): 

1.	 During our testwork over the Traverse journal voucher (JV) worksheet, we identified one instance in 

which the review and approval of a manual JV was performed by an individual who was in a position 

below that of the preparer of the journal voucher. 

2.	 During our testwork over the December 2015 quarterly estimates, we noted there were incorrect 

descriptions for assumptions listed on the quarterly estimate worksheet. These assumptions related to 

the calculation of the forecasting figures for the Homeowners Flood Insurance Affordability Act 

(HFIAA) Surcharge and Change in HFIAA Surcharge. While the amounts recorded in the spreadsheet 

were correct, the incorrect assumptions were listed within the document, evidencing improper review 

and approval of the first quarter Financial Forecast. 

Cause: 

FIMA did not effectively monitor the controls in place at the NFIP service provider. 

4
 
Recommendations: 

We recommend that FEMA: 

1.	 Ensure that its service provider has sufficient resources to maintain proper internal controls. 

2.	 Monitor its service provider to ensure that they develop and implement a process to review and update 

financial statement assumptions related to the calculation of the forecasting amounts related to the 

HFIAA Surcharge and Change in HFIAA Surcharge. 

Observation #5 (Communicated in NFR FEMA 16-07): 

During our testwork over the December 2015 financial versus statistical data variance report, we identified two 

instances in which there was not sufficient documentation to support the service provider’s required follow up 

communication with the insurance companies. The lack of supporting documentation indicates a deficiency in 

monitoring the WYO companies’ variances that exceeded the established thresholds. 

Cause: 

FIMA is not effectively monitoring the controls in place at the NFIP third party service provider to ensure that 

internal controls are operating and required supporting documentation is properly maintained. 

Recommendation: 

We recommend that FEMA monitor its service provider to ensure that they develop and implement a process to 

review and ensure variances are communicated to the appropriate insurance companies and NFIP standards 

committee as they are identified during the financial versus statistical data variance report process. 

Observation #6 (Communicated in NFR FEMA 16-17): 

1.	 During testwork over the June 2016 Financial Data Receiving Log, we identified one instance in which 

a WYO company was listed on the financial data summary but was omitted from the financial data 

receiving log. 

2.	 During our testwork over the June 2016 Transaction Record Reporting and Processing (TRRP) 

preliminary financial statements and Financial Data Summary Reconciliation, we identified a monetary 

difference in the amount of the recoveries line item between the Financial Data Summary and the 

TRRP preliminary financial statements which had not been identified by FIMA as part of their 

monitoring process. 

Cause: 

FIMA did not effectively monitor the controls in place at the NFIP third-party service provider to ensure internal 

controls were operating effectively. 

Recommendations: 

We recommend that FEMA: 

1.	 Enhance the Front-End Balancing process to ensure the accuracy and completeness of the Receiving 

Log and financial statements. 

5
 
2.	 Utilize the Financial Data Summary generated to provide WYO report classification totals to verify the 

validity of the upload of exhibits to TRRP to ensure there is no difference between the Financial Data 

Summary and TRRP. 

VI.	 INTERNAL CONTROL DEFICIENCIES RELATED TO INVESTMENTS 

Observation #7 (Communicated in NFR FEMA 16-32): 

FEMA records investment activity to its financial system, WebIFMIS, based on monthly Fed Invest reports 

provided by Federal Investments and Borrowing Branch (FIBB). However, FEMA does not perform 

procedures on those reports as recommended to users in the FIBB related Statement on Standards for 

Attestation Engagements (SSAE) 16 report nor reconciles the FEMA recalculated amounts to the Fed Invest 

reports as required by the Treasury Financial Manual (TFM) to ensure the accuracy of investment amortization 

premiums and/or discounts. 

Cause: 

FEMA has not designed and implemented adequate policies and procedures to determine the accuracy of 

investment data and the reconciliation of that data to Treasury Reports, specifically the amortization of 

investment premiums and/or discounts as recommended in the FIBB SSAE 16 report and required by the TFM. 

Recommendation: 

We recommend FEMA OCFO record investment activity to FEMA’s financial system, WebIFMIS, based on 

the policies and procedures established under Treasury’s TFM 4700, Agency Reporting Requirements for the 

Financial Report of the United States Government. Each quarter, FEMA should ensure the investment balance 

reconciles with Treasury’s balances per TFM Volume 1 Part 2 Chapter 4700, Appendix 10. FEMA has stated it 

will establish procedures to recalculate investment amortization on three randomly selected Treasury Bonds for 

the NFIF, annually. This recalculation will support the FIBB SSAE 16 agency user control considerations. 

VII.	 INTERNAL CONTROL DEFICIENCIES RELATED TO MISCELLANEOUS NFIP 

ACTIVITY 

Observation #8 (Communicated in NFR 16-04): 

1.	 Based on our walkthroughs, we determined that as of June 30, 2016 the NFIP Standards Committee 

had not met quarterly; and furthermore, had not met quarterly since April 2, 2015. 

2.	 The NFIP Standards Committee did not review the results of neither the Financial Control Plan’s WYO 

company audit nor other NFIP required reporting. 

Cause: 

1.	 FEMA has not ensured compliance with policies and procedures that require the NFIP Standards 

Committee to meet on a periodic basis throughout the year. 

2.	 The Standards Committee has not met on a periodic basis in a manner to review and evaluate WYO 

Company audit results. 

6
 
 

Recommendation: 

We recommend that FEMA reinstitute regularly scheduled quarterly meetings with the NFIP Standards 

Committee to ensure there is proper WYO Company Statistical and Financial Review and oversight as directed 

in the Financial Control Plan (FCP). 

FEMA has stated the program will coordinate with the Standards Committee in arranging and scheduling the 

Standards Committee meetings a year in advance during each quarter. In addition, FEMA stated it will engage 

the Standards Committee outside the regularly scheduled meeting times as the need arises. In instances in 

which travel proves difficult or where there are other extenuating circumstances, the Standards Committee 

meeting will be held via conference call or webinar. 

Observation #9 (Communicated in NFR 16-26): 

During our testwork over the WYO Biennial Audits and Operational reviews of Claims and Underwriting, we 

determined that the results of the reviews performed by FIMA were not properly communicated to all relevant 

parties. There was no consideration of the financial impact of both satisfactory and unsatisfactory results, as 

determined by FIMA during their review, pertaining to claims on FEMA’s insurance liability calculation. 

Cause: 

FEMA has not established policies and procedures to ensure the findings of WYO companies’ Biennial Audits 

and Operational reviews of Claims and Underwriting are communicated to the appropriate individuals for full 

consideration in the calculation of the actuarial insurance liability. 

Recommendation: 

We recommend that FEMA develop and implement policies and procedures to communicate the results of the 

Biennial Audits and Operational reviews of Claims and Underwriting to all relevant parties including FIMA’s 

actuary for consideration in preparation of FEMA’s insurance liability calculation. 

7
 
 

 

 

"QQFOEJY"
 

U.S. Department of Homeland Security 

Washington, DC 20472 

April 7, 2017 

MEMORANDUM FOR: John V. Kelly 

Deputy Inspector General 

FROM: 

Office of Inspector General 

Roy E. Wright 

Deputy Associate Administrator 

Federal Insurance and Mitigation Administration 

SUBJECT:	 National Flood Insurance Program’s Management Letter
 

for DHS’ FY 2016 Financial Statements Audit
 

OIG Project No. 17-033-AUD-FEMA
 

Thank you for the opportunity to review and comment on the draft report, “National Flood Insurance 

Program’s Management Letter for DHS’ Fiscal Year 2016 Financial Statements Audit.” This 

memorandum addresses our responses to the nine observations and fifteen accompanying 

recommendations contained in the report. FEMA concurs and requests the closure of six 

recommendations, and concurs and is remediating nine recommendations. 

Over the past year, the Federal Insurance and Mitigation Administration (FIMA) has taken 

significant action to transform the National Flood Insurance Program (NFIP) to (1) ensure that all 

policyholders get every dollar they are owed under their flood insurance policies, and (2) add 

additional oversight to the program to ensure that the companies with whom we partner share our 

values of customer-centric delivery and service. 

FEMA appreciates the findings and recommendations from the Office of the Inspector General 

(OIG). We are committed to improving and strengthening our internal controls to ensure that the 

Program can better serve our policyholders and the Nation. 

Recommendations 1, 2, and 3 relate to INTERNAL CONTROL DEFICIENCIES RELATED 

TO WRITTEN PREMIUMS. 

Recommendation 1: Follow up with the insurance company to determine that they have 

implemented the appropriate corrective action to address the exception identified. 

Response: Concur-Request Closure. As recommended, FEMA took corrective measures to remedy 

this finding. FEMA followed up with the identified insurer. The insurer corrected the Community 

Rating System (CRS) discount and adjusted the policy premium by crediting the overcharge of $99.12. 

Recommendation 2: Provide increased oversight to the insurance company participating in the NFIP 

to ensure they process and review underwriting files in accordance with the NFIP guidelines. 


 
 

 

 

Response: Concur-Remediating. FEMA concurs with the need to provide increased oversight to 

stakeholders of the Program, to ensure they process and review underwriting files in accordance with 

the NFIP guidelines. FEMA is providing biannual updates to the Transaction Record Reporting and 

Processing (TRRP) Plan (system processing) and Flood Insurance Manual (agent information) 

through the October 2017 Program Changes. These updates will help to communicate clear system 

and procedural guidance for the processing of data elements and the correct application of rates, 

premium processing, and policy effective date rules. FEMA is also developing training materials, 

issuing bulletins, and conducting an annual training with Write Your Own (WYO) company 

underwriters to ensure our partners process and review underwriting files in accordance with the 

Program’s guidelines. 

Recommendation 3: During the Operational Review include specific file review samples for 

verification by the underwriter that the proper CRS discount is being applied. 

Response: Concur-Request Closure. FEMA revised the Operational Review process to include the 

review of specific file samples for verification. FEMA also added additional oversight by instituting 

a pre-implementation procedure that requires the companies to provide a random sample of policies 

or documents related to program changes before the policy is processed, so the information can be 

validated before the policies become effective. 

Recommendations 4, 5, 6, and 7 relate to INTERNAL CONTROL DEFICIENCIES 

RELATED TO PAID CLAIMS 

Recommendation 4: Follow up with the NFIP WYO companies to ensure that appropriate 

corrective action has been taken to address the exception noted. 

Response: Concur-Request Closure. As recommended, FEMA followed up with the identified 

insurer. The insurer took appropriate corrective action. WYO companies are approved to use their 

examination staff to handle their claims internally, in accordance with their normal business practices. 

However, the adjuster authorization is required by the NFIP. Moving forward, we have required the 

WYOs to submit the adjuster flood control number (FCN) and the adjusting company identifier on all 

claims transactions, starting from October 1, 2016, dates of loss, to confirm NFIP authorization. 

FEMA has further enhanced monitoring and oversight of claims processing. 

Recommendation 5: Enhance monitoring and oversight of NFIP insurers to ensure: 

a)	 Claim files are processed and reviewed in accordance with NFIP guidelines between issuance 

of claim payments. 

b)	 WYO companies have established policies and procedures surrounding the authorization of 

the claims reviews performed by the WYO claims examiners. 


 
 

 

 

 

Response: Concur-Remediating. FEMA is enhancing the monitoring and oversight of claims in 

various ways. To ensure claims are being handled properly at the beginning of the process, FEMA 

now conducts a Random Claims Quality Check (RCQC). FEMA reviews claims at various stages of 

the claim process to ensure that adjusters and insurers are on the right path. The claims are randomly 

selected for review, and 10 percent of the selected cases involve a field inspection with the 

policyholder and insurer representatives when possible. The RCQC identifies and mitigates technical 

and procedural problems early in the claim adjustment process, balancing resources with the size of 

an event to best serve the policyholder and to provide FEMA with trends and analysis on both open 

and closed files. A claim summary report follows each review. If an error is identified, the WYO 

company is notified. FEMA then asks that the WYO companies act on the findings immediately. If 

warranted, FEMA may require WYO companies to provide additional cases to be re-inspected. The 

RCQC standard operations process (SOP) document will be finalized no later than April 1, 2017. We 

will be requesting this finding to be closed. 

FEMA has also taken steps to improve the appeal process for policyholders. A policyholder appeal 

provides us with an opportunity to ensure fair treatment for our policyholder and to confirm that the 

companies we oversee properly carry out their responsibilities. Over the last year, FEMA has 

established an Appeals Branch that is independent from the Claims Branch and claim process. The 

new Appeals Branch uses a case management approach through the resolution of the appeal, 

assigning an insurance examiner, program analyst, and attorney to every appeal. The Appeals 

Branch directs the readjustment of claims and settlements, when possible and appropriate. Finally, 

the new Appeals Branch is capturing key data points that it will provide to internal and external 

stakeholders with the dual goals of improving program delivery and increasing transparency. The 

SOP for the improved appeals process will be finalized no later than March 31, 2017. We will be 

requesting this finding to be closed. 

FEMA continues to monitor and provide oversight into claims by using audit processes such as the 

triennial Operational Reviews, which monitor the claims processing by WYOs and NFIP Direct, and 

the annual Improper Payments Elimination and Recovery Improvement Act (IPERIA), which audits 

any improper claim overpayments. 

Recommendation 6: Follow up with the NFIP insurer to determine that appropriate corrective action 

has been implemented to address the exception identified. 

Response: Concur-Request Closure. FEMA identifies any instances of improper reserving during 

the claims Operational Reviews. Improper reserves are considered critical errors and calculated into 

the total error percentage. Proper reserving instructions have been provided to the insurers and will 

be reiterated in the new Claims Manual that is currently being developed. The new Claims Manual 

will be finalized no later than October 1, 2017. 

Recommendation 7: Develop a requirement for NFIP insurers to review case reserve transactions for 

accuracy prior to submission of the data to the third-party service provider. 

Response: Concur-Request Closure. FEMA issued direction to the WYOs on the NFIP Case Loss 

Reserving procedures through WYO bulletin W-10100. This guidance instructs WYO companies on 

the procedure and requirements for case loss reserving throughout the claim lifecycle. 


 
 

 

 

Recommendations 8, 9, 10, 11, and 12 relate to INTERNAL CONTROL DEFICIENCIES 

RELATED TO NFIP SERVICE PROVIDER 

Recommendation 8: Ensure that its service provider has sufficient resources to maintain proper 

internal controls. 

Response: Concur-Request Closure. In January 2017, as recommended, FEMA hired a new contract 

staff to serve the role of Finance Manager, to fulfill the review and approval over the Legacy Systems 

and Services (LSS) contractor deliverables. 

Recommendation 9: Monitor its service provider to ensure that they develop and implement a process 

to review and update financial statement assumptions related to the calculation of the forecasting 

amounts related to the Homeowner Flood Insurance Affordability Act (HFIAA) surcharge and change 

in HFIAA surcharge. 

Response: Concur-Remediating. FIMA convened meetings with stakeholders across the enterprise 

(Fund Management Directorate, Federal Insurance Directorate, and Risk Management Directorate) to 

discuss and identify appropriate Points of Contact (POCs) to be responsible for reviewing and 

approving LSS contractor activities/deliverables. This governance will better enable appropriate 

oversight and management of the LSS contractor. By June 30, 2017, FEMA will develop a contractual 

governance document that outlines the POCs and their respective roles (Responsible, Accountable, 

Consulted, or Informed) regarding monitoring and oversight of the LSS contractor. Formalizing the 

contract governance will enable a more adequate monitoring and oversight of the LSS contractor 

activities, and it can also be used for the NFIP IT S&S contractor, once those activities are transitioned 

in fall 2017. 

Recommendation 10: We recommend that FEMA monitor its service provider to ensure that they 

develop and implement a process to review and ensure variances are communicated to the appropriate 

insurance companies and NFIP Standards Committee as they are identified during the financial versus 

statistical data variance report process. 

Response: Concur-Remediating. As part of the deliverable noted in response to Recommendation 9, 

FEMA will develop and codify a process to review and ensure that variances are communicated to the 

appropriate insurance companies and the NFIP Standards Committee. The NFIP Standards Committee 

reviewed company variance reports and identified common errors at its March 2017 meeting. 

Recommendation 11: Enhance the Front-End Balancing process to ensure the accuracy and 

completeness of the Receiving Log and financial statements. 

Response: Concur-Remediating. As noted in the response to Recommendation 9, FEMA has taken 

initial measures to effectively monitor the controls in place at the NFIP service provider. The 

contractual governance document to be developed by June 30, 2017, will outline the appropriate 

policies and procedures to enable oversight of the NFIP service provider. 


 
 

 

 

 

 

Recommendation 12: Utilize the Financial Data Summary generated to provide WYO report 

classification totals to verify the validity of the upload of exhibits to FOCUS to ensure there is no 

difference between the Financial Data Summary and FOCUS. 

Response: Concur-Remediating. As noted in the response for Recommendation 9, FEMA has taken 

initial measures to effectively monitor the controls in place at the NFIP service provider. The 

contractual governance document to be developed by June 30, 2017, will outline the appropriate 

policies and procedures to enable oversight of the NFIP service provider. 

Recommendation 13 relates to INTERNAL CONTROL DEFICIENCIES RELATED TO 

INVESTMENTS 

Recommendation 13: We recommend FEMA OCFO record investment activity to FEMA’s financial 

system, Web-IFMIS, based on the policies and procedures established under Treasury’s TFM 4700, 

Agency Reporting Requirements for the Financial Report of the United States Government. Each 

quarter, FEMA should ensure the investment balance reconciles with Treasury’s balances per TFM 

Volume 1 Part 2 Chapter 4700, Appendix 10. FEMA has stated it will establish procedures to 

recalculate investment amortization on three randomly selected Treasury Bonds for the NFIF, 

annually. This recalculation will support FIBB SSAE 16 agency user control considerations. 

Response: Concur-Remediating. FEMA records investment activity in its financial system, WebIFMIS, based on monthly FedInvest reports provided by the Federal Investments and 

Borrowings Branch (FIBB). However, FEMA does not perform procedures on those reports as 

recommended to users in the FIBB-related Statement on Standards for Attestation Engagements 

(SSAE) 16 report; rather, it reconciles the FEMA-recalculated amounts to the FedInvest reports, as 

required by the Treasury Financial Manual (TFM) to ensure the accuracy of investment amortization, 

premiums, and/or discounts. FEMA is developing an Excel spreadsheet to recalculate investment 

activity to ensure the accuracy of investment amortization, premiums, and/or discounts. A Reserve 

Fund SOP, which will be finalized no later than May 1, 2017, will include the process of recalculating 

investment activity in accordance with the TFM. Finally, FEMA will provide training to its staff no 

later than May 1, 2017, to ensure the updated processes are communicated and adhered to. 

Recommendations 14 and 15 relate to INTERNAL CONTROL DEFICIENCIES RELATED 

TO MISCELLANEOUS NFIP ACTIVITY 

Recommendation 14: We recommend that FEMA reinstitute regularly scheduled quarterly meetings 

with the NFIP Standards Committee to ensure there is proper WYO Company Statistical and 

Financial Review and oversight as directed in the Financial Control Plan (FCP). 

Response: Concur-Remediating. In 2016, FEMA hired a new Branch Chief to lead the Industry 

Management Branch (IMB) and increased the staffing of the branch. In 2017, the IMB reconvened the 

NFIP Standards Committee and coordinated the scheduling of meetings for the remainder of Fiscal 

Year 2017. 

No later than June 1, 2017, the committee plans to develop a NFIP Standards Committee Charter that 

outlines the roles and responsibilities of its committee members. In parallel to the charter effort, IMB is 

working to refresh the WYO Arrangement (which includes the Financial Control Plan that outlines the 


 
 

purpose of the committee and the governance processes). FEMA will send the WYO Arrangement and 

Financial Control Plan to the WYO companies no later than July 1, 2017. 

In consultation with WYOs and industry subject matter experts, FEMA has created a 3-year 

framework for major changes to the WYO Arrangement. The guiding principles for this framework 

are “Measure,” “Benchmark.” and “Reward.” In 2017, the WYO Arrangement will focus on 

delivering a report of performance metrics for the program’s identified areas of focus. 

Recommendation 15: We recommend that FEMA develop and implement policies and procedures 

to communicate the results of the Biennial Audits and Operational Reviews of Claims and 

Underwriting to all relevant parties, including FEMA’s actuary, for consideration in preparation of 

FEMA’s insurance liability calculation. 

Response: Concur-Remediating. FEMA is developing policies and procedures to ensure the results 

of the Biennial Audits and Operational Reviews are being communicated to all relevant internal 

parties. By August 31, 2017, FEMA will develop an SOP that outlines the process for 

communicating results to internal parties. By July 15, 2017, FEMA will develop an SOP on 

calculating FEMA’s insurance liability, taking into consideration the results of the Operational 

Review and Biennial Audit. 


 
 

OFFICE OF INSPECTOR GENERAL 

Department of Homeland Security 

Appendix B 

Report Distribution 

Department of Homeland Security 

Secretary 

Deputy Secretary 

Chief of Staff 

General Counsel 

Executive Secretary 

Director, GAO/OIG Liaison Office 

Assistant Secretary for Office of Policy 

Assistant Secretary for Office of Public Affairs 

Assistant Secretary for Office of Legislative Affairs 

Chief Financial Officer 

Federal Emergency Management Agency 

Administrator 

Chief Financial Officer 

Audit Liaison 

Deputy Associate Administrator for Insurance 

Director, Risk Insurance Division 

FEMA Audit Liaison 

Office of Management and Budget 

Chief, Homeland Security Branch 

DHS OIG Budget Examiner 

Congress 

Congressional Oversight and Appropriations Committees 

www.oig.dhs.gov OIG-17-53 
 

 

ADDITIONAL INFORMATION AND COPIES 

To view this and any of our other reports, please visit our website at: www.oig.dhs.gov. 

For further information or questions, please contact Office of Inspector General Public Affairs 

at: DHS-OIG.OfficePublicAffairs@oig.dhs.gov. Follow us on Twitter at: @dhsoig. 

OIG HOTLINE 

To report fraud, waste, or abuse, visit our website at www.oig.dhs.gov and click on the red 

"Hotline" tab. If you cannot access our website, call our hotline at (800) 323-8603, fax our 

hotline at (202) 254-4297, or write to us at: 

Department of Homeland Security 

Office of Inspector General, Mail Stop 0305 

Attention: Hotline 

245 Murray Drive, SW 

Washington, DC 20528-0305