GAO 

United States Government Accountability Office

Report to the Ranking Member, 

Committee on Banking, Housing, and 

Urban Affairs, U.S. Senate 

FINANCIAL 

MANAGEMENT 

Improvements Needed 

in National Flood 

Insurance Program’s 

Financial Controls and 

Oversight 

December 2009 

GAO-10-66 
What GAO Found

United States Government Accountability Office

Why GAO Did This Study

Highlights

Accountability Integrity Reliability

December 2009

FINANCIAL MANAGEMENT 

Improvements Needed in National Flood Insurance 

Program’s Financial Controls and Oversight 

Highlights of GAO-10-66, a report to the 

Ranking Member, Committee on Banking, 

Housing, and Urban Affairs, U.S. Senate 

Due to the federal government’s 

role as guarantor, floods impose an 

enormous potential financial 

burden on the federal government. 

Consequently, decision makers at 

the Department of Homeland 

Security (DHS), the Federal 

Emergency Management Agency 

(FEMA), and the Congress need 

accurate and timely financial 

information to assess the 

effectiveness of the National Flood 

Insurance Program (NFIP). This 

report assesses whether controls in 

place during the 2005 to 2007 time 

frame were effective and whether 

actions to improve controls are 

likely to address identified 

weaknesses. GAO reviewed and 

analyzed FEMA/NFIP guidance, 

data, and financial reports, 

reviewed prior audit reports, 

interviewed FEMA officials and 

contractors, and selected a sample 

of claim losses paid to determine 

whether claim files contained key 

documents. 

What GAO Recommends

GAO makes seven 

recommendations to improve NFIP 

financial management controls and 

oversight. FEMA agreed with two 

of GAO’s recommendations and 

cited corrective actions under way, 

stated that two recommendations 

were unnecessary because 

sufficient procedures were already 

in place, and disagreed with the 

remaining three recommendations. 

GAO reaffirms the need for all 

seven recommendations. 

Weaknesses in internal controls impaired FEMA’s ability to maintain effective 

transaction-level accountability. These weaknesses limited FEMA’s ability to 

assure accurate NFIP financial data during the 3-year period from fiscal year 

2005 through 2007, which included the financial activity related to the 2005 

Gulf Coast hurricanes. FEMA relies heavily on Write Your Own (WYO) 

insurance companies to carry out NFIP financial activities such as 

documenting and maintaining claim files. FEMA’s Bureau and Statistical 

Agent (BSA) serves as a liaison between the government and WYO insurance 

companies. GAO identified weaknesses at three levels of the NFIP transaction 

accountability and financial reporting process. First, at the WYO level, our 

internal control testing of a statistical sample determined that almost 71 

percent of WYO company claims loss files did not have the necessary 

documents to support the claims, or reports were filed late. Second, 

incomplete BSA-level premium data files (lacking key information such as 

insureds’ names and addresses) prevented an assessment of the reliability of 

reported NFIP premium amounts. Further, BSA-level internal control 

activities were ineffective in verifying the accuracy of WYO-submitted data. 

Lastly, FEMA’s financial reporting process uses summary data that is overly 

reliant on error-prone manual data entry. 

GAO found that FEMA’s broader oversight structures were also of limited 

effectiveness. Specifically, GAO found weaknesses in three key structures 

FEMA relies on to provide oversight over NFIP and monitor financial activity: 

(1) WYO company audits—specifically, we found that FEMA did not collect 

the results of state insurance department audits related to flood insurance 

activity and did not perform any audits for cause; (2) triennial operational 

reviews of WYO insurance companies—we found that FEMA did not perform 

operational reviews at almost one third of all WYO companies over the 3-year 

period; and (3) FEMA’s claims reinspection program—we found that FEMA 

used flawed sampling procedures in the claims reinspection program. These 

findings are consistent with weaknesses GAO has previously identified. These 

oversight weaknesses limited FEMA’s ability to identify and address financial 

transaction control breakdowns resulting from the 2005 hurricanes. 

FEMA’s initiatives to improve specific internal control weaknesses and the 

overall NFIP control environment since the 2005 Gulf Coast hurricanes have 

done little to address many of the NFIP financial data deficiencies highlighted 

by these catastrophic events. FEMA has made improvements such as revising 

its claim reinspection selection methodology to provide for review of a 

random selection of a statistically representative sample of claim files. 

However, the modified reinspection methodology still does not include all 

claims. FEMA has also implemented a tracking system to monitor the number 

of WYO biennial audits obtained and reviewed. Further, FEMA has a system 

modernization development and implementation effort under way. It is too 

soon to determine the extent to which these efforts will achieve program 

efficiencies. 

View GAO-10-66 or key components.

For more information, contact Susan Ragland 

at (202) 512-9095 or raglands@gao.gov. 
Page i GAO-10-66 

Contents 

Letter 1

Background 3 

Weaknesses in NFIP Transaction Controls and Processing Limited 

Accountability and Financial Reporting 9 

Weaknesses in FEMA’s Oversight Structures Limited Effectiveness 

in Monitoring NFIP Financial Activity 14 

Recent and Planned Initiatives Do Little to Address Identified 

Weaknesses 19 

Conclusions 21 

Recommendations for Executive Action 22 

Agency Comments and Our Evaluation 22 

Appendix I Scope and Methodology 27 

Appendix II Comments from the Department of Homeland 

Security 30 

Appendix III GAO Contact and Staff Acknowledgments 37 

Related GAO Products 38 

Table 

Table 1: Description of Claims Populations and Related Statistical 

Samples 28 

Figures 

Figure 1: Key Participants in the NFIP WYO Program 4 

Figure 2: NFIP Financial Reporting Process for Fiscal Years 2005 to 

2007 8 

Figure 3: WYO Companies with Operational Reviews Completed by 

FEMA in Fiscal Years 2005 through 2007 17 

 NFIP Financial Transactions 
Figure 4: Companies That Had Biennial Financial Audits 

Completed or Not Completed for Fiscal Years 2005 

through 2007 20 

Abbreviations 

BSA Bureau and Statistical Agent 

DHS Department of Homeland Security 

FEMA Federal Emergency Management Agency 

FFMIA Federal Financial Management 

 Improvement Act of 1996 

Financial Control Plan NFIP WYO Program Financial Control Plan 

Requirements and Procedures 

HHS Department of Health and Human Services 

IFMIS Integrated Financial Management 

 Information System 

NFIP National Flood Insurance Program 

OCFO Office of the Chief Financial Officer 

OIG Office of Inspector General 

TIER Treasury Information Executive Repository 

TRRP Transaction Record Reporting and 

Processing 

WYO Write Your Own 

This is a work of the U.S. government and is not subject to copyright protection in the 

United States. The published product may be reproduced and distributed in its entirety 

without further permission from GAO. However, because this work may contain 

copyrighted images or other material, permission from the copyright holder may be 

necessary if you wish to reproduce this material separately. 

Page ii GAO-10-66 NFIP Financial Transactions
Page 1 GAO-10-66 

 

United States Government Accountability Office

Washington, DC 20548 

 

December 22, 2009 

The Honorable Richard C. Shelby 

Ranking Member 

Committee on Banking, Housing, and Urban Affairs 

United States Senate 

Dear Senator Shelby: 

The Federal Emergency Management Agency (FEMA), a component of the 

Department of Homeland Security (DHS), is charged with administering 

the National Flood Insurance Program (NFIP). NFIP, established in 1968, 

is primarily implemented through private insurance companies that 

participate in FEMA’s Write Your Own (WYO) program. Through the WYO 

program, insurance companies sell and service flood insurance policies 

and adjust claims after flood losses. The federal government acts as a 

guarantor of flood insurance coverage for WYO policies issued under the 

WYO Arrangement. As a guarantor, the federal government is liable for 

paying NFIP claim losses should premiums collected be insufficient to 

cover these payments. To the extent possible, the program is designed to 

pay operating expenses and flood insurance claims with premiums 

collected on flood insurance policies rather than by tax dollars. 

Flood losses have imposed an enormous financial burden on the federal 

government. Until 2004, NFIP was able to cover most of its losses. 

However, in order to pay claims arising from the 2005 hurricanes (Katrina, 

Rita, and Wilma), the Congress authorized loans to NFIP of about $16.8 

billion from the Treasury that the program used to cover the enormous 

number of claims.1

 Given this large debt and ongoing complex financial 

challenges created by the 2005 Gulf Coast hurricanes, the fiscal 

sustainability of the flood insurance program has come under scrutiny. 

In March 2006, we designated NFIP as a high-risk program in part because 

of the program’s financial condition and inability to repay borrowed funds. 

Since then, we have made recommendations2

 to improve rate-setting 

1

As of December 2008, NFIP owed over $18 billion to the Treasury. 

2

See GAO, Flood Insurance: FEMA’s Rate-Setting Process Warrants Attention, GAO-09-12 

(Washington, D.C.: Oct. 31, 2008); National Flood Insurance Program: FEMA’s 

Management and Oversight of Payments for Insurance Company Services Should Be 

Improved, GAO-07-1078 (Washington, D.C.: Sept. 5, 2007). 

 NFIP Financial Transactions 
 

methods and program oversight. The program remains on our January 

2009 list of high-risk federal programs. 

This report provides the results of our review of NFIP financial 

transactions related to Hurricane Katrina and other hurricanes of the 2005 

season. Specifically, this report, 

• assesses whether controls were effective in providing accountability 

and reliable financial reporting for NFIP transactions during the 2005 to 

2007 time frame, 

• evaluates oversight structures in place to monitor NFIP financial 

activity for that 3-year period, and 

• assesses whether recent and planned actions to improve NFIP controls 

and the overall control environment are likely to address identified 

financial control weaknesses. 

To assess whether controls were effective in providing accountability and 

reliable financial reporting for NFIP transactions during the 2005 to 2007 

time frame, we obtained and reviewed available transaction data and 

financial reports for NFIP for fiscal years 2005 through 2007. We reviewed 

the WYO Financial Control Plan, WYO Accounting Procedures Manual, 

and other relevant NFIP policy guidance documents to determine the 

design of NFIP financial reporting processes and related internal controls. 

We reviewed NFIP transaction accountability in accordance with the 

guidelines of the Federal Financial Management Improvement Act of 1996 

(FFMIA).3

 We conducted interviews and walkthroughs of reporting 

processes with officials from FEMA, FEMA contractors, and the DHS 

Office of Inspector General (OIG) to document and obtain an 

understanding of the financial reporting process and related internal 

controls for NFIP transactions. We obtained NFIP’s databases of claim 

losses paid for fiscal years 2005 through 2007 and selected a statistical 

sample from the insurance claim losses paid databases for testing of data 

fields such as coverage and deductible amounts, claim payment amounts, 

and policy effective dates against source documents. 

 

3

Federal Financial Management Improvement Act of 1996, Pub. L. No. 104-208, div. A., § 

101(f), title VIII, 110 Stat. 3009, 3009-389 (Sept. 30, 1996). FFMIA was directed at ensuring 

that federal financial management systems provide accurate, reliable, and timely financial 

management information to government managers. FFMIA requires DHS and 23 other 

major departments and agencies to implement and maintain financial management systems 

that comply substantially with (1) federal financial management systems requirements, (2) 

federal accounting standards, and (3) the U.S. Government Standard General Ledger at 

the transaction level. 

Page 2 GAO-10-66 NFIP Financial Transactions
 

To evaluate oversight structures in place to monitor NFIP financial activity 

for the 3-year period covering 2005 to 2007, we reviewed prior GAO and 

DHS OIG reports to identify and follow up on any previously reported 

weaknesses or concerns. Previously reported weaknesses included the 

sample selection process for claims reinspections and the lack of tracking 

results of biennial financial audits. We also identified and assessed 

significant oversight structures outlined in the WYO Financial Control 

Plan. 

To assess whether recent and planned actions to improve NFIP controls 

and the overall control environment are likely to address identified 

financial control weaknesses, we met with key program officials to discuss 

the NextGen system-development effort. We also discussed recent and 

planned NFIP program changes to address the internal control 

weaknesses and oversight issues previously identified by us and the DHS 

OIG. Appendix I provides more details on our scope and methodology. 

We conducted this performance audit from February 2008 to December 

2009 in accordance with generally accepted government auditing 

standards. Those standards require that we plan and perform the audit to 

obtain sufficient, appropriate evidence to provide a reasonable basis for 

our findings and conclusions based on our audit objectives. Our audit 

objectives were not designed to detect fraud. We believe that the evidence 

obtained provides a reasonable basis for our findings and conclusions 

based on our audit objectives. 

Congress established NFIP in the National Flood Insurance Act of 1968 to 

provide an alternative to disaster assistance that would reduce the 

escalating costs to the federal government of repairing flood damage.4

FEMA, within DHS, administers NFIP and is responsible for its 

management and oversight. Under NFIP’s WYO program, FEMA enters 

into an arrangement with individual private-sector insurance companies 

licensed by states to provide property insurance. The arrangement allows 

these companies—using their customary business practices—to offer 

flood insurance coverage to eligible property owners. Figure 1 provides an 

overview of the WYO companies and other key participants in NFIP. 

Background 

 

4

The National Flood Insurance Act of 1968, as amended, is codified at 42 U.S.C. §§ 4001 to 

4129. 

Page 3 GAO-10-66 NFIP Financial Transactions
 

Figure 1: Key Participants in the NFIP WYO Program 

Source: GAO analysis of FEMA data.

Homeowner

Purchases NFIP policy

Seeks information on

coverage

Files claim after flood

event

Insurance agent

Under contract to sell NFIP

policies in the name of one

or more WYO insurance

companies

WYO company

Underwrites policy

Collects premiums

Processes claims

Sends in flood adjuster

FEMA and its Bureau

and Statistical Agent (BSA)

Manages National Flood

Insurance Fund

Pays WYO providers based

on schedule of operating

costs

Receives premium deposits

Manages and regulates

NFIP 

Flood adjuster

Assesses damage

Estimates losses

Submits required reports

to insurance companies

FLOOD

INSURANCE

POLICY

WYO Companies A private insurance company becomes a WYO company5

 by entering into 

an agreement with FEMA known as the Financial Assistance / Subsidy 

Arrangement. Under the arrangement, private insurance companies agree 

to issue flood policies in their own name. The WYO companies adjust 

flood claims as well as settle, pay, and defend all claims arising from the 

flood policies. Participating WYO companies are to comply with FEMA’s 

NFIP WYO Program Financial Control Plan Requirements and Procedures 

(Financial Control Plan), which outlines WYO insurance companies’ 

responsibilities for underwriting, claims adjustments, cash management, 

and financial reporting. 

Selling policies. NFIP coverage is available to all owners of insurable 

property (a building or its contents, or both) in a community participating 

in NFIP. Builders of buildings in the course of construction, condominium 

associations, and owners of residential condominium units in participating 

communities may also purchase flood insurance. Insurance agents under 

contract to one or more WYO insurance companies are the main point of 

contact for approximately 97 percent of policyholders. Based on 

information the insurance agents submit, the WYO insurance companies 

issue policies, collect premiums from policyholders, deduct an allowance 

for expenses from the premium, and remit the balance to the National 

Flood Insurance Fund. The remaining 3 percent of policies are written 

directly by the federal government through a FEMA contractor known as 

 

5

There were approximately 90 WYO companies operating during 2008. 

Page 4 GAO-10-66 NFIP Financial Transactions
 

the Direct Servicing Agent.6 The Direct Servicing Agent provides an 

alternative, for example, when a WYO company is unable or unwilling to 

write a flood insurance policy. 

Adjusting claims. Insurance companies employ certified7

 flood adjusters 

to settle NFIP claims. When flood losses occur, policyholders report them 

to their insurance agent, who notifies the WYO insurance company. The 

WYO insurance company assigns a flood adjuster who is responsible for 

assessing damage, estimating losses, and submitting required reports, 

work sheets, and photographs to the WYO insurance company, where the 

claim is reviewed and, if approved, processed for payment. NFIP’s claims 

payment policy states that FEMA will pay only that part of the loss that 

exceeds the deductible amount, subject to the applicable limit of liability 

(i.e., the amount of insurance coverage). FEMA provides funds to the WYO 

insurance companies from the National Flood Insurance Fund for the 

amounts paid for approved claims and related expenses. As of December 

2008 the fund was over $18 billion in debt. 

FEMA Management and 

Oversight 

About 68 FEMA Mitigation Directorate employees, assisted by 

approximately 105 to 110 Bureau and Statistical Agent8

 (BSA) contractor 

employees, are responsible for managing and overseeing NFIP and the 

National Flood Insurance Fund into which premiums are deposited and 

claims and expenses paid. FEMA and its contractor (the BSA) are 

responsible for monitoring and overseeing the quality of the performance 

of the approximately 90 WYO insurance companies to assure that NFIP is 

administered properly. Their management responsibilities include 

establishing and updating NFIP regulations and flood insurance rates, 

offering training to WYO company insurance agents and adjusters, and 

implementing the Financial Control Plan. 

 

6

The Direct Servicing Agent was outside the scope of our review. 

7

According to the NFIP Adjuster Claims Manual, the Bureau and Statistical Agent (BSA) 

maintains a database of independent adjusters who qualify to adjust flood claims. This 

database reflects whether the adjuster has attended FEMA-recognized flood workshops. 

8

FEMA awards a contract for a BSA, which is responsible for conducting financial and 

statistical reporting based upon data submissions from the WYO companies, developing 

forms and information related to NFIP, and providing various data analyses. The BSA 

serves as the liaison between the government and insurance companies that issue federally 

guaranteed NFIP policies. 

Page 5 GAO-10-66 NFIP Financial Transactions
 

The NFIP financial reporting process begins at the WYO company level 

when the companies provide summary-level financial data and 

transaction-level statistical data to the BSA.9

 The WYO Financial Control 

Plan requires the WYO companies to submit a monthly financial statement 

reporting package to the BSA, which is to include financial, reconciliation, 

and certification statements, and statistical transactions.10 The BSA uses 

the detailed transaction-level data in the reporting package for statistical 

purposes that include information on claims, losses, and premiums (such 

as claim payment and coverage amounts, data on buildings and contents, 

and policy effective dates). The BSA uploads the summary-level financial 

information to its financial system which is used for financial reporting 

purposes. 

NFIP’s Financial Reporting 

Process 

After the BSA receives the reporting package,11 it performs front-end 

balancing—a process intended to ensure the WYO company data are 

consistent with the WYO companies’ reconciliation statements. After BSA 

personnel complete the front-end balancing process they use manual 

processes to upload financial data into the Focus system from a 

spreadsheet.12 The consolidated financial data in Focus is then 

downloaded to a database to prepare journal entries that are then 

uploaded into the Traverse financial reporting system. The BSA uses the 

Traverse system to prepare the financial statement booklets and ultimately 

produce four financial statements—for the Direct Servicing Agent, WYO 

companies, BSA, and a consolidated report that includes all three entities. 

The BSA sends the financial statement booklets consisting of these four 

sets of consolidated—but unaudited—financial statements to FEMA’s 

Office of the Chief Financial Officer (OCFO) monthly. The OCFO prepares 

journal vouchers based on line items from the NFIP consolidated financial 

 

9

In addition, WYO companies house premium and claim files and related records. 

10The Transaction Record Reporting and Processing (TRRP) Plan defines the reporting 

requirements applicable to the writing and servicing of policies issued by the WYO 

companies. The plan contains detailed specifications for recording and compiling data. 

11The WYO Accounting Procedures Manual provides templates called “Financial Exhibits” 

for the WYO companies to use in submitting financial data. For purposes of our report, we 

use the term “financial exhibit” when describing the financial statements submitted to the 

BSA by the WYO companies. 

12BSA personnel upload financial data from spreadsheets the WYO companies submit into 

the Focus mainframe system. These spreadsheets consist of the WYO companies’ financial 

statement exhibits in a standard format required by FEMA’s WYO Accounting Procedures 

Manual. 

Page 6 GAO-10-66 NFIP Financial Transactions
 

statements that the BSA provides. OCFO personnel enter these journal 

vouchers into the Integrated Financial Management and Information 

System (IFMIS), which is FEMA/NFIP’s official accounting system of 

record. After the journal voucher entries are loaded into IFMIS, OCFO 

personnel produce trial balance data and load it into the Treasury 

Information Executive Repository (TIER), which is a data warehouse for 

DHS’ components’ data. 

See figure 2, which depicts NFIP’s financial reporting processes. 

Page 7 GAO-10-66 NFIP Financial Transactions
 

Figure 2: NFIP Financial Reporting Process for Fiscal Years 2005 to 2007 

WYO

documentation

Certification statements,

TRRP data, and

financial exhibits

WYO insurance

companies

Provide documentation

to the BSA on

a monthly basis

Focus mainframe

system

Houses financial

statement information from

WYO companies and

provides the basis for

journal entries

Traverse

system

Processes general ledger

and produces financial

statement booklet

including statements for

WYO companies, BSA, and

direct servicing agent

IFMIS -

FEMA

System for financial

management of both

appropriated funds

and reimbursable funds

Treasury Information

Executive Repository

(TIER) - DHS

Warehouses FEMA

trial balance data

extracted by DHS

Financial

statement booklet

Financial statement

booklet is 1 of 11

FEMA status reports

FEMA

OCFO

Receives hardcopy

financial statement

booklet on monthly

basis and uses data to

prepare journal vouchers

Bureau and

Statistical Agent (BSA)

Consolidates claims,

underwriting, financial,

and statistical data

from WYO insurance

companies

Data are

reentered

BSA personnel

enter data from Focus

into database to

prepare journal

entries for Traverse

Data are

reentered

OCFO personnel

rekey data from the

financial statement

booklets into IFMIS

through journal

vouchers

Front-end

balancing

BSA reviews

WYO submitted

data 

Source: GAO.

Page 8 GAO-10-66 NFIP Financial Transactions
 

Control weaknesses impaired FEMA’s ability to maintain effective 

transaction-level accountability. Consequently, NFIP had limited 

assurance that its financial data for fiscal years 2005 to 2007 were 

accurate. This impaired data reliability resulted from weaknesses at all 

three levels of the NFIP transaction accountability and financial reporting 

process: at the WYO companies, BSA, and FEMA. At the WYO level, WYO 

companies did not adhere to policies and procedures regarding required 

claims file documentation, and therefore almost one third of the claims 

loss files we reviewed were missing supporting documents. This 

deficiency undermined assurances regarding the reliability of the claims 

loss financial data the WYO companies reported. Further, incomplete BSA 

premium data files, such as missing insureds’ names and addresses, 

prevented our assessment of the reliability of reported premium amounts. 

BSA-level controls were ineffective in verifying the accuracy of WYOsubmitted data. At the FEMA level, financial reporting process controls 

were not based on transaction-level data—instead FEMA relied primarily 

on summary data compiled using error-prone manual data entry. 

Weaknesses in NFIP 

Transaction Controls 

and Processing 

Limited 

Accountability and 

Financial Reporting 

WYO Companies Did Not 

Provide Complete 

Documentation to FEMA 

for Claims Transactions 

The WYO companies did not provide complete documentation to FEMA 

for claims paid to insureds during fiscal years 2005 to 2007. According to 

NFIP policies and procedures, claim loss files are to contain adequate 

documentation relevant to the adjustment of a claim to support claim 

payments. Our detailed testing of claim losses paid during fiscal years 2005 

through 2007 showed that 20 percent (36 out of 177) of the claim files 

reviewed were missing adjuster-prepared preliminary reports13 and 20 

percent (36 out of 177) did not contain adjuster-prepared final reports14

 

13Preliminary reports are to be completed by adjusters for all flood losses and must be 

submitted within 15 days after receipt of the loss assignment. The preliminary report 

documents information on the insurance policy, the risk, and the cause of the loss. 

14Final reports are also to be completed by adjusters for all flood losses and are due 30 days 

after the preliminary report is submitted. The final report documents information on the 

history of the premises such as date constructed, any alterations, and any prior losses, as 

well as information on the mortgagee, a summary of the claim, and any excluded damages. 

Page 9 GAO-10-66 NFIP Financial Transactions
 

required by the NFIP Adjuster Claims Manual.15 In addition, for the claim 

files we reviewed, WYO companies did not file 42 percent (74 out of 177) 

of the preliminary and 34 percent (61 out of 177) final reports within the 

required 15 and 45 days, respectively, from the date of loss in accordance 

with NFIP policy. Our findings are consistent with prior audit findings. 

Specifically, DHS’ auditor for its financial statement audit for fiscal year 

2006 reported that preliminary and final reports were not filed within the 

required time frames. Similarly, almost 71 percent (125 out of 177) of the 

statistically sampled claim losses paid files we reviewed failed at least one 

internal control test. These included tests such as determining whether 

claim file documents were missing and whether adjusters filed required 

reports on time or late. Although FEMA officials pointed to the 

unprecedented severity, frequency, and complexity of flood claims during 

this period, these internal control issues identified raise concerns that the 

claim payment amounts were not adequately supported. 

The BSA’s Premium 

Database Was Incomplete 

Over 50 percent of the transactions in the NFIP databases for the 

insurance premium policies for fiscal years 2006 and 2007 that the BSA 

extracted for our testing either lacked or had incomplete insured names, 

addresses, or policy effective dates. Consequently, we were unable to test 

the accuracy of reported insurance premium amounts or whether policy 

premium information was complete. Officials from the BSA attributed the 

missing or incomplete insurance premium information to their extraction 

process and difficulties they encountered (programming errors) when 

extracting the data into a separate database specifically for our use. 

Furthermore, the fact that BSA officials could not readily produce reliable 

or complete data poses questions regarding their capacity to analyze data 

and the NFIP program officials’ ability to identify appropriate managerial 

actions based on what is reported to them by WYO companies through 

their own BSA contractor. 

 

15We noted that 35 of these claim files missing preliminary and final reports are for claims 

adjusted by one particular WYO company. According to FEMA, this WYO company has 

historically taken the position that they will provide the information required but will do so 

in accordance with the processing of all its insurance policies as allowed by the Financial 

Assistance / Subsidy Arrangement. In other words, it will use its own forms that contain the 

information in the NFIP preliminary and final reports. While complying with the Financial 

Assistance / Subsidy Arrangement, based on our review of the information in the claim files 

as compared to the standard preliminary and final reports, we noted that the company’s 

forms in the files do not contain certain information such as any salvage amount and the 

prior condition of the building and contents. In addition, the forms are not consistently 

signed by the adjuster and it is not clear whether the reports were prepared timely. 

Page 10 GAO-10-66 NFIP Financial Transactions
 

We developed alternative procedures that we planned to use to make 

conclusions about the reliability of reported insurance premiums written 

amounts. These alternative procedures involved testing the premium and 

policy information from the sample we selected for claims losses paid. 

However, we were unable to verify information in the premiums database 

for many sample items because of the missing information described 

previously and because of limitations in the quality of the data. 

BSA-Level Internal 

Controls Do Not Verify 

Accuracy of WYO 

Company Data 

We found weaknesses in two key controls outlined in the Financial 

Control Plan for the BSA to ensure the accuracy of WYO companysubmitted data. These controls include front-end balancing, which is a 

process intended to ensure the WYO company data are consistent with the 

WYO companies’ reconciliation statements, and variance reporting, which 

analyzes WYO-submitted transaction-level (statistical) data in comparison 

with summary-level financial data submitted by WYO companies. These 

features do offer some assurances regarding the consistency of data 

provided by WYO companies and recorded by the BSA. However, neither 

offers any assurances that the WYO company-provided information 

accurately reflects actual transactions. Consistent with Standards for 

Internal Control,16 an agency must have sufficient controls in place to 

provide reliable information to run and control its operations. Such 

controls generally include procedures to verify the validity and accuracy 

of the recorded transactions or events. 

Every month, after receiving summary financial and transaction-level 

statistical data17 from WYO companies, the BSA performs front-end 

balancing. As provided by the Financial Control Plan, front-end balancing 

is a process intended to ensure the WYO company data are consistent with 

the WYO companies’ reconciliation statements that compare the statistical 

transaction data to selected financial exhibit entries. This process is 

intended to validate that the BSA has recorded the same information that 

 

16GAO, Internal Control Management and Evaluation Tool, GAO-01-1008G (Washington, 

D.C.: August 2001). 

17The WYO Financial Control Plan requires WYO companies to submit a monthly financial 

statement reporting package to the BSA. This package is to include financial statements, 

reconciliation statements, certification statements, and statistical transactions. The WYO 

Accounting Procedures Manual provides templates called “Financial Exhibits” for the WYO 

companies to use in submitting financial data. For purposes of our report, we use the term 

“financial exhibit” when describing the financial statements submitted to the BSA by the 

WYO companies. 

Page 11 GAO-10-66 NFIP Financial Transactions
 

individual WYO companies have transmitted. The BSA’s front-end 

balancing, while helping to verify that the number of records and dollar 

amounts agree to the reconciliation documents and the timeliness of the 

WYO-submitted data, does not verify or validate the data’s accuracy. 

Although WYO companies submit statistical transaction-level data for 

claims losses paid and premiums written, which are the primary sources of 

financial activity for NFIP, the BSA does not base its financial reporting on 

this transaction-level data, but instead compiles the financial exhibits 

submitted by the WYO companies, and therefore reduces assurances that 

activity reported to FEMA represents actual transactions between WYO 

companies and policyholders. 

The BSA’s monthly variance reporting18 was also not designed to ensure 

WYO company data accuracy. The Financial Control Plan requires the BSA 

to analyze WYO-submitted transaction-level (statistical) data in 

comparison with summary-level financial data submitted by WYO 

companies and produce a report identifying any differences. BSA 

personnel told us that various parties, such as the Standards Committee,19

use the Consolidated Variance Report to monitor the statistical data and 

financial information reported by the WYO companies. However—much 

like front-end balancing—the usefulness of the variance reporting process 

was limited because the BSA review was not designed to check the 

underlying NFIP transaction data submitted by WYO companies against an 

independent source for accuracy or completeness. 

The Design of FEMA’s 

Financial Reporting for 

NFIP Activity Increases 

Risk 

Along with the internal control weaknesses discussed previously, the 

design of FEMA’s NFIP financial reporting process increased the risk of 

inaccurate or incomplete data because it did not include a process of 

analyzing the detailed data for accuracy or analyzing the financial reports 

in relation to the transaction-level data currently submitted by WYO 

companies for statistical purposes. Finally, the process places an 

 

18Variance reporting is the preparation of a report—by the BSA using spreadsheet 

software—that shows variances or differences between financial information and 

statistical information. This report also tracks year-to-date and historical financial and 

statistical information. 

19The Standards Committee meets three times a year (and is alerted to WYO company 

activity by the BSA and FEMA officials throughout the year) to discuss the status of NFIP 

on such topics as WYO company performance issues and material variances between 

statistical and financial data in excess of 1 percent or $50,000 for Net Written Premium or 

Net Paid Losses or $5,000 for Federal Policy Fees. 

Page 12 GAO-10-66 NFIP Financial Transactions
 

overreliance on manual procedures for processing and entering data. The 

design weaknesses increase the likelihood of incomplete or inaccurate 

NFIP financial information. 

As FEMA’s NFIP financial reporting process was designed, approximately 

90 WYO insurance companies submit summary financial information in emails to the BSA for consolidation and submission to FEMA. Throughout 

the entire process, the BSA captures and processes key financial 

information such as net written premiums on the financial statements 

prepared by the WYO companies. By presenting the net written premium 

amount, a WYO company does not show how much of its earned 

premiums went to pay premium refunds. This process limits management 

and audit visibility into identifying and resolving any underlying 

transaction reliability issues because it does not show different 

components of transactions. Furthermore, even when detailed transactionlevel financial data were available, we found that supporting 

documentation was missing. Absent supporting transaction information, it 

was not practical for FEMA to reconstruct or validate NFIP amounts 

reported. 

FEMA’s reliance on unverified WYO data and manual processing as 

described in the background section of this report greatly increases the 

chances of errors or misstatements. Similarly, a reliance on net 

(aggregated) data increases the risk of undetected data errors at the FEMA 

level. As a result, in fiscal year 2006, for example, FEMA OCFO officials 

had to correct over 100 journal vouchers totaling an estimated $260 billion. 

These errors occurred because FEMA OCFO officials erroneously 

recorded NFIP financial activity during fiscal year 2006. According to 

Standards for Internal Control implementation guidance, excessive 

adjustments to numbers or account classifications should not be 

necessary prior to finalization of financial reports. Proper classification 

and recording of transactions or events should take place throughout the 

entire life cycle of each transaction or event, including authorization, 

initiation, processing, and reporting. 

Page 13 GAO-10-66 NFIP Financial Transactions
 

Weaknesses in the broad oversight structures that FEMA relies on to 

monitor NFIP financial activity in three key areas limited the effectiveness 

of FEMA’s oversight: (1) FEMA did not have processes to monitor WYO 

company audits by independent public accountants and other parties, 

including required biennial audits, state insurance department audits, and 

audits for cause; (2) FEMA did not perform triennial operational reviews 

of all WYO insurance companies; and (3) FEMA’s claims reinspection 

program used flawed sampling procedures. These weaknesses are 

consistent with issues identified in our prior reports. As a result of these 

oversight deficiencies, FEMA’s ability to identify and address NFIP 

financial transaction control breakdowns when processing transactions 

related to the 2005 Gulf Coast hurricanes was limited. 

Weaknesses in 

FEMA’s Oversight 

Structures Limited 

Effectiveness in 

Monitoring NFIP 

Financial Activity 

FEMA Did Not Monitor 

Completion or Results of 

WYO Company Audits 

FEMA did not have any mechanism for tracking completion and reviewing 

the results of required biennial financial statement audits of WYO 

companies, did not collect results of state insurance department audits 

related to flood insurance activity, or conduct audits for cause. According 

to the Financial Control Plan, biennial audits are FEMA’s primary 

oversight mechanism for obtaining assurance that it receives complete and 

accurate financial management information from WYO insurance 

companies. The plan provides that such audits are intended to reduce or 

eliminate the need for FEMA auditors to conduct on-site visits to WYO 

insurance companies to oversee their financial activities; specifies that 

biennial financial statement audits are a required condition of an 

insurance company’s participation in the WYO program; and states that 

they must be conducted by an independent Certified Public Accountant.20

According to the Financial Control Plan, these audits are to include an 

opinion on the fairness of the financial statements, the adequacy of the 

internal controls, and the extent of compliance with laws and regulations. 

In 2007, we reported that 5 out of 94 (about 5 percent) WYO companies 

had biennial audits completed for the 2-year period covering fiscal years 

2005 and 2006.21 In response to findings that FEMA had failed to 

consistently enforce the biennial audit requirement, FEMA officials told us 

that they had exempted from this requirement companies that said that 

 

20According to GAO’s previous report, National Flood Insurance Program: FEMA’s 

Management and Oversight of Payments for Insurance Company Services Should Be 

Improved (GAO-07-1078), biennial audits were not performed consistently as required by 

regulation. 

21See GAO-07-1078. We did not evaluate the quality of the biennial audits conducted. 

Page 14 GAO-10-66 NFIP Financial Transactions
 

they were overwhelmed with administering flood claims after the 2005 

hurricane season. 

The Financial Control Plan also requires FEMA to consider the results of 

other audits of the WYO companies such as state insurance department 

audits, as appropriate. Based on our testing of FEMA’s compliance with 

the Financial Control Plan, we reported in August 200922 that FEMA rarely 

or never reviewed state insurance department audits. FEMA officials 

clarified that state departments of insurance audits require a “trigger.” For 

such audits, a financial officer of the insurer is to “trigger” an alert to 

FEMA of any state audit involving NFIP activities. A more independent 

way for FEMA to learn of these audits would be to have contact directly 

with the states. According to FEMA, during our review period, FEMA did 

not receive any such notices. These audits are typically in response to 

company-specific concerns—they are not routine. 

The Financial Control Plan outlines criteria that, in combination or 

independently, may prompt FEMA to perform an audit for cause. Based on 

our testing of FEMA’s compliance with the Financial Control Plan, we 

reported in August 200923 that FEMA rarely or never implemented audits 

for cause. According to FEMA officials, the last audits for cause were done 

in the late 1990s. Because FEMA did not systematically track and centrally 

store all required evaluations, inspections, audits, or reviews, FEMA 

management had no basis for timely access to them or effectively 

overseeing the 90-plus participating insurance companies, and therefore 

had no reasonable basis for determining whether any audits for cause 

were necessary. FEMA told us that based on our August 2009 

recommendations, it now plans to implement such a system. It will be 

important for FEMA to maintain ongoing awareness of state audit 

initiatives identified through an independent information source. 

 

22See GAO, Flood Insurance: Opportunities Exist to Improve Oversight of the WYO 

Program, GAO-09-455 (Washington, D.C.: Aug. 21, 2009). 

23See GAO-09-455. 

Page 15 GAO-10-66 NFIP Financial Transactions
 

FEMA did not perform operational reviews for all WYO companies on a 

triennial basis as required and used a flawed sampling methodology to 

select underwriting files at the WYO companies that it did review.24 The 

Financial Control Plan calls for conducting the following types of 

operational reviews: underwriting/policy administration; claims; 

marketing; customer services; and litigation.25 These reviews are intended 

to provide FEMA with an effective mechanism to monitor, identify, and 

resolve problems related to how WYO companies sell and renew NFIP 

policies and adjust claims. According to Standards for Internal Control 

implementation guidance,26 information should be available on a timely 

basis to allow effective monitoring of events, activities, and transactions 

and to allow prompt action. Given that operational reviews are FEMA’s 

primary method to monitor the WYO insurance companies for the two 

most significant areas of the program—underwriting and claims 

processing—it is important for FEMA to conduct these reviews on a 

regular basis. 

Operational Reviews Are 

Ineffective 

Without the timely information regarding how WYO companies sell and 

adjust claims gained through operation reviews, FEMA cannot be certain 

that the WYO companies provide appropriate financial information to 

NFIP program managers. Policies and procedures specify that all WYO 

companies are to be reviewed at a minimum every 3 years. Therefore, we 

expected that FEMA would have done an operational review of all the 

WYO companies during the 3-year period covering 2005 to 2007. However, 

as shown in figure 3, we found that FEMA had completed operational 

reviews on only 71 percent (82 out of 116) of WYO companies during this 

period. 

 

24According to GAO’s previous report, Federal Emergency Management Agency: 

Improvements Needed to Enhance Oversight and Management of the National Flood 

Insurance Program, GAO-06-119 (Washington, D.C.: Oct. 18, 2005), the process FEMA 

used to select a sample of claims files for operational reviews and the process its program 

contractor used to select a sample of adjustments for reinspections did not produce a 

sample that was randomly chosen or statistically representative of all claims. 

25FEMA officials told us that they are revising the Financial Control Plan and no longer 

perform marketing, customer services, and litigation operational reviews. There were no 

reviews of this type performed during the period of our review (fiscal years 2005 to 2007). 

The FEMA officials said each of these functions were being reviewed by other methods; 

however, we reported that the draft Financial Control Plan did not incorporate these other 

methods. 

26GAO, Internal Control Management and Evaluation Tool, GAO-01-1008G (Washington, 

D.C.: August 2001). 

Page 16 GAO-10-66 NFIP Financial Transactions
 

Figure 3: WYO Companies with Operational Reviews Completed by FEMA in Fiscal 

Years 2005 through 2007 

29%

71%

Source: GAO analysis of data provided by FEMA.

WYO companies that had 

operational reviews completed

WYO companies that did NOT have 

operational reviews completed

Further, as previously reported,27 FEMA did not use a statistical sampling 

methodology to select files for operational reviews—instead it uses 

nonprobability sampling processes. In nonprobability sampling, staff are 

to select a sample based on their knowledge of the population’s 

characteristics. The major limitation of this type of sampling is that the 

results cannot be generalized to a larger population. A nonprobability 

sample is therefore not appropriate to use if the objective is to generalize 

about the population from which the sample is taken.28

FEMA’s Flawed Sampling 

Procedures Hamper Its 

Claims Reinspection 

Program 

According to FEMA’s Financial Control Plan, the claims reinspection 

program is to serve as a mechanism supporting FEMA’s oversight of WYO 

insurance companies. The objectives of the claims reinspection program 

were to (1) keep FEMA and the BSA informed, (2) assist in the overall 

claims operation, and (3) provide necessary assurances and 

documentation for dealing with external parties. The BSA is to conduct all 

reinspections and prepare a report documenting the appropriateness of 

 

27See GAO-06-119. 

28GAO, Policy Manual (Washington, D.C.: Jan. 1, 2004). 

Page 17 GAO-10-66 NFIP Financial Transactions
 

the original claims adjuster’s work. However, we found that FEMA did not 

use a statistical sampling basis for selecting claims for reinspection. 

Specifically, adjusters selected claims to reinspect based upon judgmental 

criteria including, among other items, the size and location of loss and 

complexity of claims. Further, FEMA only required testing for a selection 

of claims for flood events with over 400 claims per a single flood event for 

a particular WYO company. Also, the actual number of claim losses 

selected for reinspection only represents a very small percentage of the 

total number of claim losses processed. Using this flawed methodology for 

selecting samples for claims reinspections, the percentage of claims 

reinspected by flood event for fiscal years 2005 and 2006 was 1.8 percent 

for Katrina, 3.6 percent for Rita, and 5.0 percent for Wilma. By using a 

statistical sampling methodology for selecting claim reinspections, FEMA 

would be able to use this oversight mechanism to make conclusions about 

the accuracy of the total amount of claims losses paid, with a similar level 

of effort. 

These findings are consistent with findings from previous audits. 

Specifically, we previously reported in October 200529 that neither FEMA 

nor its program contractor used a statistically valid method for selecting 

files for reinspections of claims adjusted after each flood event because 

FEMA guidance did not include procedures on the sample selection 

process. Without a statistically valid sampling methodology that 

represents the population, the agency cannot project the results of these 

reinspection oversight activities to confidently determine the overall 

accuracy of claims settled for specific flood events or assess the overall 

performance of insurance companies and their adjusters in fulfilling their 

NFIP responsibilities. In December 2006, we again reported30 that FEMA 

neither used a random sample of claims for its reinspections nor analyzed 

the overall results of those reinspections to determine the total number of 

payment errors and their potential causes. 

 

29See GAO-06-119. 

30See GAO, National Flood Insurance Program: New Processes Aided Hurricane Katrina 

Claims Handling, but FEMA’s Oversight Should Be Improved, GAO-07-169 (Washington, 

D.C.: Dec. 15, 2006). 

Page 18 GAO-10-66 NFIP Financial Transactions
 

FEMA has revised its draft Financial Control Plan (dated August 2009) to 

require selection of a statistically representative sample of claim files for 

its reinspection reviews. However, the modified policy continues to cover 

only those claims associated with single flood events with over 400 claims 

per WYO company. Substantial claims activity may still be excluded from 

reinspection. For fiscal years 2005 and 2006, almost $1.5 billion of the 

$16.5 billion in claims filed would not have been considered for 

reinspection under this criterion. Until processes are modified to make all 

cases eligible for reinspection, FEMA will not be able to effectively 

determine whether the case population is complete as well as whether the 

total amount of claims losses paid is reasonable. 

Recent and Planned 

Initiatives Do Little to 

Address Identified 

Weaknesses 

Available data indicate that the number of biennial financial audits has 

increased since FEMA began tracking the results in fiscal year 2008. Figure 

4 shows that few audits were conducted for fiscal years 2005 and 2006, but 

that there was considerable improvement for fiscal years 2006 and 2007. 

Page 19 GAO-10-66 NFIP Financial Transactions
 

Figure 4: Companies That Had Biennial Financial Audits Completed or Not 

Completed for Fiscal Years 2005 through 2007 

0

10

20

30

40

50

60

70

80

90

100

2005-2006

2006-2007

Number of WYO companies

Fiscal year

WYO companies that did not have financial audits completed

WYO companies that had financial audits completed

Source: GAO analysis of data provided by FEMA.

5

46

89

49

94 95

Note: As the biennial audits cover a 2-year period, the fiscal year 2005 to 2006 audits were 

completed in fiscal year 2007 and the fiscal year 2006 to 2007 audits were completed in fiscal year 

2008. 

Prior to fiscal year 2008, FEMA had not tracked and reviewed these audit 

results because FEMA did not follow NFIP policies and procedures 

requiring it to receive and analyze such information. Accordingly, FEMA 

could not determine whether it received and reviewed all required audit 

reports, nor have a basis for monitoring implementation of necessary 

corrective actions. In response to our previous recommendation regarding 

this long-standing concern, FEMA is now using a tracking mechanism to 

document audit reports received and those reviewed by FEMA staff.31

According to FEMA, once the financial audit reports are received, staff 

and management now review the audit reports and document the results 

 

31See GAO-07-1078. 

Page 20 GAO-10-66 NFIP Financial Transactions
 

of their review on the tracking schedule. While improvements have been 

made with regard to tracking and reviewing the results of biennial audits, 

this is only one component of FEMA’s oversight structure and, as 

discussed in this report, we continue to note weaknesses in the other 

areas. 

FEMA has a system development and implementation effort, referred to as 

NextGen,32 under way. This effort has experienced delays and it is too 

soon to determine whether planned program efficiencies—such as 

confirmation of insured’s property address—will be achieved under the 

new system. According to FEMA, the NextGen system implementation 

effort is designed to be an insurance system that links key data elements 

like claims and policies through shared processes. Under the current 

system, the BSA maintains claim losses paid and premium policies data in 

separate databases. FEMA officials have expressed concern about the 

readiness of the NextGen system to support NFIP program operations. 

As currently designed and implemented, FEMA’s internal controls over 

NFIP offer limited transaction-level accountability and assurances that 

financial reporting is accurate or that insurance company operations 

conform to program requirements. Transaction-level accountability and 

reporting to administer NFIP are fundamental to attaining accountability 

over program resources. Internal controls are also critical to ensure that 

claim payments are adequately supported, and FEMA was missing key 

documentation to support claims. Given the involvement of multiple 

private entities participating in this insurance program, establishing and 

implementing effective policies and procedures to thoroughly implement 

required audits and overall operational and targeted reviews will be 

critical for FEMA to exercise its managerial responsibilities. FEMA has 

taken some steps to strengthen NFIP internal controls such as overseeing 

WYO companies by tracking and reviewing the results of their required 

biennial financial audits. The enormous potential financial burden on the 

federal government that flood events pose, coupled with the risks of 

inaccurate and incomplete NFIP financial information described in this 

Conclusions 

 

32According to FEMA, NextGen is intended to be a full life-cycle NFIP technologymodernization effort focused on providing business-driven solutions for the NFIP BSA 

using state-of-the-art, industry-proven technologies. The principal NextGen project goals 

are to improve BSA and WYO company processes to benefit all NFIP stakeholders, while 

achieving more efficient and effective program operations. We currently have work under 

way looking at this system. 

Page 21 GAO-10-66 NFIP Financial Transactions
 

report, serve to underscore that effective NFIP controls are critical. As 

such, it will be important to take immediate actions to improve these 

controls over NFIP transactions, financial reporting, and oversight. 

To improve the financial reporting process and strengthen internal 

controls, we recommend that the Secretary of Homeland Security direct 

the Acting Assistant Administrator, FEMA Mitigation Directorate, to take 

the following seven actions: 

• Augment NFIP policies to require the BSA to develop procedures to 

analyze financial reports in relation to the transaction-level information 

that WYO companies submit for statistical purposes. 

• Revise required internal control activities for the BSA to provide for 

verifying and validating the reliability of WYO-reported financial 

information based upon a review of a sample of the underlying 

transactions or events, or obtain verification that these objectives have 

been met through independent audits of the WYO companies. 

• Determine the feasibility of integrating and streamlining numerous 

existing NFIP financial reporting processes to reduce the risk of errors 

inherent in the manual recording of accounting transactions into multiple 

systems. 

• Establish and implement procedures to require reviewing available 

information such as the results of biennial audits, operational reviews, and 

claim reinspections to determine whether the targeted audits for cause 

managerial tool should be used. 

• Establish and implement procedures to require maintaining and 

considering current information from an independent source regarding 

state audit results to gather pertinent information such as customer 

service issues and inform determinations about when to conduct audits 

for cause. 

• Establish and implement procedures to schedule and conduct all required 

operational reviews within the prescribed 3-year period. 

• Establish and implement procedures to select statistically representative 

samples of all claims as a basis for conducting reinspections of claims by 

general adjusters. 

We requested comments on a draft of this report from the Secretary of 

Homeland Security. Comments received from the DHS Departmental 

GAO/OIG Liaison Office on behalf of FEMA are reprinted in appendix II. In 

its comments, FEMA concurred with two of our recommendations, stated 

that two recommendations were unnecessary in that the recommended 

Recommendations for 

Executive Action 

Agency Comments 

and Our Evaluation 

Page 22 GAO-10-66 NFIP Financial Transactions
 

procedures were already in place, and disagreed with the remaining three 

recommendations. We reaffirm all seven recommendations. 

With respect to the recommendations for which FEMA concurred 

regarding (1) streamlining financial reporting processes and (2) 

conducting operational reviews, FEMA noted it has actions under way to 

integrate and streamline numerous existing financial reporting processes 

in the design of a new NFIP system, and stated that its new operational 

review process will address our recommendation to schedule and conduct 

all required operational reviews within the prescribed 3-year period. 

Regarding our recommendation for establishing and implementing 

procedures for reviewing all available audit and other reports, FEMA 

stated that it already had a process in place to review WYO company 

performance and trigger audits for cause. FEMA further commented that 

the Standards Committee considers the results of biennial audits, 

operational reviews, and claims reinspections when it reviews company 

performance and considers whether to recommend audits for cause. We 

disagree that the process FEMA has in place is sufficient to address our 

recommendation. As discussed in our draft report, during the period of our 

review, FEMA management, including the Standards Committee, lacked 

timely access to all audit and other reports because FEMA did not 

systematically track and centrally store all required evaluations, 

inspections, audits, or reviews. Therefore, without further action to 

establish additional procedures directed at ensuring access and a 

systematic review of WYO company performance, FEMA will continue to 

be unable to effectively oversee the 90-plus participating insurance 

companies or determine whether any audits for cause are necessary. 

Also, regarding our recommendation concerning selecting statistically 

representative samples of claims for reinspections, FEMA stated that the 

reinspections are not intended to be a definitive audit of the NFIP’s claims 

handling process, and cited the random sample of claims it currently has 

in place. We disagree. As discussed in our draft report, adjusters selected 

claims to reinspect based upon judgmental criteria, not on a random 

sample. Further, FEMA only required reinspection when there were more 

than 400 claims per flood event for a particular WYO company. Because 

reinspections are conducted principally on open claims files to document 

the appropriateness of the original claims adjuster’s work, the lack of a 

statistically representative sample not only precludes FEMA from 

projecting the results of these reinspections to determine the overall 

accuracy of claims, it also limits FEMA’s ability to continuously assess the 

overall performance of insurance companies and adjusters in fulfilling 

Page 23 GAO-10-66 NFIP Financial Transactions
 

their NFIP responsibilities. FEMA also noted that claims operational 

reviews are designed to provide feedback on claims settlements and 

ascertain compliance by WYO companies. The claims operational reviews 

that FEMA cited, while an important oversight mechanism, do not allow 

for continuous feedback concerning the overall insurance company 

performance. 

We also continue to reaffirm our three recommendations for which FEMA 

disagreed in its comments on our draft report. First, with respect to our 

recommendations that FEMA develop financial reports using the 

transaction-level information that WYO companies currently submit for 

statistical purposes, FEMA stated that implementing our recommendation 

would be onerous and burdensome because of the number of transactions 

involved. We subsequently adjusted our recommendation to have NFIP 

augment its policies to require the BSA to develop procedures to analyze 

financial reports in relation to the transaction-level information that WYO 

companies submit for statistical purposes. Such a procedure would help 

compensate for the risks introduced by the current approach of entering 

summary-level information to its financial reporting system. Because WYO 

companies already submit transaction-level data on claims losses paid and 

premiums written and FEMA uses this information for statistical purposes, 

using these transaction-level financial data to increase the reliability of 

FEMA’s financial reporting should impose minimal additional burden. 

Also, with respect to FEMA’s nonconcurrence with our recommendation 

to verify and validate WYO-reported financial information, FEMA 

maintained that the form and structure of the transaction-level detail is 

audited at the source, including consideration of the relevance, reliability, 

and accuracy of the transaction-level detail. However, as discussed in our 

report, during the period of our review, we were not provided any 

evidence showing that FEMA obtained any assurances concerning the 

accuracy or validity of WYO company transaction-level financial data. 

Specifically, FEMA did not demonstrate that it had mechanisms in place 

during fiscal years 2005 through 2007 for receiving and reviewing the 

results of the required biennial financial statement audits of WYO 

companies, or for tracking completion of these audits. FEMA was unable 

to provide evidence of whether all WYO companies had completed 

biennial audits and had not reviewed the results of these WYO company 

biennial audits. Further, as discussed in our report, FEMA officials 

exempted certain WYO companies from the biennial audit requirement 

after the 2005 hurricane season. Therefore, FEMA had no assurance as to 

the accuracy or validity of WYO company transaction-level financial data. 

We reaffirm our recommendation that FEMA revise required internal 

Page 24 GAO-10-66 NFIP Financial Transactions
 

control activities for the BSA to provide required procedures for verifying 

and validating the reliability of WYO-reported financial information based 

upon a review of a sample of the underlying transactions or events. We 

also adjusted our recommendation to include the option for FEMA to 

obtain assurance of the reliability of WYO company-reported financial data 

by verifying that those objectives were met through the independent 

audits of WYO companies. 

Finally, FEMA did not concur with our recommendation to maintain and 

consider information from an independent source regarding state audit 

results in determining whether to conduct audits for cause. FEMA 

contended that such sources do not focus on federal programs, such as 

NFIP. However, FEMA’s Financial Control Plan states that it is expected 

that audits of WYO companies by state insurance departments will include 

flood insurance activity. Further, FEMA acknowledges receiving 

information from a source independent of the WYO companies. 

Specifically, it acknowledged receiving correspondence from state 

insurance departments regarding issues of customer service with the WYO 

companies. It is important for FEMA to establish and implement 

procedures to require maintaining and considering all current information 

available from an independent source regarding state audit results. We 

found that FEMA rarely received or reviewed information from state 

insurance department audits. Consequently, we continue to reaffirm our 

recommendation to obtain and consider independent information on state 

audits of the WYO companies, rather than continuing to rely solely on the 

WYO company that underwrites policies and processes claims to alert 

FEMA of any state issues. 

FEMA also expressed concern over several points in our draft report’s 

narrative. We continue to affirm the process descriptions and the findings 

in our draft report but made several changes in the report to clarify the 

narrative. Our responses to other FEMA concerns with our draft’s 

narrative are provided following FEMA’s comments in appendix II. 

As agreed with your office, unless you publicly announce the contents of 

this report earlier, we plan no further distribution until 30 days from the 

report date. At that time, we will send copies to the Secretary of Homeland 

Security, relevant congressional committees, and other interested parties. 

The report will also be available at no charge on our Web site at 

http://www.gao.gov. 

If you or your staff have any questions about this report, please contact me 

at (202) 512-9095 or raglands@gao.gov. Contact points for our Offices of 

Page 25 GAO-10-66 NFIP Financial Transactions
 

Congressional Relations and Public Affairs may be found on the last page 

of this report. GAO contact and staff acknowledgments are listed in 

appendix III. 

Sincerely yours, 

Director, Financial Management and Assurance 

Susan Ragland 

Page 26 GAO-10-66 NFIP Financial Transactions
Appendix I: Scope and Methodology Appendix I: Scope and Methodology 

To assess whether controls were effective in providing accountability and 

reliable financial reporting for National Flood Insurance Program (NFIP) 

transactions during the 2005 to 2007 time frame, we obtained and reviewed 

available transaction data and financial reports for NFIP for fiscal years 

2005 through 2007. We selected these years to identify transactions 

relevant to the 2005 Gulf Coast hurricanes and to capture more current 

financial information. We reviewed the Write Your Own (WYO) Financial 

Control Plan, WYO Accounting Procedures Manual, and other relevant 

NFIP policy guidance documents to determine the design of NFIP financial 

reporting processes and related internal controls. We reviewed NFIP 

transaction accountability in accordance with the guidelines of the Federal 

Financial Management Improvement Act of 1996 (FFMIA).1

 We also 

interviewed Federal Emergency Management Agency (FEMA), FEMA 

contractors, and Department of Homeland Security (DHS) Office of 

Inspector General (OIG) officials to document and obtain an 

understanding of the financial reporting process and related internal 

controls for NFIP transactions. We conducted walkthroughs to understand 

the reporting process for financial transactions including the review of 

related evidentiary supporting documentation, including journal vouchers 

and adjusting journal entries. Further, to determine how the financial 

transactions were recorded, specifically insurance premiums written and 

claim losses paid, we reviewed NFIP financial reports and met with NFIP 

program and FEMA officials to obtain an understanding of the processing 

cycles for premiums written and claim losses paid. We interviewed FEMA 

personnel and contractors responsible for collecting and maintaining NFIP 

financial data to understand the available data. In addition, we obtained 

requested extracts of NFIP databases of the insurance premiums written 

and claim losses paid for these fiscal years to identify the total population 

including the number of transactions, and planned to select statistical 

samples of claims and policies to test from these databases. We reconciled 

the Bureau and Statistical Agent (BSA) extracts of net premiums written 

and claim losses paid databases to the BSA prepared financial statements 

based on the data provided to FEMA. Once we were able to successfully 

 

1

Federal Financial Management Improvement Act of 1996, Pub. L. No. 104-208, div. A., § 

101(f), title VIII, 110 Stat. 3009, 3009-389 (Sept. 30, 1996). FFMIA was directed at ensuring 

that federal financial management systems provide accurate, reliable, and timely financial 

management information to government managers. FFMIA requires DHS and 23 other 

major departments and agencies to implement and maintain financial management systems 

that comply substantially with (1) federal financial management systems requirements, (2) 

federal accounting standards, and (3) the U.S. Government Standard General Ledger at 

the transaction level. 

Page 27 GAO-10-66 NFIP Financial Transactions 
Appendix I: Scope and Methodology 

complete our reconciliation,2 but before selecting samples, we performed 

data reliability tests on the databases and determined that the claims 

losses paid database was sufficiently reliable for our purposes. We did not 

audit the data that WYO companies submit to FEMA’s contractor, CSC, 

nor did we audit the data produced by CSC or the information included by 

FEMA in DHS’ annual reports. We used the statistical samples of insurance 

claim losses paid as outlined below to perform detailed testing through 

verification of data fields such as coverage and deductible amounts, claim 

payment amounts, and policy effective dates against source documents. 

We also used these samples to further test internal controls over NFIP 

financial reporting. Results from the statistical samples were projected by 

fiscal year both individually and combined. See table 1 below for details 

related to the statistical samples. 

Table 1: Description of Claims Populations and Related Statistical Samples 

Fiscal 

year Type of sample Sample size

Total dollar 

value of claim 

losses selected 

in the sample (in 

millions)

Total number of 

claim losses in the 

sample population 

Total dollar value of 

claim losses in the 

sample population 

(in millions)

2005 Classical probability proportionate to size 

sample 

59 16.0 104,517 2,694.5

2006 Classical probability proportionate to size 

sample 

59 10.3 189,776 16,179.7

2007 Classical probability proportionate to size 

sample 

59 6.3 38,409 885.4

Source: GAO. 

Using the above statistical samples, we also tested other NFIP programoversight controls as deemed necessary and in accordance with our 

engagement objectives. In order to ensure efficient detailed testing, we 

conducted dual-purpose testing, which includes reviewing dollar amounts 

as well as the related internal controls. We found information in the 

premiums written database was not sufficiently reliable for our purposes. 

We were unable to perform detailed testing of the premiums written 

 

2

We were able to successfully reconcile the second set of premium data we requested and 

received for fiscal years 2006 and 2007; a third set of premium data was requested for fiscal 

year 2005 and then we were able to reconcile this set. We performed this reconciliation 

between the financial statements and the database financial information. 

Page 28 GAO-10-66 NFIP Financial Transactions
Appendix I: Scope and Methodology 

database due to a significant number of data-reliability issues that we 

discovered. 

To evaluate oversight structures in place to monitor NFIP financial activity 

for the 3-year period covering 2005 to 2007, we reviewed prior GAO and 

DHS OIG reports to identify and follow up on any previously reported 

weaknesses or concerns, including sample selection for claims 

reinspections and tracking results of biennial financial audits. We also 

interviewed FEMA personnel and contractors regarding the oversight 

structures in place. In addition, we identified and assessed significant 

oversight structures as outlined in the WYO Financial Control Plan, and 

analyzed the results of these controls. 

To assess whether recent and planned actions to improve NFIP controls 

and the overall control environment are likely to address identified 

financial control weaknesses, we reviewed NFIP policy and procedural 

guidance that has been issued subsequent to the 2005 Gulf Coast 

hurricanes. We also met with key program officials to discuss the NextGen 

system development effort. We also discussed recent and planned NFIP 

program changes to address the internal control weaknesses and oversight 

issues previously identified by GAO and the DHS OIG. 

Page 29 GAO-10-66 NFIP Financial Transactions
Appendix II: Comments from the Department Appendix II: Comments from the Department of Homeland Security 

of Homeland Security 

Note: GAO comments 

supplementing those in 

the report text appear at 

the end of this appendix. 

Page 30 GAO-10-66 NFIP Financial Transactions 
Appendix II: Comments from the Department 

of Homeland Security 

Page 31 GAO-10-66 NFIP Financial Transactions
Appendix II: Comments from the Department 

of Homeland Security 

See comment 1. 

Report incorporates 

additional detail on pages 

6, 7, 11, and 12 clarifying 

FEMA’s use of manual 

processes. 

Page 32 GAO-10-66 NFIP Financial Transactions
Appendix II: Comments from the Department 

of Homeland Security 

See comment 2. 

See comment 3. 

See comment 4. 

Report addresses on 

pages 11 and 12. 

Page 33 GAO-10-66 NFIP Financial Transactions
Appendix II: Comments from the Department 

of Homeland Security 

Page 34 GAO-10-66 NFIP Financial Transactions
Appendix II: Comments from the Department 

of Homeland Security 

Page 35 GAO-10-66 NFIP Financial Transactions
Appendix II: Comments from the Department 

of Homeland Security 

Page 36 GAO-10-66 

The following section provides GAO’s comments on DHS’ letter dated 

December 4, 2009. 

1. We deleted the footnote containing this estimate, although the draft 

report did not characterize it as an overpayment. We revised the text on 

page 5 in the Background section to clarify our description of FEMA's 

claims adjustment process. 

GAO Comments 

2. Our report recognizes the unprecedented losses, but nevertheless the 

internal control issues we identified raise concerns that the amounts of the 

claims NFIP paid were not adequately supported even considering the 

expedited procedures in place at the time. 

3. Because we used a statistical sample from the insurance claim losses 

paid databases, our sample allows us to make generalizations about the 

population. The larger WYO companies that processed more claims would 

constitute a larger number of claims in our statistical sample. 

4. FEMA was unable to provide evidence of whether all WYO companies 

had completed biennial audits and had not reviewed the results of any 

biennial audits. Further, as discussed in our draft report, FEMA officials 

exempted certain WYO companies from the biennial audit requirement 

after the 2005 hurricane season. Therefore, FEMA had no assurance as to 

the accuracy or validity of WYO company transaction-level financial data. 

 NFIP Financial Transactions 
Appendix III: GAO Contact and Staff Appendix III: GAO Contact and Staff Acknowledgments 

Acknowledgments 

Susan Ragland, (202) 512-9095 or raglands@gao.gov GAO Contact 

In addition to the contact named above, Chanetta Reed, Assistant Director; 

Sharon Byrd, Assistant Director—Audit Sampling; Kwabena Ansong; 

Gabrielle Fagan; Patrick Frey; Elizabeth Isom; Jason Kirwan; Jason Kelly; 

Chelsea Lounsbury; Mary Osorno; and Gabrielle Perret made significant 

contributions to this report. 

Acknowledgments 

Page 37 GAO-10-66 NFIP Financial Transactions
Related GAO Products Related GAO Products 

High-Risk Series: An Update. GAO-09-271. Washington, D.C.: January 

2009. 

Flood Insurance: Options for Addressing the Financial Impact of 

Subsidized Premium Rates on the National Flood Insurance Program. 

GAO-09-20. Washington, D.C.: November 14, 2008. 

Flood Insurance: FEMA’s Rate-Setting Process Warrants Attention. 

GAO-09-12. Washington, D.C.: October 31, 2008. 

Information Technology: Management Improvements Needed on The 

Department of Homeland Security’s Next Generation Information Sharing 

System. GAO-09-40. Washington, D.C.: October 8, 2008. 

National Flood Insurance Program: Financial Challenges Underscore 

Need for Improved Oversight of Mitigation Programs and Key Contracts. 

GAO-08-437. Washington, D.C.: June 16, 2008. 

National Flood Insurance Program: Greater Transparency and 

Oversight of Wind and Flood Damage Determinations Are Needed. 

GAO-08-28. Washington, D.C.: December 28, 2007. 

Federal Emergency Management Agency: Ongoing Challenges Facing the 

National Flood Insurance Program. GAO-08-118T. Washington, D.C.: 

October 2, 2007. 

T

National Disasters: Public Policy Options for Changing the Federal Role 

in Natural Catastrophe Insurance. GAO-08-7. Washington, D.C.: 

November 26, 2007. 

Financial Management: Persistent Financial Management Systems 

Issues Remain for Many CFO Act Agencies. GAO-08-1018. Washington, 

D.C.: September 30, 2008. 

National Flood Insurance Program: FEMA’s Management and Oversight 

of Payments for Insurance Company Services Should Be Improved. 

GAO-07-1078. Washington, D.C.: September 5, 2007. 

National Flood Insurance Program: Preliminary Views on FEMA’s 

Ability to Ensure Accurate Payments on Hurricane-Damaged 

Properties. GAO-07-991T. Washington, D.C.: June 12, 2007. T

Page 38 GAO-10-66 NFIP Financial Transactions
Related GAO Products 

National Flood Insurance Program: New Processes Aided Hurricane 

Katrina Claims Handling, but FEMA’s Oversight Should Be Improved. 

GAO-07-169. Washington, D.C.: December 15, 2006. 

GAO’s High-Risk Program. GAO-06-497T. Washington, D.C.: March 15, 

2006. 

Federal Emergency Management Agency: Challenges for the National 

Flood Insurance Program. GAO-06-335T. Washington, D.C.: January 25, 

2006. 

Federal Emergency Management Agency: Improvements Needed to 

Enhance Oversight and Management of the National Flood Insurance 

Program. GAO-06-119. Washington, D.C.: October 18, 2005. 

National Flood Insurance Program: Oversight of Policy Issuance and 

Claims. GAO-05-532T. Washington, D.C.: April 14, 2005. 

(195135) Page 39 GAO-10-66 NFIP Financial Transactions
GAO’s Mission The Government Accountability Office, the audit, evaluation, and 

investigative arm of Congress, exists to support Congress in meeting its 

constitutional responsibilities and to help improve the performance and 

accountability of the federal government for the American people. GAO 

examines the use of public funds; evaluates federal programs and policies; 

and provides analyses, recommendations, and other assistance to help 

Congress make informed oversight, policy, and funding decisions. GAO’s 

commitment to good government is reflected in its core values of 

accountability, integrity, and reliability. 

The fastest and easiest way to obtain copies of GAO documents at no cost 

is through GAO’s Web site (www.gao.gov). Each weekday afternoon, GAO 

posts on its Web site newly released reports, testimony, and 

correspondence. To have GAO e-mail you a list of newly posted products, 

go to www.gao.gov and select “E-mail Updates.” 

Obtaining Copies of 

GAO Reports and 

Testimony 

Order by Phone The price of each GAO publication reflects GAO’s actual cost of 

production and distribution and depends on the number of pages in the 

publication and whether the publication is printed in color or black and 

white. Pricing and ordering information is posted on GAO’s Web site, 

http://www.gao.gov/ordering.htm. 

Place orders by calling (202) 512-6000, toll free (866) 801-7077, or 

TDD (202) 512-2537. 

Orders may be paid for using American Express, Discover Card, 

MasterCard, Visa, check, or money order. Call for additional information. 

Contact: 

Web site: www.gao.gov/fraudnet/fraudnet.htm

E-mail: fraudnet@gao.gov

Automated answering system: (800) 424-5454 or (202) 512-7470 

Ralph Dawn, Managing Director, dawnr@gao.gov, (202) 512-4400 

U.S. Government Accountability Office, 441 G Street NW, Room 7125 

Washington, DC 20548 

To Report Fraud, 

Waste, and Abuse in 

Federal Programs 

Congressional 

Relations 

Chuck Young, Managing Director, youngc1@gao.gov, (202) 512-4800 

U.S. Government Accountability Office, 441 G Street NW, Room 7149 

Washington, DC 20548 

Public Affairs 

Please Print on Recycled Paper