Department of Energy: Use of Leading Practices Could Help Manage the Risk of Fraud and Other Improper Payments
Published: 2017-03-30T00:00:00

Fast Facts:
DOE's inadequate management and oversight of its contractors led us to designate its contract management as a High Risk area. For example, in November 2016, DOE contractors constructing a nuclear waste treatment plant agreed to pay a combined $125 million to settle a lawsuit alleging, among other things, that a contractor improperly used federal funds for lobbying purposes.
We found that DOE does not use leading practices for managing fraud risks—such as data analytics—that can help agencies detect fraudulent spending or other improper payments.
We made six recommendations aimed at reducing DOE's risk of fraud and improper payments.

Highlights:
section_title: Why GAO Did This Study
paragraphs: Over the past decade, incidents of fraud by DOE contractors have occurred. From 2003 through 2008, employees of one contractor at DOE's Hanford site in Washington state made hundreds of fraudulent purchases and solicited and received kickbacks. In another case, Hanford contractors agreed to pay a combined $125 million to settle disputed claims regarding federal dollars spent on nonnuclear-compliant parts. To help federal program managers combat fraud, in July 2015, GAO issued leading practices for managing fraud risks.
GAO was asked to review DOE's processes, programs, and practices for managing its risk of fraud. This report examines (1) DOE's approach to managing its risk of fraud and other improper payments and challenges, if any, that may limit the effectiveness of this approach; (2) the extent to which DOE's approach incorporates leading practices; and (3) the application of data analytics in identifying potential indicators of fraud or other improper payments associated with selected DOE contracts.
section_title: What GAO Found
paragraphs: The Department of Energy (DOE) manages the risk of fraud and improper payments through its internal controls program, which includes, among other things, prepayment invoice reviews and post payment audits. However, several challenges limit the effectiveness of this approach. For example, DOE does not have a department-wide invoice review policy or well-documented procedures at five of the six sites with invoice review responsibilities. Consequently, DOE has no assurance that control activities at these sites are operating as intended. Time constraints also limit the effectiveness of invoice reviews. For example, some invoices can have numerous associated transactions and the reviews must be completed within a limited time frame before payment, which may be as short as 10 days.
DOE's approach to managing fraud risk does not incorporate leading practices such as creating a dedicated antifraud entity to lead fraud risk management activities; conducting regular fraud risk assessments that are tailored to the program; developing and documenting a strategy to mitigate assessed fraud risks; or designing and implementing specific control activities, such as data analytic activities, to prevent and detect fraud. By not implementing leading practices, DOE is missing an opportunity to organize and focus its resources in a way that would allow it to mitigate the likelihood and impact of fraud. Moreover, the Fraud Reduction and Data Analytics Act of 2015 establishes requirements aimed at improving federal agencies' controls and procedures for assessing and mitigating fraud risks through the use of data analytics. The legislation also directs the Office of Management and Budget (OMB) to, among other things, establish implementation guidelines that incorporate fraud risk management leading practices. DOE officials told GAO that they plan to meet the requirements of the act but should not be expected to implement private industry leading practices prior to the issuance of OMB guidance. Incorporating leading practices could also help DOE more effectively implement the act's requirements once OMB guidance is available.
It is not possible to fully employ data analytics as a tool to identify potential indicators of fraud or other improper payments at DOE because of limitations in contractor-maintained cost data. Much of the cost data maintained by the two DOE contractors GAO selected for data analytic purposes could not be used because these data did not include a complete universe of transactions that was reconcilable with amounts billed to DOE or did not contain details necessary to determine the nature of costs charged to DOE. Because DOE does not require its contractors to maintain sufficiently detailed transaction-level cost data that are reconcilable with amounts charged to DOE, it is not well positioned to employ data analytics as a fraud detection tool. Effective fraud risk managers collect and analyze data and identify fraud trends and use them to improve fraud risk management activities, according to leading practices that GAO has previously identified. Without the detailed data necessary to conduct such analysis, DOE is missing an opportunity to develop, refine, and improve its experience with data analytic tools and techniques, and better position itself to meet the requirements of the Fraud Reduction and Data Analytics Act.
section_title: What GAO Recommends
paragraphs: GAO is making six recommendations, including that DOE establish invoice review policies and procedures, employ leading practices such as data analytics to help manage fraud risk, and require that its contractors maintain sufficiently detailed cost data for reconciling with amounts charged. DOE generally concurred with five of GAO's six recommendations but did not agree to require contractors to maintain detailed data. GAO continues to believe that the recommendation is valid, as discussed in the report.

section_title: Letter
paragraphs: As the largest contracting agency in the federal government outside of the  Department of Defense, the Department of Energy (DOE) relies primarily  on contractors to carry out its diverse missions and operate its  laboratories and other facilities, spending approximately 90 percent of its  annual budget of $27 billion on contracts and major capital asset projects  (i.e., those with an estimated cost of $750 million or more). DOE’s history  of inadequate management and oversight of its contractors led us in 1990  to designate DOE’s contract management, including both contract  administration and project management, as a high-risk area vulnerable to  fraud, waste, abuse, and mismanagement. In our 2013 High-Risk Update,  to acknowledge progress DOE had made in managing nonmajor projects  (i.e., those costing less than $750 million), we narrowed the focus of  DOE’s high-risk designation to major contracts and projects but noted that  we would continue to monitor nonmajor projects to ensure that progress  in this area was sustained.
Improper payments, which include fraudulent payments, are a significant  problem in the federal government, and over the past decade, there have  been a number of high-profile incidents involving fraudulent activity by  contractors at DOE. For example, from 2003 through 2008, contractor  employees at DOE’s Hanford site in Washington State made hundreds of  fraudulent purchases using government purchase cards and solicited,  received, and accepted kickbacks. In this case, the contractor had been  alerted to weaknesses in its purchase card controls but failed to address  these weaknesses. In addition, the DOE Office of Inspector General  (OIG) has reported on numerous cases of fraud, including a case in which  a subcontractor and former state grants administrator conspired to submit  fraudulent documents and make false claims to obtain approximately $2  million in funds DOE had received under the 2009 American Recovery  and Reinvestment Act. More recently, in November 2016, DOE  contractors responsible for designing and constructing the Hanford Waste  Treatment Plant in Richland, Washington, agreed to pay a combined  $125 million to settle part of a lawsuit alleging, among other things, that  the contractors failed to comply with the nuclear quality requirements of  the Waste Treatment Plant contract in connection with the procurement,  fabrication, and installation of certain of its components. The settlement  also covers claims that one contractor improperly used federal funds for  lobbying purposes.
To address the problem of improper payments, legislation enacted since  2002 requires, among other things, that federal agencies review their  programs and identify those that are susceptible to significant improper  payments—a process known as risk assessment. In December 2014, we  found that DOE had developed a process to assess its programs’ risk of  improper payments, but that the process was not followed by all DOE  programs. For example, 26 of DOE’s 55 programs did not prepare risk  assessments in 2011. DOE, nonetheless, reported that it did not have  any programs susceptible to significant improper payments. We  recommended that DOE take steps to improve its risk assessments,  including revising guidance for its programs. DOE concurred with our  recommendations and has taken some steps to improve its guidance for  assessing its risk of improper payments.
While legislation has focused federal managers’ attention on addressing  improper payments, including such payments made as a result of fraud,  the deceptive nature of fraud makes it difficult to measure in a reliable  way. In addition, standards for internal control in the federal government  require managers to consider the potential for fraud when identifying,  analyzing, and responding to risks. In July 2015, to help federal program  managers combat fraud and ensure integrity in government agencies and  programs, we issued A Framework for Managing Fraud Risks in Federal  Programs. In this guide, we identified leading practices for managing  fraud risks and organized them into a conceptual framework called the  Fraud Risk Framework. One of the leading practices we identified was the  use of data analytics to prevent and detect fraud. Data analytics enable  an organization to analyze transactional data to obtain insights into the  operating effectiveness of internal controls and to identify improper cost  charges, potential indicators of fraud, or actual fraudulent payments or  activities. In June 2016, Congress passed the Fraud Reduction and Data  Analytics Act of 2015, which established requirements aimed at improving  federal agencies’ controls and procedures for assessing and mitigating  fraud risks and capabilities to identify, prevent, and respond to fraud,  including improper payments, through the development and use of data  analytics. Furthermore, this legislation directed the Office of Management  and Budget (OMB) to, among other things, establish guidelines for  agencies for implementing control activities to prevent, detect, and  respond to fraud, including improper payments; these guidelines are to  incorporate the leading practices identified in the Fraud Risk Framework.
You requested that we review DOE’s processes, programs, and practices  for managing its risk of fraud. This report examines (1) DOE’s approach  to managing its risk of fraud and other improper payments and  challenges, if any, that may limit the effectiveness of this approach; (2)  the extent to which DOE’s approach incorporates leading practices, such  as the use of data analytics; and (3) the application of data analytics in  identifying potential indicators of fraud or other improper payments  associated with selected DOE contracts.
To examine DOE’s approach to managing its risk of fraud and other  improper payments, as well as any challenges that may affect the  effectiveness of this approach, we reviewed federal requirements and  DOE regulations, directives, and guidance for internal controls over  financial and accounting operations and for contractor oversight. In  addition, we interviewed DOE officials from headquarters organizations,  including the Office of the Chief Financial Officer (CFO), the Office of the  Chief Risk Officer, and the Office of Inspector General (OIG). We  interviewed DOE’s field CFOs and contracting officers at 10 DOE site  offices and DOE’s contractors at each site, and we determined that 6 of  those sites oversaw at least one non-M&O contractor. In addition, we  collected DOE policies and procedures for oversight and review of  contractor costs from each site office. We reviewed and analyzed DOE  and contractor responses and information provided through the interview  process. We visited DOE’s Hanford office in Richland, Washington, and  the National Nuclear Security Administration’s (NNSA) Office of Financial  Performance in Albuquerque, New Mexico, to gain an in-depth  understanding of the local DOE processes for oversight of contractors’  costs.
To examine the extent to which DOE’s approach incorporates leading  practices, we reviewed the standards and guidance of the Institute of  Internal Auditors and our Fraud Risk Framework to identify leading  practices for managing the risk of fraud and improper payments in the  federal government, and we compared DOE’s policies and procedures  with selected leading practices. To ensure that we had a cross section of  leading practices, we selected at least one leading practice from each of  the following components of the Fraud Risk Framework: commit to  combating fraud, assess fraud risk, and design and implement a strategy  for mitigating risk. The leading practices we selected from each  component were chosen because the use of these practices could be  objectively verified.
To examine the application of data analytics in identifying potential  indicators of fraud or other improper payments for selected DOE  contracts, we selected data from Sandia Corporation, the management  and operating (M&O) contractor responsible for managing and operating  Sandia National Laboratories, and Bechtel National, Inc., the non-M&O  contractor responsible for the design and construction of the Waste  Treatment Plant at DOE’s Hanford site, for transaction-level cost data for  fiscal years 2013 through 2015. We selected these contractors for in- depth review based on type of contractor (M&O and non-M&O), contract  size in dollars, and geographic location (for ease of access to contractor  data).To assess the reliability of the data we obtained, we interviewed  DOE officials responsible for the data to understand how the data were  maintained and performed data testing, including checking totals in the  data against control totals provided by DOE, and examining, among other  things, outliers and missing data. We found the data to be sufficiently  reliable for the purposes of our engagement.
We conducted this performance audit from June 2015 to March 2017 in  accordance with generally accepted government auditing standards.  Those standards require that we plan and perform the audit to obtain  sufficient, appropriate evidence to provide a reasonable basis for our  findings and conclusions based on our audit objectives. We believe that  the evidence obtained provides a reasonable basis for our findings and  conclusions based on our audit objectives.
subsections: section_title: Background
paragraphs: This section discusses DOE’s use of M&O and non-M&O contracts, cost- reimbursement contracts and cost-surveillance procedures, DOE  headquarters and field office responsibilities for cost-surveillance and  financial management policies and activities, leading practices for  managing the risk of fraud and other improper payments, and data  analytic tools and techniques to prevent and detect fraud.
subsections: section_title: DOE’s Use of M&O and Non-M&O Contracts
paragraphs: Since the Manhattan Project produced the first atomic bomb during World  War II, DOE and its predecessor agencies have depended on the  expertise of private firms, universities, and others with the scientific,  manufacturing, and engineering expertise needed to carry out research  and development work and manage the government-owned, contractor- operated facilities where the bulk of the department’s mission activities  are carried out. DOE relies on contracts in general, and M&O contracts in  particular, to do much of this work.
The Federal Acquisition Regulation (FAR) authorizes DOE and other  agencies with sufficient statutory authority and the need for contracts to  manage and operate their facilities to use the M&O form of contract, but,  according to DOE, it is the only agency using such contracts. An M&O  contract is characterized both by its purpose and by the special  relationship it creates between government and contractor. For example,  the FAR recognizes that because of the nature of M&O contract work, or  because it is to be performed in government facilities, the government  must maintain special, close relationships with its M&O contractors and  the contractors’ personnel in various important areas (e.g., safety,  security, cost control, and site conditions).
DOE’s use of M&O contracts has changed over time. Beginning in the  1990s, DOE undertook a detailed review of the then-existing M&O  contracts to determine if the mission requirements remained appropriate  for using such contracts. As a result of that review, DOE reduced the  number of M&O contracts from approximately 52 to 29 and began using  more non-M&O contracts, particularly for its environmental management  activities and for some large capital asset construction projects. Although  DOE uses fewer M&O contracts today than it did in the 1990s, they  remain the primary contract form it uses, in terms of contract spending. In  fiscal year 2015, for example, DOE had almost 6,700 non-M&O contracts  and 22 M&O contracts. That year, DOE spent almost $19 billion on its  M&O contracts—three-quarters of its total $25 billion in spending.
section_title: Cost-Reimbursement Contracts and Cost- Surveillance Procedures
paragraphs: Regardless of the contract form used—M&O or non-M&O—the majority of  DOE’s contracts are cost-reimbursement contracts. Under cost- reimbursement contracts, the government primarily pays the contractor’s  allowable costs incurred, rather than paying for the delivery of an end  product or service; the government also pays a fee that is either fixed at  the outset of the contract or adjustable based on objective or subjective  performance criteria set out in the contract. This type of contract is  considered high risk for the government because the primary risk of cost  overruns is placed on the government. Cost-reimbursement contracts  also require significantly more government oversight than do fixed-price  contracts. For example, for cost-reimbursement contracts, the  government must determine that the contractor’s accounting system is  adequate for determining costs related to the contract and update this  determination periodically. In addition, the government needs to monitor  contractor costs—known as cost surveillance—to provide reasonable  assurance that the contractor is using efficient methods and effective cost  controls.
By employing cost-surveillance procedures under cost-reimbursement  contracts, the government can help ensure that the contractor is  performing efficiently and effectively and that the government pays only  for allowable, allocable, and reasonable costs applicable to the contract.  As we reported in September 2009, federal agencies use a range of  procedures for monitoring contractor cost controls. The procedures  generally used by the civilian agencies we reviewed called for invoice  reviews. Invoice reviews help to ensure that the goods and services for  which the government is being billed were actually received, that the  amounts billed are allowable, and that the government is not incurring  costs that are inadequately supported. In addition, some agencies  followed alternative procedures for monitoring costs and supplemented  their cost monitoring with audits for the purpose of testing whether  invoiced costs are allowable—known as incurred cost audits.
section_title: DOE Headquarters and Field Office Responsibilities for Financial Management and Cost-Surveillance Policies and Activities
paragraphs: The responsibility for establishing policies and performing cost- surveillance activities is split between DOE headquarters and field offices.  The following DOE headquarters offices are responsible for establishing  department-wide policies and guidance related to cost surveillance and  financial management.
DOE’s Office of Acquisition Management is responsible for  establishing procurement-related policies and guidance. Among  other things, the office is responsible for establishing cost-surveillance  policies and guidance that help ensure that DOE pays only for  allowable, allocable, and reasonable costs applicable to the contract.  This includes updates to the DOE FAR Supplement (Department of  Energy Acquisition Regulation), DOE Acquisition Letters, DOE  procurement related Orders and Directives, and DOE’s Acquisition  Guide.
According to DOE Order 520.1A, DOE’s Office of the CFO is  responsible for establishing, maintaining, and interpreting policy and  general procedures for accounting and related reporting. In addition,  the Office of the CFO is responsible for establishing policies and  guidance for assessing DOE’s internal controls over contractor  payments and assessing the risk of fraud and improper payments.
Procurement and financial management components at DOE’s field  offices are responsible for overseeing DOE contractors to include carrying  out cost-surveillance and financial management activities. These include  the following officials:
DOE contracting officers are responsible for, among other things,  determining the allowability of costs incurred by contractors under  cost-reimbursement contracts. They are also responsible for ensuring  that contract invoices are properly reviewed and analyzed before  payment. In exercising this responsibility, a contracting officer may  designate other qualified personnel to be the contracting officer’s  representative for the purpose of performing certain technical  functions in administering a contract, including conducting invoice  reviews.
DOE’s field office CFOs, in cooperation with DOE contracting officers  and other field office staff, are responsible for overseeing contactor  costs and conducting other financial management activities, such as  internal control and improper payment risk assessments. For  example, invoice reviews require close coordination among the  contracting officer, contracting officer’s representatives, and the field  CFO.
section_title: Leading Practices for Managing the Risk of Fraud and Other Improper Payments
paragraphs: In September 2014, we issued revised federal internal control standards  that went into effect at the start of fiscal year 2016. These revised  standards, along with our Fraud Risk Framework, OMB guidance, and  the Fraud Reduction and Data Analytics Act of 2015 have placed an  increased focus on the need for federal program managers to take a  strategic approach to managing improper payments and risks, including  fraud risk.
Our Fraud Risk Framework provides comprehensive guidance for  conducting fraud risk assessments and using the results as part of the  development of a robust antifraud strategy. It also describes concepts  and leading practices for establishing an organizational structure and  culture that are conducive to fraud risk management, designing and  implementing controls to prevent and detect potential fraud, and  monitoring and evaluating fraud risk management activities. The leading  practices described in the Fraud Risk Framework are meant to provide  additional guidance for implementing requirements contained in federal  internal control standards and OMB circulars. Our Fraud Risk Framework  also states that practices in the Framework are not necessarily meant to  be sequential or interpreted as a step-by-step process.
The Fraud Risk Framework consists of the following four components:
Commit. Commit to combating fraud by creating an organizational  culture and structure conducive to fraud risk management.
Assess. Plan regular fraud risk assessments and assess risks to  determine a fraud risk profile.
Design and implement. Design and implement a strategy with  specific control activities to mitigate assessed fraud risks and  collaborate to help ensure effective implementation.
Evaluate and adapt. Evaluate outcomes using a risk-based approach  and adapt activities to improve fraud risk management.
Each component includes overarching fraud risk management concepts  and leading practices for carrying out the concepts. These concepts  include creating a structure with a dedicated entity to lead fraud risk  management activities; conducting regular fraud risk assessments that  are tailored to the program to determine the program’s fraud risk profile;  design and implement a strategy to mitigate assessed fraud risks; and  designing and implementing specific control activities, such as data  analytic activities, to prevent and detect fraud. Leading practices for  carrying out the concepts include:
Designated antifraud entity. A designated entity to design and  oversee fraud risk management activities serves as the repository of  knowledge on fraud risks and controls, manages the fraud risk  assessment process, and leads or assists with training and other  fraud awareness activities. The dedicated entity could be an individual  or a team, depending on the needs of the agency.
Tailored fraud risk assessments and profiles. An effective  antifraud entity tailors the approach for carrying out fraud risk  assessments to the program. More specifically, antifraud entities that  effectively plan fraud risk assessments identify specific tools,  methods, and sources for gathering information about fraud risks. This  information includes data on fraud schemes and trends from  monitoring and detection activities. This approach allows the agency  to develop a fraud risk profile that fully considers the specific fraud  risks the agency or program faces, analyze the potential likelihood  and impact of fraud schemes, and then ultimately document prioritized  fraud risks.
Develop and document an antifraud strategy. Managers who  effectively manage fraud risks develop and document an antifraud  strategy that describes the program’s activities for preventing,  detecting, and responding to fraud.
Data analytic activities. Data analytic activities can include a variety  of techniques. For example, data matching and data mining  techniques can enable programs to identify potential fraud or improper  payments that have already been awarded, thus assisting programs in  recovering these dollars, and predictive analytics can identify potential  fraud before payments are made.
Fraud awareness initiatives. Increasing managers’ and employees’  awareness of potential fraud schemes through training and education  can serve a preventive purpose by helping to create a culture of  integrity and compliance within the program. Further, increasing fraud  awareness can enable managers and employees to better detect  potential fraud. In addition, increasing fraud awareness through  training and education of external stakeholders, such as contractors,  can help prevent and deter fraud.
section_title: Data Analytic Tools and Techniques to Prevent and Detect Fraud
paragraphs: Our Fraud Risk Framework incorporates long-standing industry practices  related to the use of data analytics. In addition to the information included  in the Fraud Risk Framework, the Institute of Internal Auditors, the  American Institute of Certified Public Accountants, and the Association  of Certified Fraud Examiners have issued practice guides and other  materials that explain how data analytics can be used to help manage  fraud risk. Selected information from these guides is discussed below.
According to the Institute of Internal Auditors, data analytics enables an  organization to analyze transactional data to obtain insights into the  operating effectiveness of internal controls and to identify indicators of  improper cost charges, fraud risk or actual fraudulent activities. In  addition, because automated checks are less labor-intensive than  traditional control mechanisms, such as manual checks, automating data  analytic tests can allow managers to monitor large amounts of data more  efficiently. Data analytics is used to identify activities or transactions that  deviate from expected patterns. It can be used, for example, to review  payroll records for fictitious employees or accounts payable transactions  for duplicate invoices. The tools and techniques used may vary and range  from simple data mining techniques, such as sorting and filtering, to using  sophisticated algorithms to analyze multiple data sets. Examples of the  type of data analytic tests that can be performed include the following.
Calculation of statistical parameters (e.g., averages, standard  deviations, highest and lowest values)—to identify outlying  transactions that could be indicative of fraudulent activity.
Classification—to find patterns and associations among groups of  data elements.
Stratification of numeric values—to identify unusual (i.e., excessively  high or low) values.
Joining different data sources—to identify inappropriately matching  values, such as names, addresses, and account numbers in disparate  systems.
Duplicate testing—to identify simple and/or complex duplications of  business transactions, such as payments, payroll, claims, or expense  report line items.
Gap testing—to identify missing numbers in sequential data.
Validating data entry dates—to identify postings or data entry times  that are inappropriate or suspicious.
According to the Institute of Internal Auditors, for fraud detection data  analytics programs to be effective, the fraud detection techniques listed  above must be performed against full data populations. Although the use  of sampling data is a valid and effective audit approach, it is not  necessarily appropriate for fraud detection purposes. When only partial  data are analyzed, it is likely that a number of control breaches and  suspicious transactions will be missed, the impact of control failures may  not be quantified fully, and smaller anomalies may be overlooked. It is  often these small anomalies that point to weaknesses that can be  exploited, causing a material breach. Analyzing the data against full data  populations provides a more complete picture of potential anomalies.
Random sampling is most effective for identifying problems that are  relatively consistent throughout the data population; fraudulent  transactions, by nature, do not occur randomly.
section_title: DOE Uses Cost- Surveillance Procedures to Manage Its Risk of Fraud and Other Improper Payments, but Challenges Limit the Effectiveness of This Approach DOE Uses Prepayment Invoice Reviews to Monitor Non-M&O Contract Costs, but Shortcomings in Its Control Activities and Resource Challenges Limit the Effectiveness of These Reviews
paragraphs: DOE uses prepayment invoice reviews to monitor the costs of non-M&O  contracts but has shortcomings in its control activities at the six site  offices that oversee them, as well as resource challenges that limit the  effectiveness of these reviews. DOE uses post payment incurred cost  audits to detect fraud and other improper payments for both its M&O and  non-M&O contracts, but resource constraints and other challenges limit  the audits’ effectiveness.
DOE uses prepayment invoice reviews to monitor non-M&O contract  costs. Under such reviews, non-M&O contractors submit invoices to DOE  for items delivered or services performed before the contractors receive  payment. Invoice reviews help to ensure that the goods and services for  which the government is being billed were actually received, the amounts  billed are allowable, and the government is not incurring claimed costs  that are inadequately supported. DOE contracting officers are responsible  for ensuring that contract invoices are properly reviewed and analyzed  prior to payment. In exercising this responsibility, contracting officers may  delegate invoice review and analysis functions to other government  personnel, such as technical and financial representatives. For the six  DOE sites that oversee non-M&O contractors, invoice reviews generally  included a technical review—to ensure that the costs billed were for  services performed or goods delivered—and a financial review—to  ensure that the costs billed conformed with the terms of the contract.
However, the control activities at the six site offices that oversee non- M&O contracts have limitations. Specifically, DOE does not have a  department-wide invoice review policy or well-documented procedures at  most of these site offices, and DOE officials face challenges in reviewing  invoices prior to payment.
subsections: section_title: DOE Does Not Have a Department-Wide Invoice Review Policy, and Invoice Review Procedures Are Not Well-Documented at Most Sites
paragraphs: According to federal internal control standards, management should  implement control activities through policies. However, officials with the  Office of the CFO at DOE headquarters told us that DOE does not have  department-wide invoice review policies and procedures. Instead,  according to these officials, field CFOs and contracting officials are  responsible for developing appropriate invoice review policies and  procedures. Headquarters CFO officials said that they provide tools and  guidance to field CFOs for things such as assessing internal controls and  contractors’ accounting and purchasing systems, but they do not  prescribe or assess payment procedures at DOE field offices. Similarly,  DOE’s Office of Acquisition Management has issued invoice review  guidance but does not prescribe specific policies and procedures.  Specifically, DOE’s Acquisition Guide contains a chapter on contract  financing that discusses reviewing and approving invoices. The guide  states, for example, that prior to payment the responsible approving  official must, among other things, ensure that all invoiced costs are allowable and allocable to the contract,  items or services included on previously paid invoices are not also  included on the current invoice,  labor hours are billed at appropriate rates, and all other direct costs have been properly substantiated and are  consistent with the requirements in the contract.
According to DOE’s Acquisition Guide, however, these are general  guiding principles for approving officials to consider when reviewing and  analyzing cost elements included in contract invoices; they are not  intended to repeat or conflict with local procedures. Unlike other chapters  of the guide that contain relevant internal standard operating procedures  to be followed by both procurement and program personnel, the invoice  review and approval discussion is not considered an operating procedure,  according to DOE’s Acquisition Guide. Moreover, our analysis of the  invoice review and approval discussion contained in DOE’s Acquisition  Guide found that it does not contain the detail necessary to serve as an  operating procedure.
We have reported previously on DOE’s invoice review policies and  procedures at one of DOE’s largest clean-up sites. Specifically, in July  2007 we found that DOE’s Hanford Office was not adequately reviewing  invoices for a multibillion-dollar cost-reimbursement contract to design  and construct the Hanford Waste Treatment Plant, risking hundreds of  millions of dollars in improper payments. Instead, DOE relied primarily on  the Defense Contract Audit Agency (DCAA), an independent third party  that has traditionally been the primary auditor for non-M&O contracts, to  review and approve the contractor’s financial systems and relied on the  contractor’s review and approval of subcontractor charges. DOE’s heavy  reliance on others, with little oversight of its own, exposed the hundreds  of millions of dollars it spent annually on the Waste Treatment Plant to an  unnecessarily high risk of improper payments. Our July 2007 report  recommended, among other things, that DOE perform an assessment of  the risks associated with contract payments and establish appropriate  policies and procedures for effective review and approval of the prime  contractor’s invoices related to the Hanford Waste Treatment Plant. DOE  agreed with the recommendation, and in 2007 the Hanford Office  conducted a risk assessment and developed a revised invoice review  policy that applies to contractor invoices that it reviews. However, it is not  a department-wide policy.
In the absence of DOE-wide policy and procedures, the six sites reported  following different procedures. As discussed previously, invoice reviews  generally include a technical review—to ensure that the costs billed were  for services performed or goods delivered—and a financial review—to  ensure that the costs billed conform to the terms of the contract. On the  basis of questionnaire responses and documents provided by each of the  six sites responsible for reviewing non-M&O contractor invoices, we  determined that the procedures sites used for the technical and financial  reviews varied—with some sites reporting that they used locally  developed, site-specific procedures and others reporting that they relied  on the general guidance provided in DOE’s Acquisition Guide (see table  1).
In addition, on the basis of our review of site office policies and  procedures, we determined that five of the six sites did not have well- documented policies or procedures. According to federal internal control  standards, management should implement control activities through  policies and document them in the appropriate level of detail to allow  management to effectively monitor the control activity. Federal internal  control standards also state that effective documentation assists in  management’s design of internal control by establishing and  communicating the who, what, when, where, and why of internal control  execution to personnel. However, only one site—the Hanford Office—had  detailed, well-documented operating procedures. The invoice review  procedures for this site, for example, specified the number of transactions  to be reviewed and included step-by-step instructions for selecting the  transactions and the transactions’ component items to be reviewed and  verified. None of the other sites’ local procedures contained detailed  instructions for conducting the reviews. That is, they did not contain the  who, what, when, where, and why of internal control execution. Instead,  the procedures included general statements such as “the financial  reviewer is to perform the necessary financial responsibilities in  determining the adequacy of contractor cost invoices” or “the level of  review should be based on risk as determined by risk assessment” but  did not provide any specific detail or steps on how to perform the reviews.  Moreover, several sites referenced DOE’s Acquisition Guide as their  invoice review policy or procedure. However, as discussed above, DOE’s  Acquisition Guide does not contain the details necessary to be an  operating procedure. Without a DOE-wide invoice review policy that  requires sites to establish well-documented invoice review operating  procedures, DOE management has no assurance that the six offices are  effectively conducting invoice reviews or that this control activity is  operating as intended.
section_title: DOE Officials Face Challenges Reviewing Invoices Prior to Payment
paragraphs: Regarding the capacity and time officials have to devote to oversight  duties, including invoice reviews, DOE faces significant challenges.  According to a 2013 DOE Acquisition Workforce Study commissioned by  DOE, insufficient capacity to properly administer contracts raises the risk  of fraud, waste, and abuse, which could result in extra cost and delay.  The core challenge facing DOE’s acquisition community, according to the  study, is the pervasive lack of sufficient staffing in the majority of DOE  field procurement offices. As we have reported previously, having the  capacity to perform contractor oversight duties is an important criterion for  demonstrating progress toward addressing DOE’s contract and project  management challenges—an area we have designated as at high risk for  fraud, waste, and abuse. Because contracting officers and their  delegates play an important role in ensuring that the government makes  payments to contractors only for goods and services received and  accepted pursuant to contractual terms, these challenges also impact  DOE’s ability to properly review contractor invoices.
DOE’s ability to perform comprehensive invoice reviews is also limited by  the large number of transactions associated with individual invoices and  the limited amount of time DOE has to submit payment after receipt of an  invoice. For example, the contractor responsible for the design and  construction of the Hanford Waste Treatment Plant submits biweekly  invoices for $20 million or more that average over 10,000 transactions  each. Upon receipt of the contractor’s invoice, according to the terms of  the contract, DOE has 10 business days to submit its payment.  Consequently, officials responsible for performing invoice reviews may  not be able to determine, prior to payment, if the amounts billed to DOE  are allowable. For example, a reviewing official at the Hanford site  included a disclaimer on invoices he reviewed, stating that “the  appropriateness of the invoiced costs could not be determined in the time  allotted.”
Given the time constraints associated with prepayment review of invoices,  DOE’s Hanford Office also selectively performs post payment invoice  review; it is the only one of the six site offices to do so. Specifically,  DOE’s Hanford Office selects a non-statistical sample of between 75 and  100 invoiced transactions to review on a quarterly basis after the invoices  have been paid, according to the site’s local procedures. Officials from  the Hanford Office told us that the items sampled are selected based on  risk and that risk is determined based on a variety of factors, such as the  results of internal and external audits. Using this approach, the Hanford  Office was able to select and review less than 1 percent of the  contractor’s costs for fiscal years 2013 through 2015. DOE disallowed a  total of $9,078 of the contractor’s invoiced costs as a result of these  reviews.
section_title: DOE Uses Post Payment Incurred Cost Audits for M&O and Non-M&O Contracts, but Resource Constraints and Other Challenges Limit Their Effectiveness
paragraphs: For both its M&O and non-M&O contracts, DOE uses post payment  incurred cost audits to detect fraud and other improper payments.  However, resource constraints limit the effectiveness of these audits. For  non-M&O contracts, DOE relies on DCAA to perform audits of  contractors’ invoiced costs. However, resource issues and a backlog of  audits at DCAA have resulted in audit delays. According to a 2015 DOE  OIG report, some of DOE’s non-M&O contracts have not been audited in  over 8 years. To try to address the DCAA audit backlog, DOE has used  independent public accounting firms, expanded internal audit functions,  and relied more heavily on invoice reviews and OIG audits and  assessments. However, DOE’s OIG reported that these methods have  not been completely effective and do not meet audit standards in some  cases.
For the 22 M&O contracts DOE had in fiscal year 2015, which accounted  for about 75 percent of DOE’s spending, DOE did not perform post  payment reviews of contractor costs. We reported in August 2016 that  DOE officials told us they were able to monitor the appropriateness of  M&O contractors’ withdrawal of funds in near real time. DOE officials  said that this was possible because M&O contractors are required to  integrate their accounting systems with DOE’s accounts each month,  which provides DOE with visibility into contractor accounts. However, with  the exception of monitoring aggregate spending to ensure that costs do  not exceed budgetary limits, DOE policies and procedures do not require  that sites monitor M&O contractor withdrawals to determine the  appropriateness of costs incurred by the contractor. Specifically, none of  the cost-surveillance policies, procedures, or guidance used by DOE sites  discusses real-time monitoring of contractor withdrawals. Moreover, there  are logistical issues at some sites that make it unlikely that such  monitoring is occurring on a routine basis. According to DOE officials, not  all sites have direct access to or visibility into M&O contractors’ systems.  For example, to monitor withdrawals, DOE officials at one site said that  they would need to gain access to the contractor’s system by traveling to  the contractor’s site to obtain information about specific cost transactions.  In addition, DOE does not require M&O contractors to submit invoices  before receiving payment and instead requires a “payments cleared  financing arrangement,” which is the authority for contractors to draw  funds directly from federal accounts to pay for contract performance.  Under this arrangement, DOE does not use prepayment reviews to  determine the appropriateness of M&O contract costs.
Moreover, for its M&O contracts, DOE does not use an independent third  party to audit contractors’ costs and ensure that invoiced costs are  allowable under the contract. Instead, incurred cost audits are performed  by the M&O contractors’ internal audit staff under a process known as the  “cooperative audit strategy.” Specifically, the M&O contractors’ internal  audit organization is responsible for performing operational and financial  audits, assessing the adequacy of management control systems, and  conducting an audit of the M&O contractors’ incurred cost statements. In  addition, M&O contractors are required to conduct or arrange for audits of  their subcontractors when subcontracts are structured as cost  reimbursement-type contracts, including time and materials and cost  reimbursable subcontracts. According to the OIG’s audit manual, under  the cooperative audit strategy, each year DOE’s OIG performs an  assessment of incurred cost statements for the 10 M&O contractors that  incurred and claimed the most costs that year.  For the remaining M&O  contractors, the OIG performs assessments based on risk. If not  considered high-risk, the OIG assesses the contractor at least once every  four years. The OIG assessments, however, do not represent  independent third-party audits. Although the OIG is an independent third  party, according to the DOE OIG audit manual, cost statement work  under the cooperative audit strategy is not an audit but instead follows  standards for review-level engagements, which are substantially less  broad in scope. According to the OIG, the framework of the Cooperative  Audit Strategy ensures the integrity and reliability of the review-level  engagements by confirming the independence of the M&O internal audit  organizations and through various oversite procedures. We did not  perform work to substantiate the effectiveness of the OIG’s oversight  procedures.
DOE’s OIG has reported on the following challenges that impact the  effectiveness of both M&O contractor cost audits and subcontractor  audits.
Regarding M&O contractor cost audits, a 2015 DOE OIG report noted  delays in completing audits, and, in some cases, audits that did not  comply with professional audit standards. For example, as of the  end of fiscal year 2014, there were more than 22 open M&O  contractor cost audits with a total of $1.1 billion in unresolved  questioned contractor costs.
Regarding subcontract audits, from 2010 to 2012, subcontracts  valued in excess of $906 million had not been audited or were  reviewed in a manner that did not meet audit standards, according to  a 2013 OIG report. According to the report, the subcontract costs  were not audited because the department did not ensure that its M&O  contractors developed and implemented procedures to meet their  contractual requirements.
As discussed previously, the Fraud Reduction and Data Analytics Act of  2015 establishes requirements aimed at improving federal agencies’  controls and procedures for assessing and mitigating fraud risks and  capabilities to identify, prevent, and respond to fraud, including improper  payments, through the development and use of data analytics.  Implementation of these requirements could help mitigate some of the  resource challenges DOE is currently facing in overseeing payments to its  contractors. DOE officials told us they plan to meet all requirements for  managing the risk of fraud and improper payments, which should include  requirements of the Fraud Reduction and Data Analytics Act of 2015.
section_title: DOE Has Not Used Leading Practices to Manage Its Risk of Fraud and Other Improper Payments
paragraphs: DOE has not used leading practices in its approach to managing its risk  of fraud and other improper payments. In particular, DOE has not (1)  created a structure with a dedicated entity to lead fraud risk management  activities; (2) conducted fraud risk assessments that are tailored to its  programs in order to develop a fraud risk profile; (3) documented a  strategy to mitigate assessed fraud risks; or (4) designed and  implemented specific control activities, such as data analytics, to prevent  and detect fraud and other improper payments. The Fraud Reduction  and Data Analytics Act of 2015, which Congress passed in June 2016,  establishes requirements aimed at improving federal agencies’ controls  and procedures for assessing and mitigating fraud risks and directs OMB  to establish implementation guidelines that incorporate the leading  practices identified in the Fraud Risk Framework.
We compared the following leading practices in the standards and  guidance of the Institute of Internal Auditors and our Fraud Risk  Framework with DOE’s policies and procedures.
Dedicated entity to manage fraud risk. A leading practice for  managing fraud risk and demonstrating management’s commitment to  combating fraud is to designate an entity to design and oversee fraud  risk management activities. DOE has not created a structure with a  dedicated antifraud entity to lead fraud risk management activities. In  August 2015, DOE established its first Chief Risk Officer to advance  department-wide approaches to enterprise risk management, which  may include fraud risk management. However, the Chief Risk Officer  has a broad focus on general risks to the department, and the specific  responsibilities of the position have yet to be defined. As a result, it is  not clear whether the position will include leading practices related to  an antifraud entity’s responsibilities, such as serving as the repository  of knowledge on fraud risks and controls, managing the fraud risk  assessment process, and leading or assisting with training and other  fraud awareness activities.
Fraud risk assessments and profile. According to our Fraud Risk  Framework, an effective antifraud entity tailors the approach for  carrying out regular fraud risk assessments to its programs. This  allows the agency to develop a fraud risk profile that fully considers  the specific fraud risks the agency or program faces, analyze the  potential likelihood and impact of fraud schemes, and then ultimately  document prioritized fraud risks. DOE has not conducted fraud risk  assessments that are tailored to its programs and that would allow the  department to create a fraud risk profile, which is considered a leading  practice for managing the risk of fraud. In March 2016, DOE revised  its internal control evaluation guidance with the stated purpose of  updating its focus on the identification of improper payment risks and  fraud risks, among other things. According to DOE’s revised  guidance, DOE updated its internal control assessment tools to allow  its offices to identify and manage fraud risks. DOE provided us with  a list of fraud risks that they had identified for fiscal year 2016 using  the revised assessment tools. Examples of risks identified include  statements such as “if costs are inaccurately reported, then  mischarging could occur, impacting budgets and financial statements”  and “if requisitions are not approved by the appropriate personnel,  then inappropriate purchases may be made.” DOE’s approach was  not tailored to DOE programs; instead, it provided all sites with the  same list of potential risks. According to our Fraud Risk Framework,  an effective antifraud entity tailors the approach for carrying out fraud  risk assessments to the program. More specifically, antifraud entities  that effectively plan fraud risk assessments identify specific tools,  methods, and sources for gathering information about fraud risks. This  information includes data on fraud schemes and trends from  monitoring and detection activities. Because DOE’s approach to  assessing its fraud risk is not tailored to its programs, DOE is not  positioned to determine each program’s fraud risk profile.
Strategy to mitigate fraud risk. Managers who effectively manage  fraud risk, according to our Fraud Risk Framework, develop and  document an antifraud strategy that describes the program’s  approach for addressing the prioritized fraud risks identified during the  fraud risk assessment. An effective antifraud strategy describes the  program’s activities for preventing, detecting, and responding to fraud.  DOE has not developed or documented a DOE-wide antifraud  strategy or directed individual programs to develop program-specific  strategies, according to DOE officials. As discussed previously,  federal internal control standards require managers to design a  response to analyzed risks. Managers should consider the likelihood  and impact of the risks, as well as their defined risk tolerance. These  are key elements of a program’s fraud risk profile. According our  Fraud Risk Framework, effective managers of fraud risks use the  program’s fraud risk profile to help decide how to allocate resources to  respond to fraud risks.
Specific control activities to prevent or detect fraud or improper  payments. Managers who effectively manage fraud risks design and  implement specific control activities, such as fraud awareness and  data analytic activities, according to our Fraud Risk Framework. DOE  has not designed and implemented specific control activities to  prevent and detect fraud and other improper payments. Of the 10 field  offices responsible for overseeing contractor costs, none required  employees responsible for reviewing contractor costs to attend fraud  awareness training. Moreover, DOE does not routinely use data  analytic techniques. Data analytics is a type of control activity that can  be effective in detecting fraudulent spending or other improper  payments. Of the 10 field offices responsible for reviewing contractor  costs, officials from 4 reported in their questionnaire responses that  they employed data analytic techniques to help detect fraudulent or  other improper costs in contractor invoices or charges. On the basis of  the description of the specific data analytic methods they reported  using, we determined that only one field office—the Hanford Office— had reported that it was performing analysis that could be considered  data analytics. According to their response to our questionnaire,  officials at the Hanford Office reported that they use data trending, risk  matrixes, cost data graphing, and key word searches to look for  anomalies. However, Hanford officials did not provide documentation  to illustrate their use of these data analytic techniques as we had  requested. In addition, the office’s invoice review procedures do not  discuss the application of the data analytic techniques Hanford  officials reported using. As a result, we could not substantiate the  site’s reported use of data analytic techniques. We discuss the use of  data analytics in more detail in the next section.
According to DOE officials, they do not use leading practices for  managing the department’s risk of fraud because they consider the risk of  fraud to be low. DOE officials told us that, unlike other federal agencies,  DOE is not at the highest risk for fraud and improper payments and  therefore cannot be expected to commit the resources necessary to  independently identify, evaluate, adapt, and implement private industry  leading practices. According to DOE officials, “a lack of widespread  implementation of private sector fraud prevention and detection leading  practices at DOE is not indicative of a management failure to  appropriately manage the risk of fraud.” These officials told us that DOE  manages the risk of fraud and improper payments through its internal  controls program; DOE OIG efforts to prevent, detect, and make  recommendations related to fraud; and implementation of requirements of  the Improper Payments Elimination and Recovery Act.
DOE’s approach for managing its risk of fraud and improper payments,  however, may not be sufficient. According to the DOE OIG’s Fiscal Year  2015 Performance Report and Fiscal Year 2016-2017 Performance  Plan, the opportunity for fraud to occur or exist within various  department programs is significant. Moreover, given that DOE has not  conducted fraud risk assessments that are tailored to its programs, it is  unclear how DOE officials reached the conclusion that the department’s  risk of fraud is low. As discussed previously, the deceptive nature of fraud  makes it difficult to measure in a reliable way. For example, the alleged  fraudulent activity discussed previously, which involved contractors at  DOE’s Hanford site and resulted in a $125 million settlement, was  identified and reported by whistleblowers. It was not prevented or  detected through any strategic fraud risk management effort on DOE’s  part. In the absence of such a framework, DOE has little assurance that  the types of conduct reported by these whistleblowers are not  widespread.
The leading practices contained in our Fraud Risk Framework are  designed to help federal program managers take a more strategic  approach to assessing and managing fraud risks. Although our Fraud  Risk Framework may be new to DOE and other federal agencies, many of  the leading practices contained in it are based on long-standing industry  practices. Other frameworks and guides related to fraud risk management  and integrity have existed for some time, including publications by the  Institute of Internal Auditors, American Institute of Certified Public  Accountants, and Association of Certified Fraud Examiners, as well as  the Australian National Audit Office, the Committee of Sponsoring  Organizations of the Treadway Commission, and the Organisation for  Economic Co-operation and Development. The Fraud Risk Framework  allows for flexibility in how these leading practices are implemented.  Effectively mitigating fraud risks by adopting these leading practices can  help DOE to meet its mission by helping to ensure that funds are used  only for approved purposes.
DOE officials told us that they plan to meet the requirements of the Fraud  Reduction and Data Analytics Act of 2015 but should not be expected to  implement private industry leading practices prior to the issuance of OMB  guidance. Without implementing these selected leading practices for  managing its risk of fraud, DOE is missing an opportunity to better  position itself to meet the requirements of the Fraud Reduction and Data  Analytics Act of 2015 and to organize and focus its resources in a way  that would allow the department to mitigate the likelihood and impact of  fraud.
Without a dedicated entity within DOE to design and oversee fraud  risk management activities, DOE is missing an opportunity to create a  structure that is more conducive to fraud risk management.
Without tailored risk assessments that result in an accurate fraud risk  profile, DOE is not equipped to understand its fraud risk and take  steps to mitigate it.
Because DOE has not developed and documented an antifraud  strategy that describes its programs’ approaches for addressing fraud  risks, DOE is missing an opportunity to allocate resources more  effectively to respond to fraud risks.
Because DOE has not designed and implemented specific control  activities, such as fraud awareness training and data analytics, it does  not have assurance that its managers and employees are fully aware  of potential fraud schemes. Such awareness can enable managers  and employees to better detect potential fraud. Moreover, DOE is  missing an opportunity to allow managers to monitor large amounts of  data more efficiently. Finally, because DOE has not employed data  analytics, and therefore has not benefitted from the experience of  designing, implementing, and improving its analytic procedures, the  department is not well positioned to implement the requirements of  the Fraud Reduction and Data Analytics Act of 2015.
section_title: Data Analytics Helped Identify Potentially Improper Charges, but Billions in Costs Could Not Be Analyzed Because Contractor Data Were Not Sufficiently Detailed
paragraphs: In applying data analytics to identify potential indicators of fraud or other  improper payments associated with selected DOE contracts, we found  that much of the cost data we requested from two DOE contractors for the  purpose of performing data analytics was not suitable for analysis. The  data were not suitable either because they were not for a complete  universe of transactions that was reconcilable with amounts billed to DOE  or because they were not sufficiently detailed. Sufficiently detailed data  include identifiers such as transaction date, dollar amount, item or service  description, and transaction codes to indicate the type of cost represented  (e.g., construction materials, property lease, and office supplies).  However, for those subsets of DOE contractor data that were complete  and sufficiently detailed, we were able to apply data analytics, and we  identified potential indicators of improper charges that could be used to  guide further investigation of these charges.
subsections: section_title: Much of the Cost Data Maintained in Two Contractors’ Accounting Systems Were Not Suitable for Data Analytic Techniques to Produce Meaningful Results
paragraphs: Much of the transaction-level cost data for fiscal years 2013 through 2015  that we requested from one M&O contractor and one non-M&O contractor  were not suitable for use with data analytic techniques. We requested  data from two contractors—the M&O contractor that operates Sandia  National Laboratories and the non-M&O contractor responsible for the  design and construction of the Hanford Waste Treatment Plant. The M&O  contractor at Sandia, however, was unable to produce a full data  population of sufficiently detailed transaction-level data for any of the over  $8 billion in costs it incurred and claimed during the 3-year time frame we  examined (see fig. 1). More specifically, the contractor was unable to  provide data files that could be used to compile a data set in which the  total of all cost transactions could be reconciled with the total amount paid  by DOE. According to representatives of the M&O contractor and  documents they provided, the contractor’s core accounting system  generates financial information for both internal and external use through  the use of project accounting and general ledger modules. Specifically,  the contractor’s project accounting module generates information for  internal management use, and the general ledger module generates  information for external reporting purposes. However, neither the project  accounting nor the general ledger module contains transaction-level cost  data suitable for data analytics (see app. II for more detail on issues with  the data provided by the M&O contractor). Having a data set that  reconciles with the amount charged to the government is important  because it ensures that the data set represents a complete universe of  cost transactions.
Regarding the non-M&O contractor, we requested and received a data  set of cost transactions for the nearly $1.8 billion it charged DOE over the  3-year period. Of the nearly $1.8 billion in costs, $1.342 billion were  sufficiently detailed for the purpose of employing data analytics (see fig.  1). However, about $437 million in subcontractor costs were not  sufficiently detailed. Payments to subcontractors accounted for almost 25  percent of all expenses billed by the non-M&O contractor to DOE for this  period, but these transactions did not contain specific information  regarding the types of services or materials purchased from the  subcontractor. Without detailed cost data for the entire population of  subcontractor-related costs, analyses of these costs were not possible.  According to DOE officials, they review most types of costs as part of  their quarterly post payment invoice review process. However, our  analysis of all costs DOE sampled and tested from fiscal year 2013  through 2015 found that DOE sampled about 1 percent (50 transactions  totaling $3.7 million) of the nearly $437 million in subcontractor-related  costs. As discussed previously, fraudulent transactions, by nature, do not  occur randomly and, therefore, are not effectively identified through  sampling. When only partial data are tested, it is likely that a number of  control breaches and suspicious transactions will be missed, the impact  of control failures may not be quantified fully, and smaller anomalies may  be overlooked. It is often these small anomalies that point to weaknesses  that can be exploited, causing a material breach.
Of the nearly $10 billion of costs these two contractors incurred during  fiscal years 2013 through 2015, only $1.3 billion was suitable for analysis  using data analytic techniques. (See fig. 1.)
DOE has not required that these contractors maintain sufficiently detailed  transaction-level cost data that are reconcilable with amounts charged to  the government. Under federal internal control standards, managers  should use quality information to achieve the entity’s objectives. To do  this, managers may identify information requirements, obtain relevant  data from reliable internal and external sources, and process data into  information that is appropriate, current, complete, accurate, accessible,  and provided on a timely basis. In addition, as discussed previously, the  Fraud Reduction and Data Analytics Act of 2015 established new  requirements aimed at mitigating fraud risk through the development and  use of data analytics, among other things. Without requiring contractors to  maintain sufficiently detailed transaction-level cost data that are  reconcilable with amounts charged to the government, DOE will not be  well positioned to meet the requirements of the Fraud Reduction and  Data Analytics Act of 2015.
section_title: Simple Analytic Techniques Identified Potentially Improper Charges for Non-M&O Contractor Costs for Fiscal Years 2013 through 2015
paragraphs: Using simple analytic techniques (such as sorting and classifying), we  reviewed costs charged to DOE for fiscal years 2013 through 2015 by the  non-M&O contractor and identified indicators of potential improper cost  charging that could be useful to guide further investigation of these  charges. The purpose of employing data analytics was to identify costs  that appeared unusual or out of the ordinary. Unusual costs are not  necessarily fraudulent or improper but instead serve as red flags or  possible indicators of improper cost charging that may warrant further  review.
Using data analytics, we identified unusual costs that we believe warrant  further review by DOE. Examples of the costs we identified include the  following.
Relocation and temporary assignment costs. We identified  employee permanent relocation and temporary assignment costs of  nearly $26 million for the 3-year period we examined. In total, these  costs were spread across 16 different cost codes in the other direct  cost and labor files and seemed high. Furthermore, in reviewing the  cost transactions associated with these 16 different cost codes, we  identified a subset of transactions totaling $7.8 million that were  unusual because they appeared to be per-diem payments but were  not directly tied to an individual employee—an attribute normally  associated with per-diem payments. Specifically, the transactions  we identified were weekly lump-sum payments—averaging about  $50,000 weekly—that were coded “temporary assignment per-diem  paid by payroll.” None of the transactions contained information  necessary to link them to the individual employees receiving payment.  We also identified other transactions totaling over $2.5 million that  were unusual because they did not appear to be reimbursements to  employees for relocation expenses, but instead appeared to be  relocation bonuses. For example, 68 payments of $25,600 each (total  about $1.741 million) and 34 payments of $19,300 each (total about  $656,000) were made to individual, named employees. Each  transaction was connected to a permanent relocation and temporary  assignment cost code and contained the cost description  “miscellaneous other payments or reimbursements.”
Christmas Day purchases. We identified four purchases of varying  amounts ($400, $137, $81, and $11) totaling over $600 that were  made from Amazon, an online retailer, on Christmas Day. There may  be a valid reason for purchases that occur on a holiday, but in  general, holiday purchases are considered red flags and should be  scrutinized.
Payments to an affiliate. We identified 455 affiliated subcontractor  transactions totaling over $6.8 million. Specifically, these transactions  reflect costs charged to DOE for services provided to the non-M&O  prime contractor by a subcontractor that was affiliated with the prime  contractor. The subcontractor, according to its website, is responsible  for, among other things, monitoring supplier quality and on-time  delivery for the prime contractor’s projects. Given the affiliation  between the prime and subcontractor, additional scrutiny may be  needed to ensure that goods and services provided by the  subcontractor affiliate are competitively priced.
Labor costs. We identified nearly 10,000 transactions totaling over  $241 million in payroll costs that were included in the “other direct  costs” data file instead of the labor cost data file. These transactions  did not contain an earnings code (a code that indicates the type of  cost, such as “straight time,” “overtime,” or other type of labor  expense) that is typically assigned to labor costs.
In July 2016, we provided the results of our analysis to DOE Hanford site  officials, and in August 2016 we provided additional detailed information  on our methodology to allow them to replicate our analysis. DOE Hanford  site officials initially declined to respond to our questions about the results  of our analysis. However, in December 2016, they provided a written  response to our November 30, 2016, request to confirm facts about the  data in which they disagreed with our observations and analysis and  provided explanations for the cost charges we identified. Their specific  explanations follow.
Regarding relocation and temporary assignment costs, according to  the Hanford site’s written response, appendix A of the Hanford Site  Stabilization Agreement establishes daily travel pay rates for  construction employees. The lump-sum per-diem payments totaling  $7.8 million were “travel-to-the-site payments,” which are authorized  by the Hanford Site Stabilization Agreement and are charged to DOE  in lump-sum amounts because charging for individual (or daily) trips  for hundreds of workers would be too onerous and inefficient. The  transactions totaling over $2.5 million, which were identified as  “miscellaneous other payments or reimbursements” were “living- away-from-home-option” costs, which are consistent with the Advance  Understanding on Costs agreement that DOE has with the contractor.  The site’s written response also states that Hanford officials expected  relocation and temporary assignment costs to be significant because  the Advance Understanding on Costs agreement authorizes these  significant costs. As evidence that these charges were appropriate,  Hanford officials provided us with a copy of the Advance  Understanding on Costs agreement and the Hanford Site Stabilization  Agreement. Hanford officials did not provide other documentation to  support the appropriateness of these charges, and it is unclear how  the site can substantiate per-diem payments if they are not associated  with individual employees.
Regarding the Christmas day purchases on Amazon, according to the  written response, the contractor’s accounting software, which uses  batch processing, generates transaction posting dates that may  appear to be on a holiday when in fact the purchases were made  before the holiday. For example, the transaction date for the Amazon  purchases we identified was December 25, but these purchases were  actually made on October 29 and November 4, according to the  documentation DOE provided. However, DOE did not provide  information regarding how it might isolate holiday purchases, given  that transaction dates in the contractor’s system did not necessarily  reflect the date of purchase. On the basis of our review of the site’s  invoice review procedures, the Hanford Office does not specifically  target for review transactions that fall on or around holidays.  Moreover, if the contractor’s use of batch processing overrides the  transaction date of a purchase, it is unclear how DOE can reliably  determine the validity of costs charged to the government.
Regarding each of the cost categories we identified, according to its  written response, the Hanford Office has reviewed each of “these  type” of expenses as part of its post payment invoice review process  and found them to be proper. However, our review of all the  transactions the Hanford Office reported sampling and reviewing for  fiscal years 2013 through 2015 found that the Hanford Office had  reviewed very few of the transactions we identified through our use of  data analytics. Specifically, as part of its regular selective invoice  reviews, the Hanford Office reviewed 4 relocation and temporary  assignment transactions identified as “miscellaneous other payments  or reimbursements,” 4 of the subcontractor affiliated transactions, and  1 of the nearly 10,000 payroll cost transactions that were included in  the “other direct costs” data file instead of the “labor” file. The Hanford  Office did not review any of the $7.8 million in lump-sum per-diem  payments or the Christmas Day purchases on Amazon.
In addition to the costs we identified above, we had initially identified $2  million in costs for equipment depreciation expenses billed to DOE that  we thought were unusual until DOE officials provided us with information  that clarified our understanding of the contractor’s data. Specifically,  DOE officials explained that the entire description of the account we were  examining was “depreciation or purchase” and that, in response to our  observations, the Hanford office reviewed two transactions from this  account and found that they were purchases and not depreciation.  Although DOE’s clarification resolved our initial reason for flagging these  costs, the new information raised other questions regarding the use of a  single cost code to track dissimilar costs. The FAR requires that costs be  allowable, reasonable, and allocable to the contract. Unless contractor  costs are submitted in a manner that allows DOE to distinguish between  depreciation expenses and purchases without having to review every cost  submitted under a single cost code, it is unclear how DOE can ensure that costs are allowable and allocable. In addition, the contractor’s use of  a single cost code to track dissimilar costs undermines DOE’s ability to  identify potentially improper cost charges using data analytics.
Data analytics, as discussed previously, enable an organization to  analyze transactional data to obtain insights into the operating  effectiveness of internal controls and to identify improper cost charges,  indicators of fraud, or actual fraudulent activities. Because automated  checks are less labor-intensive than traditional control mechanisms, such  as manual checks, automating data analytic tests can allow managers to  monitor large amounts of data more efficiently. Regarding the usefulness  of performing data analytics, DOE officials told us that a data analytic  analysis would not be cost-effective because it produced too many false  positives—that is, unusual transactions that are later determined to be  legitimate. In addition, they said that until recently there was no  requirement to perform data analytics and, because it has not been  required, they have not devoted the time or manpower to developing and  implementing data analytic tools and techniques.
DOE officials said that they agreed that our review may have helped  identify how the use of data analytics can be expanded at DOE but said  that performing data analytics would require DOE to complete “other  steps” in our Fraud Risk Framework before deciding to design and  implement additional analytics. However, practices in the Fraud Risk  Framework are not necessarily meant to be sequential or interpreted as a  step-by-step process. According to the Fraud Risk Framework, effective  fraud risk managers collect and analyze data on identified fraud trends  and use them to improve fraud risk management activities. For instance,  managers may revise data analytic tests based on identified fraud  schemes to better identify these schemes in the future. However,  because DOE has not employed data analytics, as discussed previously,  the department has not benefitted from the experience of designing,  implementing, and improving its analytic procedures. As a result, the  department is not well positioned to implement the requirements of the  Fraud Reduction and Data Analytics Act of 2015.
section_title: Conclusions
paragraphs: DOE’s approach to managing its risk of fraud and other improper  payments relies on traditional cost-surveillance procedures, which include  prepayment invoice reviews for its non-M&O contracts and post payment  incurred cost audits for both its M&O and non-M&O contracts. The  effectiveness of DOE’s approach, however, is hampered by shortcomings  in control activities (policies and procedures). Without a department-wide  invoice review policy or well-documented procedures, DOE management  does not have assurance that invoice reviews are being performed or that  these control activities are operating as intended.
In addition, DOE has not used leading practices in its approach to  managing its risk of fraud and other improper payments. In particular,  DOE has not (1) created a structure with a dedicated entity to lead fraud  risk management activities; (2) conducted fraud risk assessments that are  tailored to its programs in order to develop a fraud risk profile; (3)  developed and documented a strategy to mitigate assessed fraud risks;  or (4) designed and implemented specific control activities, such as data  analytics, to prevent and detect fraud and other improper payments.  Without implementing these selected leading practices for managing its  risk of fraud, DOE is missing an opportunity to organize and focus its  resources in a way that would allow the department to mitigate the  likelihood and impact of fraud.
Finally, in applying data analytics to data from selected DOE contracts,  our work demonstrated that with complete data that are sufficiently  detailed, data analytics can be used to efficiently and more  comprehensively monitor contractor costs. However, much of the cost  data we requested from one DOE contractor and some data from the  other were not sufficiently detailed for applying data analytics. DOE has  not required that its contractors maintain sufficiently detailed transaction- level cost data that are reconcilable with amounts charged to the  government. Without requiring contractors to maintain such data— including cost data that, at a minimum, represent a full data population  and contain the details necessary to determine the nature of each cost  transaction—DOE will not be well positioned to meet the requirements of  the Fraud Reduction and Data Analytics Act of 2015 and employ data  analytic techniques as a means to more efficiently monitor contractor  costs and manage its risk of fraud and other improper payments.
section_title: Recommendations for Executive Action
paragraphs: We recommend that the Secretary of Energy take the following six  actions.
To allow DOE management to effectively monitor invoice reviews and  have assurance that this control activity is operating as intended,  establish a DOE-wide invoice review policy that includes requirements for  sites to establish well-documented invoice review operating procedures.
To help DOE take a more strategic approach to managing improper  payments and risk, including fraud risk, implement the following leading  practices for managing the department’s risk of fraud:  create a structure with a dedicated entity within DOE to design and  oversee fraud risk management activities;  conduct fraud risk assessments that are tailored to each program and  use the assessments to develop a fraud risk profile; develop and document an antifraud strategy that describes the  programs’ approaches for addressing the prioritized fraud risks  identified during the fraud risk assessment; and design and implement specific control activities, including fraud  awareness training and data analytics, to prevent and detect fraud  and other improper payments.
To help ensure that necessary data are available to employ data analytics  as a tool to perform contractor cost-surveillance activities, require  contractors to maintain sufficiently detailed transaction-level cost data that  are reconcilable with amounts charged to the government, including  cost data that, at a minimum, represent a full data population and  the details necessary to determine the nature of each cost  transaction, with such identifiers as transaction date, dollar amount,  item or service description, and transaction codes to indicate the type  of cost represented (e.g., construction materials, property lease, and  office supplies).
section_title: Agency Comments and Our Evaluation
paragraphs: We provided DOE with a draft of this report for its review and comment.  DOE provided written comments, which are reproduced in appendix III,  and technical comments that were incorporated as appropriate. In its  written comments, DOE generally concurred in principle with five  recommendations but did not concur with the sixth, which is aimed at  ensuring that DOE has the necessary data available to employ data  analytics. DOE’s Office of Inspector General (OIG) also provided written  comments, which are reproduced in appendix IV. We incorporated some  of the OIG’s suggested language regarding their role in the Cooperative  Audit Strategy.
DOE generally concurred in principle with five of our  recommendations.  In its letter, DOE agreed to (1) establish a DOE-wide  invoice review policy that includes requirements for sites to establish well- documented invoice review operating procedures; (2) create a structure  with a dedicated entity within DOE to design and oversee fraud risk  management activities—but stated that it will have to consider the cost,  benefits, and need for a separate organization before implementing a  dedicated antifraud entity to design and oversee fraud risk management  activities; (3) conduct fraud risk assessments that are tailored to each  program and use the assessments to develop a fraud risk profile; (4)  develop and document an antifraud strategy that describes the programs’  approaches for addressing the prioritized fraud risks identified during the  fraud risk assessment; and (5) design and implement specific control  activities, including fraud awareness training and data analytics, to  prevent and detect fraud and other improper payments. DOE states that it  has already, or is in the process of, implementing each of these five  recommendations. We will continue to monitor DOE’s efforts to implement  these changes and address our recommendations.
In its letter, DOE did not concur with our sixth recommendation to require  contractors to maintain sufficiently detailed transaction-level cost data that  are reconcilable with amounts charged to the government. In its letter,  DOE states that it does not concur with this recommendation because the  recommendation establishes agency-specific requirements for DOE  contractors that are more prescriptive than current federal requirements  and that its M&O contractors, not DOE, are responsible for performing  data analytics and determining what data are needed to do so. Based on  DOE’s response we are concerned that it does not fully appreciate its  responsibility for overseeing contractor costs. Specifically:
DOE disagreed with our recommendation because it asserted that  implementing the recommendation would require DOE to establish  agency-specific requirements for DOE contractors that are more  prescriptive than current federal requirements. However, under the  FAR agencies are authorized to establish their own agency-specific  requirements governing contracts. Under federal internal control  standards, managers should use quality information to achieve the  entity’s objectives. To do this, managers may identify information  requirements, obtain relevant data from reliable internal and external  sources, and process data into information that is appropriate, current,  complete, accurate, accessible, and provided on a timely basis.
DOE also stated that its fiscal year 2017 internal control evaluations  guidance requires M&O contractors to apply data-analytics, as  appropriate, and that federal employees assess the contractors’  implementation of fraud risk activities, such as the use of data analytic  tools to identify fraud risk factors. DOE’s letter, however, does not  acknowledge that it has a responsibility for employing data-analytics  under the Fraud Reduction and Data Analytics Act of 2015. Instead,  DOE’s letter states that under the M&O contracting model, the  contractor is responsible for performing data-analytics. The act— which is intended to improve federal agencies' development and use  of data analytics for the purpose of identifying, preventing, and  responding to fraud, including improper payments—does not  specifically authorize DOE (or any other agency) to delegate its fraud  management responsibilities to a contractor or any other nonfederal  entity. The use of some data analytic techniques by its contractors  does not relieve DOE of its responsibility to establish and maintain an  effective fraud risk management framework.  In addition, as we  discuss in our report, the one M&O contractor we examined was  unable to produce data that were suitable for data-analytic techniques  to produce meaningful results. We continue to believe that the use of  data-analytic techniques by DOE employees could help mitigate some  of the challenges that limit the effectiveness of DOE’s approach for  overseeing M&O contractor costs. However, effectively applying data- analytics is dependent upon the availability of complete and  sufficiently detailed contractor data. Therefore, we continue to believe  that DOE needs to implement our recommendation and require  contractors to maintain sufficiently detailed transaction-level cost data  that are reconcilable with amounts charged to the government.
Although DOE did not concur with our sixth recommendation, DOE’s  letter states that it will discuss the merits of government-wide guidance for  applying data-analytics to contract costs with the data-analytics working  group that OMB is required to establish as part of the Fraud Reduction  and Data Analytics Act of 2015. DOE stated that if the working group  determines that there is a need for contractors to retain and provide  additional data to support data analytic procedures, any proposed new  requirement should be discussed with the FAR Council; the OMB Office  of Federal Procurement Policy; and potentially, the OMB Office of  Intergovernmental and Regulatory Affairs. However, the purpose of the  working group is to share "financial and administrative controls" and  "data-analytics techniques". In other words, this is an information sharing  entity to facilitate the sharing of fraud management best practices. It is not  an implementing body, and agencies do not need its permission before  proceeding with fraud risk reduction efforts. The law does not prohibit  DOE (or any other agency) from acting unless and until there is  interagency consensus on an issue.
In addition to DOE’s response to our recommendations, DOE’s letter  states that the department is concerned with the accuracy of statements  throughout the report. Specifically, DOE states that it has invoice review  procedures and uses data analytics in its internal control processes. We  disagree. As we discuss in our report, officials with the Office of the CFO  at DOE headquarters told us that DOE does not have department-wide  invoice review policies and procedures. Instead, according to these  officials, field CFOs and contracting officials are responsible for  developing appropriate invoice review policies and procedures. Notably,  in our query of all DOE sites, we found that most did not have well- documented invoice review procedures. Regarding the use of data- analytics, DOE officials stated that DOE’s contractors use some data- analytic techniques.  However, as we discuss in our report, most DOE  sites in our query of all sites do not use data-analytics.  Further, as  discussed in the report, we reviewed one of DOE’s large M&O contractors  and found that cost data is not maintained in a way to support  comprehensive data analysis and neither the contractor nor DOE was  doing such analyses.
In its letter, DOE also states that the report should acknowledge DOE’s  compliance with requirements in effect at the time of our review. Our work  was not designed as a compliance audit to test the effectiveness of  DOE’s internal financial controls. Our report examined the extent to which  DOE’s approach to managing its risk of fraud and other improper  payments incorporates leading practices, such as the use of data  analytics. We do not assert in our report that the leading practices  included in GAO’s Fraud Risk Framework are requirements. However, as  we discuss in our report, by not incorporating these leading practices,  DOE is missing an opportunity to organize and focus its resources in a  way that would allow the department to mitigate the likelihood and impact  of fraud.
As agreed to with your offices, unless you publicly announce the contents  of this report earlier, we plan no further distribution until 30 days from the  report date. At that time, we will send copies of this report to the  appropriate congressional committees, the Secretary of Energy, the  Administrator of NNSA, and other interested parties. In addition, the  report will be available at no charge on the GAO website at  http://www.gao.gov.
If you or your staff members have any questions about this report, please  contact me at (202) 512-3841 or trimbled@gao.gov. Contact points for  our Offices of Congressional Relations and Public Affairs may be found  on the last page of this report. GAO staff who made major contributions to  this report are listed in appendix V.
section_title: Appendix I: Scope and Methodology
paragraphs: To examine the Department of Energy’s (DOE) approach to managing its  risk of fraud and other improper payments and challenges, if any, that  may limit the effectiveness of this approach, we took the following steps.
We reviewed the Federal Acquisition Regulation (FAR), Office of  Management and Budget (OMB) requirements and Presidential  memorandums, federal legislation regarding improper payments, our  Standards for Internal Control in the Federal Government, our A  Framework for Managing Fraud Risk in Federal Programs, and  standards and guidance of the Institute of Internal Auditors to identify  federal requirements and best practices for prevention and detection  of fraud and other improper payments. To identify DOE’s agency-wide  approach to managing its risk of fraud and improper payments,  including key internal controls over financial and accounting  operations and for contractor oversight, we reviewed DOE  regulations, directives, procedures, and guidance, and we interviewed  DOE officials from headquarters organizations, including the Office of  the Chief Financial Officer (CFO), the office of the Chief Risk Officer,  the Office of Acquisition Management, and the Office of Inspector  General (OIG).
To identify DOE’s approach to managing its risk of fraud and improper  payments in its field locations, we developed a semi structured  interview, which was administered to officials at DOE field locations  that oversee at least one prime contractor. Through review of DOE  documents and discussions with officials in the Office of the CFO, we  identified 10 field office locations responsible for oversight of at least  one prime contractor; and we determined that 6 of those sites  oversaw at least one non-M&O contractor. To develop the interview  questions, we reviewed OMB Circular A-123, federal internal control  standards, and the Fraud Risk Framework provided in and identified  key controls and leading practices for prevention and detection of  fraud and other improper payments. We pretested interview  questions and made changes to the interview guide as appropriate;  we conducted these semi structured interviews with DOE’s field  CFOs, contracting officers, and major contractors at each site. We  also collected DOE policies and procedures for oversight and review  of contractor costs from each site. We analyzed DOE and contractor  responses and information provided through the semi structured  interview process and summarized DOE’s approach to managing its  risk of fraud and improper payments in its field locations.
To gain an in-depth understanding of the local DOE processes for  oversight of contractors’ costs, we visited DOE’s Hanford Office in  Washington State and the National Nuclear Security Administration’s  (NNSA) Office of Financial Performance in Albuquerque, New Mexico,  and held discussions with DOE officials responsible for financial and  administrative oversight of prime contractors at the sites. To identify  challenges to DOE’s approach, we reviewed DOE internal  assessments, OIG reports, and a DOE-commissioned study on DOE’s  contract administration practices. We also interviewed officials from  the DOE OIG audit and investigations units in headquarters and in the  field to further identify and discuss additional challenges DOE faces in  using its approach.
To examine the extent to which DOE’s approach incorporates leading  practices, such as the use of data analytics, through our review of  standards and guidance of the Institute of Internal Auditors, federal  internal control standards, and our Fraud Risk Framework, we identified  key leading practices for managing the risk of fraud and improper  payments in the federal government. The Fraud Risk Framework consists  of four components—commit, assess, design and implement, and  evaluate and adapt—each of which are overarching fraud risk  management concepts and leading practices for carrying out the  overarching concept. To ensure that we had a cross section of leading  practices, we selected at least one leading practice from each component  of the Fraud Risk Framework: commit to combating fraud by creating an  organizational culture and structure that is conducive to fraud risk  management, plan regular fraud risk assessments and assess risks to  determine a fraud risk profile, and design and implement a strategy with  specific control activities to mitigate assessed fraud risks. After  determining that DOE had not adopted fraud risk management activities  that incorporated leading practices from the first three components, we  did not assess whether DOE was evaluating and adapting its use of  leading fraud risk management practices. The leading practices we  selected from each component were selected because the use of these  practices could be objectively verified. We then compared DOE’s  approach to managing its risk of fraud and improper payments, including  our analyses and summary of its policies and procedures for oversight of  its contractors, with the key leading practices and identified similarities  and differences between these practices and DOE’s approach.
To examine the application of data analytics in identifying potential  indicators of fraud or other improper payments associated with selected  DOE contracts, we planned to review costs charged to DOE by one  management and operating (M&O) contractor and one non-M&O  contractor. We selected these contractors for in-depth review based on  type of contractor, contract size in dollars, and ease of access of  contractor data. Specifically, we selected one M&O and one non-M&O  contract to review because these types of contracts charge costs to DOE  differently and we wanted to capture this variation in our review. We  chose two contracts that were large in terms of dollars charged to DOE in  order to have two large data sets with many types of expenses to  analyze. We selected the non-M&O contractor at the Hanford Site for  ease of access to the data and proximity to our offices for follow-up on  data questions and issues. We selected the M&O contractor because it is  co-located with DOE’s NNSA Office of Financial Performance, the field  office responsible for oversight of all NNSA contractors, also making it  much easier to follow up on data questions and issues.
We requested 3 years of cost data charged to DOE by each contractor  during fiscal years 2013 through 2015.
Non-M&O contractor analysis. We requested data from Bechtel  National, Inc., the non-M&O contractor responsible for the design and  construction of the Waste Treatment Plant at DOE’s Hanford site.  DOE provided the requested cost data for the non-M&O contractor in  72 files, and each file was separated into two types of costs: labor  costs and other direct costs. These files contained fields regarding the  natural class, source reference number and descriptions, cost  accounting code, control account description, and others. We  combined these data into two data sets, one set for labor costs and  one set for other direct costs. To determine the reliability of these  data, we (1) conducted a series of interviews with DOE officials  responsible for the data to understand how the data are maintained  and verified; (2) performed data testing, including checking totals in  the data against control totals provided by the agency, as well as  examination of outliers and missing data, and (3) reviewed the data  dictionary. We determined the data were sufficiently reliable for the  purposes of this engagement. We performed a variety of analyses of  these data, including examining distributions of variables,  classification of costs into categories, cross-tabulation, and trend  analysis. For example, we summarized both the labor and other direct  costs data by type of cost. We reviewed the results of these analyses  and identified certain costs that could potentially be unallowable as  defined in the FAR and that warranted further review. For some of the  potentially unallowable costs we identified, we examined the details of  the transactions to help us to identify the type and/or purpose of the  costs represented. To validate our findings, we provided a detailed  briefing to DOE on the results of our analyses and at that time we  requested additional information about the purpose and allowability of  the potentially unallowable costs we identified. DOE did not respond  to our request to provide us with this information.
DOE did, however, provide us with a file of individual cost transactions  that it examined in connection with its review of the 72 invoice files from  fiscal years 2013 through 2015. We performed a variety of analyses of  these data, including, for example, classification of the costs into  categories and cross-tabulating this information with the labor and other  direct costs data summaries.
M&O contractor analysis. We requested data from Sandia Corporation,  the M&O contractor responsible for managing and operating Sandia  National Laboratories. DOE was unable to provide us with the requested  data in a format that was suitable for analysis. Specifically, DOE was  unable to provide the data because the contractor tracked costs by  project in several sub-accounting systems, and the contractor could not  produce a full data population of sufficiently detailed transaction-level  data for the costs it incurred and claimed during the fiscal years 2013  through 2015 time frame we examined. In addition, the contractor did not  identify costs by the cost types identified in the FAR.
section_title: Appendix II: Details of Issues Identified with the Data Provided by the M&O Contractor
paragraphs: The M&O contractor that operates Sandia National Laboratories was  unable to produce a full data population of sufficiently detailed  transaction-level data for any of the over $8 billion in costs it incurred and  claimed during the fiscal years 2013 through 2015 time frame we  examined. According to representatives of the M&O contractor and  documents it provided, the contractor’s core accounting system generates  financial information for both internal and external use through the use of  project accounting and general ledger modules. Specifically, the  contractor’s project accounting module generates information for internal  management use, and the general ledger module generates information  for external reporting purposes. However, neither the project accounting  nor the general ledger module contained transaction-level cost data  suitable for data analytics.
The information contained in the contractor’s project accounting  module did not have the expenditure detail needed to effectively  perform data analytics, according to documents provided by the  contractor. The contractor’s project accounting module tracks four  cost categories: labor, chargebacks, travel, and purchases. Costs  within each of these cost categories were not further identified by  expense type, such as construction materials, property lease, or office  supplies.
The information contained within the contractor’s general ledger  module also did not contain the expenditure detail needed to  effectively perform data analytics. According to representatives of the  M&O contractor and documents they provided, the contractor’s  general ledger system is not set up to function like the ledgers used  by nongovernmental businesses. A general ledger system, according  to the contractor, would normally contain detailed information that  would define the expenditure type and associated detail of the  expenditure that could then allow analytics to be performed.  Furthermore, the contractor told us that it does not produce financial  statements and DOE does not require its contractors to report  transactional detail to support the agency’s preparation of  consolidated financial statements. Consequently, the contractor’s  general ledger system does not contain the detailed information  needed to allow analytics to be performed.
According to representatives of the M&O contractor and documents they  provided, although transaction-level cost data are not maintained in the  project accounting or general ledger modules, detailed cost information is  found in several of the contractor’s sub-accounting systems. Specifically,  they said that the M&O contractor maintains several sub-accounting  systems that separately process and capture transactions by type, such  as travel, purchase card, and employee expense voucher systems. Data  from the sub-accounting systems are summarized and used to populate  the contractor’s project accounting and general ledger modules,  according to contractor representatives and documents provided.  Notably, the M&O contractor at Sandia does not meet the financial  management system standards it sets for prospective subcontractors.  According to the M&O contractor’s guidance for prospective  subcontractors, an adequate accounting system must be able to collect,  process, and report costs. It should be able to break out costs by cost  element, and cost elements used should be easily traceable to the  general ledger and the financial statements. As discussed above, the  M&O contractor’s financial system does not enable cost elements to be  easily traceable to the contractor’s general ledger, and the contractor  does not produce corporate financial statements.
Representatives of the contractor told us that they have processes and  controls in place that ensure that cost information from their subsystems  reconciles with amounts charged to DOE. However, documentation the  contractor provided us regarding costs contained in each subsystem did  not reconcile with amounts included on the contractor’s statement of  costs incurred and claimed, and contractor officials could not confirm that  the transactional expenditures pulled from the sub-accounting systems  were reconciled with amounts charged to DOE. Instead, these officials  suggested that we use data analytics on the subset of data contained in  each of the sub-accounting systems—an approach they told us they use  to ensure that the financial information they are reporting to DOE is  proper. Unless the transactional expenditures pulled from the contractor’s  sub-accounting systems are reconciled with amounts charged to DOE,  however, there is no assurance that the data are complete. Without  complete data, meaningful analysis using data analytics is not possible.
According to DOE’s contract with the M&O contractor, the contractor’s  financial management systems are to be responsive to the responsibilities  of sound financial stewardship and public accountability. The overall  system is to include an integrated accounting system suitable to collect,  record, and report all financial activities; a budgeting system for the  formulation and execution of resource requirements; a disbursements  system for employee payroll and supplier payments; and an effective  internal control system for all expenditures. Given the difficulty in  producing transaction-level cost data that are reconcilable to the amounts  charged to DOE, it is unclear how DOE ensures that the M&O contractor  at Sandia meets these requirements.
section_title: Appendix III: Comments from the Department of Energy
section_title: Appendix IV: Comments from the Department of Energy Office of Inspector General
section_title: Appendix V: GAO Contact and Staff Acknowledgments
subsections: section_title: GAO Contact
section_title: Staff Acknowledgments
paragraphs: In addition to the contact named above, Diane LoFaro (Assistant  Director), David Dornish, Farrah Graham, Mark Keenan, Courtney  Liesener, Andrew Moore, and Kathryn Pedalino made key contributions to  this report.