Improper Payments: Strategy and Additional Actions Needed to Help Ensure Agencies Use the Do Not Pay Working System as Intended
Published: 2016-10-14T00:00:00

Fast Facts:

Highlights:
section_title: Why GAO Did This Study
paragraphs: Improper payments are a long-standing, significant problem in the federal government, estimated at nearly $137 billion in fiscal year 2015. GAO previously reported that one strategy to help prevent improper payments is up-front verification of eligibility through data sharing and matching. Established by OMB in 2011 and hosted by Treasury, the DNP working system is a web-based, centralized data matching service.
GAO was asked to review the DNP working system. This report examines the extent to which (1) OMB and Treasury developed the DNP working system and obtained access to relevant databases, (2) selected agencies used the DNP working system to help review eligibility, and (3) OMB monitored the use of the system. GAO reviewed relevant laws and guidance; interviewed officials at OMB, Treasury, and 10 user agencies selected in part based on size and reported improper payment estimates, including those with the largest reported estimates; and analyzed DNP working system documentation.
section_title: What GAO Found
paragraphs: The Office of Management and Budget (OMB), in coordination with the Department of the Treasury (Treasury), developed the Do Not Pay (DNP) working system as a data matching service for agencies to use in preventing improper payments, but GAO found that the DNP working system offers either partial or no access to three of the six databases required by the Improper Payments Elimination and Recovery Improvement Act of 2012, as amended. Specifically, the DNP working system offers no access to the Social Security Administration's (SSA) prisoner records and partial access to the Credit Alert Interactive Voice Response System and SSA's death records. The death records offered through the DNP working system do not include state-reported death data. SSA officials stated that sharing its full death file—which includes state-reported death data—would require an amendment to the Social Security Act. Sharing the full death file through the DNP working system would enhance efforts to identify and prevent improper payments.
The 10 agencies GAO reviewed have used the DNP working system in limited ways, in part because of a lack of clear OMB strategy and guidance. The most common way these agencies used the DNP working system is through its payment integration process, whereby Treasury compares disbursements it makes with DNP databases. However, Treasury matches against only two databases, and because the matching is performed simultaneously with disbursement, agencies generally do not receive the results in time to prevent improper payments. Further, because the payment integration process is built into Treasury's payment process, it does not compare payments disbursed through other means, such as payments made by the Defense Finance and Accounting Service ($477 billion in fiscal year 2015). OMB and Treasury guidance do not fully address the limitations of the payment integration process or whether its use is required. Aside from payment integration, 6 of the 10 agencies GAO reviewed used the DNP working system in limited ways, and 9 of the 10 agencies used some of the databases outside the DNP working system. OMB has not developed a strategy or communicated through guidance how it expects agencies to use the DNP working system. As a result, agencies may not effectively and efficiently use the system to help reduce improper payments.
Although OMB collects certain information about the use of the DNP working system, it has not developed monitoring mechanisms, such as goals or performance measures. Reported savings from use of the DNP working system have been minimal. OMB reported that the overall DNP Initiative (which encompasses the DNP working system and other agency-specific efforts) prevented over $2 billion in improper payments in fiscal year 2014, but none of these savings resulted from use of the DNP working system. Further, while OMB has not reported on fiscal year 2015 results, the 24 Chief Financial Officers Act agencies reported about $680,000 in improper payments prevented through use of the system in fiscal year 2015. However, GAO identified instances in which such agency-reported information was not consistent with reports generated by the system. Without monitoring mechanisms and reliable data, OMB cannot effectively evaluate the DNP working system or identify and address performance issues.
section_title: What GAO Recommends
paragraphs: Congress should consider amending the Social Security Act to allow SSA to share its full death file through the DNP working system. GAO is making two recommendations to Treasury and seven to OMB, including for OMB to develop and communicate a strategy and guidance and develop monitoring mechanisms. Treasury agreed. OMB agreed with two and agreed or generally agreed with the concepts behind the remaining five. GAO believes that it is important to fully implement all of the recommendations.

section_title: Letter
paragraphs: Improper payments are a long-standing, widespread, and significant  problem in the federal government. In fiscal year 2015 alone, improper  payment estimates totaled almost $137 billion government-wide. While  strategies for reducing improper payments include both prevention and  detection techniques, proactively preventing improper payments avoids  the difficulties associated with the “pay and chase” aspects of recovering  overpayments. We previously reported that one strategy to help prevent  improper payments is up-front verification of eligibility through data  sharing and matching, such as use of the Do Not Pay (DNP) working  system. Established by the Office of Management and Budget (OMB)  and hosted by the Department of the Treasury (Treasury), the DNP  working system is a web-based, centralized data matching service that  allows agencies to review multiple databases—such as data on deceased  individuals and entities barred from receiving federal awards—before  making payments.
You asked us to examine the DNP working system. This report examines  the extent to which (1) OMB and Treasury developed the DNP working  system and obtained access to relevant databases, (2) selected agencies  used the DNP working system to help review eligibility, and (3) OMB  monitored the use of the DNP working system.
In addition to OMB and Treasury’s DNP Business Center, we selected a  nongeneralizable sample of 10 agencies and relevant components for  review, which are listed in table 1, to get a variety of perspectives on use  of the DNP working system. To select these agencies and components,  we reviewed (1) fiscal year 2014 budgetary outlays and net cost  information to select both large and small agencies and relevant  components within these agencies, (2) improper payment estimates  reported in fiscal year 2014 to select agencies and components with high  improper payment estimates, and (3) information on agencies’ capabilities  in the DNP working system to select agencies capable of using the  different functionalities that the system offers. We also selected the Social  Security Administration (SSA) as one of the 10 agencies because, while it  is the source of certain data in the DNP working system, the agency does  not use the system.
To address our objectives, we obtained relevant documentation regarding  availability of data through the DNP working system and interviewed staff  from OMB and Treasury. We also reviewed relevant OMB and Treasury  guidance regarding the DNP working system. We interviewed officials at  the 10 agencies we selected and reviewed their policies and procedures  for use of the DNP working system. Additionally, we met with officials at  shared service providers used by certain of our selected agencies and  components. We also reviewed the 10 selected agencies’ fiscal year  2015 agency financial reports (AFR) regarding these agencies’ reporting  on their use of the DNP working system and interviewed OMB staff  regarding related monitoring processes. We compared the information we  obtained to relevant laws, guidance, and federal internal control  standards. Appendix I provides further details on our scope and  methodology.
We conducted this performance audit from April 2015 to October 2016 in  accordance with generally accepted government auditing standards.  Those standards require that we plan and perform the audit to obtain  sufficient, appropriate evidence to provide a reasonable basis for our  findings and conclusions based on our audit objectives. We believe that  the evidence obtained provides a reasonable basis for our findings and  conclusions based on our audit objectives.
subsections: section_title: Background
subsections: section_title: June 2010 Presidential Memorandum
paragraphs: In June 2010, the President directed agencies to review their preaward  and prepayment procedures and ensure that a thorough review of  applicable databases occurs before the release of any federal funds to  help verify eligibility and prevent certain improper payments. The  Presidential Memorandum listed five databases for review and directed  OMB to develop a plan for integrating these databases so that agencies  could access them through a single point of entry. In response to the  memorandum, OMB and Treasury established the DNP working system  in 2011. In April 2012, OMB issued guidance on the DNP working  system through OMB Memorandum M-12-11 (M-12-11), which required  the chief financial officer of each agency to submit to OMB a plan for  using the DNP working system.
section_title: Improper Payments Elimination and Recovery Improvement Act of 2012
paragraphs: The Improper Payments Elimination and Recovery Improvement Act of  2012 (IPERIA), as amended by the Bipartisan Budget Act of 2013 and the  Federal Improper Payments Coordination Act of 2015 (FIPCA), enacted  into law elements of the Presidential Memorandum by requiring agencies  to ensure that a thorough review of available databases occurs prior to  the release of federal funds. IPERIA, as amended, requires (1) the DNP  working system to include six databases, as well as other databases  designated by the Director of OMB in consultation with agencies, and   (2) agencies to review—at a minimum—those six databases as  appropriate before issuing any payment or award to help verify eligibility.  The required databases are listed in table 2.
section_title: The DNP Initiative and the DNP Working System
paragraphs: In August 2013, OMB issued guidance through OMB Memorandum M-13- 20 (M-13-20) to help agencies protect privacy while reducing improper  payments with the DNP Initiative. According to OMB, the DNP Initiative  encompasses multiple databases and analytics resources to support  agencies as they verify entity eligibility for awards or payment. This  includes centralized data portals (such as the DNP working system) and  agency-specific initiatives that serve particular program needs (such as  the Centers for Medicare & Medicaid Services’ (CMS) Fraud Prevention  System). According to OMB, the DNP working system is one element of  the DNP Initiative that agencies can use to meet the requirements set out  in IPERIA.
The DNP working system offers user agencies four different  functionalities by which they can perform searches of databases at  various times during the award or payment process.
The payment integration functionality matches agency payment files  that are sent to Treasury at the time of payment. The payment files  are matched against two databases—the Death Master File (DMF)  and the System for Award Management (SAM) exclusion records— and matching results are sent back to the agencies. When agencies  receive matches through the payment integration functionality, they  are required to adjudicate each match (i.e., verify the match to  determine whether the corresponding payment is improper) and  record the results in the DNP working system.
The other three functionalities are online single search, batch  matching, and continuous monitoring. Through online single search,  an agency can match a single entity against the authorized and  available databases for that agency in the DNP working system.  Batch matching is a similar process in which an agency can match  multiple entities against the authorized and available databases at  one time. Online single search and batch matching can be conducted  either before or after a payment is made, as decided by the agency.  Continuous monitoring matches an agency’s file of entities against the  authorized and available data sources on an ongoing basis whenever  the data are updated. For these three functionalities, an agency  receives matches through the DNP working system but does not  record adjudication results for these matches in the system.
section_title: Responsibilities Related to the DNP Initiative and Working System
paragraphs: M-13-20 splits responsibilities related to the DNP Initiative—and the DNP  working system—among four entities: (1) OMB, (2) Treasury, (3) original- source agencies, and (4) payment-issuing agencies. These entities’  responsibilities include the following.
OMB is responsible for implementing the DNP Initiative—including  establishing a working system for prepayment and preaward review—and  providing guidance, oversight, and assistance to agencies. IPERIA  requires OMB to submit annual reports to Congress regarding the  operation of the DNP Initiative. These reports should include an  evaluation of whether it has reduced improper payments or improper  awards and provide the frequency of data corrections or identification of  incorrect information.
subsections: section_title: Treasury
paragraphs: OMB directed Treasury to host the DNP working system. In doing so,  Treasury is responsible for developing memorandums of understanding  (MOU) with original-source agencies and entering into computer matching  agreements with payment-issuing agencies, as appropriate. OMB  guidance states that Treasury must also periodically reassess whether all  of the data in the DNP working system are relevant and necessary and  delete any data that are not. Additionally, Treasury is responsible for  preparing and submitting to OMB a written assessment documenting the  suitability of any commercial databases that could be designated for use  in the DNP working system. Further, Treasury is responsible for taking  steps to ensure that records in the DNP working system are sufficiently  accurate, complete, and up-to-date; coordinating with original-source  agencies to allow individuals to request data corrections; and submitting  periodic reports to OMB.
section_title: Original-Source Agencies
paragraphs: Original-source agencies provide records (e.g., databases) to Treasury  for the DNP working system. These agencies are responsible for entering  into MOUs with Treasury that describe how Treasury may use the records  and provide rules for protecting and correcting the information and for  retaining and destroying the records. Additionally, original-source  agencies are responsible for ensuring that they have sufficient legal  authority and specific designation from OMB (except as provided by law)  to share the records and that Treasury has the appropriate level of  security controls before providing records to the DNP working system.
section_title: Payment-Issuing Agencies
paragraphs: Payment-issuing agencies are responsible for making determinations  about the disbursement of payments or awards, consistent with legal  authority. In using the DNP working system, these agencies are  responsible for ensuring that they only match against data sources that  are relevant and necessary for the specific matching purpose. Payment- issuing agencies are responsible for ensuring that they have sufficient  legal authority to engage in a matching program and, when appropriate,  entering into computer matching agreements with Treasury. Treasury’s  Do Not Pay User Guide states that each agency should verify match  results received from the DNP working system against a secondary data  source to ensure that match information received from the DNP working  system is accurate. M-13-20 states that payment-issuing agencies should  comply with all applicable requirements in the Privacy Act, which may  include verifying match results and providing individuals an opportunity to  contest match results prior to taking adverse action.
section_title: OMB and Treasury Have Developed the DNP Working System, but Access to Certain Data Is Limited
paragraphs: Although OMB and Treasury have developed the DNP working system,  the system does not offer full access to three of the six databases  required by law. For example, the DNP working system offers access to  the more limited DMF, but access to SSA’s full death file is not available.  OMB has not formally evaluated user-agency suggestions for additional  databases for the DNP working system, in part because it has not  developed a formal process for obtaining the suggestions.
subsections: section_title: The DNP Working System Offers Either Partial or No Access to Three of the Six Databases Required by Law
paragraphs: The DNP working system offers full access to three of the databases  required by IPERIA: the System for Award Management exclusion  records, the Debt Check database, and the List of Excluded Individuals  and Entities (LEIE). However, it offers either partial or no access to the  remaining three: the Credit Alert Interactive Voice Response System,  SSA’s prisoner data, and SSA’s death records. Availability of data  through the DNP working system is shown in table 3.
According to Treasury officials, the process for obtaining access to  databases for the DNP working system is extensive and requires  coordination with original-source agencies to establish MOUs and to  revise system of records notices (SORN) to include routine uses that  allow disclosure of the data through the DNP working system. Treasury  officials stated that Credit Alert Interactive Voice Response System  (CAIVRS) data inputs from the Departments of Agriculture (USDA) and  Education (Education) are not currently available through the DNP  working system because of delays in negotiating MOUs with these  agencies and revising SORNs. As efforts to finalize these documents  continue, Treasury officials stated that they estimate that the DNP  working system will offer access to CAIVRS data from USDA by the end  of fiscal year 2016 and from Education in early fiscal year 2017.
Additionally, the DNP working system does not offer access to SSA’s  prisoner data. According to agency officials, Treasury and SSA have  negotiated a permanent MOU to allow (1) the Internal Revenue Service  (IRS) access to SSA’s prisoner data for tax administration through the  DNP working system and (2) Treasury access to the data for planning  and analysis purposes related to the DNP working system. The MOU  allows Treasury to evaluate the prisoner data and determine whether it  will be useful in the DNP working system, although SSA officials noted  that disclosure of the prisoner data to other agencies for matching  purposes through the DNP working system will be limited until the  relevant SORN is revised to include this matching as a routine use of the  prisoner data. Although Treasury continues to work with relevant  agencies, until access to all of the required databases is offered,  agencies may face a higher risk of not preventing or identifying improper  payments, particularly those to prisoners and individuals that are  delinquent on federal nontax debt.
Further, Treasury has not obtained SSA’s more complete death records  for the DNP working system. SSA shares two sets of death data: its full  death file and DMF. DMF is a subset of the full death file, as it contains  about 10 percent fewer death records than the full death file and does not  include state-reported death data. Initially, IPERIA listed DMF as a  required database for the DNP working system. FIPCA amended IPERIA  by replacing the reference to DMF with “death records maintained by the  Commissioner of Social Security.” SSA officials stated that the Social  Security Act limits sharing of SSA’s full death file to federal benefit-paying  agencies, which does not include the DNP working system. These  officials stated that the Social Security Act would need to be amended to  allow the agency to share its full death file with Treasury for the DNP  working system. The President’s Budget for fiscal year 2017 included a  proposal for such an amendment, but no amendment providing this  authority has been enacted. Consequently, the DNP working system  offers access to only DMF and not the full death file.
In November 2013, we reported that SSA’s processes for collecting and  maintaining death reports could result in untimely or erroneous death  information, such as including living individuals or not including deceased  individuals. For example, we identified about 500 instances in which  death reports submitted to SSA in early 2013 listed dates of death in 2011  or earlier. This is of concern because—if the dates of death are  accurate—SSA and other agencies may have been at risk of paying  benefits to these individuals for long periods after they died. We also  reported that SSA’s Office of Inspector General found that data for about  182,000 deceased Supplemental Security Income recipients and about  1.2 million deceased Old Age and Survivors Insurance beneficiaries were  not included in SSA’s death data. To help improve the accuracy of its  death data, we recommended that SSA conduct a risk assessment and  assess the feasibility and cost-effectiveness of addressing various types  of errors given the risk they pose. We found that since fiscal year 2014,  SSA has been taking steps to redesign how the agency processes death  reports and compiles data for dissemination. As part of that redesign,  SSA completed a risk assessment and a data quality assessment in June  2014. SSA has completed the first two phases of its redesign project and  developed a business process description for the third phase. According  to SSA, the agency is taking care to ensure that improvements made to  the death data processing system are cost-effective. Although we have  not assessed the extent to which SSA’s efforts have improved the quality  of its death data, we are encouraged that SSA plans to continue the  redesign project in future years. SSA’s efforts will be critical to addressing  the risk of errors in its death data. However, it is important to note that  SSA does not guarantee the accuracy of the death information it provides  to agencies. SSA reported that users of its death data must agree to  independently verify the information before taking action based on an  individual’s death report. Such verification—if completed—should help  reduce the effect of erroneous death data.
While there is a continued need for SSA to address the risk of errors in its  death data, sharing the full death file through the DNP working system  would provide agencies with additional information and enhance efforts to  identify and prevent improper payments to deceased individuals. As we  previously reported, because the deaths reported by states are generally  more accurate, and these reports are included in the full death file, it is  likely that agencies using SSA’s full death file would encounter fewer  errors than agencies using the DMF.
section_title: OMB Has Not Designated Additional Databases for Inclusion in the DNP Working System
paragraphs: IPERIA provides the Director of OMB, in consultation with agencies, the  authority to designate additional databases that substantially assist in  preventing improper payments. However, OMB has not formally  evaluated user agencies’ suggestions for additional databases or  designated any additional databases to be included in the DNP working  system. OMB staff stated that they consulted with data analytic centers  regarding potential databases and services, and the President’s Budget  for fiscal year 2017 included proposals to obtain access to additional  databases. Nevertheless, certain user agencies we reviewed identified  additional databases that could be beneficial if included in the DNP  working system.
OMB has not developed a formal process for user agencies to suggest  additional databases to be included in the DNP working system. OMB  staff stated that they expect user agencies to suggest additional  databases to be included in the DNP working system through their AFRs.  However, neither M-13-20 nor OMB Circular No. A-136 financial reporting  requirements communicate these expectations. Further, OMB staff  acknowledged that some user agencies made suggestions for additional  databases through their AFRs but stated that the suggestions were not  communicated through “formal requests.” OMB guidance does not clarify  how agencies should formally suggest additional databases for inclusion  in the DNP working system or how OMB should communicate its  decisions to agencies. Because a formal process for obtaining  suggestions for additional databases—whether from the AFRs or other  means—has not been fully developed and communicated, OMB may not  be identifying or considering additional relevant databases that could  improve the effectiveness of the DNP working system.
section_title: Selected Agencies Have Used the DNP Working System in Limited Ways in Part Because of a Lack of Clear Strategy and Guidance
paragraphs: Nine of the 10 agencies we reviewed used the DNP working system’s  payment integration functionality, despite limitations in its effectiveness  and the lack of OMB and Treasury guidance for key aspects of the  payment integration process. For example, this process matches against  only two databases, and agencies generally receive results after  payments are made. Further, certain agencies reported confusion  regarding whether they were required to use the payment integration  process, especially those agencies with other—and potentially  duplicative—data matching processes. Aside from the payment  integration process, 6 of the 10 agencies we reviewed used the DNP  working system in limited ways, and 9 of the 10 agencies accessed the  databases through means other than the DNP working system. OMB staff  stated that they expect agencies to leverage the DNP working system to  complement existing, non-DNP data matching processes, but OMB  guidance does not reflect this approach, and OMB has not developed a  strategy for how this should be carried out. The policies and procedures  for using the DNP working system at the agencies that we reviewed  generally lacked specific processes for (1) determining whether DNP  matches were actually improper payments and (2) verifying matches  against a secondary data source. These shortcomings were due in part to  unclear and inconsistent guidance from OMB and Treasury.
subsections: section_title: OMB and Treasury Guidance Does Not Address Key Aspects of the Payment Integration Process
paragraphs: Nine of the 10 agencies we reviewed used DNP’s payment integration  functionality—despite limitations in its effectiveness—because it is built  into Treasury’s payment process. In part because OMB and Treasury  guidance does not address key aspects of the payment integration  process, understanding of the process varied across selected agencies,  and in some cases, the process was potentially duplicative of existing  agency procedures.
subsections: section_title: Guidance Does Not Fully Address Limitations of DNP’s Payment Integration Process
paragraphs: DNP’s payment integration functionality is limited because of the timing of  the matching performed and the scope of databases and payments  reviewed. Moreover, certain limitations are not fully communicated  through existing guidance.
Timing of matching. The payment integration process is not  consistent with the requirement in IPERIA to review databases prior to  award or payment. While matching is conducted at the time of  payment, agencies generally receive the results after payments have  been made. As such, use of the payment integration process does not  assist agencies in preventing improper payments before they occur.  While Treasury’s Do Not Pay Agency Implementation Guide states  that payment integration matching happens at the time of payment,  the agencies we reviewed reported inconsistent interpretations of the  timing of the process. Because the guide is not clear that the results  are generally received after payments have been made, about half of  the agencies we reviewed considered the payment integration  process to be a prepayment function, whereas others considered it to  be a postpayment activity. Further, OMB guidance does not  specifically reference the payment integration functionality or its  timing.
Databases used in matching. The payment integration process  matches against only two databases, DMF and SAM exclusion  records. Any other database available through the DNP working  system must be accessed outside of the payment integration process.  Some agencies we reviewed did not know which databases were  included in the payment integration process, which may be a result of  unclear guidance. While agency officials confirmed that it was their  understanding that the objective of the process is to match against  only DMF and SAM exclusion records, Treasury’s Do Not Pay Agency  Implementation Guide states that the objective of the payment  integration process is to match all payment files against the data  sources identified in IPERIA. The guide does not acknowledge that  the process matches payments against only two of the data sources  identified in IPERIA, DMF and SAM exclusion records.
Payments reviewed. Because the payment integration functionality is  part of Treasury’s payment issuance process, payments that are  made through other means—such as non-Treasury disbursing offices  or contractors—are not automatically matched. Examples of these  types of payments include Department of Defense payments  disbursed through the Defense Finance and Accounting Service  ($477 billion in fiscal year 2015) and Medicare Fee-for-Service  payments ($351 billion in calendar year 2014). Further, certain federal  payments flow through various entities—such as state or local  governments—before ultimately being spent for their intended  purposes. For example, benefits for USDA’s Supplemental Nutrition  Assistance Program are funded by the federal government, but states  are responsible for determining individual and household eligibility for  the program, calculating the amount of monthly benefits, and issuing  benefits on an electric benefit transfer card. In these cases, only the  payment from the federal agency to the first recipient is matched  against DMF and SAM exclusion records, and subsequent  payments—those to the ultimate recipients, for example—are not  matched through DNP’s payment integration process, though they  may go through other agency-specific reviews. Figure 1 illustrates the  payments reviewed through the payment integration process.
Standards for Internal Control in the Federal Government states that  management should externally communicate the necessary quality  information to achieve the entity’s objectives. Without clear guidance on  the limitations of the payment integration functionality, there is an  increased risk that agencies will not use the DNP working system  effectively to reduce improper payments.
section_title: Guidance Unclear as to Whether Use of the Payment Integration Process Is Required
paragraphs: Eight of the 10 agencies we reviewed considered use of the payment  integration functionality required because it is built into Treasury’s  payment process, though neither OMB nor Treasury guidance sets out  this requirement. OMB staff stated that they do not consider use of the  process to be a requirement. However, OMB’s actions (as noted below)  could give the opposite impression.
Two agencies we reviewed—SSA and IRS—requested and received  permission exempting them from using the payment integration  functionality for at least some of their payments. For example, OMB  specifically determined that SSA is not required to use the payment  integration functionality because it is the source agency for two  relevant databases (death and prisoner data) and has access to SAM  exclusion data and the Department of Health and Human Services’  Office of Inspector General’s LEIE outside of the DNP working  system. Similarly, IRS officials stated that they worked with OMB to  receive permission exempting IRS from using the payment integration  process for its tax refunds given its existing data matching processes  and confidentiality restrictions. Had the payment integration  functionality been clearly optional, explicit OMB exemptions would not  be necessary.
Two other agencies we reviewed—the Railroad Retirement Board  (RRB) and the Department of Veterans Affairs’ (VA) Veterans Benefits  Administration (VBA)—had procedures to review SSA’s full death file  for certain programs prior to implementation of the DNP working  system. Officials at these agencies stated that they requested an  exemption from OMB from the payment integration process—which  they considered duplicative of their existing procedures—but were  denied. OMB staff stated that they did not recall these agencies’  requests but that they would be willing to work with them to avoid  duplication.
Standards for Internal Control in the Federal Government states that  management should externally communicate the necessary quality  information to achieve the entity’s objectives. Given the limitations of the  payment integration functionality, clear guidance is critical to help ensure  that agencies fully understand the process and whether its use is  required. Without clear guidance on whether the payment integration  process is required, there is an increased risk that agencies may not  effectively or efficiently use the DNP working system to reduce improper  payments.
section_title: Aside from Payment Integration, Use of the DNP Working System at Selected Agencies Is Limited
paragraphs: Only 6 of the 10 agencies we reviewed used the DNP working system for  purposes outside of payment integration, and their uses of the system  were limited to certain programs or databases and often were not part of  payment or award eligibility determinations. Two of the agencies we  reviewed—the National Science Foundation and USDA—used the DNP  working system on a preaward or prepayment basis for certain types of  payments.
Officials at the National Science Foundation stated that the agency  uses the DNP working system to review grant proposals against SAM  (both exclusion records and entity registration records) and LEIE  simultaneously, streamlining and automating a process that was  previously performed manually for one application at a time.
USDA officials stated that the Commodity Credit Corporation and Risk  Management Agency use the DNP working system on a preaward or  prepayment basis for certain payments. According to officials, the  Commodity Credit Corporation uses the DNP working system to  review secure payments against DMF and SAM exclusion records.  Similarly, the Risk Management Agency uses the DNP working  system to review payments for reinsurance funds to entities other than  approved insurance providers against DMF.
The other four agencies use the DNP working system to periodically  review certain of their databases, though the reviews are not necessarily  tied to a payment or award. For example:
CMS officials reported using the working system to review provider  enrollment information from its Provider Enrollment, Chain and  Ownership System against SAM exclusion records on a monthly  basis.
Officials at the General Services Administration reported using the  DNP working system to review its vendor database against SAM  exclusion records on a monthly basis.
While some of the agencies we reviewed used the DNP working system  for purposes beyond payment integration, 9 of the 10 agencies we  reviewed accessed certain IPERIA-specified databases outside of the  DNP working system. For example:
Most agencies reported that they use SAM exclusion records when  awarding contracts, as required by the Federal Acquisition Regulation.  These agencies generally accessed SAM exclusion records through  SAM.gov or by using systems integrated with SAM data.
As previously noted, RRB and VBA reported that they use SSA’s full  death file outside of the DNP working system. For example, VBA  reported matching its Compensation and Pension programs’ master  records against SSA’s full death file on a weekly basis, while RRB  reported matching its master benefit payment file against SSA’s full  death file on a monthly basis.
Officials at the Veterans Health Administration reported that it reviews  LEIE outside of the DNP working system when adding non-VA  medical providers to its vendor database.
Agencies are using the DNP working system in limited ways in part  because of a lack of OMB strategy and guidance. OMB has not  developed or documented a strategy for how it expects agencies to use  the DNP working system. Instead, OMB staff informed us that OMB  expects agencies to determine how best to use the DNP working system  to complement existing data matching processes. According to M-13-20,  OMB is responsible for providing agencies guidance on the DNP  Initiative, but key aspects of OMB’s stated approach are not addressed by  its existing guidance. Specifically, the memorandum does not indicate  that agencies should determine how to use the DNP working system or  whether agencies should consider using the system to streamline existing  data matching processes. Because the DNP working system offers a  single point of access to multiple databases, agencies may be able to  streamline existing processes by using the DNP working system rather  than accessing these databases separately.
While it required agencies to develop plans for using the DNP working  system through M-12-11 in 2012, OMB has not followed up with agencies  to determine whether the plans were implemented or updated as the  capabilities of the DNP working system evolved. Further, OMB guidance  does not address other key aspects of the program, including how  agencies should demonstrate that their data matching processes meet  the requirements of IPERIA, whether agencies can decide on their own  which specific databases to use, or how agencies should use the specific  data matching functionalities offered through the DNP working system.  Standards for Internal Control in the Federal Government states that  management should externally communicate the necessary quality  information to achieve the entity’s objectives. Without a strategy  communicated through guidance, agencies may not effectively use the  DNP working system to help prevent improper payments and, when  possible, streamline data matching processes.
section_title: Selected Agencies Had Limited Policies and Procedures for Using the DNP Working System
paragraphs: Most of the agencies we reviewed did not have documented policies and  procedures for determining whether a DNP match represented an  improper payment (i.e., the adjudication process), including verifying a  DNP match against a secondary data source and providing individuals an  opportunity to contest the matching results prior to taking adverse action.  OMB and Treasury guidance is inconsistent and unclear regarding  agencies’ responsibilities for verifying DNP matches. M-13-20 provides  requirements for agencies conducting matching programs under the  Privacy Act, which include verifying matches and providing individuals an  opportunity to contest. However, agencies we reviewed did not consider  the majority of their matching through the DNP working system to meet  the definition of a matching program per the Privacy Act, and M-13-20  does not state what is required if an agency concludes that its use of the  DNP working system does not constitute a matching program.
In contrast to OMB guidance, Treasury’s Do Not Pay User Guide states  that agencies should verify all DNP matches against a secondary source.
However, aside from Treasury’s Quick Reference Card for SAM, neither  OMB nor Treasury guidance explains how an agency should verify a DNP  match, including the use of a secondary source. Standards for Internal  Control in the Federal Government states that management should  externally communicate the necessary quality information to achieve the  entity’s objectives. Without clear and consistent guidance, agencies  may not effectively develop and document processes to help ensure that  DNP matches are accurate and that, when appropriate, individuals are  given an opportunity to contest adverse actions. Further, if agencies do  not verify DNP matches, they face an increased risk that they may not  effectively use the DNP working system to reduce improper payments.
section_title: OMB Does Not Sufficiently Monitor Agency Use of the DNP Working System
subsections: section_title: OMB Has Not Evaluated Agency Use of the DNP Working System
paragraphs: Although OMB collects relevant information, it has not evaluated agency  use of the DNP working system. OMB has not established specific goals  or performance measures by which to evaluate agency use of the DNP  working system, in part because it has not developed a strategy for how  agencies should use the system. In its first annual report to Congress on  the overall DNP Initiative, OMB reported that the DNP Initiative prevented  $2 billion in improper payments in fiscal year 2014. While the report  highlighted the DNP working system and four other agency-specific  efforts, all of the reported $2 billion in prevented improper payments  resulted from use of the agency-specific efforts, not the DNP working  system.
Further, several agencies we reviewed reported little benefit from their  use of the DNP working system. The 10 agencies under our review  reported in their AFRs a total of only $725 in improper payments that  were prevented through use of the DNP working system during fiscal year  2015, although concerns regarding the reliability of these data are  discussed later in this report. The 24 Chief Financial Officers Act  agencies collectively reported in their AFRs about $680,000 in improper  payments prevented through use of the DNP working system in fiscal  year 2015. Although OMB considers it to be one part of the overall DNP  Initiative, it is important for OMB to specifically monitor agency use of the  DNP working system—as part of its responsibility to oversee the DNP  Initiative—to determine whether its use is effective. Standards for Internal  Control in the Federal Government states that management should  establish and operate monitoring activities, evaluate the results, and  remediate identified deficiencies on a timely basis. To do so,  management can establish baselines or benchmarks against which to  measure program performance. Without monitoring mechanisms, OMB  may not effectively evaluate the DNP working system or identify  performance issues. Further, OMB may be unable to provide complete  information on the DNP working system to Congress as part of its annual  report on the overall DNP Initiative.
section_title: OMB Did Not Identify Inconsistencies in Agency- Reported Data
paragraphs: While OMB staff stated that they collect and review agency-reported data  on use of the DNP working system, the information may be limited and  unreliable. Specifically, OMB staff stated that they use information in  agencies’ AFRs to monitor the DNP Initiative, which includes agencies’  use of the DNP working system. OMB staff stated that they reviewed  draft AFRs for fiscal year 2015 against OMB guidance in OMB Circular  No. A-136 and found no issues with the information. However, among the  10 agencies we reviewed, we identified instances in which certain  reporting in the fiscal year 2015 AFRs was inconsistent with OMB  guidance or monthly adjudication reports generated by the DNP working  system, calling into question the reliability of the information.
subsections: section_title: Inconsistency with OMB Guidance
paragraphs: Certain agencies we reviewed did not include all required elements in the  AFR narrative or complete the results summary table in accordance with  OMB guidance, resulting in potentially inaccurate data. For example:
One agency overstated its false positives in its results table by  reporting the payments reviewed that did not receive matches, instead  of payments with matches that were reviewed and the payment  determined to be proper (i.e., false positives).
One agency did not use the most up-to-date template for its results  table, leading it to report results of its matching inconsistent with the  reporting of other agencies. Specifically, the agency reported on  matches identified as improper payments instead of false positives.
One agency reported on its use of the DNP working system for fiscal  year 2014 instead of fiscal year 2015 in its fiscal year 2015 AFR.
section_title: Inconsistency with DNP Working System Reports
paragraphs: In addition, certain agencies we reviewed included information in the AFR  results summary table that conflicted with reports generated by the DNP  working system. For example:
One agency reported no false positives in its summary table, but its  DNP working system adjudication reports indicated over 60 false  positives for fiscal year 2015.
One agency reported identical information as both payments stopped  and false positives in its summary table, calling into question the  accuracy of these data. Further, these results did not agree with the  agency’s DNP working system adjudication reports and were  inconsistent with the agency’s AFR narrative, which stated that  reviews were conducted after payments had been made. Because  reviews were performed on a postpayment basis, the payments could  not have been stopped.
Given the issues we identified, OMB’s process for reviewing information  on agency use of the DNP working system reported in AFRs may not be  effective. Further, OMB Circular No. A-136 notes that Treasury will  provide OMB summary information on use of the DNP working system on  behalf of user agencies. However, this information is limited to results of  the payment integration functionality. Although the DNP working system  offers agencies four different methods for conducting data matching, the  system only tracks results for the payment integration process. Treasury  officials stated that the decision to track only payment integration results  was made for ease of use by agencies. Agencies using the other three  functionalities—online single search, batch matching, and continuous  monitoring that can be used for prepayment reviews, such as eligibility  determinations—must track their results manually, which may be more  inefficient and susceptible to human error. Additionally, OMB guidance  does not indicate whether agencies should report on all uses of the DNP  working system, including those outside payment integration that the DNP  working system does not track. Standards for Internal Control in the  Federal Government states that management should use quality  information to achieve the entity’s objectives. Without complete and  reliable data and clear guidance on what information agencies should  report, OMB cannot effectively monitor and evaluate the use of the DNP  working system.
section_title: Conclusions
paragraphs: Improper payments are a significant problem in the federal government,  and the DNP working system is one tool that agencies can use to help  reduce them. However, the lack of certain data limits the effectiveness of  the DNP working system. For example, SSA’s more complete set of  death data is not offered through the DNP working system, and OMB has  not developed a formal process to obtain suggestions of additional  databases from user agencies for data matching.
While the most common use of the DNP working system is its payment  integration process, OMB guidance is unclear as to whether use of the  process is required, and Treasury’s Do Not Pay Agency Implementation  Guide does not clearly describe the limitations of the process, including  the data sources used and the timing of matching. Further, the agencies  we reviewed used the DNP working system in limited ways in part  because OMB has not developed a strategy for how agencies should use  it. Without a strategy that is communicated through guidance, agencies  may not use the DNP working system to effectively and efficiently reduce  improper payments.
Finally, OMB does not sufficiently monitor use of the DNP working  system. OMB has not developed performance measures or other  monitoring mechanisms, in part because it lacks a strategy for use of the  system, and the information OMB collects on agencies’ use of the DNP  working system may be unreliable. Because the DNP working system  does not track matches obtained through all of the available  functionalities, the information OMB collects may also be incomplete.  Without monitoring mechanisms and reliable and complete data, OMB will  not be able to effectively evaluate agencies’ use of the DNP working  system or remediate any issues identified.
section_title: Matter for Congressional Consideration
paragraphs: To provide agencies access to SSA’s more complete set of death data,  Congress should consider amending the Social Security Act to explicitly  allow SSA to share its full death file with Treasury for use through the  DNP working system.
section_title: Recommendations for Executive Action
paragraphs: We recommend that the Director of OMB take the following seven  actions.
To reasonably assure that additional relevant databases are identified  and evaluated for inclusion in the DNP working system, the Director of  OMB should develop, document, and communicate a formal process  that user agencies can use to identify, suggest, and receive feedback  on additional databases to be evaluated for inclusion in the DNP  working system.
To reasonably assure that the DNP working system is used effectively  and consistently, the Director of OMB should develop guidance that  clarifies whether the use of DNP’s payment integration functionality is  required and—if required—the circumstances and process in which  agencies may obtain an exemption from this requirement.
To reasonably assure that agencies use the DNP working system  effectively, the Director of OMB should develop a strategy—and  communicate its strategy through guidance—for how agencies should  use the DNP working system to complement existing data matching  processes and whether and how agencies should consider using the  DNP working system to streamline existing data matching. Such  guidance may cover how agencies should demonstrate that their data  matching processes meet the requirements in IPERIA, whether  agencies can decide on their own which specific databases to use,  and how agencies should use the functionalities available through the  DNP working system.
To reasonably assure that agencies develop consistent policies and  procedures to verify DNP matches, the Director of OMB should  provide additional guidance that outlines when and how agencies  should verify DNP matches against a secondary source and provide  individuals an opportunity to contest before taking adverse actions as  a result of DNP matches.
To better monitor agency use of the DNP working system once a  strategy has been developed, the Director of OMB should develop  and implement monitoring mechanisms—such as goals, benchmarks,  and performance measures—to evaluate agency use of the DNP  working system.
To reasonably assure that agency-reported information on use of the  DNP working system is reliable, the Director of OMB should develop a  process for comparing agency reporting on the use of the DNP  working system to available sources, such as OMB guidance and  DNP working system adjudication reports.
To reasonably assure that agency-reported information on use of the  DNP working system is complete, the Director of OMB should revise  its guidance to clarify whether agencies should report on their uses of  all of the functionalities of the DNP working system in their AFRs.
In addition, we recommend that the Secretary of the Treasury take the  following two actions:  revise Treasury’s Do Not Pay Agency Implementation Guide to clearly  describe the limitations of the payment integration process, including  the data sources used and the timing of matching, and modify the DNP working system to track adjudication of matches  obtained through all functionalities.
section_title: Agency Comments and Our Evaluation
paragraphs: We provided a draft of this report to each of the agencies we reviewed for  comment. OMB, Treasury, and SSA provided written comments, which  are reprinted in appendixes II through IV, respectively. USDA, HHS,  Department of the Interior, Department of Labor, VA, GSA, National  Science Foundation, and RRB had no formal comments on the draft  report. In addition, Treasury, HHS, Department of Labor, SSA, and  National Science Foundation provided technical comments, which we  have incorporated as appropriate.
In its written comments, OMB stated that it agreed with our first two  recommendations and cited plans to consider or implement them. OMB  stated that it agreed or generally agreed with the concepts behind the  remaining five recommendations, as discussed below, but did not state  whether it agreed with the recommendations themselves or planned to  implement them.
In response to our third recommendation, OMB stated that it generally  agreed with the concept of developing a strategy for how agencies  should use the DNP working system to complement existing data  matching processes and will explore the concept further.
In response to our fourth recommendation, OMB stated that it agreed  with the concept of consistent policies and procedures and will work  with agencies so that their policies and procedures for verifying DNP  matches are developed consistently.
In response to our fifth recommendation, OMB stated that it agreed  with the concept of monitoring mechanisms and will continue to work  with agencies to reduce improper payments and encourage agencies  to establish goals to improve payment accuracy that will be monitored  and evaluated by OMB.
In response to our sixth recommendation, OMB stated that it agreed  with the concept of ensuring that data are reliable and will consider  the feasibility of a process to compare agency submissions to  available sources to reasonably assure that agency-reported  information on use of the DNP working system is reliable.
In response to our seventh recommendation, OMB stated that it  agreed with ensuring the completeness of data and will continue to  work with agencies and the Chief Financial Officer community to  ensure that agency-reported information on use of the DNP working  system is complete.
While OMB stated that it agreed or generally agreed with the concepts  behind the recommendations and in some cases identified steps it would  take in response, it is too soon to determine whether OMB’s approach will  fully address these recommendations. We continue to believe that  implementing the recommendations would help ensure that agencies use  the DNP working system as intended.
In its written comments, Treasury agreed with our two recommendations  to it and stated that it plans to take action to implement them.
Although there were no recommendations made to SSA, the agency  noted in its written comments that it appreciates the matter for  congressional consideration regarding amending the Social Security Act  to explicitly allow the sharing of SSA’s full death file through the DNP  working system, stating that it aligns with a similar proposal in the  President’s Budget for fiscal year 2017.
As agreed with your office, unless you publicly announce the contents of  this report earlier, we plan no further distribution until 30 days from the  report date. At that time, we will send copies of this report to relevant  congressional committees; the Director of the Office of Management and  Budget; the Secretaries of Agriculture, Health and Human Services; the  Interior; Labor, the Treasury; and Veterans Affairs; the Administrator of  the General Services Administration; the Director of the National Science  Foundation; the Railroad Retirement Board; the Commissioner of the  Social Security Administration; and other interested parties. In addition,  this report will be available at no charge on the GAO website at  http://www.gao.gov.
If you or your staff have any questions on matters discussed in this report,  please contact me at (202) 512-2623 or davisbh@gao.gov. Contact  points for our Offices of Congressional Relations and Public Affairs may  be found on the last page of this report. GAO staff who made major  contributions to this report are listed in appendix V.
section_title: Appendix I: Objectives, Scope, and Methodology
paragraphs: This review examines the extent to which (1) the Office of Management  and Budget (OMB) and the Department of the Treasury (Treasury)  developed the Do Not Pay (DNP) working system and obtained access to  relevant databases, (2) selected agencies used the DNP working system  to help review eligibility, and (3) OMB monitored the use of the DNP  working system.
subsections: section_title: Agencies Selected for Review
paragraphs: In addition to OMB and Treasury’s DNP Business Center, we selected 10  agencies and relevant components for review. To do so, we reviewed  budgetary outlays, net cost information, and improper payment estimates  from fiscal year 2014 (the most recent information available at the time of  the review), as well as information about agencies’ use of the DNP  working system obtained from the DNP Business Center. We determined  that these data were sufficiently reliable for the purposes of selecting  agencies and components for review. The agencies and relevant  components selected for review are included in table 4.
To select the 10 agencies for review, we first split agencies into two  groups (large and small agencies) based on fiscal year 2014 budgetary  outlays. Within these groups, we analyzed fiscal year 2014 improper  payment estimates to select agencies with high improper payment  estimates and information on agencies’ use of the DNP Business Center  to select agencies capable of using the different functionalities offered by  the DNP working system. We also selected the Social Security  Administration because, while it is the source of certain data in the DNP  working system, the agency does not use the system.
Five of the selected agencies delegated use of the DNP working system  to agency components. For 4 of these agencies, we selected relevant  components for review based on analysis of information on net costs by  components in agencies’ fiscal year 2014 agency financial reports and  fiscal year 2014 improper payment estimates. We used this information to  identify large components and those with high reported improper payment  estimates. Because net cost information does not capture Treasury’s  custodial activities relating to tax administration (i.e., tax collections and  refunds/tax credits), we used improper payment estimates and interviews  with agency officials to select relevant Treasury components for review.
section_title: Methodology
paragraphs: To address our first objective, we obtained documentation from OMB and  Treasury regarding the availability of required databases and other  relevant databases through the DNP working system. We compared this  documentation to relevant laws and guidance. We also interviewed  officials at Treasury’s DNP Business Center, OMB, and the 10 user  agencies selected for review regarding database availability and  suggestions for additional databases for inclusion in the DNP working  system.
To address our second objective, we interviewed officials at the selected  agencies regarding their use of the DNP working system. Additionally, we  met with officials at shared service providers used by certain of our  selected agencies and components as these shared service providers  may use the DNP working system on behalf of the selected agencies. We  analyzed OMB and Treasury guidance on the DNP working system. We  also reviewed the 10 selected agencies’ policies and procedures for using  the DNP working system to determine if they were effectively designed to  meet requirements in relevant laws, guidance, and federal internal control  standards. Our review focused on the design of internal controls, and as  such, we did not test the implementation of the agencies’ policies and  procedures.
To address our third objective, we analyzed agency reporting on the use  of the DNP working system in the 10 selected agencies’ fiscal year 2015  agency financial reports and OMB’s first annual report on the DNP  Initiative; obtained relevant documentation regarding OMB’s monitoring of  the DNP working system; and compared this information to relevant laws,  guidance, and federal internal control standards. We also interviewed  officials at Treasury’s DNP Business Center and OMB.
We conducted this performance audit from April 2015 to October 2016 in  accordance with generally accepted government auditing standards.  Those standards require that we plan and perform the audit to obtain  sufficient, appropriate evidence to provide a reasonable basis for our  findings and conclusions based on our audit objectives. We believe that  the evidence obtained provides a reasonable basis for our findings and  conclusions based on our audit objectives.
section_title: Appendix II: Comments from the Office of Management and Budget
section_title: Appendix III: Comments from the Department of the Treasury
section_title: Appendix IV: Comments from the Social Security Administration
section_title: Appendix V: GAO Contact and Staff Acknowledgments
subsections: section_title: GAO Contact
section_title: Staff Acknowledgments
paragraphs: In addition to the contact named above, Phillip McIntyre (Assistant  Director), James M. Healy (Auditor in Charge), Stephanie Adams, Daniel  Flavin, Maxine Hattery, Christopher R. Klemmer, Diana Lee, Kevin  McAloon, David Plocher, and Coleman Williams made key contributions  to this report.