Financial Management: Improvements Needed in National Flood Insurance Program's Financial Controls and Oversight
Published: 2009-12-22T00:00:00

Fast Facts:

Highlights:
section_title: Why GAO Did This Study
paragraphs: Due to the federal government's role as guarantor, floods impose an enormous potential financial burden on the federal government. Consequently, decision makers at the Department of Homeland Security (DHS), the Federal Emergency Management Agency (FEMA), and the Congress need accurate and timely financial information to assess the effectiveness of the National Flood Insurance Program (NFIP). This report assesses whether controls in place during the 2005 to 2007 time frame were effective and whether actions to improve controls are likely to address identified weaknesses. The Government Accountability Office (GAO) reviewed and analyzed FEMA/NFIP guidance, data, and financial reports, reviewed prior audit reports, interviewed FEMA officials and contractors, and selected a sample of claim losses paid to determine whether claim files contained key documents.
section_title: What GAO Found
paragraphs: Weaknesses in internal controls impaired FEMA's ability to maintain effective transaction-level accountability. These weaknesses limited FEMA's ability to assure accurate NFIP financial data during the 3-year period from fiscal year 2005 through 2007, which included the financial activity related to the 2005 Gulf Coast hurricanes. FEMA relies heavily on Write Your Own (WYO) insurance companies to carry out NFIP financial activities such as documenting and maintaining claim files. FEMA's Bureau and Statistical Agent (BSA) serves as a liaison between the government and WYO insurance companies. GAO identified weaknesses at three levels of the NFIP transaction accountability and financial reporting process. First, at the WYO level, our internal control testing of a statistical sample determined that almost 71 percent of WYO company claims loss files did not have the necessary documents to support the claims, or reports were filed late. Second, incomplete BSA-level premium data files (lacking key information such as insureds' names and addresses) prevented an assessment of the reliability of reported NFIP premium amounts. Further, BSA-level internal control activities were ineffective in verifying the accuracy of WYO-submitted data. Lastly, FEMA's financial reporting process uses summary data that is overly reliant on error-prone manual data entry. GAO found that FEMA's broader oversight structures were also of limited effectiveness. Specifically, GAO found weaknesses in three key structures FEMA relies on to provide oversight over NFIP and monitor financial activity: (1) WYO company audits--specifically, we found that FEMA did not collect the results of state insurance department audits related to flood insurance activity and did not perform any audits for cause; (2) triennial operational reviews of WYO insurance companies--we found that FEMA did not perform operational reviews at almost one third of all WYO companies over the 3-year period; and (3) FEMA's claims reinspection program--we found that FEMA used flawed sampling procedures in the claims reinspection program. These findings are consistent with weaknesses GAO has previously identified. These oversight weaknesses limited FEMA's ability to identify and address financial transaction control breakdowns resulting from the 2005 hurricanes. FEMA's initiatives to improve specific internal control weaknesses and the overall NFIP control environment since the 2005 Gulf Coast hurricanes have done little to address many of the NFIP financial data deficiencies highlighted by these catastrophic events. FEMA has made improvements such as revising its claim reinspection selection methodology to provide for review of a random selection of a statistically representative sample of claim files. However, the modified reinspection methodology still does not include all claims. FEMA has also implemented a tracking system to monitor the number of WYO biennial audits obtained and reviewed. Further, FEMA has a system modernization development and implementation effort under way. It is too soon to determine the extent to which these efforts will achieve program efficiencies.

section_title: Letter
paragraphs: The Federal Emergency Management Agency (FEMA), a component of the  Department of Homeland Security (DHS), is charged with administering  the National Flood Insurance Program (NFIP). NFIP, established in 1968,  is primarily implemented through private insurance companies that  participate in FEMA’s Write Your Own (WYO) program. Through the WYO  program, insurance companies sell and service flood insurance policies  and adjust claims after flood losses. The federal government acts as a  guarantor of flood insurance coverage for WYO policies issued under the  WYO Arrangement. As a guarantor, the federal government is liable for  paying NFIP claim losses should premiums collected be insufficient to  cover these payments. To the extent possible, the program is designed to  pay operating expenses and flood insurance claims with premiums  collected on flood insurance policies rather than by tax dollars.
Flood losses have imposed an enormous financial burden on the federal  government. Until 2004, NFIP was able to cover most of its losses.  However, in order to pay claims arising from the 2005 hurricanes (Katrina,  Rita, and Wilma), the Congress authorized loans to NFIP of about $16.8  billion from the Treasury that the program used to cover the enormous  number of claims. Given this large debt and ongoing complex financial  challenges created by the 2005 Gulf Coast hurricanes, the fiscal  sustainability of the flood insurance program has come under scrutiny.
In March 2006, we designated NFIP as a high-risk program in part because  of the program’s financial condition and inability to repay borrowed funds.  Since then, we have made recommendations to improve rate-setting  methods and program oversight. The program remains on our January  2009 list of high-risk federal programs.
This report provides the results of our review of NFIP financial  transactions related to Hurricane Katrina and other hurricanes of the 2005  season. Specifically, this report,    assesses whether controls were effective in providing accountability  and reliable financial reporting for NFIP transactions during the 2005 to  2007 time frame,    evaluates oversight structures in place to monitor NFIP financial  activity for that 3-year period, and    assesses whether recent and planned actions to improve NFIP controls  and the overall control environment are likely to address identified  financial control weaknesses.
To assess whether controls were effective in providing accountability and  reliable financial reporting for NFIP transactions during the 2005 to 2007  time frame, we obtained and reviewed available transaction data and  financial reports for NFIP for fiscal years 2005 through 2007. We reviewed  the WYO Financial Control Plan, WYO Accounting Procedures Manual,  and other relevant NFIP policy guidance documents to determine the  design of NFIP financial reporting processes and related internal controls.  We reviewed NFIP transaction accountability in accordance with the  guidelines of the Federal Financial Management Improvement Act of 1996  (FFMIA). We conducted interviews and walkthroughs of reporting  processes with officials from FEMA, FEMA contractors, and the DHS  Office of Inspector General (OIG) to document and obtain an  understanding of the financial reporting process and related internal  controls for NFIP transactions. We obtained NFIP’s databases of claim  losses paid for fiscal years 2005 through 2007 and selected a statistical  sample from the insurance claim losses paid databases for testing of data  fields such as coverage and deductible amounts, claim payment amounts,  and policy effective dates against source documents.
To evaluate oversight structures in place to monitor NFIP financial activity  for the 3-year period covering 2005 to 2007, we reviewed prior GAO and  DHS OIG reports to identify and follow up on any previously reported  weaknesses or concerns. Previously reported weaknesses included the  sample selection process for claims reinspections and the lack of tracking  results of biennial financial audits. We also identified and assessed  significant oversight structures outlined in the WYO Financial Control  Plan.
To assess whether recent and planned actions to improve NFIP controls  and the overall control environment are likely to address identified  financial control weaknesses, we met with key program officials to discuss  the NextGen system-development effort. We also discussed recent and  planned NFIP program changes to address the internal control  weaknesses and oversight issues previously identified by us and the DHS  OIG. Appendix I provides more details on our scope and methodology.
We conducted this performance audit from February 2008 to December  2009 in accordance with generally accepted government auditing  standards. Those standards require that we plan and perform the audit to  obtain sufficient, appropriate evidence to provide a reasonable basis for  our findings and conclusions based on our audit objectives. Our audit  objectives were not designed to detect fraud. We believe that the evidence  obtained provides a reasonable basis for our findings and conclusions  based on our audit objectives.
subsections: section_title: Background
paragraphs: Congress established NFIP in the National Flood Insurance Act of 1968 to  provide an alternative to disaster assistance that would reduce the  escalating costs to the federal government of repairing flood damage.  FEMA, within DHS, administers NFIP and is responsible for its  management and oversight. Under NFIP’s WYO program, FEMA enters  into an arrangement with individual private-sector insurance companies  licensed by states to provide property insurance. The arrangement allows  these companies—using their customary business practices—to offer  flood insurance coverage to eligible property owners. Figure 1 provides an  overview of the WYO companies and other key participants in NFIP.
subsections: section_title: WYO Companies
paragraphs: A private insurance company becomes a WYO company by entering into  an agreement with FEMA known as the Financial Assistance / Subsidy  Arrangement. Under the arrangement, private insurance companies agree  to issue flood policies in their own name. The WYO companies adjust  flood claims as well as settle, pay, and defend all claims arising from the  flood policies. Participating WYO companies are to comply with FEMA’s  NFIP WYO Program Financial Control Plan Requirements and Procedures  (Financial Control Plan), which outlines WYO insurance companies’  responsibilities for underwriting, claims adjustments, cash management,  and financial reporting.
Selling policies. NFIP coverage is available to all owners of insurable  property (a building or its contents, or both) in a community participating  in NFIP. Builders of buildings in the course of construction, condominium  associations, and owners of residential condominium units in participating  communities may also purchase flood insurance. Insurance agents under  contract to one or more WYO insurance companies are the main point of  contact for approximately 97 percent of policyholders. Based on  information the insurance agents submit, the WYO insurance companies  issue policies, collect premiums from policyholders, deduct an allowance  for expenses from the premium, and remit the balance to the National  Flood Insurance Fund. The remaining 3 percent of policies are written  directly by the federal government through a FEMA contractor known as  the Direct Servicing Agent. The Direct Servicing Agent provides an  alternative, for example, when a WYO company is unable or unwilling to  write a flood insurance policy.
Adjusting claims. Insurance companies employ certified flood adjusters  to settle NFIP claims. When flood losses occur, policyholders report them  to their insurance agent, who notifies the WYO insurance company. The  WYO insurance company assigns a flood adjuster who is responsible for  assessing damage, estimating losses, and submitting required reports,  work sheets, and photographs to the WYO insurance company, where the  claim is reviewed and, if approved, processed for payment. NFIP’s claims  payment policy states that FEMA will pay only that part of the loss that  exceeds the deductible amount, subject to the applicable limit of liability  (i.e., the amount of insurance coverage). FEMA provides funds to the WYO  insurance companies from the National Flood Insurance Fund for the  amounts paid for approved claims and related expenses. As of December  2008 the fund was over $18 billion in debt.
section_title: FEMA Management and Oversight
paragraphs: About 68 FEMA Mitigation Directorate employees, assisted by  approximately 105 to 110 Bureau and Statistical Agent (BSA) contractor  employees, are responsible for managing and overseeing NFIP and the  National Flood Insurance Fund into which premiums are deposited and  claims and expenses paid. FEMA and its contractor (the BSA) are  responsible for monitoring and overseeing the quality of the performance  of the approximately 90 WYO insurance companies to assure that NFIP is  administered properly. Their management responsibilities include  establishing and updating NFIP regulations and flood insurance rates,  offering training to WYO company insurance agents and adjusters, and  implementing the Financial Control Plan.
section_title: NFIP’s Financial Reporting Process
paragraphs: The NFIP financial reporting process begins at the WYO company level  when the companies provide summary-level financial data and  transaction-level statistical data to the BSA. The WYO Financial Control  Plan requires the WYO companies to submit a monthly financial statement  reporting package to the BSA, which is to include financial, reconciliation,  and certification statements, and statistical transactions. The BSA uses  the detailed transaction-level data in the reporting package for statistical  purposes that include information on claims, losses, and premiums (such  as claim payment and coverage amounts, data on buildings and contents,  and policy effective dates). The BSA uploads the summary-level financial  information to its financial system which is used for financial reporting  purposes.
After the BSA receives the reporting package, it performs front-end  balancing—a process intended to ensure the WYO company data are  consistent with the WYO companies’ reconciliation statements. After BSA  personnel complete the front-end balancing process they use manual  processes to upload financial data into the Focus system from a  spreadsheet. The consolidated financial data in Focus is then  downloaded to a database to prepare journal entries that are then  uploaded into the Traverse financial reporting system. The BSA uses the  Traverse system to prepare the financial statement booklets and ultimately  produce four financial statements—for the Direct Servicing Agent, WYO  companies, BSA, and a consolidated report that includes all three entities.
The BSA sends the financial statement booklets consisting of these four  sets of consolidated—but unaudited—financial statements to FEMA’s  Office of the Chief Financial Officer (OCFO) monthly. The OCFO prepares  journal vouchers based on line items from the NFIP consolidated financial  statements that the BSA provides. OCFO personnel enter these journal  vouchers into the Integrated Financial Management and Information  System (IFMIS), which is FEMA/NFIP’s official accounting system of  record. After the journal voucher entries are loaded into IFMIS, OCFO  personnel produce trial balance data and load it into the Treasury  Information Executive Repository (TIER), which is a data warehouse for  DHS’ components’ data.
See figure 2, which depicts NFIP’s financial reporting processes.
section_title: Weaknesses in NFIP Transaction Controls and Processing Limited Accountability and Financial Reporting
paragraphs: Control weaknesses impaired FEMA’s ability to maintain effective  transaction-level accountability. Consequently, NFIP had limited  assurance that its financial data for fiscal years 2005 to 2007 were  accurate. This impaired data reliability resulted from weaknesses at all  three levels of the NFIP transaction accountability and financial reporting  process: at the WYO companies, BSA, and FEMA. At the WYO level, WYO  companies did not adhere to policies and procedures regarding required  claims file documentation, and therefore almost one third of the claims  loss files we reviewed were missing supporting documents. This  deficiency undermined assurances regarding the reliability of the claims  loss financial data the WYO companies reported. Further, incomplete BSA  premium data files, such as missing insureds’ names and addresses,  prevented our assessment of the reliability of reported premium amounts.  BSA-level controls were ineffective in verifying the accuracy of WYO- submitted data. At the FEMA level, financial reporting process controls  were not based on transaction-level data—instead FEMA relied primarily  on summary data compiled using error-prone manual data entry.
subsections: section_title: WYO Companies Did Not Provide Complete Documentation to FEMA for Claims Transactions
paragraphs: The WYO companies did not provide complete documentation to FEMA  for claims paid to insureds during fiscal years 2005 to 2007. According to  NFIP policies and procedures, claim loss files are to contain adequate  documentation relevant to the adjustment of a claim to support claim  payments. Our detailed testing of claim losses paid during fiscal years 2005  through 2007 showed that 20 percent (36 out of 177) of the claim files  reviewed were missing adjuster-prepared preliminary reports and 20  percent (36 out of 177) did not contain adjuster-prepared final reports  required by the NFIP Adjuster Claims Manual. In addition, for the claim  files we reviewed, WYO companies did not file 42 percent (74 out of 177)  of the preliminary and 34 percent (61 out of 177) final reports within the  required 15 and 45 days, respectively, from the date of loss in accordance  with NFIP policy. Our findings are consistent with prior audit findings.  Specifically, DHS’ auditor for its financial statement audit for fiscal year  2006 reported that preliminary and final reports were not filed within the  required time frames. Similarly, almost 71 percent (125 out of 177) of the  statistically sampled claim losses paid files we reviewed failed at least one  internal control test. These included tests such as determining whether  claim file documents were missing and whether adjusters filed required  reports on time or late. Although FEMA officials pointed to the  unprecedented severity, frequency, and complexity of flood claims during  this period, these internal control issues identified raise concerns that the  claim payment amounts were not adequately supported.
section_title: The BSA’s Premium Database Was Incomplete
paragraphs: Over 50 percent of the transactions in the NFIP databases for the  insurance premium policies for fiscal years 2006 and 2007 that the BSA  extracted for our testing either lacked or had incomplete insured names,  addresses, or policy effective dates. Consequently, we were unable to test  the accuracy of reported insurance premium amounts or whether policy  premium information was complete. Officials from the BSA attributed the  missing or incomplete insurance premium information to their extraction  process and difficulties they encountered (programming errors) when  extracting the data into a separate database specifically for our use.  Furthermore, the fact that BSA officials could not readily produce reliable  or complete data poses questions regarding their capacity to analyze data  and the NFIP program officials’ ability to identify appropriate managerial  actions based on what is reported to them by WYO companies through  their own BSA contractor.
We developed alternative procedures that we planned to use to make  conclusions about the reliability of reported insurance premiums written  amounts. These alternative procedures involved testing the premium and  policy information from the sample we selected for claims losses paid.  However, we were unable to verify information in the premiums database  for many sample items because of the missing information described  previously and because of limitations in the quality of the data.
section_title: BSA-Level Internal Controls Do Not Verify Accuracy of WYO Company Data
paragraphs: We found weaknesses in two key controls outlined in the Financial  Control Plan for the BSA to ensure the accuracy of WYO company- submitted data. These controls include front-end balancing, which is a  process intended to ensure the WYO company data are consistent with the  WYO companies’ reconciliation statements, and variance reporting, which  analyzes WYO-submitted transaction-level (statistical) data in comparison  with summary-level financial data submitted by WYO companies. These  features do offer some assurances regarding the consistency of data  provided by WYO companies and recorded by the BSA. However, neither  offers any assurances that the WYO company-provided information  accurately reflects actual transactions. Consistent with Standards for  Internal Control, an agency must have sufficient controls in place to  provide reliable information to run and control its operations. Such  controls generally include procedures to verify the validity and accuracy  of the recorded transactions or events.
Every month, after receiving summary financial and transaction-level  statistical data from WYO companies, the BSA performs front-end  balancing. As provided by the Financial Control Plan, front-end balancing  is a process intended to ensure the WYO company data are consistent with  the WYO companies’ reconciliation statements that compare the statistical  transaction data to selected financial exhibit entries. This process is  intended to validate that the BSA has recorded the same information that  individual WYO companies have transmitted. The BSA’s front-end  balancing, while helping to verify that the number of records and dollar  amounts agree to the reconciliation documents and the timeliness of the  WYO-submitted data, does not verify or validate the data’s accuracy.  Although WYO companies submit statistical transaction-level data for  claims losses paid and premiums written, which are the primary sources of  financial activity for NFIP, the BSA does not base its financial reporting on  this transaction-level data, but instead compiles the financial exhibits  submitted by the WYO companies, and therefore reduces assurances that  activity reported to FEMA represents actual transactions between WYO  companies and policyholders.
The BSA’s monthly variance reporting was also not designed to ensure  WYO company data accuracy. The Financial Control Plan requires the BSA  to analyze WYO-submitted transaction-level (statistical) data in  comparison with summary-level financial data submitted by WYO  companies and produce a report identifying any differences. BSA  personnel told us that various parties, such as the Standards Committee,  use the Consolidated Variance Report to monitor the statistical data and  financial information reported by the WYO companies. However—much  like front-end balancing—the usefulness of the variance reporting process  was limited because the BSA review was not designed to check the  underlying NFIP transaction data submitted by WYO companies against an  independent source for accuracy or completeness.
section_title: The Design of FEMA’s Financial Reporting for NFIP Activity Increases Risk
paragraphs: Along with the internal control weaknesses discussed previously, the  design of FEMA’s NFIP financial reporting process increased the risk of  inaccurate or incomplete data because it did not include a process of  analyzing the detailed data for accuracy or analyzing the financial reports  in relation to the transaction-level data currently submitted by WYO  companies for statistical purposes. Finally, the process places an  overreliance on manual procedures for processing and entering data. The  design weaknesses increase the likelihood of incomplete or inaccurate  NFIP financial information.
As FEMA’s NFIP financial reporting process was designed, approximately  90 WYO insurance companies submit summary financial information in e- mails to the BSA for consolidation and submission to FEMA. Throughout  the entire process, the BSA captures and processes key financial  information such as net written premiums on the financial statements  prepared by the WYO companies. By presenting the net written premium  amount, a WYO company does not show how much of its earned  premiums went to pay premium refunds. This process limits management  and audit visibility into identifying and resolving any underlying  transaction reliability issues because it does not show different  components of transactions. Furthermore, even when detailed transaction- level financial data were available, we found that supporting  documentation was missing. Absent supporting transaction information, it  was not practical for FEMA to reconstruct or validate NFIP amounts  reported.
FEMA’s reliance on unverified WYO data and manual processing as  described in the background section of this report greatly increases the  chances of errors or misstatements. Similarly, a reliance on net  (aggregated) data increases the risk of undetected data errors at the FEMA  level. As a result, in fiscal year 2006, for example, FEMA OCFO officials  had to correct over 100 journal vouchers totaling an estimated $260 billion.  These errors occurred because FEMA OCFO officials erroneously  recorded NFIP financial activity during fiscal year 2006. According to  Standards for Internal Control implementation guidance, excessive  adjustments to numbers or account classifications should not be  necessary prior to finalization of financial reports. Proper classification  and recording of transactions or events should take place throughout the  entire life cycle of each transaction or event, including authorization,  initiation, processing, and reporting.
section_title: Weaknesses in FEMA’s Oversight Structures Limited Effectiveness in Monitoring NFIP Financial Activity
paragraphs: Weaknesses in the broad oversight structures that FEMA relies on to  monitor NFIP financial activity in three key areas limited the effectiveness  of FEMA’s oversight: (1) FEMA did not have processes to monitor WYO  company audits by independent public accountants and other parties,  including required biennial audits, state insurance department audits, and  audits for cause; (2) FEMA did not perform triennial operational reviews  of all WYO insurance companies; and (3) FEMA’s claims reinspection  program used flawed sampling procedures. These weaknesses are  consistent with issues identified in our prior reports. As a result of these  oversight deficiencies, FEMA’s ability to identify and address NFIP  financial transaction control breakdowns when processing transactions  related to the 2005 Gulf Coast hurricanes was limited.
subsections: section_title: FEMA Did Not Monitor Completion or Results of WYO Company Audits
paragraphs: FEMA did not have any mechanism for tracking completion and reviewing  the results of required biennial financial statement audits of WYO  companies, did not collect results of state insurance department audits  related to flood insurance activity, or conduct audits for cause. According  to the Financial Control Plan, biennial audits are FEMA’s primary  oversight mechanism for obtaining assurance that it receives complete and  accurate financial management information from WYO insurance  companies. The plan provides that such audits are intended to reduce or  eliminate the need for FEMA auditors to conduct on-site visits to WYO  insurance companies to oversee their financial activities; specifies that  biennial financial statement audits are a required condition of an  insurance company’s participation in the WYO program; and states that  they must be conducted by an independent Certified Public Accountant.  According to the Financial Control Plan, these audits are to include an  opinion on the fairness of the financial statements, the adequacy of the  internal controls, and the extent of compliance with laws and regulations.  In 2007, we reported that 5 out of 94 (about 5 percent) WYO companies  had biennial audits completed for the 2-year period covering fiscal years  2005 and 2006. In response to findings that FEMA had failed to  consistently enforce the biennial audit requirement, FEMA officials told us  that they had exempted from this requirement companies that said that  they were overwhelmed with administering flood claims after the 2005  hurricane season.
The Financial Control Plan also requires FEMA to consider the results of  other audits of the WYO companies such as state insurance department  audits, as appropriate. Based on our testing of FEMA’s compliance with  the Financial Control Plan, we reported in August 2009 that FEMA rarely  or never reviewed state insurance department audits. FEMA officials  clarified that state departments of insurance audits require a “trigger.” For  such audits, a financial officer of the insurer is to “trigger” an alert to  FEMA of any state audit involving NFIP activities. A more independent  way for FEMA to learn of these audits would be to have contact directly  with the states. According to FEMA, during our review period, FEMA did  not receive any such notices. These audits are typically in response to  company-specific concerns—they are not routine.
The Financial Control Plan outlines criteria that, in combination or  independently, may prompt FEMA to perform an audit for cause. Based on  our testing of FEMA’s compliance with the Financial Control Plan, we  reported in August 2009 that FEMA rarely or never implemented audits  for cause. According to FEMA officials, the last audits for cause were done  in the late 1990s. Because FEMA did not systematically track and centrally  store all required evaluations, inspections, audits, or reviews, FEMA  management had no basis for timely access to them or effectively  overseeing the 90-plus participating insurance companies, and therefore  had no reasonable basis for determining whether any audits for cause  were necessary. FEMA told us that based on our August 2009  recommendations, it now plans to implement such a system. It will be  important for FEMA to maintain ongoing awareness of state audit  initiatives identified through an independent information source.
section_title: Operational Reviews Are Ineffective
paragraphs: FEMA did not perform operational reviews for all WYO companies on a  triennial basis as required and used a flawed sampling methodology to  select underwriting files at the WYO companies that it did review. The  Financial Control Plan calls for conducting the following types of  operational reviews: underwriting/policy administration; claims;  marketing; customer services; and litigation. These reviews are intended  to provide FEMA with an effective mechanism to monitor, identify, and  resolve problems related to how WYO companies sell and renew NFIP  policies and adjust claims. According to Standards for Internal Control  implementation guidance, information should be available on a timely  basis to allow effective monitoring of events, activities, and transactions  and to allow prompt action. Given that operational reviews are FEMA’s  primary method to monitor the WYO insurance companies for the two  most significant areas of the program—underwriting and claims  processing—it is important for FEMA to conduct these reviews on a  regular basis.
Without the timely information regarding how WYO companies sell and  adjust claims gained through operation reviews, FEMA cannot be certain  that the WYO companies provide appropriate financial information to  NFIP program managers. Policies and procedures specify that all WYO  companies are to be reviewed at a minimum every 3 years. Therefore, we  expected that FEMA would have done an operational review of all the  WYO companies during the 3-year period covering 2005 to 2007. However,  as shown in figure 3, we found that FEMA had completed operational  reviews on only 71 percent (82 out of 116) of WYO companies during this  period.
Further, as previously reported, FEMA did not use a statistical sampling  methodology to select files for operational reviews—instead it uses  nonprobability sampling processes. In nonprobability sampling, staff are  to select a sample based on their knowledge of the population’s  characteristics. The major limitation of this type of sampling is that the  results cannot be generalized to a larger population. A nonprobability  sample is therefore not appropriate to use if the objective is to generalize  about the population from which the sample is taken.
section_title: FEMA’s Flawed Sampling Procedures Hamper Its Claims Reinspection Program
paragraphs: According to FEMA’s Financial Control Plan, the claims reinspection  program is to serve as a mechanism supporting FEMA’s oversight of WYO  insurance companies. The objectives of the claims reinspection program  were to (1) keep FEMA and the BSA informed, (2) assist in the overall  claims operation, and (3) provide necessary assurances and  documentation for dealing with external parties. The BSA is to conduct all  reinspections and prepare a report documenting the appropriateness of  the original claims adjuster’s work. However, we found that FEMA did not  use a statistical sampling basis for selecting claims for reinspection.  Specifically, adjusters selected claims to reinspect based upon judgmental  criteria including, among other items, the size and location of loss and  complexity of claims. Further, FEMA only required testing for a selection  of claims for flood events with over 400 claims per a single flood event for  a particular WYO company. Also, the actual number of claim losses  selected for reinspection only represents a very small percentage of the  total number of claim losses processed. Using this flawed methodology for  selecting samples for claims reinspections, the percentage of claims  reinspected by flood event for fiscal years 2005 and 2006 was 1.8 percent  for Katrina, 3.6 percent for Rita, and 5.0 percent for Wilma. By using a  statistical sampling methodology for selecting claim reinspections, FEMA  would be able to use this oversight mechanism to make conclusions about  the accuracy of the total amount of claims losses paid, with a similar level  of effort.
These findings are consistent with findings from previous audits.  Specifically, we previously reported in October 2005 that neither FEMA  nor its program contractor used a statistically valid method for selecting  files for reinspections of claims adjusted after each flood event because  FEMA guidance did not include procedures on the sample selection  process. Without a statistically valid sampling methodology that  represents the population, the agency cannot project the results of these  reinspection oversight activities to confidently determine the overall  accuracy of claims settled for specific flood events or assess the overall  performance of insurance companies and their adjusters in fulfilling their  NFIP responsibilities. In December 2006, we again reported that FEMA  neither used a random sample of claims for its reinspections nor analyzed  the overall results of those reinspections to determine the total number of  payment errors and their potential causes.
section_title: Recent and Planned Initiatives Do Little to Address Identified Weaknesses
paragraphs: FEMA has revised its draft Financial Control Plan (dated August 2009) to  require selection of a statistically representative sample of claim files for  its reinspection reviews. However, the modified policy continues to cover  only those claims associated with single flood events with over 400 claims  per WYO company. Substantial claims activity may still be excluded from  reinspection. For fiscal years 2005 and 2006, almost $1.5 billion of the  $16.5 billion in claims filed would not have been considered for  reinspection under this criterion. Until processes are modified to make all  cases eligible for reinspection, FEMA will not be able to effectively  determine whether the case population is complete as well as whether the  total amount of claims losses paid is reasonable.
Available data indicate that the number of biennial financial audits has  increased since FEMA began tracking the results in fiscal year 2008. Figure  4 shows that few audits were conducted for fiscal years 2005 and 2006, but  that there was considerable improvement for fiscal years 2006 and 2007.
Prior to fiscal year 2008, FEMA had not tracked and reviewed these audit  results because FEMA did not follow NFIP policies and procedures  requiring it to receive and analyze such information. Accordingly, FEMA  could not determine whether it received and reviewed all required audit  reports, nor have a basis for monitoring implementation of necessary  corrective actions. In response to our previous recommendation regarding  this long-standing concern, FEMA is now using a tracking mechanism to  document audit reports received and those reviewed by FEMA staff.  According to FEMA, once the financial audit reports are received, staff  and management now review the audit reports and document the results  of their review on the tracking schedule. While improvements have been  made with regard to tracking and reviewing the results of biennial audits,  this is only one component of FEMA’s oversight structure and, as  discussed in this report, we continue to note weaknesses in the other  areas.
FEMA has a system development and implementation effort, referred to as  NextGen, under way. This effort has experienced delays and it is too  soon to determine whether planned program efficiencies—such as  confirmation of insured’s property address—will be achieved under the  new system. According to FEMA, the NextGen system implementation  effort is designed to be an insurance system that links key data elements  like claims and policies through shared processes. Under the current  system, the BSA maintains claim losses paid and premium policies data in  separate databases. FEMA officials have expressed concern about the  readiness of the NextGen system to support NFIP program operations.
section_title: Conclusions
paragraphs: As currently designed and implemented, FEMA’s internal controls over  NFIP offer limited transaction-level accountability and assurances that  financial reporting is accurate or that insurance company operations  conform to program requirements. Transaction-level accountability and  reporting to administer NFIP are fundamental to attaining accountability  over program resources. Internal controls are also critical to ensure that  claim payments are adequately supported, and FEMA was missing key  documentation to support claims. Given the involvement of multiple  private entities participating in this insurance program, establishing and  implementing effective policies and procedures to thoroughly implement  required audits and overall operational and targeted reviews will be  critical for FEMA to exercise its managerial responsibilities. FEMA has  taken some steps to strengthen NFIP internal controls such as overseeing  WYO companies by tracking and reviewing the results of their required  biennial financial audits. The enormous potential financial burden on the  federal government that flood events pose, coupled with the risks of  inaccurate and incomplete NFIP financial information described in this  report, serve to underscore that effective NFIP controls are critical. As  such, it will be important to take immediate actions to improve these  controls over NFIP transactions, financial reporting, and oversight.
section_title: Recommendations for Executive Action
paragraphs: To improve the financial reporting process and strengthen internal  controls, we recommend that the Secretary of Homeland Security direct  the Acting Assistant Administrator, FEMA Mitigation Directorate, to take  the following seven actions:    Augment NFIP policies to require the BSA to develop procedures to  analyze financial reports in relation to the transaction-level information  that WYO companies submit for statistical purposes.
Revise required internal control activities for the BSA to provide for  verifying and validating the reliability of WYO-reported financial  information based upon a review of a sample of the underlying  transactions or events, or obtain verification that these objectives have  been met through independent audits of the WYO companies.
Determine the feasibility of integrating and streamlining numerous  existing NFIP financial reporting processes to reduce the risk of errors  inherent in the manual recording of accounting transactions into multiple  systems.
Establish and implement procedures to require reviewing available  information such as the results of biennial audits, operational reviews, and  claim reinspections to determine whether the targeted audits for cause  managerial tool should be used.
Establish and implement procedures to require maintaining and  considering current information from an independent source regarding  state audit results to gather pertinent information such as customer  service issues and inform determinations about when to conduct audits  for cause.
Establish and implement procedures to schedule and conduct all required  operational reviews within the prescribed 3-year period.
Establish and implement procedures to select statistically representative  samples of all claims as a basis for conducting reinspections of claims by  general adjusters.
section_title: Agency Comments and Our Evaluation
paragraphs: We requested comments on a draft of this report from the Secretary of  Homeland Security. Comments received from the DHS Departmental  GAO/OIG Liaison Office on behalf of FEMA are reprinted in appendix II. In  its comments, FEMA concurred with two of our recommendations, stated  that two recommendations were unnecessary in that the recommended  procedures were already in place, and disagreed with the remaining three  recommendations. We reaffirm all seven recommendations.
With respect to the recommendations for which FEMA concurred  regarding (1) streamlining financial reporting processes and (2)  conducting operational reviews, FEMA noted it has actions under way to  integrate and streamline numerous existing financial reporting processes  in the design of a new NFIP system, and stated that its new operational  review process will address our recommendation to schedule and conduct  all required operational reviews within the prescribed 3-year period.
Regarding our recommendation for establishing and implementing  procedures for reviewing all available audit and other reports, FEMA  stated that it already had a process in place to review WYO company  performance and trigger audits for cause. FEMA further commented that  the Standards Committee considers the results of biennial audits,  operational reviews, and claims reinspections when it reviews company  performance and considers whether to recommend audits for cause. We  disagree that the process FEMA has in place is sufficient to address our  recommendation. As discussed in our draft report, during the period of our  review, FEMA management, including the Standards Committee, lacked  timely access to all audit and other reports because FEMA did not  systematically track and centrally store all required evaluations,  inspections, audits, or reviews. Therefore, without further action to  establish additional procedures directed at ensuring access and a  systematic review of WYO company performance, FEMA will continue to  be unable to effectively oversee the 90-plus participating insurance  companies or determine whether any audits for cause are necessary.
Also, regarding our recommendation concerning selecting statistically  representative samples of claims for reinspections, FEMA stated that the  reinspections are not intended to be a definitive audit of the NFIP’s claims  handling process, and cited the random sample of claims it currently has  in place. We disagree. As discussed in our draft report, adjusters selected  claims to reinspect based upon judgmental criteria, not on a random  sample. Further, FEMA only required reinspection when there were more  than 400 claims per flood event for a particular WYO company. Because  reinspections are conducted principally on open claims files to document  the appropriateness of the original claims adjuster’s work, the lack of a  statistically representative sample not only precludes FEMA from  projecting the results of these reinspections to determine the overall  accuracy of claims, it also limits FEMA’s ability to continuously assess the  overall performance of insurance companies and adjusters in fulfilling  their NFIP responsibilities. FEMA also noted that claims operational  reviews are designed to provide feedback on claims settlements and  ascertain compliance by WYO companies. The claims operational reviews  that FEMA cited, while an important oversight mechanism, do not allow  for continuous feedback concerning the overall insurance company  performance.
We also continue to reaffirm our three recommendations for which FEMA  disagreed in its comments on our draft report. First, with respect to our  recommendations that FEMA develop financial reports using the  transaction-level information that WYO companies currently submit for  statistical purposes, FEMA stated that implementing our recommendation  would be onerous and burdensome because of the number of transactions  involved. We subsequently adjusted our recommendation to have NFIP  augment its policies to require the BSA to develop procedures to analyze  financial reports in relation to the transaction-level information that WYO  companies submit for statistical purposes. Such a procedure would help  compensate for the risks introduced by the current approach of entering  summary-level information to its financial reporting system. Because WYO  companies already submit transaction-level data on claims losses paid and  premiums written and FEMA uses this information for statistical purposes,  using these transaction-level financial data to increase the reliability of  FEMA’s financial reporting should impose minimal additional burden.
Also, with respect to FEMA’s nonconcurrence with our recommendation  to verify and validate WYO-reported financial information, FEMA  maintained that the form and structure of the transaction-level detail is  audited at the source, including consideration of the relevance, reliability,  and accuracy of the transaction-level detail. However, as discussed in our  report, during the period of our review, we were not provided any  evidence showing that FEMA obtained any assurances concerning the  accuracy or validity of WYO company transaction-level financial data.  Specifically, FEMA did not demonstrate that it had mechanisms in place  during fiscal years 2005 through 2007 for receiving and reviewing the  results of the required biennial financial statement audits of WYO  companies, or for tracking completion of these audits. FEMA was unable  to provide evidence of whether all WYO companies had completed  biennial audits and had not reviewed the results of these WYO company  biennial audits. Further, as discussed in our report, FEMA officials  exempted certain WYO companies from the biennial audit requirement  after the 2005 hurricane season. Therefore, FEMA had no assurance as to  the accuracy or validity of WYO company transaction-level financial data.  We reaffirm our recommendation that FEMA revise required internal  control activities for the BSA to provide required procedures for verifying  and validating the reliability of WYO-reported financial information based  upon a review of a sample of the underlying transactions or events. We  also adjusted our recommendation to include the option for FEMA to  obtain assurance of the reliability of WYO company-reported financial data  by verifying that those objectives were met through the independent  audits of WYO companies.
Finally, FEMA did not concur with our recommendation to maintain and  consider information from an independent source regarding state audit  results in determining whether to conduct audits for cause. FEMA  contended that such sources do not focus on federal programs, such as  NFIP. However, FEMA’s Financial Control Plan states that it is expected  that audits of WYO companies by state insurance departments will include  flood insurance activity. Further, FEMA acknowledges receiving  information from a source independent of the WYO companies.  Specifically, it acknowledged receiving correspondence from state  insurance departments regarding issues of customer service with the WYO  companies. It is important for FEMA to establish and implement  procedures to require maintaining and considering all current information  available from an independent source regarding state audit results. We  found that FEMA rarely received or reviewed information from state  insurance department audits. Consequently, we continue to reaffirm our  recommendation to obtain and consider independent information on state  audits of the WYO companies, rather than continuing to rely solely on the  WYO company that underwrites policies and processes claims to alert  FEMA of any state issues.
FEMA also expressed concern over several points in our draft report’s  narrative. We continue to affirm the process descriptions and the findings  in our draft report but made several changes in the report to clarify the  narrative. Our responses to other FEMA concerns with our draft’s  narrative are provided following FEMA’s comments in appendix II.
As agreed with your office, unless you publicly announce the contents of  this report earlier, we plan no further distribution until 30 days from the  report date. At that time, we will send copies to the Secretary of Homeland  Security, relevant congressional committees, and other interested parties.  The report will also be available at no charge on our Web site at  http://www.gao.gov.
If you or your staff have any questions about this report, please contact me  at (202) 512-9095 or raglands@gao.gov. Contact points for our Offices of  Congressional Relations and Public Affairs may be found on the last page  of this report. GAO contact and staff acknowledgments are listed in  appendix III.
section_title: Appendix I: Scope and Methodology
paragraphs: To assess whether controls were effective in providing accountability and  reliable financial reporting for National Flood Insurance Program (NFIP)  transactions during the 2005 to 2007 time frame, we obtained and reviewed  available transaction data and financial reports for NFIP for fiscal years  2005 through 2007. We selected these years to identify transactions  relevant to the 2005 Gulf Coast hurricanes and to capture more current  financial information. We reviewed the Write Your Own (WYO) Financial  Control Plan, WYO Accounting Procedures Manual, and other relevant  NFIP policy guidance documents to determine the design of NFIP financial  reporting processes and related internal controls. We reviewed NFIP  transaction accountability in accordance with the guidelines of the Federal  Financial Management Improvement Act of 1996 (FFMIA). We also  interviewed Federal Emergency Management Agency (FEMA), FEMA  contractors, and Department of Homeland Security (DHS) Office of  Inspector General (OIG) officials to document and obtain an  understanding of the financial reporting process and related internal  controls for NFIP transactions. We conducted walkthroughs to understand  the reporting process for financial transactions including the review of  related evidentiary supporting documentation, including journal vouchers  and adjusting journal entries. Further, to determine how the financial  transactions were recorded, specifically insurance premiums written and  claim losses paid, we reviewed NFIP financial reports and met with NFIP  program and FEMA officials to obtain an understanding of the processing  cycles for premiums written and claim losses paid. We interviewed FEMA  personnel and contractors responsible for collecting and maintaining NFIP  financial data to understand the available data. In addition, we obtained  requested extracts of NFIP databases of the insurance premiums written  and claim losses paid for these fiscal years to identify the total population  including the number of transactions, and planned to select statistical  samples of claims and policies to test from these databases. We reconciled  the Bureau and Statistical Agent (BSA) extracts of net premiums written  and claim losses paid databases to the BSA prepared financial statements  based on the data provided to FEMA. Once we were able to successfully  complete our reconciliation, but before selecting samples, we performed  data reliability tests on the databases and determined that the claims  losses paid database was sufficiently reliable for our purposes. We did not  audit the data that WYO companies submit to FEMA’s contractor, CSC,  nor did we audit the data produced by CSC or the information included by  FEMA in DHS’ annual reports. We used the statistical samples of insurance  claim losses paid as outlined below to perform detailed testing through  verification of data fields such as coverage and deductible amounts, claim  payment amounts, and policy effective dates against source documents.  We also used these samples to further test internal controls over NFIP  financial reporting. Results from the statistical samples were projected by  fiscal year both individually and combined. See table 1 below for details  related to the statistical samples.
Using the above statistical samples, we also tested other NFIP program- oversight controls as deemed necessary and in accordance with our  engagement objectives. In order to ensure efficient detailed testing, we  conducted dual-purpose testing, which includes reviewing dollar amounts  as well as the related internal controls. We found information in the  premiums written database was not sufficiently reliable for our purposes.  We were unable to perform detailed testing of the premiums written  database due to a significant number of data-reliability issues that we  discovered.
To evaluate oversight structures in place to monitor NFIP financial activity  for the 3-year period covering 2005 to 2007, we reviewed prior GAO and  DHS OIG reports to identify and follow up on any previously reported  weaknesses or concerns, including sample selection for claims  reinspections and tracking results of biennial financial audits. We also  interviewed FEMA personnel and contractors regarding the oversight  structures in place. In addition, we identified and assessed significant  oversight structures as outlined in the WYO Financial Control Plan, and  analyzed the results of these controls.
To assess whether recent and planned actions to improve NFIP controls  and the overall control environment are likely to address identified  financial control weaknesses, we reviewed NFIP policy and procedural  guidance that has been issued subsequent to the 2005 Gulf Coast  hurricanes. We also met with key program officials to discuss the NextGen  system development effort. We also discussed recent and planned NFIP  program changes to address the internal control weaknesses and oversight  issues previously identified by GAO and the DHS OIG.
section_title: Appendix II: Comments from the Department of Homeland Security
paragraphs: The following section provides GAO’s comments on DHS’ letter dated  December 4, 2009.
subsections: section_title: GAO Comments
paragraphs: 1. We deleted the footnote containing this estimate, although the draft  report did not characterize it as an overpayment. We revised the text on  page 5 in the Background section to clarify our description of FEMA's  claims adjustment process.  2. Our report recognizes the unprecedented losses, but nevertheless the  internal control issues we identified raise concerns that the amounts of the  claims NFIP paid were not adequately supported even considering the  expedited procedures in place at the time.  3. Because we used a statistical sample from the insurance claim losses  paid databases, our sample allows us to make generalizations about the  population. The larger WYO companies that processed more claims would  constitute a larger number of claims in our statistical sample.  4. FEMA was unable to provide evidence of whether all WYO companies  had completed biennial audits and had not reviewed the results of any  biennial audits. Further, as discussed in our draft report, FEMA officials  exempted certain WYO companies from the biennial audit requirement  after the 2005 hurricane season. Therefore, FEMA had no assurance as to  the accuracy or validity of WYO company transaction-level financial data.
section_title: Appendix III: GAO Contact and Staff Acknowledgments
subsections: section_title: GAO Contact
section_title: Acknowledgments
paragraphs: In addition to the contact named above, Chanetta Reed, Assistant Director;  Sharon Byrd, Assistant Director—Audit Sampling; Kwabena Ansong;  Gabrielle Fagan; Patrick Frey; Elizabeth Isom; Jason Kirwan; Jason Kelly;  Chelsea Lounsbury; Mary Osorno; and Gabrielle Perret made significant  contributions to this report.
section_title: Related GAO Products
paragraphs: High-Risk Series: An Update. GAO-09-271. Washington, D.C.: January  2009.
Flood Insurance: Options for Addressing the Financial Impact of  Subsidized Premium Rates on the National Flood Insurance Program.  GAO-09-20. Washington, D.C.: November 14, 2008.
Flood Insurance: FEMA’s Rate-Setting Process Warrants Attention.  GAO-09-12. Washington, D.C.: October 31, 2008.
Information Technology: Management Improvements Needed on The  Department of Homeland Security’s Next Generation Information Sharing  System. GAO-09-40. Washington, D.C.: October 8, 2008.
National Flood Insurance Program: Financial Challenges Underscore  Need for Improved Oversight of Mitigation Programs and Key Contracts.  GAO-08-437. Washington, D.C.: June 16, 2008.
National Flood Insurance Program: Greater Transparency and  Oversight of Wind and Flood Damage Determinations Are Needed.  GAO-08-28. Washington, D.C.: December 28, 2007.
Federal Emergency Management Agency: Ongoing Challenges Facing the  National Flood Insurance Program. GAO-08-118T. Washington, D.C.:  October 2, 2007.
National Disasters: Public Policy Options for Changing the Federal Role  in Natural Catastrophe Insurance. GAO-08-7. Washington, D.C.:  November 26, 2007.
Financial Management: Persistent Financial Management Systems  Issues Remain for Many CFO Act Agencies. GAO-08-1018. Washington,  D.C.: September 30, 2008.
National Flood Insurance Program: FEMA’s Management and Oversight  of Payments for Insurance Company Services Should Be Improved.  GAO-07-1078. Washington, D.C.: September 5, 2007.
National Flood Insurance Program: Preliminary Views on FEMA’s  Ability to Ensure Accurate Payments on Hurricane-Damaged  Properties. GAO-07-991T. Washington, D.C.: June 12, 2007.
National Flood Insurance Program: New Processes Aided Hurricane  Katrina Claims Handling, but FEMA’s Oversight Should Be Improved.  GAO-07-169. Washington, D.C.: December 15, 2006.
GAO’s High-Risk Program. GAO-06-497T. Washington, D.C.: March 15,  2006.
Federal Emergency Management Agency: Challenges for the National  Flood Insurance Program. GAO-06-335T. Washington, D.C.: January 25,  2006.
Federal Emergency Management Agency: Improvements Needed to  Enhance Oversight and Management of the National Flood Insurance  Program. GAO-06-119. Washington, D.C.: October 18, 2005.
National Flood Insurance Program: Oversight of Policy Issuance and  Claims. GAO-05-532T. Washington, D.C.: April 14, 2005.