Improper Payments: Improvements Needed in CMS and IRS Controls over Health Insurance Premium Tax Credit
Published: 2017-07-13T00:00:00

Fast Facts:

Highlights:
section_title: Why GAO Did This Study
paragraphs: The Patient Protection and Affordable Care Act (PPACA) aims to expand health insurance coverage and affordability. PPACA provides eligible individuals with PTC to help cover the cost of premiums for health plans purchased through a marketplace. CMS maintains the federally facilitated marketplace known as HealthCare.gov. IRS is responsible for processing PTC-related amounts on tax returns. The estimated fiscal year 2016 net outlay for PTC that was refunded to taxpayers was about $24 billion, while the estimated revenue effect from PTC that taxpayers used to reduce their tax liabilities was about $2 billion.
GAO was asked to examine improper payments related to PTC. This report assesses the extent to which (1) CMS and IRS assessed the susceptibility of their PTC programs to significant improper payments; (2) CMS properly designed and implemented key control activities related to preventing and detecting improper payments of advance PTC; and (3) IRS properly designed and implemented key control activities related to preventing and detecting improper payments of PTC, including recovering overpayments and reimbursing underpayments of PTC.
GAO reviewed the improper payment susceptibility assessments completed by CMS and IRS; interviewed agency officials; reviewed policies and procedures; and tested statistical samples of (1) CMS applications with advance PTC transactions during the 2016 open enrollment period and (2) income tax returns with PTC transactions processed during the first 9 months of fiscal year 2016.
section_title: What GAO Found
paragraphs: In fiscal year 2016, the Department of Health and Human Services' (HHS) Centers for Medicare & Medicaid Services (CMS) assessed its advance premium tax credit (PTC) program as susceptible to significant improper payments. CMS instituted a qualitative method for assessing the susceptibility of its program that was consistent with requirements, including assessing each of the nine required qualitative risk factors. However, CMS stated that it may not report improper payment estimates for the PTC program as required until at least fiscal year 2022 because of the complexity and timing of the process for developing such estimates. As a result, HHS's overall improper payments estimate will continue to be understated, and Congress and others will continue to lack key payment integrity information for monitoring HHS's improper payments. The fiscal year 2016 Internal Revenue Service (IRS) assessment for its PTC program was not consistent with requirements nor did it demonstrate whether the program met applicable thresholds for susceptibility to significant improper payments. Until IRS conducts an appropriate assessment, it will remain uncertain whether IRS should estimate the amount of improper payments for its PTC program.
Although CMS properly designed and implemented control activities related to the accuracy of advance PTC payments, it did not properly design control activities related to preventing and detecting improper payments of advance PTC, such as verifying individuals' eligibility. As a result, CMS is at increased risk of making improper payments of advance PTC to issuers on behalf of individuals.
IRS did not design and implement certain key control activities related to preventing and detecting PTC improper payments, including recovering excess advance PTC overpayments. For example, IRS did not properly design procedures to routinely check for duplicate employer- or government-sponsored coverage. In addition, in 2015 and 2016, IRS used an ad hoc process for notifying nonfilers of the requirement to file tax returns; however, IRS did not establish procedures for sending these notices regularly during each filing season to facilitate compliance. Without properly designed control activities related to PTC, IRS is at increased risk of making improper payments to individuals.
IRS faces challenges that affect its ability to design and implement procedures related to preventing and detecting PTC improper payments, including recovering advance PTC overpayments and reimbursing advance PTC underpayments. For example, IRS maintains that reduced resources have impaired its ability to implement needed controls. Further, statutory limitations contributed to IRS's inability to fully collect excess advance PTC overpayments and reimburse PTC underpayments and to automatically correct errors in tax returns. GAO previously suggested that IRS seek legislative authority to correct tax returns at filing based on marketplace data. The Department of the Treasury, on behalf of IRS, has submitted proposals for congressional consideration to permit IRS to correct such errors where individuals' information on tax returns does not match corresponding information provided in government databases. Congress has not yet granted this broad authority.
section_title: What GAO Recommends
paragraphs: GAO is making 10 recommendations to HHS. Of these, 2 recommendations are related to complying with annual reporting of advance PTC improper payments estimates, including assuring that CMS expedites the process for reporting such estimates. The 8 remaining recommendations address improving control activities related to eligibility determinations and calculations of advance PTC based on incomes and family sizes. HHS concurred with 7 of the recommendations and neither agreed nor disagreed with the remaining 3 recommendations, which related to improving control activities for verifying identities of individuals, preventing duplicate coverage of individuals receiving minimum essential coverage through their employers, and verifying household incomes and family sizes. GAO continues to believe that actions to implement these 3 recommendations are needed as discussed in the report.
GAO is also making 5 recommendations to IRS. Of these, 1 recommendation focuses on properly assessing the susceptibility of the PTC program to significant improper payments. The remaining 4 recommendations address improving control activities related to processing PTC information on tax returns, such as recovering advance PTC made for individuals who do not meet the eligibility requirements for citizenship or lawful presence. IRS agreed with 2 recommendations, partially agreed with 2 other recommendations, and disagreed with the remaining recommendation. For the 2 partial concurrences, GAO continues to believe that actions to fully implement these recommendations are needed as discussed in the report. Although IRS disagreed with the 1 recommendation related to reviewing tax returns to those who are not reporting shared responsibility payments, the actions IRS described in its comments, if implemented effectively, would address the recommendation.

section_title: Letter
paragraphs: The Patient Protection and Affordable Care Act (PPACA) aims to expand  health insurance coverage and make it more affordable for low-income  households. PPACA required the establishment of health insurance  exchanges, or marketplaces, in all states to assist individuals in  comparing and selecting among insurance plans offered by participating  private issuers of health care coverage, such as health insurance  companies. Under PPACA, states may elect to operate their own  respective health insurance marketplaces, but a majority of states rely on  the federally facilitated marketplace (FFM), known to the public as  HealthCare.gov. The Centers for Medicare & Medicaid Services (CMS)  within the Department of Health and Human Services (HHS) is  responsible for overseeing the establishment of these state-based  marketplaces and maintaining the FFM.
To help pay the cost of insurance premiums for taxpayers and their  dependents, PPACA provides a premium tax credit (PTC) to individuals  who meet certain income and other requirements. Individuals can have  the federal government pay PTC to their issuers in advance on their  behalf, known as advance PTC, which lowers their monthly premium  payments. The advance PTC is based on estimates of household income.  Taxpayers who choose to have advance PTC must reconcile the amount  of advance PTC paid to issuers on their behalf with PTC they are eligible  for on their income tax returns, which is computed based on the actual  modified adjusted gross income calculated when filing their returns. PTC  is a refundable tax credit in that in addition to offsetting tax liability, any  credit amounts in excess of tax liability are refunded to taxpayers. The  Internal Revenue Service (IRS) is responsible for ensuring individuals,  employers, and issuers comply with certain PPACA health coverage and  tax filing requirements.
PTC represents a significant fiscal commitment for the federal  government. According to the Department of the Treasury (Treasury), the  estimated fiscal year 2016 net outlay for the portion of PTC that was  refunded to taxpayers was about $24 billion; the estimated revenue effect  from the portion that taxpayers used to reduce their tax liabilities was  about $2 billion. Enrollment control activities to reasonably assure that  only qualified applicants receive PTC—and any advance payments  toward their insurance premiums—are a key factor in administering the  credit effectively and efficiently.
House Report No. 114-195, which accompanied H.R. 3020, Departments  of Labor, Health and Human Services, and Education, and Related  Agencies Appropriations Bill, 2016, included a provision for GAO to  evaluate the process and coordination between HHS and Treasury to  prevent improper payments of PTC. The objectives of this report are to  determine the extent to which (1) CMS and IRS assessed the  susceptibility of their PTC programs to significant improper payments and,  if the programs were deemed susceptible, whether CMS and IRS took  actions required by the Improper Payments Information Act of 2002, as  amended (IPIA), and Office of Management and Budget (OMB)  guidance; (2) CMS properly designed and implemented key control  activities related to preventing and detecting improper payments of  advance PTC; and (3) IRS properly designed and implemented key  control activities related to preventing improper payments of PTC in  processing federal income tax returns, detecting and recovering advance  PTC overpayments made to issuers on behalf of policyholders, and  reimbursing underpayments made to policyholders. Further, for those key control activities that we determined were properly designed and  implemented, we evaluated the extent to which such control activities  were operating as designed.
To address our first objective, we reviewed relevant laws, regulations,  and guidance to identify the requirements that agencies must meet to  identify programs that are susceptible to significant improper payments.  We reviewed improper payment assessments that CMS and IRS  conducted for fiscal year 2016 for their respective PTC program areas.  We then analyzed those assessments against relevant IPIA requirements  and OMB guidance to determine whether the agencies had evaluated the  appropriate risk factors for improper payments and appropriately  considered those factors in their susceptibility assessments. We also  interviewed CMS and IRS officials on their plans to estimate and report  improper payments for their PTC programs.
To address our second objective, we first reviewed PPACA and its  implementing regulations, relevant internal control standards, and  leading practices for managing fraud risks in federal programs (GAO’s  fraud risk framework), and identified the relevant risks for which control  activities are needed. To assess the design and implementation of key  control activities related to PTC at CMS and to identify any deficiencies,  we focused on key control activities at CMS related to the FFM for plan  year 2016. We selected CMS’s FFM because, at the time of our audit, it  operated on behalf of about two-thirds of the states and about 75 percent  of all enrollees receiving advance PTC. We evaluated the design and  implementation of key control activities by reviewing CMS policies,  procedures, and other relevant documents, such as interagency  agreements and standard operating procedures for eligibility support  workers. We compared the key risks we identified with the key control  activities we identified to evaluate whether CMS’s design of its control  activities sufficiently addressed each key risk area.
For key control activities that we determined were properly designed and  implemented, we evaluated whether they were operating as designed by  testing a statistically random sample of applications for FFM policyholders  with advance PTC transactions from CMS. The testing period covered  applications received during the 2016 open enrollment period (November  1, 2015, through February 1, 2016). We did not evaluate control activities  related to advance PTC payments to issuers on behalf of individuals  because such payments included other aggregated costs and  adjustments, such as cost-sharing reduction subsidies and user fees,  which were beyond the scope of our audit. We also did not evaluate  whether key control activities that we determined were not properly  designed and implemented were operating as designed because, without  proper design and implementation, such control activities cannot achieve  the control objective.
To address our third objective, we reviewed PPACA and its implementing  regulations, relevant internal control standards, and GAO’s fraud risk  framework, and identified the relevant risks areas for which control  activities are needed. Consistent with our procedures for our second  objective, we also reviewed IRS’s processes to evaluate the design and  implementation of its key control activities and identify any deficiencies.  We evaluated the design and implementation of key control activities at  IRS by reviewing IRS policies and procedures, such as the Internal  Revenue Manual (IRM). We then compared the key risks we identified  with key control activities to evaluate whether IRS’s design of its control  activities sufficiently addressed each key risk area. To assess whether  IRS key control activities identified in our evaluation as properly designed  and implemented were also operating as designed, we tested a statistical  random sample of individual federal income tax returns with PTC  transactions for the first 9 months of fiscal year 2016 (from October 1,  2015, to June 18, 2016).
To assess the reliability of the CMS application data and IRS PTC  transaction data, we reviewed relevant documentation and interviewed  officials responsible for these data. We also performed electronic testing  to determine the validity of specific data elements we used to perform our  work. For both sets of data, based on the reliability examination we  undertook for each, we concluded that the data we used for this report  were sufficiently reliable for our purposes. Appendix I provides additional  details on our scope and methodology.
While our second and third audit objectives focused on certain significant  control activities related to preventing and detecting improper payments in  the PTC programs at CMS and IRS, we did not evaluate all control  activities and other components of internal control. If we had done so,  additional deficiencies may have been identified that could impair the  effectiveness of the control activities evaluated as part of this audit.  Appendix II provides additional details on standards for internal control in  the federal government.
We conducted this performance audit from January 2016 to July 2017 in  accordance with generally accepted government auditing standards.  Those standards require that we plan and perform the audit to obtain  sufficient, appropriate evidence to provide a reasonable basis for our  findings and conclusions based on our audit objectives. We believe that  the evidence obtained provides a reasonable basis for our findings and  conclusions based on our audit objectives.
subsections: section_title: Background
subsections: section_title: CMS Marketplace Responsibilities for Advance PTC Payments
paragraphs: Under PPACA, health care marketplaces are the mechanisms through  which applicants enroll in qualified health plans and apply for income- based advance PTC payments (paid directly to issuers) to offset the cost  of these plans. As applicable, they also obtain eligibility determinations for  other health coverage programs, such as Medicaid or the Children’s  Health Insurance Program (CHIP). CMS is responsible for overseeing  the establishment of state-based marketplaces and operating the FFM for  states that did not establish their own marketplaces. Applicants in these  states enroll in qualified health plans through the FFM. CMS operates the  FFM in about two-thirds of the states. Specifically, CMS oversees  implementation of certain PPACA provisions related to the FFM, including ensuring that individuals are eligible to receive health insurance coverage  through the FFM and determining the amount of any advance PTC they  are eligible to receive.
To be eligible to enroll in a qualified health plan offered through a  marketplace, applicants must be U.S. citizens or nationals, or otherwise  lawfully present in the United States; reside in the marketplace service  area; and not be incarcerated (unless incarcerated while awaiting  disposition of charges). Marketplaces are required by law to verify certain  application information to determine applicant eligibility for enrollment  and, if applicable, advance PTC. The verification steps include validating  applicant Social Security numbers, if provided; verifying citizenship or  lawful presence status, and verifying household income.
PPACA requires that applicant-submitted information be verified and that  determinations of eligibility be made through either an electronic  verification system or another HHS-approved method. To implement this  verification process, CMS developed its Data Services Hub, which acts as  a conduit for exchanging information between (1) the FFM; state-based  marketplaces; Medicaid agencies; and other federal, state, and  commercial entities and (2) CMS’s external partners, including IRS, the  Social Security Administration (SSA), and other federal agencies. The  FFM accesses this information through the Data Services Hub to verify  that applicant information necessary to support an eligibility determination  is consistent with external data sources.
CMS generates an “inconsistency” when applicant-submitted information  does not match information from trusted data sources—either because  information an applicant provided does not match information contained  in the data sources or because such information is not available.  Inconsistencies are also created whenever the FFM is unable to solicit  information from trusted data sources due to data element requirements.  As required by federal regulations, when there are inconsistencies, the  marketplace grants temporary eligibility using applicant attestations and  ensures that advance PTC is provided to issuers on behalf of the  applicants qualified to receive them while such inconsistencies are being  resolved. Also, under this marketplace process, applicants are asked to  provide additional information or documentation for the marketplaces to  review to resolve the inconsistencies. When applicants are unable to  resolve the inconsistencies within the resolution period, the marketplace  may terminate advance PTC and coverage in certain circumstances.
Marketplaces are required to provide Form 1095-A, Health Insurance  Marketplace Statement, to recipients enrolled in qualified health plans  through the marketplace and to IRS. This form includes information on  covered enrollees, coverage periods, monthly premiums, and amounts of  advance PTC paid to issuers on behalf of the enrollees. Enrollees are  instructed to use Form 1095-A information to prepare Form 8962,  Premium Tax Credit, for their federal income tax returns.
Treasury regulations require marketplaces to report detailed information  for each qualified health plan to IRS monthly, by the 15th day after each  month of health insurance coverage. This monthly transmission—the  Exchange Periodic Data (EPD) transmission—contains cumulative  coverage information for the year, starting in January; thus, the EPD  transmission due to IRS by January 15 should contain complete  marketplace data for the entire previous coverage year. The EPD  transmission is also required to include information on any exemptions  from coverage requirements that are granted by the marketplace.
CMS is responsible for performing certain oversight functions intended to  help ensure that the plans offered through the FFM meet certification  standards. These oversight functions are intended to verify that enrollees  receive appropriate health insurance coverage and that federal funds are  not provided to health plans and issuers that do not meet the certification  standards. When plans no longer meet certification standards, CMS may  decertify them.
Each month, CMS is also responsible for calculating, processing, and  authorizing aggregated advance PTC payments to issuers on behalf of  eligible enrollees, along with cost-sharing reduction subsidies and  collecting user fees from issuers in certain states. For enrollees  determined eligible for advance PTC, the marketplace determines the  advance PTC amounts using, among other things, enrollee-reported  incomes and family sizes.
section_title: IRS Responsibilities Related to PTC
paragraphs: IRS is responsible for determining the final amounts of PTC that  taxpayers are entitled to receive based on household incomes and family  sizes reported on their tax returns. Taxpayers are eligible for PTC if they  meet various criteria: (1) buy qualified health insurance through a  marketplace; (2) are ineligible for affordable, minimum-value coverage  through an employer or government plan; (3) are within certain income  limits (household income from 100 percent to 400 percent of the federal  poverty level); (4) do not file a tax return with the status of married filing  separately; and (5) cannot be claimed as a dependent by another  person. While marketplaces determine the amounts of advance PTC for  which individuals are eligible based on their anticipated family sizes and  household incomes for the year reported to the marketplace, the final  PTC amounts are based on actual incomes reported when those  individuals file their federal income tax returns. As shown in figure 1,  taxpayers use Form 1095-A, provided by marketplaces, and their actual  modified adjusted gross incomes and family sizes to calculate their actual  PTC amounts on Form 8962.
Form 8962 is the key form that IRS uses to determine and recover  advance PTC overpayments and reimburse underpayments to  individuals. When the claimed amounts are greater than the total advance  PTC paid to issuers on behalf of individuals, those individuals report net  PTC on their federal income tax returns (e.g., Form 1040, Individual  Income Tax Return). The net PTC can increase refund amounts that  taxpayers receive or reduce amounts due from taxpayers. When the  claimed amounts are less than the total advance PTC paid to issuers on  behalf of individuals, those individuals report the excess advance PTC on  their federal income tax returns (e.g., Form 1040) as an increase in tax,  subject to limitations on the increase. The excess advance PTC can  reduce refund amounts that taxpayers receive or increase the amounts  due from taxpayers. Taxpayers are responsible for submitting their  federal income tax returns to IRS for processing with an attached Form  8962.
IRS is responsible for processing tax returns to determine the final  amount of PTC to which taxpayers are entitled and recovering advance  PTC overpayments. When IRS receives tax returns, IRS checks them for  completeness and attempts to verify taxpayer identities and PTC  eligibility. To verify PTC claims on federal income tax returns, IRS relies  on marketplace data to confirm that taxpayers were enrolled in qualified  health plans. As illustrated in figure 2, at the time of filing (i.e., before  refunds are issued), IRS’s Affordable Care Act Verification Service (AVS)  system compares the information taxpayers reported on their tax returns  to information furnished by the marketplaces, potentially identifying math  errors or discrepancies with marketplace data. For example, AVS may  identify taxpayers who received advance PTC according to the  marketplaces, but did not report it on their tax returns through Form 8962.  AVS may also detect cases when taxpayers claim the PTC on Form 8962  but are ineligible because they were not enrolled in a marketplace plan.  When discrepancies are identified, IRS may correspond with taxpayers to  address the related issues, or IRS may correct certain mathematical or  clerical errors on tax returns and notify taxpayers of the proper tax  liabilities based on those corrections. If IRS is unable to resolve such  discrepancies through correspondence with taxpayers or through its math  error authority, it may refer cases to examination for further review.
section_title: Improper Payment Reporting Requirements
paragraphs: IPIA defines an improper payment as any payment that should not have  been made or that was made in an incorrect amount (including  overpayments and underpayments) under statutory, contractual,  administrative, or other legally applicable requirements. It includes  duplicate payments; any payment made for an ineligible recipient, an  ineligible good or service, or a good or service not received; or any  payment that does not account for credit for applicable discounts. OMB  guidance also instructs agencies to treat any payments for which  insufficient or no documentation is found as improper payments.
IPIA also defines the scope of payments subject to assessment,  estimation, and reporting. Specifically, a payment is defined as any  transfer or commitment for future transfer of federal funds—such as cash,  securities, loans, loan guarantees, and insurance subsidies—to any  nonfederal person or entity that is made by a federal agency, a federal  contractor, a federal grantee, or a governmental or other organization  administering a federal program or activity. IRS has historically estimated  improper payments for the Earned Income Tax Credit but not for other  refundable credits.
IPIA and OMB guidance together provide the specific requirements for  assessing, estimating, and reporting on improper payments. Federal  agencies are required to review all programs and activities that they  administer and identify any program or activity that may be susceptible to  significant improper payments. IPIA defines “significant improper  payments” as gross annual improper payments (i.e., the total amount of  overpayments and underpayments) that may have exceeded (1) both 1.5  percent of program outlays and $10 million of all program or activity  payments made during the fiscal year reported or (2) $100 million  (regardless of the improper payment percentage of total program  outlays). Agencies must institute a systematic method of reviewing and  assessing their programs, which may take the form of either through a  quantitative analysis based on a statistical sample or qualitative  evaluation.
OMB guidance requires that agencies take into account the following nine  risk factors that are likely to contribute to significant improper payments:  1.  whether the program or activity reviewed is new to the agency;  2.  the complexity of the program or activity reviewed, particularly with  respect to determining correct payment amounts;  3.  the volume of payments made annually;  4.  whether payments or payment eligibility decisions are made outside of  the agency, for example, by a state or local government or a regional  federal office;  5.  recent major changes in program funding, authorities, practices, or  6.  the level, experience, and quality of training for personnel responsible  for making program eligibility determinations or certifying that  payments are accurate;  7.  inherent risks of improper payments because of the nature of agency  8.  significant deficiencies in the agency’s audit reports, including but not  limited to the agency inspector general or GAO audit findings or other  relevant management findings that might hinder accurate payment  certification; and  9.  results from prior improper payment work.
OMB guidance describes these risk factors as the minimum that agencies  should consider. An agency’s assessment may include other risk factors,  as appropriate, specific to the program or activity being assessed.
IPIA requires agencies to assess the risk of improper payments for each  program and activity that they administer, at least once every 3 years for  programs and activities deemed not susceptible to significant improper  payments. If an agency finds that a program is susceptible to significant  improper payments, the agency is required to estimate the annual amount  of improper payments for the program, publish corrective action plans, set  reduction targets, and annually report on the results of addressing these  requirements for that program.
OMB established an interagency working group, which included officials  from Treasury, IRS, HHS, and CMS, to help agencies navigate OMB  improper payments guidance. The interagency working group concluded  that CMS would be responsible for assessing risks and developing  improper payment error rates for advance PTC payments and that IRS  would be responsible for assessing risk and developing improper  payment error rates for net PTC in tax return processing.
section_title: CMS and IRS Did Not Take All Required Actions to Assess, Estimate, and Report PTC-Related Improper Payments
paragraphs: In fiscal year 2016, neither CMS nor IRS took all required actions for  assessing, estimating, and reporting improper payments related to PTC.  CMS assessed its advance PTC program as susceptible to significant  improper payments by appropriately considering each of OMB guidance’s  nine qualitative risk factors; however, it did not complete other key IPIA  requirements for programs deemed susceptible to significant improper  payments for its advance PTC program. IRS did not assess its PTC  program’s susceptibility to significant improper payments in a manner  consistent with IPIA requirements.
subsections: section_title: CMS Assessed Its PTC Program as Susceptible to Significant Improper Payments but Has Not Estimated or Reported Amounts as Required
paragraphs: In fiscal year 2016, CMS concluded that its advance PTC program was  susceptible to significant improper payments. We determined that CMS  instituted a systematic, qualitative method for assessing risk that was  consistent with IPIA requirements and OMB guidance. CMS appropriately  assessed each of the nine risk factors required by OMB guidance. For  example, CMS considered the risk factor regarding whether a program is  new to the agency and rated the advance PTC program, which started in  2014, as high risk. CMS also appropriately tailored risk factors to its  advance PTC program. For example, in considering the risk factor  regarding recent changes in program operations and funding, CMS also  considered projected future changes in program operations and funding  that could affect improper payments for the program. The analysis that  CMS performed on the risk factors supported its conclusion that the  advance PTC program was susceptible to significant improper payments,  as defined by IPIA and OMB guidance.
Although CMS reviewed its advance PTC program and concluded that it  was susceptible to significant improper payments, it did not complete  other key IPIA requirements for programs deemed susceptible to  significant improper payments for its advance PTC program. Specifically,  CMS did not estimate or report the annual amount of improper payments  for the advance PTC program. According to the fiscal year 2016 HHS  agency financial report, CMS was unable to specify the year that the rate  and the improper payment estimate amount will be reported. Further,  CMS officials could not provide us with a specific date when they  expected to be in compliance with these IPIA requirements. CMS officials  told us that they will not report improper payment estimates in fiscal year  2017 and may not be able to report estimates until at least fiscal year  2022. According to the fiscal year 2016 HHS agency financial report, the  agency is unable to specify the year that it will report the improper  payment rate and amount because of the complexity of the improper  payment error rate measurement methodology development process.  This process involves conducting pilot testing, using those tests to refine  the methodology, and then undergoing the rule-making process before  implementing the methodology. However, the fiscal year 2016 HHS  agency financial report did not disclose a timeline for completion of the  key steps necessary for developing the improper payment methodology  or why challenges will result in delays in meeting IPIA requirements for  estimating and reporting improper payments.
According to internal control standards, management should externally  communicate the necessary quality information to achieve the entity’s  objectives. This involves communicating with external parties—such as  legislators, oversight bodies, and the general public—using established  reporting lines. Information communicated to oversight bodies includes  significant matters relating to risks, changes, or issues that affect the  entity’s internal controls for achieving compliance and reporting  objectives. This communication is necessary for the effective oversight of  internal control.
Because CMS does not plan to report improper payment estimates for  this program for several years, HHS’s overall improper payment estimate  will continue to be understated, and CMS may be hindered in its efforts to  reduce improper payments in this program. Additionally, Congress and  other external stakeholders will continue to lack key payment integrity  information for monitoring improper payments. Likewise, if CMS does not  communicate significant matters relating to IPIA estimation, compliance,  and reporting objectives for the advance PTC program; its progress and  timeline for achieving those objectives; and the basis for its timeline for  reporting improper payment estimates, legislators’, oversight bodies’, and  the general public’s expectations for CMS improper payments reporting  may not align with those set by CMS management.
section_title: IRS Did Not Determine Whether Its PTC Program Is Susceptible to Significant Improper Payments
paragraphs: In its fiscal year 2016 improper payments susceptibility assessment, IRS  did not assess the PTC program’s susceptibility to significant improper  payments in a manner consistent with IPIA requirements. IPIA and OMB  guidance require agencies to identify all programs and activities that may  be susceptible to significant improper payments. OMB guidance further  instructs agencies not to put programs or activities into groupings that  may mask significant improper payment rates by the scope of a grouping.  However, IRS did not consider key types of PTC-related errors that may  result in improper payments within the scope of its assessment. IRS  focused its assessment on payment errors for taxpayers who reported a  net PTC amount on their tax returns—that is, individuals who reported a  final PTC amount that was greater than the advance PTC amounts they  reported on their tax returns. IRS did not assess payment errors for  taxpayers who (1) reported final PTC amounts equal to the advance PTC  amounts they reported on their tax returns or (2) reported an excess  advance PTC—that is, advance PTC amounts that exceeded the final  PTC amounts they reported on their tax returns. Such errors fall under the  purview of IRS controls and can affect the accuracy of net PTC payments  and tax collections of excess advance PTC.
IRS officials told us that errors resulting in (1) final PTC claims equal to  advance PTC and (2) excess advance PTC, which increase taxes owed,  do not affect program outlays or improper payments. As a result, IRS  maintains that these types of errors are not covered by IPIA. However,  IPIA defines improper payments to include both overpayments and  underpayments.
Although we agree that excess advance PTC increases taxes owed,  taxpayers may inaccurately complete Form 8962 and erroneously report  excess advance PTC on their returns instead of claiming net PTC, or they  may simply fail to report net PTC on their tax returns altogether. Such  errors would result in underpayments of net PTC and therefore affect  program outlays and improper payments. These error types were not  considered within the scope of the IRS susceptibility assessment for  improper payments.
Likewise, IRS did not conclude on whether the PTC program is or is not  susceptible to significant improper payments. Instead, IRS concluded that  the risk of improper payments in the net PTC program was “medium.” The  assessment defined a “medium” risk level as one that is partially mitigated  by current mitigation measures and internal controls (see fig. 3). IRS’s  fiscal year 2016 IPIA susceptibility assessment for the net PTC was  prepared by a contractor under the direction and oversight of IRS  management. IRS management allowed the contractor to use a risk level  definition that was inconclusive for purposes of assessing whether or not  the program may be susceptible to significant improper payment  thresholds, as defined by IPIA.
Although IRS used all of the required qualitative risk factors specified in  IPIA and OMB guidance within its assessment, IRS did not analyze how  each of the risk factors affected the susceptibility of the program to  significant improper payments, as defined by IPIA. For example, rather  than analyzing whether the volume of PTC payments made was likely to  cause the program to meet applicable IPIA thresholds for susceptibility to  significant improper payments, IRS compared the projected total number  of taxpayers who are able to claim net PTC on their federal income tax  returns to the total number of taxpayers filing federal income tax returns  as a whole during the 2015 filing season. Such a comparison is not  relevant to assessing whether the program’s error rates or improper  payment amounts may have exceeded the applicable thresholds for  susceptibility: either (1) 1.5 percent of program outlays and $10 million or  (2) $100 million.
Internal control standards state that management should use quality  information to achieve the entity’s objectives. Management obtains  relevant data from reliable internal and external sources in a timely  manner based on the identified information requirements. Relevant data  have a logical connection with, or bearing upon, the identified information  requirements. Reliable internal and external sources provide data that are  reasonably free from error and bias and faithfully represent what they  purport to represent.
By not considering certain types of underpayments or concluding whether  its PTC program is susceptible to significant improper payments, IRS did  not demonstrate whether the program met applicable thresholds for  susceptibility to significant improper payments. Until IRS conducts an  appropriate assessment, it will continue to be uncertain whether IRS  should estimate the amount of improper PTC payments.
section_title: CMS Control Activities Related to Preventing and Detecting Improper Payments of Advance PTC Were Not Properly Designed
paragraphs: CMS control activities were not properly designed and implemented to  help achieve management objectives related to preventing and detecting  improper payments of advance PTC. Specifically, we identified  deficiencies in the design of key CMS control activities related to eligibility requirements for advance PTC payments and  the accuracy of advance PTC calculations based on incomes and  family sizes.
As shown in figure 4, we found that CMS control activities related to  determining the accuracy of PTC payments to certified issuers of qualified  health plans were properly designed and implemented. However, we did  not evaluate whether all control activities related to preventing and  detecting improper payments of advance PTC were operating as  designed or evaluate other internal control components, such as the  control environment. Deficiencies, if any, in the internal control  components that were not evaluated could impair the overall  effectiveness of CMS’s control activities related to preventing and  detecting improper payments in the advance PTC program.
subsections: section_title: Most CMS Control Activities Related to Key Eligibility Requirements for Advance PTC Were Not Properly Designed
paragraphs: CMS did not properly design control activities related to individuals  meeting key eligibility requirements for receiving advance PTC. While  CMS’s procedures related to verifying citizenship and lawful presence of  individuals with Social Security Administration (SSA) and the Department  of Homeland Security (DHS) were properly designed and implemented  and were operating as designed, CMS procedures to verify other key  eligibility requirements were not properly designed.
subsections: section_title: Verifying Citizenship and Lawful Presence
paragraphs: To be eligible to enroll in a qualified health plan offered through a  marketplace, an individual must be a U.S. citizen or national, or otherwise  lawfully present in the United States. For verifying citizenship or lawful  presence of individuals, CMS relies on data in SSA and DHS information  systems. According to CMS’s control activities for citizenship, CMS  queries an SSA system to validate, among other things, whether an  individual is a U.S. citizen. If the SSA system cannot verify citizenship,  and the individual has provided an immigration document number that  indicates possible citizenship or lawful presence, CMS queries a DHS  system to verify the individual’s citizenship or other immigration status.  We tested a statistical sample of 93 enrollment applications submitted  during the 2016 open enrollment period and found that CMS verified  citizenship and lawful presence with SSA or DHS for all applications.  Based on our audit work, CMS control activities for verifying citizenship  and lawful presence of individuals with SSA or DHS were properly  designed and implemented and were operating as designed.
section_title: Verifying the Identities of Individuals
paragraphs: An individual begins the marketplace enrollment process in a qualified  health plan by providing basic personal information, such as name, birth  date, and Social Security number. To prevent unauthorized individuals  from creating marketplace accounts using the identities of others when  applying for health coverage, CMS verifies some individual identities  through an identity proofing process. According to CMS’s internal control  documentation, for individuals applying for marketplace coverage online  via HealthCare.gov, CMS validates their identities through an external  source.
CMS does not perform identity proofing for individuals applying for health  coverage through the mail or over the phone. For paper applications  submitted by mail, the marketplace requires individual signatures before  the marketplace processes those applications. For phone applications,  CMS does not validate identities of individuals, instead relying solely on  the basis of verbal attestations made by individuals. CMS allows  individuals to complete the application process on the basis of these  attestations, given under penalty of perjury.
According to CMS officials, PPACA does not require CMS to validate  identities of individuals. However, internal control standards state that  management should consider the potential for fraud when identifying,  analyzing, and responding to risks and design and implement control  activities to respond to risks. Further, these standards also state that  management should design control activities to achieve objectives and  respond to risks.
Because CMS does not validate the identities of individuals who apply by  phone or mail, CMS is vulnerable to enrolling ineligible individuals in  qualified health plans with advance PTC. To illustrate, we previously  reported on our undercover testing of CMS enrollment processes in 2014,  in which we made six online applications using fictitious identities that  failed to clear an identity validation step. We subsequently were able to  obtain coverage for all six of these applications that we began online by  completing them by phone. By following instructions to make telephone  contact with the marketplace, we circumvented the initial identity-proofing  control that had stopped our online applications.
section_title: Verifying Residencies
paragraphs: CMS did not properly design procedures to verify the residencies of  individuals. HHS regulations permit CMS to accept attestations of  residency. In order to be eligible to enroll in a qualified health plan  offered through a marketplace, individuals must reside in the marketplace  service area. CMS officials told us that they were unaware of a  comprehensive, national electronic data source that could be used to  verify residence. However, CMS did not document an evaluation of  available external sources to determine the quality, relevance, and  reliability of the data. Internal control standards state that management  should use quality information to achieve the entity’s objectives. In  addition, according to GAO’s fraud risk framework, it is a leading practice  to conduct data matching to verify key information, including self-reported  data and information necessary to determine eligibility. Without verifying  the residencies of individuals, CMS is vulnerable to enrolling ineligible  individuals in qualified health plans and improperly providing advance  PTC to issuers on their behalf.
section_title: Preventing Duplicate Coverage
paragraphs: We found design deficiencies in CMS’s procedures related to determining  that advance PTC is not provided to issuers on behalf of individuals who  are receiving or eligible for minimum essential coverage through their  employers or government-sponsored programs. Specifically, CMS does  not (1) use data from nonfederal employers to check for duplicate  minimum essential coverage; (2) have procedures for terminating  coverage for individuals who have employer-sponsored minimum  essential coverage; and (3) have procedures for sharing coverage  information with, and obtaining coverage information from, such  employers. In addition, CMS checks for duplicate government-sponsored  Medicaid and CHIP coverage only in the states where applicants attest to  residing and thus would not detect whether applicants received such  coverage in different FFM states.
Although CMS has procedures to obtain data from the Office of Personnel  Management for identifying individuals receiving health care coverage from federal employers, CMS does not have procedures that use data  sources to identify individuals receiving minimum essential coverage  through nonfederal employers. CMS officials stated that PPACA does  not require that employers report information on employer-sponsored  coverage offers to HHS. CMS officials told us that they have explored  other possible data sources, including Medicare Coordination of Benefits,  the National Directory of New Hires, and Equifax data, but they have  been unable to identify comprehensive electronic data sources that are  sufficiently current and accurate for identifying these individuals.  However, CMS did not document its evaluation of the availability and  reliability of potential data sources. As a result, we were unable to  evaluate CMS’s review of these electronic data sources and assess  whether CMS reviewed other potential data sources.
CMS relies on individuals to update their marketplace applications and  has not established a process for terminating advance PTC for individuals  who have not updated their applications. CMS has not designed  procedures for the FFM to send notices to employees who have been  identified as having access to minimum essential employer-sponsored  coverage regularly during each enrollment season. CMS officials told us  that in 2016 they began notifying certain employers of individuals enrolled  in FFM coverage with advance PTC. If employers responded and  asserted that they provide individuals with access to affordable, minimum- value employer-sponsored coverage, the FFM would then send notices to  those individuals notifying them to update their marketplace applications  to reflect that they have access to or are enrolled in other coverage and  warning them that failure to update their profiles accordingly may result in  a tax liability. CMS officials told us that CMS has published information,  for example, on a Frequently Asked Questions page, on the CMS website  that describes the notices. However, these Frequently Asked Questions  do not constitute procedures that provide guidance for sending out the  notices regularly.
According to GAO’s fraud risk framework, it is a leading practice to  conduct data matching to verify key information, including self-reported  data and information necessary to determine eligibility. In addition,  internal control standards state that management should use quality  information to achieve the entity’s objectives and should obtain relevant  data from reliable internal and external sources based on the identified  information requirements for achieving the entity’s objectives and address  risks. These standards also state that management should design  control activities to achieve objectives and respond to risks.
Without policies and procedures for identifying individuals who have  minimum essential coverage from nonfederal employers and for  terminating advance PTC for those individuals, CMS is at greater risk of  providing advance PTC to issuers on behalf of ineligible individuals.
Individuals receiving coverage from government-sponsored programs,  such as Medicare, Medicaid, and CHIP, are generally allowed PTC only  for the months that one or more members of the individuals’ families are  not eligible for government-sponsored coverage. CMS has designed a  process that identifies some but not all cases in which individuals who are  applying for the advance PTC may also have government-sponsored  coverage. Specifically, CMS has procedures to identify individuals with  duplicate government-sponsored coverage using data from Medicare, the  Peace Corps, TRICARE, and the Veterans Health Administration.
CMS did not establish a process to fully identify all individuals with  duplicate government-sponsored coverage through Medicaid and CHIP.  Specifically, CMS’s procedures are designed to detect duplicate coverage  with Medicaid and CHIP only in the states where individuals applied for  coverage through the FFM and not in any other state where the FFM  operates. Consequently, its procedures do not detect when FFM  applicants have duplicate coverage through Medicaid and CHIP from  different FFM states than the states in which they applied and attested to  residing.
According to CMS officials, FFM procedures are designed to check for  Medicaid and CHIP only in the states where individuals have attested to  residing during the application review process and not in other FFM  states. Federal regulations require the FFM to verify whether individuals  have been determined eligible for coverage through Medicaid and CHIP  within the state or states in which the FFM operates by using information  obtained from the agencies administering such programs. Thus, the  FFM is required to verify whether individuals also have Medicaid and  CHIP coverage in all states covered by the FFM and not just in states  where the individuals applied for coverage and attested to reside.  According to CMS officials, it would be technically difficult and  impracticable for all FFM states to provide information that would allow  the FFM to check Medicaid and CHIP coverage for individuals in each of  those states. However, CMS did not provide us with documented  analyses to support this assessment. As a result, we were unable to  evaluate CMS’s assessment and determine whether CMS reviewed the  feasibility of using other existing resources and tools for checking for  Medicaid and CHIP coverage in all FFM states.
Internal control standards state that management should use quality  information to achieve the entity’s objectives. In addition, these  standards also state that management should design control activities to  achieve objectives and respond to risks.
Without procedures in place to detect duplicate coverage by Medicaid  and CHIP in states other than those in which individuals applied for  coverage and attested to residing, CMS is at greater risk of providing  advance PTC on behalf of individuals who receive Medicaid and CHIP  coverage from other FFM states and are therefore ineligible for advance  PTC.
section_title: Resolving Inconsistencies
paragraphs: Inconsistencies are generated when individual-attested information does  not reasonably match information from the marketplace’s trusted data  sources, or because the needed information is not available from a  federal data source. In such instances, the FFM sends eligibility letters to  individuals requesting explanations or supporting documentation to  resolve inconsistencies within a specific time frame, referred to as an  inconsistency period. Individuals are generally given 95 days to provide  the requested documentation to substantiate citizenship and lawful  presence and 90 days for other types of inconsistencies.
During inconsistency periods, individuals may enroll in a qualified health  plan and elect to receive advance PTC. Individuals can provide  explanations and substantiating documents by mail or through the  marketplace website. When individuals provide sufficient documentation  to substantiate the attested information, the inconsistencies are resolved.  When individuals do not provide sufficient documentation within the  inconsistency period, the FFM “expires” those inconsistencies and  determines the eligibility based on the existing information from electronic  data sources. If data are not available, marketplace enrollments may be  terminated or the individuals may be determined ineligible for advance  PTC.
We identified deficiencies in CMS’s design of key procedures related to  resolving eligibility issues and terminating inconsistencies related to  Social Security numbers and incarceration, as well as the timely  termination of inconsistencies.
CMS did not properly design and implement procedures related to  preventing advance PTC on behalf of individuals who submitted  inaccurate or false Social Security numbers. Based on our analysis of the  CMS inconsistency data for the 2016 open enrollment, we identified about  82,000 applications with unresolved Social Security number  inconsistencies as of May 2016. CMS provided about $42 million in  advance PTC in May 2016 on behalf of these individuals. In February  2016, we reported that unresolved Social Security number  inconsistencies are indicators of potentially fraudulent applications.  Unresolved Social Security number inconsistencies may also adversely  affect IRS’s ability to assess and fully recover advance PTC  overpayments. In our February 2016 report, we recommended that the  Secretary of Health and Human Services direct CMS to design and  implement procedures to resolve Social Security number inconsistencies  when the marketplace is unable to verify the numbers or individuals do  not provide them. HHS concurred with our recommendation, and CMS  officials told us that system functionality upgrades to address Social  Security number inconsistencies were completed and deployed in March  2017. In May 2017, CMS established procedures for verifying Social  Security numbers with documents submitted by the applicants but has not  developed procedures to terminate advance PTC for applications with  unresolved Social Security number inconsistencies. CMS officials did  state that further refinements to the process are likely to occur.
CMS did not properly design and implement procedures related to  preventing advance PTC paid on behalf of incarcerated individuals or  individuals who may be using identities of incarcerated individuals, both of  which would be ineligible for advance PTC. Based on our analysis of the  CMS inconsistency data for the 2016 open enrollment, we identified about  30,000 applications with unresolved incarceration inconsistencies as of  May 2016. CMS provided about $10 million in advance PTC in May 2016  on behalf of these individuals. We had previously reported in February  2016 that CMS did not terminate individuals who had inconsistencies  generated when verifying incarceration statuses with SSA’s Prisoner  Update Processing System (PUPS) database. We reported that CMS  officials told us that they did not terminate eligibility for incarceration  inconsistencies because they determined that the PUPS data were  unreliable for use by the marketplace. However, in the report, we stated  that CMS did not provide us documentation on how it concluded that the  PUPS data were unreliable for identifying incarcerated individuals or the  potential cost associated with not verifying incarceration status. In the  report, we recommended that the Secretary of Health and Human  Services direct CMS to reevaluate the use of PUPS incarceration data in  the inconsistency process. HHS concurred with our recommendation and  noted in its comments to our report that PUPS data were not sufficiently  current and accurate at that time. According to CMS officials, CMS  continues to work with SSA to improve the quality of incarceration data  used for verification. In March 2016, CMS officials stated that SSA  completed developmental changes to improve the reliability of the match  criteria for the incarceration database and limit the risk of receiving false  positives. CMS officials stated that they are assessing whether these data  improvements result in sufficiently reliable incarceration data but did not  provide us a date on when the assessment will be completed.
Timely Termination or Adjustment of Advance PTC Because of  Inconsistencies  CMS also did not properly design procedures related to terminating or  adjusting advance PTC timely when inconsistency periods have expired.  Specifically, CMS’s procedures call for the processing of all expiration  activities, including the notifications to issuers regarding the terminations  or adjustments of advance PTC, at the beginning of the month following  the month that the inconsistency periods expire. However, the effective  dates of the terminations or adjustments are the last day of that month,  which is also the month that notifications are provided to the issuers  regarding these terminations or adjustments. Thus, by not processing  terminations or adjustments of advance PTC on a rolling basis based on  the effective dates of the expirations of the inconsistency periods, CMS  provides an extra month of advance PTC to issuers on behalf of ineligible  individuals.
The aggregate dollar amounts for the extra month of advance PTC that  CMS pays each month on behalf of ineligible individuals can be  significant. For example, based on our analysis of CMS inconsistency  data for the 2016 open enrollment, we identified about 45,000  applications that were terminated by CMS for lawful presence or  citizenship inconsistencies. As a result of its practice of processing  advance PTC terminations, as of May 2016, CMS had paid about $19  million in extra advance PTC on behalf of these ineligible individuals  during the 2016 open enrollment.
According to CMS officials, the current process for terminating  enrollments based on expired inconsistencies gives individuals the full  inconsistency period to mail in substantiating documents—and allows  CMS to confirm whether sufficient documentation was provided—prior to  initiating the termination process. CMS officials also stated that the  processing of inconsistencies in batches also aligns with issuer  operations (allowing time to adjust billing for the next month) and allows  for a more efficient process. In addition, CMS officials told us that  processing terminations outside of normal system and marketplace rules  would require additional manual effort on the part of the marketplace and  issuers. However, we could not determine the validity of the officials’  statements because CMS did not provide us with documentation or  analyses demonstrating that its current process for terminating policies  and advance PTC is consistent with applicable statutory requirements, or  that it is more efficient and cost-effective than processing terminations  more frequently.
Internal control standards state that management should identify,  analyze, and respond to risks related to achieving the defined  objectives. These standards also state that management should design  control activities to achieve objectives and respond to risks. Without  evaluating its process for terminating inconsistencies, CMS is at risk of  providing an extra month of benefits to individuals who are eventually  terminated from coverage because of insufficient documentation to  resolve the inconsistencies.
section_title: Monitoring Continued Eligibility
paragraphs: Federal regulations require marketplaces to periodically examine certain  available data sources to determine, among other things, whether  individuals with advance PTC remain eligible. However, CMS has not  developed procedures to monitor and identify changes in circumstances,  such as duplicate coverage or death, that may not be reported in a timely  manner and would affect individuals’ eligibility for advance PTC.
CMS checks for duplicate coverage from Medicaid in the states of  individuals’ residencies at the time of initial enrollment, but CMS does not  have documented procedures to regularly monitor changes in health  insurance coverage throughout the year. In October 2015, we reported  that CMS did not have procedures to regularly monitor unreported  duplicate coverage from Medicaid in FFM states. Further, CMS had  generally not provided FFM states with marketplace enrollment  information that it would need to identify cases of duplicate coverage. In  our report, we recommended that CMS establish a schedule for regular  duplicate coverage checks and ensure that the checks are carried out  according to schedule. In response to our recommendation, CMS officials  told us that they completed checks for duplicate coverage. CMS officials  also stated that the agency intended to perform this check at least twice  per coverage year on an ongoing basis and will take steps to terminate  advance PTC for any individuals identified. However, during the course of  our audit, we found that CMS does not have documented procedures  instructing its personnel to continue running these checks regularly.
As mentioned earlier, CMS also did not provide us with documentation on  the feasibility for using other existing resources and tools for checking for  Medicaid and CHIP coverage in all FFM states. As such, we were unable  to evaluate CMS’s assessment to determine whether CMS reviewed the  feasibility of all existing resources, such as the Public Assistance  Reporting Information System (PARIS). States can use PARIS to  identify duplicate Medicaid coverage across other states. CMS officials  told us that they have not studied the feasibility of using PARIS for the  advance PTC program.
CMS also did not properly design procedures related to (1) periodically  verifying that individuals with advance PTC provided to issuers on their  behalf did not begin receiving other government-sponsored health care  coverage after enrollment, such as Medicare or Department of Veterans  Affairs health benefits, and (2) terminating advance PTC for individuals  who have such coverage. CMS officials told us that they have established  a process to check individuals enrolled in the FFM for Medicare coverage  and to send notices to them if there is a match. However, CMS officials  stated that they do not terminate advance PTC for such individuals. In  addition, CMS officials stated that when individuals update their FFM  applications, CMS checks those individuals’ marketplace applications for  duplicate government-sponsored health coverage. However, individuals  may not update their applications if they elect to auto reenroll into plans.  In such instances, CMS does not have mechanisms to terminate advance  PTC for individuals who obtain or gain access to duplicative government- sponsored coverage.
In addition, CMS does not conduct any periodic checks during the year to  determine if any individuals have subsequently died. According to CMS  officials, when individuals stop paying their premiums, such as in the case  of death, there is a 90-day grace period, as required by PPACA, after  which the individuals’ policies would be canceled for failure to pay  premiums. Thus, under the grace periods, CMS pays up to 3 months of  additional advance PTC after individuals have died unless it is otherwise  reported to their insurers. CMS officials told us that following the end of  the grace periods and subsequent issuer terminations for failure to pay  premiums, CMS retroactively recoups 2 of the 3 months of excess  advance PTC by adjusting subsequent payments to issuers following the  normal process that governs grace periods.
Internal control standards state that management should use quality  information to achieve the entity’s objectives. In addition, these  standards also state that management should design control activities to  achieve objectives and respond to risks. Without establishing proper  procedures to periodically check for changes in circumstances, such as  individuals’ eligibility for government-sponsored coverage or their deaths,  CMS is at increased risk of providing advance PTC on behalf of  individuals who are not eligible for it.
section_title: Verifying Compliance with Tax Filing Requirements
paragraphs: CMS did not properly design procedures related to timely terminating  advance PTC for individuals who have not filed the required federal  income tax returns. Under federal regulations, marketplaces must  discontinue advance PTC for individuals who did not comply with the  requirement to file a federal income tax return and reconcile the advance  PTC.
CMS allowed 2014 advance PTC recipients to attest as to whether they  had filed a 2014 tax return when making FFM eligibility determinations for  2016. CMS offered individuals the opportunity to attest they made the  proper tax filing, followed by CMS post-approval checks of IRS data. CMS  officials stated that they selected this approach in order to prevent  erroneous advance PTC terminations because of delays in IRS  processing and availability of filing data from IRS at the time of application  review. However, CMS’s process for verifying individual attestation and  termination of individuals who did not file tax returns was not documented  in its procedures. CMS officials told us that they had terminated advance  PTC in November 2016 for individuals who IRS indicated had not filed  2014 tax returns. As a result, the marketplaces continued to pay advance  PTC on behalf of those individuals for over three-quarters of plan year  2016 despite their not filing the required tax returns to reconcile their  advance PTC.
In September 2016, IRS also began sending data to CMS on individuals  or members of tax households on whose behalf CMS provided advance  PTC but who did not file the required Form 8962, Premium Tax Credit,  with their tax returns. The form is used to reconcile advance PTC  amounts with the final PTC amounts. CMS did not terminate advance  PTC for individuals who filed their tax returns but did not reconcile using  Form 8962. However, CMS officials told us that they plan to terminate  advance PTC for those who file but do not reconcile in the future.
Internal control standards state that management should use quality  information to achieve the entity’s objectives. In addition, these  standards also state that management should design control activities to  achieve objectives and respond to risks.
Without designing and implementing policies and procedures related to  preventing and detecting advance PTC to individuals who do not comply  with tax filing requirements, including those who do not file Form 8962,  CMS increases the risk that advance PTC will not be terminated on a  timely basis. Further, the federal government is missing opportunities to  recover overpayments of advance PTC as part of the IRS PTC  reconciliation process. For example, as of October 2016, approximately 1  million households still had not filed the required Form 8962 with their  2014 tax returns. However, these households had approximately $2.9  billion in advance PTC paid on their behalf in 2014. Furthermore, without  the required Form 8962 from individuals who received advance PTC, IRS  cannot identify potential underpayments or overpayments of advance  PTC.
section_title: Verifying Major Life Changes That Qualify Individuals to Enroll Outside of the Open Enrollment Period
paragraphs: Individuals are generally only allowed to enroll in qualified health plans  during the open enrollment period. However, special enrollment periods  provide an opportunity for individuals who lose health insurance coverage  during the year or experience certain major life changes to enroll in a  qualified health plan through the marketplaces outside of the annual open  enrollment period. Examples of major life changes include the loss of  minimum essential coverage, permanent move of residence, birth of a  child, and marriage.
Beginning in June 2016, individuals who qualified to enroll during special  enrollment periods were asked to provide documentation to substantiate  certain life changes. However, during the period of our audit, CMS  procedures did not require the verification of major life changes using  applicant-submitted documentation.
CMS officials told us that there is no specific legal provision that requires  federal and state marketplaces to verify events that trigger special  enrollment periods. However, in 2016, HHS conducted a study to confirm  consumers’ eligibility for special enrollment periods based on a review of  documentation submitted for a sample of special enrollment periods  granted during coverage year 2016. In April 2017, CMS issued a  regulation to take effect on June 19, 2017, stating, among other things,  that the federal marketplace will begin performing pre-enrollment  verification of life changes for special enrollment periods. In the  regulation, CMS stated that pre-enrollment verification of special  enrollment periods will be phased in, focusing first on the categories with  the highest volume and of most concern—such as loss of minimum  essential coverage, permanent move, Medicaid or CHIP denial, marriage,  and adoption. However, CMS has not yet designed and implemented  procedures for its contractor to implement this verification process.
Internal control standards state that management should use quality  information to achieve the entity’s objectives. Accordingly, management  should obtain relevant data from reliable internal and external sources in  a timely manner based on the identified information requirements for  achieving the entity’s objectives and address risks. Management  evaluates these data for reliability, obtains them on a timely basis so that  they can be used for effective monitoring, and processes the obtained  data into quality information to support the internal control system. In  addition, these standards state that management should design control  activities to achieve objectives and respond to risks.
Without verifying and documenting events that trigger eligibility for  enrollments during special enrollment periods, CMS may provide advance  PTC and health care coverage to individuals who are not eligible to enroll  outside of the annual open enrollment period. In addition, individuals may  be able to receive health care coverage for sickness or injuries  inappropriately because they received coverage outside of the open  enrollment period by providing false information to the FFM related to a  special enrollment period event. For example, in November 2016, we  reported that the FFM and selected state-based marketplaces approved  health insurance coverage and advance PTC for 9 of 12 of GAO’s  fictitious applications made during a 2016 special enrollment period. For 5  applicants, GAO provided no documents to support the special enrollment  period triggering event, but CMS approved the coverage.
section_title: CMS’s Key Control Activities Related to the Accuracy of Advance PTC Calculations Based on Income and Family Size Are Not Properly Designed
paragraphs: Individuals must meet income requirements in order to qualify for  advance PTC. Specifically, individuals are expected to have household  incomes equal to or between 100 and 400 percent of the federal poverty  level for their given family size to be eligible for advance PTC.
Although CMS designed procedures related to detecting potentially  understated income amounts, its procedures do not include verifying  income amounts that may be overstated. Specifically, CMS does not  check for potentially overstated income amounts, despite the risk that  individuals may do so in order to qualify for advance PTC. This risk is  increased for states that did not expand Medicaid coverage to individuals  who make less than 100 percent of the federal poverty level. To receive  subsidized health care coverage in these states, individuals could  overstate their income to at least 100 percent of the federal poverty level  to ensure that they qualify for advance PTC. According to CMS officials,  they did not check for potentially overstated income amounts because  federal regulations allow CMS to accept individuals’ attestations when  attested income amounts are higher than those in IRS data. However, by  not checking potentially overstated income amounts, CMS may be  improperly providing advance PTC to issuers on behalf of individuals not  eligible for the benefit.
Along with income, family size has a direct relationship to the amount of  advance PTC for which enrollees are eligible. As family size increases,  the percentage of the federal poverty level for that household to be  eligible for the maximum amount of PTC decreases, thereby affecting the  advance PTC amount. IRS provides CMS with household income and  family size information for enrollees requesting eligibility determinations  for advance PTC. However, when the family size provided by an enrollee  does not match the family size shown in IRS records, CMS does not  generate an inconsistency. CMS accepts applicant attestations without  further verification. CMS officials also told us that it could be challenging  to verify family size information with documentation from individuals.
However, CMS could use federal income tax returns and other supporting  documentation to substantiate family sizes.
Internal control standards state that management should use quality  information to achieve the entity’s objectives. Management obtains  relevant data from reliable sources. Relevant data have a logical  connection with, or bearing upon, the identified information requirements.  Reliable sources provide data that are reasonably free from error and  bias and faithfully represent what they purport to represent. Internal  control standards also state that management should design control  activities to achieve objectives and respond to risks.
Without proper procedures for verifying incomes and family sizes, CMS’s  risk of providing advance PTC on behalf of individuals who do not meet  the minimum income eligibility requirements—including those who may  purposefully misstate their incomes or family sizes in order to become  eligible for advance PTC—is increased. For example, in our testing of 93  applications, we found 11 applications for individuals residing in states  that did not expand Medicaid and for which the modified adjusted gross  incomes for those households were less than 100 percent of the federal  poverty level, according to data that IRS provided to CMS during  application review. While some of these individuals may have earned  additional income, they may have also overstated their incomes on their  applications to become eligible for coverage and advance PTC. However,  CMS did not check for potential overstatements of income amounts and  generate inconsistencies to resolve such potential overstatements.
section_title: CMS Properly Designed and Implemented Control Activities Related to the Accuracy of Advance PTC Payments Made to Certified Issuers and Qualified Health Plans
paragraphs: Based on our audit work, CMS has properly designed and implemented  procedures related to the accuracy of advance PTC to reasonably assure  that payments made to issuers and qualified health plans comply with  applicable requirements, including procedures to generate accurate policy-based payments to issuers based on properly review and approve of issuer payment calculations and perform compliance reviews to help ensure that issuers and qualified  health plans meet applicable requirements of the marketplace; and notify issuers of noncompliance and decertify those that do not meet  key requirements.
As discussed earlier, we did not test whether the control activities for  making payments to issuers were operating as designed because such  payments include other aggregated costs and adjustments, such as cost- sharing reductions and user fees, which were outside the scope of this  audit.
section_title: IRS’s Control Activities Related to PTC Were Not Properly Designed and Implemented
paragraphs: IRS control activities were not properly designed and implemented to help  achieve management objectives related to preventing and detecting  improper payments of PTC. Specifically, we found deficiencies in the  design of IRS control activities related to determining whether individuals met the citizenship or lawful presence requirement for PTC eligibility; had access to or enrollment in health care coverage that met  minimum essential coverage, which would allow individuals to obtain  PTC for the months that were not covered; properly assessed individual shared responsibility payments (SRP) on  their tax returns; and were properly notified of the requirement to file if they did not file their  tax returns.
IRS faces several challenges that affect its ability to design and  implement control activities related to PTC. These challenges include the  timeliness and availability of key income data to verify taxpayers’ PTC  claims, resource constraints in identifying tax returns for further review,  and statutory limitations for automatically correcting tax returns and  recovering excess advance PTC repayments.
We did not evaluate whether all control activities related to preventing and  detecting improper payments of PTC were operating as designed or  evaluate other internal control components, such as control environment.  Deficiencies, if any, in the internal control components that were not  evaluated could further impair the overall effectiveness of IRS’s control  activities related to preventing and detecting improper payments in the  PTC program. (See fig. 5.)
subsections: section_title: IRS Is Unable to Design and Implement Control Activities to Verify Whether Individuals Meet the Citizenship or Lawful Presence Eligibility Requirement
paragraphs: To qualify for PTC, individuals must be U.S. citizens or nationals, or  otherwise lawfully present in the United States. All advance PTC for  those not lawfully present must be reported on tax returns and repaid in  full regardless of income level. As such, individuals are not entitled to  PTC for any period during which they are not lawfully present in the  United States.
IRS officials told us that IRS does not perform compliance checks to  verify eligibility based on individuals’ citizenship or lawful presence status.  IRS officials stated that they rely on the state and federal marketplaces to  determine whether the individuals met citizenship or lawful presence  eligibility requirements. If IRS receives enrollment information from the  state or federal marketplaces, IRS presumes that individuals met  citizenship or lawful presence requirements.
While information that IRS receives from state and federal marketplaces  may be effective in determining whether individuals met citizenship and  lawful presence requirements for PTC, it does not address situations  when state or federal marketplaces conditionally provided advance PTC  on behalf of individuals but subsequently terminated advance PTC  payments because of failure to prove citizenship or lawful presence.  Specifically, PPACA’s implementing regulations allow individuals 95 days  to provide supporting information to the marketplace when the  marketplace is unable to verify that the individuals met enrollment or  advance PTC requirements for citizenship or lawful presence.  Consequently such individuals’ attested information qualifies them to be  conditionally eligible for advance PTC during this inconsistency period. At  the end of the inconsistency period, the marketplace is required to  terminate advance PTC for individuals who did not resolve their  inconsistencies related to citizenship or lawful presence.
Treasury regulations do not require the marketplaces to provide IRS with  the reasons for terminating health care coverage or advance PTC for  individuals. Because of this, the marketplaces do not report advance PTC  payment terminations to IRS for individuals who do not meet the  citizenship or lawful presence eligibility requirements when the  marketplaces make final determinations at the end of the inconsistency  periods.
Internal control standards state that management should externally  communicate the necessary quality information to achieve the entity’s  objectives. As part of this standard, management should obtain quality  information to reasonably assure that internal control objectives—such as  necessary data to verify citizenship information or legal presence  requirements for PTC—are achieved.
Because Treasury does not require the state or federal marketplaces to  provide information on individuals who do not meet the citizenship or  lawful presence requirements, IRS has not established a mechanism to  identify that individuals claiming PTC meet this key PTC eligibility  requirement. Further, according to IRS officials, they have not assessed  the feasibility of obtaining such information from the marketplaces and  incorporating such information into their processes. The volume and  dollar amount of advance PTC paid on behalf of individuals whose  coverage was terminated for citizenship or lawful presence requirements  can be significant. In our February 2016 report, we found that for the  first enrollment period, CMS terminated about 65,000 policies from the  marketplaces because individuals did not resolve their citizenship or  lawful presence issues. Over $130 million in advance PTC was paid on  behalf of these individuals. Thus, without access to the data needed to  verify citizenship or lawful presence eligibility requirements for individuals,  IRS may be missing opportunities to prevent potentially significant  improper payments of PTC.
section_title: IRS Control Activities Related to Checking for Health Care Coverage Were Not Properly Designed and Implemented
paragraphs: IRS has not properly designed and implemented key control activities to  perform the necessary post-refund checks routinely to identify individuals  who are not eligible for claimed PTC amounts because of either duplicate  health care coverage or availability of coverage from employers or  government-sponsored programs. IRS officials stated that IRS  examiners, using internal and external information systems, may check  Forms 1095-B, Health Coverage, and 1095-C, Employer-Provided Health  Insurance Offer and Coverage, filed for the individuals as part of their  general examination procedures to verify all insurance coverage in and  out of the marketplace. IRS officials stated that they rely on tax  examiners’ judgment to evaluate available data and determine whether  the presence or absence of a particular item on a tax return represents a  potential issue. IRS developed a checklist that examiners could use in  reviewing tax returns for duplicate coverage and SRP and included this  checklist in the program used by the postcompliance units. However, IRS  did not incorporate the checklist or instructions to use the checklist in the  IRM to require its use as part of the routine procedures that examiners in  the postcompliance units perform regularly.
Internal control standards state that management should design control  activities to achieve objectives and respond to risks. Control activities  are the policies, procedures, and other mechanisms that enforce  management’s directives to achieve the entity’s objectives and address  related risks.
IRS officials stated that they are reviewing the potential compliance issue  related to duplicate health insurance coverage for post-refund compliance  checks. IRS officials also stated that they have requested research data  on the level of noncompliance for tax year 2015 and that these data will  be evaluated to determine what, if any, post-refund actions are needed.  Without routinely performing post-refund checks on individuals’ health  insurance coverage from employers or government-sponsored health  care plans, IRS is vulnerable to improperly providing PTC to ineligible  recipients. The effect of IRS’s lack of routine post-refund checks on  individuals’ health insurance coverage from employers or government- sponsored health care plans was illustrated in our review of a statistical  sample of 93 tax returns with PTC-related amounts during the first 9  months of fiscal year 2016. Based on our testing, the number of  individuals who inappropriately received PTC because of their eligibility  for or receipt of minimum essential coverage outside of the marketplace  could be significant. In our statistical sample of 93 PTC-related  transactions for the first 9 months of fiscal year 2016, we found 7 cases in  which the individuals or members of their households received subsidized  coverage from the marketplaces and at the same time also had coverage  through employer- or government-sponsored health care plans for at least  1 month during the year.
section_title: IRS Control Activities Related to Verifying SRP Compliance Were Not Properly Designed and Implemented
paragraphs: IRS also does not have properly designed and implemented key control  activities to perform the necessary post-refund checks to identify  individuals who did not have health care coverage for the entire year and  did not comply with SRP requirements. In our statistical sample of 93  tax returns, we found that in 17 cases the individuals or all the members  of their tax households did not have qualifying health care coverage for  the entire year or an exemption from health care coverage for some of the  months or for the entire year. For those returns, the individuals did not  pay the required SRP for the months without coverage and IRS did not  assess SRPs for those individuals who did not have qualifying health care  coverage or have coverage exemptions for the entire year. Without  properly designed and implemented key control activities to perform the  necessary post-refund checks of SRPs, IRS may not always consistently  and equitably assess and collect the SRP.
section_title: IRS Is Unable to Design and Implement Control Activities to Verify Individuals’ Income for Calculating PTC-Related Amounts Prior to Issuing Refunds
paragraphs: IRS’s ability to verify taxpayer-reported income prior to issuing tax refunds  is limited because some deadlines for third parties to report key aspects  of taxpayer income fall late in the tax filing season. As such, IRS does  not timely receive complete income information, which impedes IRS’s  ability to design control activities for verifying PTC calculations prior to  issuing tax refunds. IRS’s challenge in verifying income before issuing  refunds is not unique to PTC; it is an inherent risk with the tax  administration processes in which refunds are issued before all  compliance checks are completed. While IRS receives some income  information from third parties—such as wage information from  employers—by mid-February, IRS may not receive other key income  information returns necessary for verifying income until later in the tax  filing season. For example, Form 1099-INT, Interest Income, can be filed  electronically to IRS as late as March 31, which is well into the tax filing  season and too late for IRS to use for checking income reporting  compliance during pre-refund processing of tax returns. Because of the  timing of third parties’ submission of comprehensive information to IRS,  IRS may not detect taxpayer misreporting of income before issuing  refunds, which could result in improper PTC payments. As a result, IRS  must rely on post-refund checks to identify any taxpayer misreporting of  income after the filing season.
section_title: IRS Is Unable to Design and Implement Control Activities to Identify Tax Returns That Contain Errors for Further Review
paragraphs: IRS is unable to identify all tax returns that contain PTC-related errors for  further review by its tax examiners. Since 2011, IRS has faced budget  reductions. These budget reductions have heightened the importance of  determining how best to allocate declining resources for IRS to  reasonably assure that it can meet agency-wide strategic goals for  increasing individual compliance, using resources more efficiently, and  minimizing individual burden. As a result, IRS officials told us that IRS has  prioritized its limited resources to design and implement cost-effective  PTC-related key procedures to reasonably assure that it is focused on  issues that may represent the greatest financial exposure to the  government. To do this, IRS established dollar thresholds to limit the  number of tax returns with PTC-related amounts for additional reviews by  IRS examiners, as it does in other types of tax administration. As a result,  IRS does not review all tax returns that may contain errors but continues  to process tax returns that have the PTC exposure amount below certain  threshold amounts without any adjustments or further reviews by tax  examiners.
We evaluated IRS’s procedures related to the PTC processing dollar  thresholds and found that IRS’s use of dollar thresholds was operating as  designed during the time period of testing. However, because IRS uses  dollar thresholds to limit the number of individual federal income tax returns reviewed by examiners, it does not pursue errors in overstated or  understated PTC amounts below the thresholds.
Although the focus was not on PTC, we reported in 2016 that IRS lacked  a comprehensive strategy for its refundable tax credit compliance  efforts. In this report, we stated that IRS was working on a strategy to  document current compliance efforts and identify and evaluate potential  new solutions to address improper payments; however, its analysis  focused on efforts to improve Earned Income Tax Credit compliance and  did not include other refundable tax credits. As a result, we recommended  that IRS develop a comprehensive operational strategy that includes all  refundable tax credits. IRS agreed with the recommendation and stated  that it is working on developing a comprehensive strategy to address  compliance and improper payments related to its refundable tax credit  programs, including PTC.
section_title: IRS Is Unable to Design and Implement Control Activities to Correct PTC- Related Errors on Tax Returns Prior to Issuing Refunds
paragraphs: A key control activity for IRS is correcting inaccuracies in individuals’ PTC  calculations. IRS does this by corresponding with individuals, suspending  the tax returns, or using its statutory math error authority. Based on  statistical sample of 93 individual federal income tax returns with PTC- related amounts from October 2015 to June 2016, we found that IRS (1)  appropriately suspended the tax returns and corresponded with  individuals to resolve PTC-related issues and errors on the tax returns  and (2) accurately calculated and processed PTC-related amounts in  cases within its statutory authority.
IRS cannot always correct individuals’ inaccuracies that it identifies while  processing tax returns. As we previously reported, in cases where  individuals do not reconcile advance PTC, IRS does not have the  authority to automatically correct the tax returns and notify the individuals  of the changes. In other circumstances, IRS has statutory math error  authority to fix easily correctable calculation errors and check for other  obvious noncompliance in limited circumstances. However, in cases of a discrepancy with marketplace data, such as differences in amounts of  advance PTC reported by individuals on their Forms 8962, IRS does not  have the authority to automatically correct the tax returns and notify  individuals of the changes. According to IRS officials, having the authority  to correct PTC errors related to discrepancies with marketplace data  would allow IRS to process returns more quickly without having to  correspond with the individuals or expend further resources to audit their  compliance.
In 2015, we suggested that IRS seek legislative authority to correct tax  returns at filing based on the marketplace data. Correctable-error  authority could help IRS meet its goals: processing tax returns timely,  providing individuals with refunds more quickly, and reducing the burden  on individuals of responding to IRS correspondence. It can also reduce  the need for IRS to resolve discrepancies in post-filing compliance, which,  as we previously concluded, is less effective and more costly than at filing  compliance. For each year beginning with fiscal year 2015, Treasury  has submitted legislative proposals that among other things, would  establish a category of correctable errors. Under the proposals, Treasury  would be granted regulatory authority to permit IRS to correct errors in  cases where information provided by individuals does not match  corresponding information in government databases. As of the  completion of our audit, Congress has not yet granted this broad  authority.
The effect of IRS’s lack of authority to correct PTC-related errors on tax  returns at filing was illustrated in our review of a statistical sample of 93  tax returns with PTC-related amounts during the first 9 months of fiscal  year 2016. We found that for 6 of the 93 sample cases, the individuals did  not submit the required Forms 8962 to reconcile PTC, when marketplace  data indicated that these individuals had advance PTC paid on their  behalf. In addition, for an additional 2 of the 93 cases, the individuals reported different amounts on their Forms 8962 than what the  marketplace data indicated. For these 8 out of 93 cases, IRS issued  refunds to the individuals without adjusting the refund amounts for the  PTC-related differences. Thus, without the ability to automatically  correct the tax returns, IRS is not able to fully collect excess advance  PTC overpayments and reimburse PTC underpayments.
section_title: IRS Is Unable to Design and Implement Control Activities for Recovering Excess Advance PTC Repayment Amounts
paragraphs: IRS cannot design control activities to recover all excess advance PTC  repayment amounts. Marketplaces determine the amounts of advance  PTC for which individuals are eligible, in part, based on each applicant’s  anticipated household income for the year. The PTC amount is based on  actual income reported when individuals file income tax returns. If the  amounts of advance PTC paid on behalf of individuals are greater than  the amounts final PTC claimed on their tax returns, then the individuals  must repay excess advance PTC. However, federal law limits the amount  of excess advance PTC overpayments that individuals must repay, based  on their household incomes as a percentage of the federal poverty level  and filing status. As a result, IRS is prohibited from recovering the full  amount of excess advance PTC payments that may otherwise be due  from individuals. (See table 1.) According to IRS, for fiscal year 2016,  individuals had over $800 million in excess advance PTC that they were  not required to repay because of repayment limitations. Under current  federal law, IRS will continue to only recover the excess advance PTC  repayment amounts up to the statutory repayment limitation.
section_title: IRS Control Activities Related to Notifying Nonfilers of the Requirement to File Tax Returns Were Not Properly Designed and Implemented
paragraphs: IRS did not properly design control activities that notified nonfilers of the  requirement to file tax returns. We found that in 2015 and 2016, IRS  used an ad hoc process to send notices to individuals who had advance  PTC paid on their behalf during the previous calendar year and failed to  file tax returns and to those who requested an extension to file. The  notices alerted the individuals of the requirement to file a tax return and  reconcile the advance PTC and warned that the failure to file could result  in the loss of advance PTC for the following calendar year. However, IRS  did not design policies and procedures for sending these notices  regularly. According to IRS officials, IRS has not decided whether sending  notices will be an ongoing process. IRS officials stated that if it becomes  an ongoing process, then IRS will likely develop policies and procedures  for sending these notices.
Internal control standards state that management should design control  activities to achieve objectives and respond to risks. Control activities  are the policies, procedures, and other mechanisms that enforce  management’s directives to achieve the entity’s objectives and address  related risks.
Without such policies and procedures in place, there is an increased risk  that the ad hoc notification process will not be followed consistently in  each filing season. As a result, individuals may be at risk for losing their  subsidized health care coverage from the marketplaces in the future  because they were not aware of the requirement to file their tax returns  and reconcile the advance PTC since there is a year’s interval between  when individuals first apply for advance PTC and when they are  supposed to reconcile it on their tax returns. In addition, without an  assessment or claim being made by individuals through tax return filing,  the federal government may not be fully collecting on excess advance  PTC that may be owed or pay any additional PTC that is due to  individuals. Individuals’ claims are especially important because, as  discussed later, IRS currently does not have the system capability to use  marketplace data to calculate PTC through the Automated Substitute for  Return (ASFR) program. Until IRS incorporates marketplace data into its  automated process, this notification process will be key to identifying and  collecting any overpayments of advance PTC made for individuals who  did not file their tax returns.
section_title: IRS Is Unable to Design and Implement Control Activities for Preparing Tax Returns with PTC Information for Nonfilers
paragraphs: IRS was unable to incorporate PTC information in the ASFR program, a  key process for preparing substitute tax returns for individuals who did not  file. IRS has the authority to prepare a tax return for a nonfiling individual  if the individual appears to be liable for the return and the individual  required to file the return either does not file it or instead files a false,  fraudulent, or frivolous return. IRS exercises this authority through its  ASFR program. If IRS is unable to secure a valid income tax return from  an individual, the ASFR program automatically estimates the tax liability  by computing the individual’s tax, penalties, and interest, based on third- party and other available information in its systems.
However, IRS officials stated that IRS faces challenges in incorporating  the PTC program into the ASFR program. Specifically, the ASFR program  does not have the PTC calculators necessary to calculate the PTC  amounts. The program does consider PTC-related information in  determining whether a substitute for return (SFR) should be created or in  calculating taxes owed when an SFR is created for an individual for other  reasons. Thus, IRS cannot automatically prepare the Form 8962 or  calculate PTC for non-filing individuals who had advance PTC paid on  their behalf.
IRS officials stated that they recognize the lack of PTC-related  calculations in the ASFR program as a gap in the collection mechanism.  However, IRS officials told us that they did not have the budgetary  resources to incorporate the complex calculations into the agency-wide  ASFR program in 2016. Without incorporating this important programming  change, IRS may not be able to recover the full extent of excess advance  PTC amounts. IRS officials stated that they will consider incorporating this  programming change in the ASFR program in the future subject to  budgetary resource availability.
section_title: Conclusions
paragraphs: Preventing and detecting improper payments in the PTC programs is a  complex undertaking. In fiscal year 2016, CMS assessed its PTC  program as susceptible to significant improper payments, in accordance  with IPIA and OMB requirements. However, CMS did not provide a  specific, expeditious time frame for complying with statutory requirements  to estimate and report on improper payments related to the program. As a  result, HHS’s overall improper payment estimate will continue to be  understated. In addition, Congress and other stakeholders will continue to  lack key payment integrity information for monitoring HHS’s improper  payments.
IRS did not assess the susceptibility of its PTC program in a manner  consistent with IPIA requirements. Specifically, IRS did not include all  types of errors that result in improper payments within the scope of its  assessment and did not assess whether its PTC program met the  applicable statutory thresholds for susceptibility to significant improper  payments, as required by IPIA. Without estimating and reporting improper  payments, IRS and external stakeholders, such as Congress, may not be  able to fully assess the extent to which payment integrity objectives for  the program are achieved.
Although CMS properly designed and implemented control activities  related to the verification of citizenship and lawful presence and the  accuracy of advance PTC payments, it did not properly design other  control activities related to preventing and detecting improper payments  of advance PTC. CMS often relies on insufficient, unreliable, and  incomplete information for ensuring eligibility for advance PTC and  accurately calculating the amounts of advance PTC. By not obtaining  relevant data from reliable sources in a timely manner to meet the  identified information requirements, and establishing procedures to verify  eligibility of enrollees and the accuracy of advance PTC, CMS cannot  reasonably assure that its payment integrity objectives are achieved.
IRS did not properly design and implement certain key control activities  related to preventing and detecting PTC improper payments, including  recovering excess advance PTC overpayments. While IRS may not  receive key information from marketplaces to identify individuals who did  not demonstrate that they met citizenship or lawful presence  requirements, IRS has not assessed the feasibility of requiring such  information from the marketplaces and incorporating such information in  its processes to recover advance PTC made for those individuals. In  addition, IRS lacks certain key procedures to verify health care coverage  on individuals routinely during its post-filing compliance checks. Without  such checks, IRS may be missing opportunities to identify individuals who  are not eligible for PTC because they can obtain health care coverage  outside of the marketplaces or identify individuals who did not properly  report their SRPs on their income tax returns. Finally, although IRS used  an ad hoc process for notifying nonfilers of the requirement to file tax  returns, IRS did not establish procedures for sending these notices  regularly during each filing season to facilitate compliance. Without  addressing these key deficiencies in control activities, IRS is at increased  risk of making improper payments to individuals and may not be fully  collecting excess advance PTC or reimbursing PTC underpayments.
IRS also faces data limitations, such as the availability of key income  information from third parties, and statutory challenges that impede its  ability to prevent improper payments, recover excess payments of  advance PTC, and reimburse underpayments. For instance, in cases of  discrepancies with marketplace data, IRS does not have the authority to  automatically correct the tax returns and notify the taxpayers of the  changes. In addition, there are statutory repayment limitations on the  amount of excess advance PTC that taxpayers are required to return to  the government. As a result, opportunities to recover PTC improper  payments are limited in these areas unless statutory changes are made.  In addition, resource constraints necessitate IRS making difficult  decisions about how best to use its resources to identify taxpayer  noncompliance and set objectives related to preventing and detecting  improper payments for the PTC program. In 2016, we recommended that  IRS develop a comprehensive operational strategy that includes all  refundable tax credits for which IRS is responsible. Implementing our  2016 recommendation could help IRS determine whether its current  allocation of resources for PTC is optimal and, if not, what adjustments  may be needed.
section_title: Recommendations for Executive Action
paragraphs: To improve annual reporting on PTC improper payments, control activities  related to eligibility determinations, and calculations of advance PTC, we  recommend that the Secretary of Health and Human Services direct the  Administrator of CMS to take the following 10 actions:  1.  Annually report improper payment estimates and error rates for the  advance PTC program.  2.  Until annual reporting of improper payment estimates and error rates  for the advance PTC program is performed, disclose significant  matters relating to IPIA estimation, compliance, and reporting  objectives for the advance PTC program in the agency financial  report, including CMS’s progress and timeline for expediting the  achievement of those objectives and the basis for any delays in  meeting IPIA requirements.  3.  Design and implement procedures for verifying the identities of phone  and mail applicants to reasonably assure that ineligible individuals are  not enrolled in qualified health plans in the marketplaces or provided  advance PTC.  4.  Assess and document the feasibility and availability of obtaining  sufficiently reliable data to verify individuals’ residencies and lack of  minimum essential coverage from nonfederal employers and, if  appropriate, design and implement procedures for using such data in  its verification processes.  5.  Design and implement procedures for sending notices to nonfederal  employers routinely and terminating advance PTC for individuals who  have access to minimum essential coverage from their employers.  6.  Assess and document the feasibility of approaches for (1) identifying  duplicate government-sponsored coverage for individuals receiving  Medicaid and CHIP coverage in FFM states outside of the states  where they attest to residing and (2) periodically verifying individuals’  continued eligibility by working with other government agencies to  identify changes in life circumstances that affect advance PTC  eligibility—such as commencement of duplicate coverage or deaths— that may occur during the plan year and, if appropriate, design and  implement these verification processes.  7.  Assess and document the feasibility of approaches for terminating  advance PTC on a timelier basis and, as appropriate, design and  implement procedures for improving the timeliness of terminations.  8.  Design and implement procedures for verifying compliance with  applicable tax filing requirements—including the filing of the federal  tax return and the Form 8962, Premium Tax Credit—necessary for  individuals to continue to be eligible for advance PTC.  9.  Design and implement procedures for verifying major life changes  using documentation submitted by applicants enrolling during special  enrollment periods.  10. Design and implement procedures for verifying with IRS (1) household  incomes, when attested income amounts significantly exceed income  amounts reported by IRS or other third-party sources, and (2) family  sizes.
To comply with improper payments reporting requirements and improve  procedures related to processing PTC information on tax returns, we  recommend that the Commissioner of Internal Revenue direct the  appropriate officials to take the following 5 actions:  1.  Assess the program against applicable IPIA-defined thresholds and  conclude on its susceptibility to significant improper payments, and  revise the scope of its improper payments susceptibility assessment  for the PTC program to include instances in which advance PTC is  greater than or equal to the amount of PTC claimed on the tax return.  If the program meets the IPIA definition for being susceptible to  significant improper payments based on this assessment, estimate  and report improper payments associated with the PTC program  consistent with IPIA requirements.  2.  Assess and document the feasibility of approaches for incorporating  information from the marketplaces on individuals who did not  demonstrate that they met the eligibility requirements for citizenship or  lawful presence in the tax compliance process. If determined feasible,  IRS should work with Treasury to require marketplaces to periodically  provide such information on individuals and use such information to  recover advance PTC made for those individuals.  3.  Assess whether IRS should require its examiners to verify health care  coverage of individuals to determine eligibility for PTC. To do this, IRS  should complete its evaluation of the level of noncompliance related to  duplicate health insurance coverage. Based on this evaluation and if  cost effective, IRS should design and implement formal policies and  procedures to routinely identify individuals inappropriately receiving  PTC because of their eligibility for or enrollment in health care  programs outside of the marketplaces and notify such individuals of  their ineligibility for PTC.  4.  Design and implement procedures in the IRM for examiners in the  post-filing compliance units to review tax returns for health insurance  coverage for the entire year, and to identify and assess individual  SRPs from those who are not appropriately reporting SRPs on their  tax returns.  5.  Design and implement procedures in the IRM to regularly notify  nonfilers of the requirement to file tax returns in order to continue to  receive advance PTC in the future.
section_title: Agency Comments and Our Evaluation
paragraphs: We provided a draft of this report to HHS, IRS, and OMB for comment. In  its comments, reproduced in appendix III, HHS concurred with seven of  our recommendations and neither agreed nor disagreed with the  remaining three recommendations.  In its comments, reproduced in  appendix IV, IRS agreed with two recommendations, partially agreed with  two other recommendations, and disagreed with the remaining  recommendation.  OMB’s liaison to GAO stated in an e-mail that OMB  had no comments on the report. HHS and IRS also provided technical  comments, which we incorporated as appropriate.
subsections: section_title: Health and Human Services
paragraphs: In its comments, HHS stated that it is committed to ensuring access to  high quality healthcare for all Americans by verifying the eligibility of  consumers who apply for enrollment in qualified health plans through a  marketplace and providing coverage to eligible individuals.  HHS stated  that it takes seriously its responsibilities to protect taxpayer funds while  reducing the burden on consumers, employers, and other individuals and  entities involved in the marketplace and other insurance affordability  programs. In its response, HHS described its initiatives to enhance the  integrity of its program, including conducting a fraud risk assessment for  potential risk in the marketplace and working towards estimating and  reporting improper payments for advance PTC. In addition, HHS  described its process for verification of identity, determination of eligibility  of enrollment through the marketplace, confirmation of individuals’  compliance with tax filing requirements, and payments of advance PTC to  certified issuers. HHS stated that it looked forward to continuing to benefit  from suggestions from GAO and HHS’s Office of Inspector General on  ways to improve its operations so eligible individuals can gain coverage  through the marketplaces and insurance affordability programs in a way  that prevents consumer harm and protects taxpayer money.
HHS stated that it concurred with 7 of our 10 recommendations and  described actions it has taken or plans to take to address these 7  recommendations. Such actions include (1) reporting on its progress in  designing and implementing an improper payment estimate for the  advance PTC program in future agency financial reports, (2) documenting  the feasibility of modifying certain verification procedures, and (3)  verifying key eligibility requirements, such as compliance with tax filing  requirements and changes in life circumstances that qualified applicants  for enrollment during special enrollment periods. The actions by HHS, if  implemented effectively, would address our recommendations.
For the remaining three recommendations, HHS did not state whether or  not they concurred with the recommendations.
In response to our third recommendation regarding verification of filer  identity, HHS stated that for individuals starting a new application via  phone, the call center representatives use verbal attestations for identity  verifications from individuals. HHS stated that for paper applications,  individuals must provide names and complete addresses as well as other  information. In addition, HHS stated that individuals must attest that the  information they provide on all applications is accurate by signing under  penalty of perjury. However, we continue to believe that because CMS  does not validate the identities of individuals who apply by phone or mail,  CMS is vulnerable to enrolling ineligible individuals in qualified health  plans with advance PTC.
For our fifth recommendation on sending notices to nonfederal  employers, HHS stated that it is evaluating its 2016 employer notice  program to determine the best approach for notifying employers in the  future. Such an evaluation may provide useful information; however, we  continue to believe that designing and implementing procedures for  sending notices to nonfederal employers and terminating advance PTC to  individuals with access to employer-sponsored coverage can reduce the  risk of providing advance PTC to issuers on behalf of ineligible  individuals.
In response to our tenth recommendation regarding verification of  household income and family sizes, HHS stated that as part of its  eligibility verification requirements, it verifies consumer-reported income  with data from IRS. However, HHS stated that because household  incomes may fluctuate year to year, it is difficult for consumers to project  income for the year in advance. According to HHS, in instances where  applicant-reported income is higher than the IRS data, HHS accepts the  consumer attestation. However, HHS stated that it will assess the  feasibility and burden on individuals of setting a reasonable threshold for  the generation of annual household income inconsistencies that would  require additional verification for consumer-attested income that  significantly exceeds income amounts reported by IRS or other third party  sources.  We believe that such an evaluation is a reasonable step to  address our recommendation to enhance the effectiveness and efficiency  of the program related to verification of household income. In addition,  HHS stated that it currently accepts attestation when the family size  provided by the individual does not match IRS’s records.  HHS stated that  establishing a process to verify family size with IRS would require  significant operational and privacy complexity.  While we recognize that  there may be certain complexities in the verification of family sizes, it is  important that CMS develop policies and procedures to reasonably  assure that such verifications are made on a regular basis.
section_title: Internal Revenue Service
paragraphs: In its comments, IRS stated that it faces significant challenges  administering refundable tax credits given their complex structural design  and the difficulty in validating eligibility criteria. IRS stated that it also  faces significant challenges in the use of third party and other data to  validate information provided by filers because many potential sources  contain information that is incomplete, out-of-date, or otherwise  unsuitable for use in tax administration. IRS also stated that the  complexity of the law means that not every situation is a matter for simple  adjudication. IRS added that it must take all these factors into account  when designing and implementing pre-filing and post-filing approaches to  tax compliance. IRS also stated that its refundable tax credits may have  compliance-related risks that differ from those associated with other tax  provisions and that administration of these provisions must address these  unique risks. According to IRS, it has committed to OMB that it will  conduct a quantitative analysis of PTC in fiscal year 2018, the first year  that National Research Program data will be available to perform such  analysis.
IRS stated that that it agreed with two of our recommendations, partially  agreed with another two recommendations, and disagreed with the  remaining recommendation.
IRS agreed with our second and third recommendations related to  meeting eligibility requirements for citizenship and identifying individuals  with duplicate health insurance coverage. IRS outlined several actions it  plans to take to address those recommendations. These actions, if  implemented effectively, would address our recommendations.
IRS partially agreed with our first recommendation related to an improper  payment assessment for the PTC program. IRS stated that instances in  which the advance PTC is greater than or equal to the PTC amount  claimed on the tax return do not result in the IRS increasing the outlay  related to PTC and so these occurrences are not subject to IPIA. While  we acknowledge that IRS’s interpretation of the IPIA definition of  “payments” excludes reductions in tax receipts, we nonetheless believe  that these instances should be considered within the scope of the IRS  susceptibility assessment for improper payments. Taxpayers may  inaccurately complete Form 8962 and erroneously report excess advance  PTC on their returns instead of claiming net PTC, or they may simply fail  to report net PTC on their tax returns altogether. Such errors would result  in underpayments of net PTC and therefore affect program outlays and  improper payments. In addition, IPIA defines improper payments to  include both overpayments and underpayments. IRS also stated that it  conducted its fiscal year 2016 PTC improper payment risk assessment  consistent with OMB guidance but will discuss with OMB a future change  to the approach for assessing PTC improper payments as part of a larger  discussion about the administration of refundable tax credits. However,  IRS did not conclude whether or not the program may be susceptible to  significant improper payments. Further, although we found that IRS used  all of the required qualitative risk factors specified in IPIA and OMB  guidance within its assessment, IRS did not analyze how each of the risk  factors affected the susceptibility of the program to significant improper  payments. Until IRS conducts an appropriate assessment consistent with  IPIA and OMB guidance, it will continue to be uncertain about whether it  should estimate the amount of improper PTC payments.
IRS also partially agreed with our fifth recommendation related to  notifying non-filers of the need to file to continue receiving advance PTC.   IRS stated that using a research-based approach to evaluate the 2015  tax filing season, it developed a post-compliance process for sending  notices to individuals who received advance PTC paid on their behalf in  the previous calendar year but failed to file a tax return and also to those  who requested an extension to file. IRS stated that being flexible in its  approach has allowed IRS to refine the process to improve efficiency and  effectiveness. IRS further stated that based on the 2017 research  analysis, IRS will determine whether the information should be included in  an existing IRM. We agree that IRS should review its process to improve  the efficiency and effectiveness of its operations. However, we continue  to believe that designing and implementing procedures to regularly notify  non-filers of the need to file to continue receiving advance PTC  decreases the risk that the ad hoc notification process will not be followed  consistently in each filing season.
IRS disagreed with our fourth recommendation related to reviewing tax  returns to those who are not reporting SRP. However, IRS stated that,  among other things, it has drafted a new IRM section for examiners who  are responsible for reviewing tax returns to determine whether health  insurance is reflected for the taxpayer for the entire year, and for  identifying and assessing SRP on taxpayers who are not appropriately  reporting SRP on their tax returns. IRS stated that the IRM section is  pending approval by Exam Policy. Although IRS stated that it disagreed  with our recommendation, we believe that the actions that IRS described  in its response to our draft report would sufficiently address our  recommendation if implemented effectively.
We are sending copies of this report to the appropriate congressional  committees, the Director of the Office of Management and Budget, the  Secretary of Health and Human Services, the Administrator of the  Centers for Medicare & Medicaid Services, the Commissioner of Internal  Revenue, and other interested parties. In addition, the report is available  at no charge on the GAO website at http://www.gao.gov.
If you or your staff have any questions about this report, please contact  me at (202) 512-2623 or davisbh@gao.gov. Contact points for our Offices  of Congressional Relations and Public Affairs may be found on the last  page of this report. GAO staff who made key contributions to this report  are listed in appendix V.
section_title: Appendix I: Objectives, Scope, and Methodology
paragraphs: The objectives of this report are to determine the extent to which (1) the  Centers for Medicare & Medicaid Services (CMS) and the Internal  Revenue Service (IRS) assessed the susceptibility of their premium tax  credit (PTC) programs to significant improper payments and, if the  programs were deemed susceptible, whether CMS and IRS took actions  required by the Improper Payments Information Act, as amended (IPIA),  and Office of Management and Budget (OMB) guidance; (2) CMS  properly designed and implemented key internal control activities related  to preventing and detecting improper payments of advance PTC; and (3)  IRS properly designed and implemented key control activities related to  preventing improper payments of PTC in processing federal income tax  returns, detecting and recovering advance PTC overpayments made to  issuers on behalf of policyholders, and reimbursing underpayments made  to policyholders. Further, for those key control activities assessed that we  determined were properly designed and implemented, we evaluated the  extent to which they were operating as designed.
To address our first objective, we reviewed improper payments reporting  requirements and guidance, such as that in IPIA and the related guidance  in Appendix C to OMB Circular No. A-123, Requirements for Effective  Estimation and Remediation of Improper Payments, to identify  requirements that agencies must meet to ascertain whether their  programs are susceptible to significant improper payments. We  interviewed key officials from CMS and IRS to gain an understanding of  their processes for implementing IPIA requirements, including how each  of their risk assessments were performed and their plans, if any, to  estimate and report on improper payments related to PTC. We also  analyzed CMS and IRS risk assessments for fiscal year 2016 to  determine whether they were consistent with IPIA and OMB guidance.  Specifically, we examined documentation to determine whether the CMS  and IRS risk assessments (1) considered the qualitative risk factors  specified by the improper payments requirements, (2) provided a basis for  the risk determination, and (3) sufficiently concluded whether the  programs met the criteria for susceptibility for significant improper  payments. In addition, we considered relevant IPIA requirements, OMB  guidance, and Standards for Internal Control in the Federal Government  to assess whether the Departments of Health and Human Services and  the Treasury externally communicated necessary quality information in  their 2016 agency financial reports regarding improper payments for the  PTC programs.
To address our second objective, we first reviewed the Patient Protection  and Affordable Care Act (PPACA), its implementing regulations, relevant  internal control standards, and leading practices for measuring fraud  risks in federal programs. Based on this review, we identified CMS’s  relevant risk areas and the key control activities needed to prevent and  detect improper payments of advance PTC. These control activities  included those related to verifying applicants’ eligibility requirements to  receive advance PTC, accurately determining advance PTC amounts  based on expected household incomes and family sizes, and making  accurate PTC payments to certified issuers for qualified health plans. The  key control activities we selected are those that we viewed as critical for  addressing the various types of key risks that CMS faces that are likely to  result in improper payments of advance PTC.
For this objective, we evaluated CMS’s key control activities related to  CMS’s federally facilitated marketplace (FFM) for plan year 2016. We  selected the FFM because it represented about two-thirds of the states  and about 75 percent of all enrollees receiving advance PTC at the time  of our audit. For our audit, we assessed whether the key control activities  at CMS, both individually and in combination with other control activities,  were properly designed to prevent and detect improper payments of  advance PTC.
We then evaluated the design of these key control activities at CMS by  reviewing CMS policies, procedures, and other relevant documents, such  as interagency agreements and standard operating procedures for  eligibility support workers. We evaluated the key control activities to  determine whether they sufficiently addressed the key risk areas that we  identified by inspecting and analyzing relevant policies and procedures  and directly testing the design of certain controls contained therein using  the sample method described below. For key control activities that we  determined were properly designed, we then performed walk-throughs  and reviewed documents related to the control activities to determine  whether CMS had properly implemented them.
For key control activities that we determined were properly designed and  implemented, we evaluated whether they were operating as designed by  testing a statistically random sample of FFM policyholders with advance  PTC payment transactions from CMS. To evaluate whether such key  control activities at CMS were operating as designed during the FFM’s  PPACA’s 2016 open enrollment period, we obtained all 2016 open  enrollment application transactions, including auto reenrollment  application transactions that had effectuated medical policies from the  FFM that were submitted from November 1, 2015, through February 1,  2016, and resulted in advance PTC. The total population of these  transactions was approximately 5.0 million records. To assess the  reliability of the application data, we (1) interviewed knowledgeable CMS  officials about the quality control procedures the agency had in place  when collecting and creating the data and (2) electronically tested the  data. Based on the results of these procedures, we determined that the  data were sufficiently reliable for our purposes.
From the population of approximately 5.0 million applications, we  randomly selected 93 applications that had effectuated policies according  to CMS records. For these 93 applications, we reviewed CMS records to  determine whether the agency had performed the required internal control  activities related to verifying key eligibility requirements and determining  payments of advance PTC. We also used the random sample to provide  evidence of the effect of providing advance PTC on behalf of individuals  who did not meet the minimum income eligibility requirements. We did not  evaluate whether the control activities related to the accuracy of advance  PTC payments to issuers were operating as designed because such  payments included aggregated costs and adjustments, such as cost- sharing reduction subsidies and user fees, which were outside the scope  of our audit. As a result, the focus of our work in this area was on the  design and implementation of key control activities related to preventing  and detecting improper payments of advance PTC made to issuers.
Similar to our procedures for our second objective, to address our third  objective, we first reviewed PPACA, its implementing regulations, relevant  internal control standards, and leading practices for managing fraud risks  in federal programs. Based on this review, we identified IRS’s relevant  risk areas and the key control activities needed to prevent improper  payments of PTC, including recovering overpayments and reimbursing  underpayments. These key control activities were related to verifying  individuals’ eligibility for PTC, accurately calculating PTC claims,  recovering overpayments (and reimbursing underpayments) related to  advance PTC, and appropriately resolving PTC-related errors and  discrepancies on federal income tax returns. The key control activities we  selected are those that we viewed as critical for addressing the various  types of key risks that IRS faces that are likely to result in improper  payments of PTC, including the failure to recover overpayments (and  reimburse underpayments).We evaluated IRS’s key control activities from  October 1, 2015, to June 18, 2016. We also did not evaluate whether key  control activities that we determined were not properly designed and  implemented were operating as designed because, without proper design  and implementation, such control activities cannot achieve the control  objectives.
We assessed whether the key control activities at IRS, both individually  and in combination with other controls, were properly designed to achieve  their objectives and address the related risks for preventing and detecting  improper payments of PTC. Specifically, we reviewed IRS’s processes  and control activities, evaluated the design of key control activities, and  identified any gaps and deficiencies. We evaluated the design of key  control activities at IRS by inspecting and analyzing relevant policies and  procedures contained in the Internal Revenue Manual and other relevant  documents and directly testing the design of certain control activities  contained therein using the sample methodology described below. For  key control activities we found to be properly designed, we then assessed  whether IRS properly implemented those key internal control activities. To  do this, we performed walk-throughs and reviewed documentation of  those key control activities.
We tested certain key control activities at IRS to determine whether they  were operating as designed. To do this, we obtained a universe of PTC  transaction data from federal income tax returns that had PTC-related  transactions from October 1, 2015, to June 18, 2016, and then identified a  relevant total population of approximately 6.1 million transactions. To  assess the reliability of the PTC-related transaction data, we (1) reviewed  IRS’s Individual Income Tax Credits reports and supporting data extracts,  (2) interviewed knowledgeable IRS officials about the quality control  procedures IRS has in place for collecting and creating the data, and (3)  electronically tested the data. Based on the results of these procedures,  we determined that the data were sufficiently reliable for our purposes.
From the population of approximately 6.1 million transactions, we  randomly selected 93 federal income tax returns with PTC transactions  for our sample. For these 93 items, we reviewed the related federal  income tax returns, including the Form 8962, Premium Tax Credit, and  IRS processing reports and financial records on PTC-related transactions  to determine whether IRS had performed the required internal control  activities related to processing the credits. We also used this random  sample to provide evidentiary support and illustrative examples of the  effect of IRS’s lack of statutory authority to correct PTC-related errors on  tax returns and certain identified control deficiencies.
Because we followed a probability procedure based on random  selections, each of our samples (for both CMS and IRS) is only one of a  large number of samples that we might have drawn from the respective  sampling populations. Since each sample could have provided different  estimates, we express our confidence in the precision of our particular  sample’s results as a 95 percent confidence interval. This is the interval  that would contain the actual population value for 95 percent of the  samples we could have drawn. Confidence intervals are provided along  with each sample estimate in this audit report. The results apply to the  universes of (1) all FFM application transactions received from November  1, 2015, through February 1, 2016, with effectuated medical policies that  resulted in payments of advance PTC and (2) PTC transaction data from  federal income tax returns occurring from October 1, 2015, through June  18, 2016.
While our second and third audit objectives focused on certain significant  control activities related to preventing and detecting the improper  payments of PTC programs at CMS and IRS; we did not evaluate all  control activities and other components of internal control. If we had done  so, additional deficiencies may have been identified that could impair the  effectiveness of the control activities evaluated as part of this audit.  Appendix II provides additional details on standards for internal control in  the federal government.
We conducted this performance audit from January 2016 to July 2017 in  accordance with generally accepted government auditing standards.  Those standards require that we plan and perform the audit to obtain  sufficient, appropriate evidence to provide a reasonable basis for our  findings and conclusions based on our audit objectives. We believe that  the evidence obtained provides a reasonable basis for our findings and  conclusions based on our audit objectives.
section_title: Appendix II: Standards for Internal Control in the Federal Government
paragraphs: Standards for Internal Control in the Federal Government provides the  overall framework for establishing and maintaining internal control.  Internal control should be designed, implemented, and operating  effectively to provide reasonable assurance that the operations, reporting,  and compliance objectives of an entity will be achieved. The five  components of internal control are as follows:
Control environment: The foundation for an internal control system. It  provides the discipline and structure to help an entity achieve its  objectives.
Risk assessment: Assesses the risks facing the entity as it seeks to  achieve its objectives. This assessment provides the basis for  developing appropriate risk responses.
Control activities: The actions management establishes through  policies and procedures to achieve objectives and respond to risks in  the internal control system, which includes the entity’s information  system.
Information and communication: The quality information management  and personnel communicate and use to support the internal control  system.
Monitoring: Activities management establishes and operates to  assess the quality of performance over time and promptly resolve the  findings of audits and other reviews.
An effective internal control system has each of the five components of  internal control effectively designed, implemented, and operating and the  five components operating together in an integrated manner. In this audit,  we evaluated certain significant control activities at the Centers for  Medicare & Medicaid Services and the Internal Revenue Service related  to preventing and detecting improper payments in the premium tax credit  programs. In addition, we also used the information and communication  component of internal control and related principles as a criterion for  addressing our audit objectives.
section_title: Appendix III: Comments from the Department of Health and Human Services
section_title: Appendix IV: Comments from the Internal Revenue Service
section_title: Appendix V: GAO Contact and Staff Acknowledgements
subsections: section_title: GAO Contact
section_title: Staff Acknowledgments
paragraphs: In addition to the contact named above, Matthew Valenta, Assistant  Director; Maria Hasan, Auditor in Charge; Jeff Arkin; Laura Bednar;  Marcia Carlsen; Nina Crocker; Francine DelVecchio; Maxine Hattery;  Wilfred Holloway; Jason Kelly; Jason Kirwan; Heena Patel; Ricky A.  Perry, Jr.; Kailey Seibert; Monasha Thompson; and Jingxiong Wu made  key contributions to this report.