Improper Payments: Agencies' Efforts to Address Improper Payment and Recovery Auditing Requirements Continue
Published: 2007-03-29T00:00:00

Fast Facts:

Highlights:
section_title: Why GAO Did This Study
paragraphs: The federal government is accountable for how its agencies and grantees spend hundreds of billions of taxpayer dollars and is responsible for safeguarding those funds against improper payments as well as for recouping those funds when improper payments occur. The Congress enacted the Improper Payments Information Act of 2002 (IPIA) and the Recovery Auditing Act to address these issues. Fiscal year 2006 marked the 3rd year that agencies were required to report improper payment and recovery audit information in their Performance and Accountability Reports. GAO was asked to testify on the progress agencies have made in these areas. Specifically, GAO focused on (1) trends in agencies' reporting under IPIA from fiscal years 2004 through 2006, (2) challenges in reporting improper payment information and improving internal control, and (3) agencies' reporting of recovery auditing efforts. This testimony is based on GAO's previous reports on agencies' efforts to implement IPIA requirements for fiscal years 2005 and 2004 and current review of available fiscal year 2006 improper payment and recovery auditing information. The Office of Management and Budget (OMB) provided technical comments that were incorporated as appropriate.
section_title: What GAO Found
paragraphs: GAO identified several key trends related to IPIA reporting requirements. (1) Risk assessments: For fiscal years 2004 through 2006, some agencies still had not instituted systematic methods of reviewing all programs and activities or had not identified all programs susceptible to significant improper payments. Further, certain agencies' risk assessments appeared questionable. GAO also noted that OMB's recently revised IPIA implementing guidance, which allows certain agencies to perform risk assessments every 3 years instead of annually, may result in fewer agencies conducting risk assessments in the future. (2) Improper payment estimates: Since fiscal year 2004, agencies have made some progress in reporting improper payment information. The number of programs reporting improper payment estimates for fiscal year 2004 totaled 41, compared to 60 programs for fiscal year 2006. The total improper payments dollar estimate was $45 billion in fiscal year 2004, $38 billion in fiscal year 2005, and about $42 billion in fiscal year 2006. (3) Noncompliance issues: Although not currently required by IPIA to do so, some agency auditors continued to report problems related to agencies' risk assessments, definition of programs for IPIA purposes, sampling methodologies, lack of reporting for all risk-susceptible programs, and supporting documentation. Although showing progress under OMB's continuing leadership, agencies' fiscal year 2006 reporting under IPIA does not yet reflect the full scope of improper payments. Major challenges remain in meeting the goals of the act and ultimately improving the integrity of payments. First, some agencies have not yet reported for all risk-susceptible programs. For example, the fiscal year 2006 total improper payment estimate of about $42 billion did not include any amounts for 13 risk-susceptible programs that had fiscal year 2006 outlays totaling about $329 billion. Second, certain methodologies used to estimate improper payments did not result in accurate estimates. Finally, GAO noted that internal control weaknesses continued to plague programs susceptible to significant improper payments. From fiscal years 2004 through 2006, the number of agencies reporting recovery auditing information for contract overpayments and the dollar amounts identified for recovery and actually recovered increased. For fiscal year 2004, 12 agencies reported recovering about $53 million, compared to 18 agencies that reported recovering about $256 million for fiscal year 2006. Given the large volume and complexity of federal contract payments and historically low recovery rates for certain programs, GAO emphasized that it is much more efficient to pay bills properly in the first place. Effective internal control calls for a sound, ongoing invoice review and approval process as the first line of defense in preventing erroneous payments.

section_title: Letter
paragraphs: I am pleased to be here today to discuss the governmentwide problem of  improper payments in federal programs and activities and agencies’ efforts  to address key requirements of the Improper Payments Information Act of  2002 (IPIA) and Section 831 of the National Defense Authorization Act for  Fiscal Year 2002, commonly known as the Recovery Auditing Act. Since  fiscal year 2000, we have issued a number of reports and testimonies  aimed at raising the level of attention given to improper payments. Our  work over the past several years has demonstrated that improper  payments are a long-standing, widespread, and significant problem in the  federal government. IPIA has increased visibility over improper payments  by requiring executive agency heads, based on guidance from the Office of  Management and Budget (OMB), to identify programs and activities  susceptible to significant improper payments, estimate amounts  improperly paid, and report on the amounts of improper payments and  their actions to reduce them. Similarly, the Recovery Auditing Act  provides an impetus for applicable agencies to systematically identify and  recover contract overpayments. This act requires, among others things,  that all executive branch agencies entering into contracts with a total  value exceeding $500 million in a fiscal year to have cost-effective  programs for identifying errors in paying contractors and for recovering  amounts erroneously paid. As the steward of taxpayer dollars, the federal  government is accountable for how its agencies and grantees spend  hundreds of billions of taxpayer dollars and is responsible for  safeguarding those funds against improper payments as well as having  mechanisms in place to recoup those funds when improper payments  occur.
OMB has played a key role in the oversight of the governmentwide  improper payments problem. In 2005, OMB established Eliminating  Improper Payments as a new program-specific initiative under the  President’s Management Agenda (PMA). This separate PMA program  initiative helps to ensure that agency managers are held accountable for  meeting the goals of IPIA and are, therefore, dedicating the necessary  attention and resources to meeting IPIA requirements. OMB continues its  commitment to identify all improper payments governmentwide by  working with agencies to establish corrective action plans to address their  root causes. OMB also annually reports on agencies’ efforts to address  IPIA and Recovery Auditing Act requirements.
Today, my testimony will focus on three key areas:  trends in agencies’ reporting under IPIA for fiscal years 2004 through  2006,    challenges in reporting improper payment information and improving    agencies’ reporting of recovery auditing efforts to recoup improper  payments.
This testimony is based on our previous reports on agencies’ efforts to  implement IPIA requirements for fiscal years 2005 and 2004 and our  current review of available fiscal year 2006 improper payment information  reported by 36 of the 38 federal agencies that the Department of the  Treasury (Treasury) determined to be significant to the U.S. government’s  consolidated financial statements. (See app. I for a list of the 38 agencies.)  The remaining 2 federal government corporations have a different year- end reporting date and had not issued their annual reports as of the end of  our fieldwork. We reviewed improper payment information reported in the  36 agencies’ fiscal year 2006 performance and accountability reports  (PAR) or annual reports. We also reviewed OMB guidance on  implementation of IPIA and the Recovery Auditing Act and its annual  report on agencies’ efforts to identify and reduce improper payments. In  addition, we reviewed GAO reports and agency Office of Inspector  General (OIG) management challenges reports to identify internal control  weaknesses and program integrity issues for agency programs reporting  improper payment estimates for fiscal year 2006. We did not independently  validate the data that agencies reported in their PARs or annual reports or  the data that OMB reported. However, we are providing agency-reported  data as descriptive information that will inform interested parties about  the magnitude of reported governmentwide improper payments and  amounts recouped through recovery audits and other improper payment- related information. We believe the data to be sufficiently reliable for this  purpose. We provided information on the major findings discussed in this  statement to OMB. OMB provided technical comments that we have  incorporated as appropriate. We conducted our work in March 2007 in  accordance with generally accepted government auditing standards.  Details on our scope and methodology related to fiscal year 2005 and 2004  findings can be found in our prior reports.
subsections: section_title: Significant Trends in IPIA Reporting
paragraphs: I would now like to focus on agencies’ efforts to address select IPIA  reporting requirements during the first 3 years of IPIA implementation,  fiscal years 2004 through 2006. Generally, agencies must perform four key  steps to address the improper payments reporting requirements—                      (1) perform a risk assessment, (2) estimate improper payments for risk- susceptible programs and activities, (3) implement a plan to reduce  improper payments for programs with estimates exceeding $10 million,  and (4) annually report improper payment estimates and actions to reduce  them. OMB requires the results of these steps to be reported in the  agencies’ PARs, in the Management Discussion and Analysis section and  as a separate appendix, for each fiscal year ending on or after      September 30, 2004. Today, I will touch on progress made and challenges  that remain in these areas.
subsections: section_title: Risk Assessments
paragraphs: Our past and current reviews of agencies’ reported risk assessments have  raised questions regarding their adequacy. For fiscal years 2004 through  2006, we found that some agencies still had not instituted systematic  methods of reviewing all programs and activities or had not identified all  programs susceptible to significant improper payments. We also reported  that certain agencies’ risk assessments appear questionable. Conducting a  risk assessment is an essential part of agencies’ efforts to comply with  IPIA. Risk assessment is a key step in helping to gain a reasonable level of  assurance that programs are operating as intended and that they are  achieving their expected outcomes. Done properly, it entails a  comprehensive review and analysis of program operations to determine if  risks exist, what those risks are, and the potential or actual effect of those  risks on program operations. The information developed during a risk  assessment forms the foundation or basis upon which management can  determine the nature and type of corrective actions needed. It also gives  management baseline information for measuring progress in reducing  improper payments.
For the first year of reporting under IPIA, we reported in March 2005,  that of the 29 agencies reviewed, 23 had completed risk assessments  for all programs and activities for fiscal year 2004. However, for 3 of  these, agencies’ auditors raised noncompliance issues with the risk  assessments. For example, agency auditors for the Department of  Justice (DOJ) and the National Aeronautics and Space Administration  (NASA) reported that the risk assessments did not consider all  payment types or programs. The auditor for the Department of  Homeland Security (DHS) reported that the agency did not institute a  systematic method of reviewing all programs and identifying those it  believed were susceptible to significant erroneous payments.
Regarding the second year of IPIA reporting, we reported in November  2006, that the same number of agencies, 23, had performed risk  assessments of all of their programs and activities based on our review  of 35 agency PARs or annual reports for fiscal year 2005. Similar to the  first year of IPIA reporting, we noted that auditors for DOJ and DHS  again raised noncompliance issues regarding the adequacy of the  agencies’ risk assessments. We noted other risk assessment  deficiencies as well. For example, the Department of Agriculture  (USDA) OIG reported that the agency’s risk assessments were not  adequate to estimate the agency’s susceptibility to improper payments  because the guidance from the USDA’s Office of the Chief Financial  Officer (OCFO) was not sufficiently prescriptive and detailed to  translate into meaningful results. As such, the OIG recommended that  the USDA OCFO strengthen guidance over its IPIA risk assessments to  provide reasonable assurance that the requirements of the act are met.  Further, the OIG stated that USDA should identify risk factors that are  discrete to the program being assessed and consider information from  all sources, such as audit reports.
For fiscal year 2006, the third year of IPIA reporting, we found that 30  of the 36 agencies had reported performing some type of assessment to  identify programs and activities susceptible to significant improper  payments. The remaining 6 agencies either did not report improper  payments information in their PARs or annual reports, or did not report  assessing for risk of improper payments for all of their programs and  activities. Of the 30, 18 agencies reported reviewing all programs and  activities as part of the risk assessment process, while the remaining 12  agencies provided enough details that indicated some level of review  was performed. For example, 1 agency reported that it had evaluated  its major programs based on its developed risk criteria. Although the  major programs made up a significant portion of the agency’s outlays,  the agency did not report that it had assessed the remaining programs  and activities. We also found instances where an agency’s description  of the risk assessment performed contradicted its assertion that all  programs and activities had been reviewed. For example, 1 agency  reported in its PAR that it had assessed all programs and activities, but  also reported in the same PAR that assessments for two activities had  not been conducted. Another agency reported that it had assessed all of  its payment programs, but later stated in its PAR that its risk  assessment only covered certain types of programs.
Similar to the previous years, agency auditors continued to find  inadequacies in agencies’ risk assessments for fiscal year 2006. The DHS  auditor reported that the agency did not perform a risk assessment for all  programs and activities. Further, the NASA auditor reported that the  agency had potentially violated certain requirements of IPIA as NASA had  been unable to provide the auditor with sufficient documentation to  support performance of an annual review of all programs and activities  that the agency administers.
Other agencies reported improving and refining their risk assessment  methodologies for fiscal year 2006. For example, USDA’s Farm Service  Agency reported that it made improvements to its risk assessments and as  a result, four additional programs were determined to be susceptible to  significant improper payments. Two other agencies reported redefining  their programs to conduct their risk assessments. DOJ reported that it  addressed its noncompliance with IPIA by performing risk assessments in  its U.S. Marshals Service component. Other agencies identified plans for  improving future risk assessments. For example, the Office of Personnel  Management (OPM) reported that it will assess in fiscal year 2007 whether  any agency payment streams, other than its former OMB Circular No. A-11  programs, are susceptible to significant improper payments. The  Department of Defense reported that it is developing a program to review  its intergovernmental payments and payments for afloat and deployed  forces. NASA reported that it plans to perform a risk assessment of the  agency’s commercial and noncommercial disbursement activities.
Finally, we noted that the number of agencies conducting risk assessments  may decrease in future reporting, because OMB’s revised IPIA  implementing guidance allows agencies to perform risk assessments every  3 years for those agency programs not deemed susceptible to significant  improper payments. Prior to issuing its revised implementing guidance,  OMB discussed the proposed changes with us. We advised OMB that the  provision to perform risk assessments every 3 years for those programs  not deemed risk-susceptible was inconsistent with the IPIA requirement  for agencies to review all programs and activities annually. In its fiscal  year 2006 PAR, the General Services Administration (GSA) reported that  because it does not have any programs or activities susceptible to  significant improper payments, GSA will perform the next risk assessment  in fiscal year 2008. Additionally, several programs included in OMB’s  former Circular No. A-11, reported that OMB had granted them a waiver  from improper payments reporting because they did not have programs  susceptible to significant improper payments. These programs included  the Environmental Protection Agency’s Clean and Drinking Water State  Revolving Funds, the National Science Foundation’s Research and  Education Grants and Cooperative Agreements, and the Department of  Veterans Affairs (VA) Insurance programs. OMB’s previous implementing  guidance required agencies to annually estimate improper payments for  their programs that were included in former Circular No. A-11, regardless  of amount.
section_title: Improper Payment Dollar and Error Rate Estimates
paragraphs: Since fiscal year 2004, agencies have made progress in reporting improper  payment information. For example, the number of programs reporting  improper payment estimates for fiscal year 2004 totaled 41, as compared  to 60 programs reporting for fiscal year 2006, a net increase of 19  programs. The total improper payments dollar estimate was $45 billion in  fiscal year 2004, $38 billion in fiscal year 2005, and about $42 billion in  fiscal year 2006. (See app. II for further details.)
We have previously testified before this subcommittee regarding the  decrease in the total improper payment estimate from $45 billion in fiscal  year 2004 to $38 billion in fiscal year 2005. Specifically, we reported that  the $7 billion decrease was primarily attributable to a decrease in the  Medicare estimate that resulted from increased efforts to educate health  care providers on the importance of responding to requests for medical  records to perform detailed statistical reviews. Also, the Department of  Health and Human Services (HHS) extended the time that providers have  for responding to documentation requests from 55 days to 90 days. We  further reported that these changes primarily affected HHS’s processes  related to its efforts to perform detailed statistical reviews for the  purposes of calculating an annual improper payment estimate for the  Medicare program. While this represents a refinement, it may not reflect  improved accountability over program dollars given that GAO continues to  designate the Medicare program as a high-risk area. Specifically, in our  January 2007 report, we reported that further action must be taken to  refine Medicare’s payment methods and collection of data used as a basis  for setting payment rates and address program integrity weaknesses,  among others. Also, HHS’s OIG continued to report the integrity of  Medicare payments as a top management challenge for fiscal year 2006.
For fiscal year 2006, the total improper payment estimate increased to  about $42 billion from the reported $38 billion for fiscal year 2005. The  increase in improper payments was primarily attributable to 15 newly  reported programs or activities totaling about $2.4 billion, and a $1.6  billion increase in USDA’s Marketing Assistance Loan program due to  improvements in how it measured its improper payments. In addition,  several programs experienced increases in their improper payment  estimates as a result of lax upfront eligibility controls to facilitate rapid  benefit delivery to victims devastated by Hurricane Katrina. According to  OMB, the programs most directly affected included the Federal  Emergency Management Agency’s Individuals and Households program  (IHP), Department of Labor’s (Labor) Disaster Unemployment Insurance  (UI) program, and the Small Business Administration’s Disaster Assistance  Loan program. For example, Labor identified more than $100 million in  improper payments related to Hurricane Katrina for the Disaster UI  program. To respond to the challenges of the Gulf Coast hurricanes, on  August 29, 2006, the President signed Executive Order 13411, Improving  Assistance for Disaster Victims, which established a task force on disaster  coordination responsible for recommending specific actions to improve  the delivery of federal disaster assistance while strengthening controls  designed to prevent improper payments and other forms of fraud, waste,  and abuse.
Mr. Chairman, I commend agencies’ efforts to decrease improper payment  error rates. For example, from our review of agency programs initially  reporting error rates in the first year of IPIA implementation, fiscal year  2004, we noted that of the 32 agency programs with changes in their error  rates, 18 program error rates, or 56 percent, had declined when compared  to fiscal year 2006. However, it should be noted that in this still-early stage  of IPIA implementation, a decrease in the reported error rate may not  signal improved accountability just as an increase may not necessarily  indicate a greater number of control weaknesses. In some cases, these  fluctuations may be attributed to changes in the estimating methodology  used. For example, USDA’s Marketing Assistance Loan program did not  report an estimate in fiscal year 2004 and reported a small estimate for  fiscal year 2005. However, with improvements in how it measures  improper payments, this program estimated an error rate of 20.3 percent  for fiscal year 2006. The Marketing Assistance Loan program is now in a  greatly improved position to identify the root causes of these errors and  ultimately improve the integrity of its payments—the primary goal of IPIA  reporting.
Table 1 highlights improper payment error rates for the 8 major programs  that accounted for 86 percent of the $42 billion total improper payment  estimate for fiscal year 2006.
section_title: Noncompliance Issues with IPIA Continue
paragraphs: Although they are not specifically required to do so by the act, some  agency auditors have reported on noncompliance issues related to  implementation of IPIA since the first year of IPIA reporting. For example,  for fiscal years 2004 and 2005, we reported that agency auditors had  identified instances of noncompliance, such as the lack of a systematic  method for reviewing all programs and risk assessments that did not  consider all payment types or programs. For fiscal year 2006, agency  auditors reported instances of noncompliance such as an agency still  being in its early stages of IPIA implementation or not yet having reported  for all risk-susceptible programs.
We found that the level of noncompliance and types of issues raised varied  over the first 3 years of IPIA reporting. From our review of the agency  auditors’ description of the noncompliance, we classified the findings into  three categories—full noncompliance, partial noncompliance, and  potential noncompliance. We noted that agency auditors reported  problems related to agencies’ risk assessments, the definition of programs  for IPIA purposes, sampling methodologies, lack of reporting for all risk- susceptible programs, and supporting documentation, as shown in table 2.  Fully addressing these matters should lead to improved reporting under  IPIA. Although IPIA does not include a separate reporting requirement for  auditors to assess agencies’ compliance, we noted that those that included  this assessment provided a valuable independent validation of agencies’  efforts to implement the act.
From our analysis, we noted that four agencies had reported  noncompliance issues for at least 2 of the 3 IPIA reporting years. For  example, agency auditors for DHS have reported noncompliance issues for  the first 3 years of IPIA reporting. As mentioned earlier in this testimony,  the first 2 years of noncompliance were primarily caused by inadequate  risk assessments. For fiscal year 2006, DHS auditors reported that the  agency had not fully complied with IPIA due to several inadequacies  related to sampling methodologies, trained staff, and monitoring of results  to ensure testing was completed for all required programs. DHS auditors  recommended that the agency follow OMB guidance for fiscal year 2007,  including completing the necessary susceptibility assessments, testing for  all material programs, and instituting sampling techniques to allow for  statistical projection of improper payments testing results.
section_title: Challenges Continue in Reporting Improper Payment Information and Improving Internal Control
paragraphs: While showing progress, agencies’ fiscal year 2006 reporting under IPIA  does not yet reflect the full scope of improper payments across executive  branch agencies. Major challenges remain in meeting the goals of the act  and ultimately improving the integrity of payments. Specifically, some  agencies have not yet reported for all risk-susceptible programs, and  certain methodologies used to estimate improper payments do not result  in reliable estimates. Also, we noted that management challenges related  to agencies’ internal control weaknesses continue to plague programs  susceptible to significant improper payments.
subsections: section_title: Improper Payments Estimate Excludes Several Large Risk-Susceptible Programs
paragraphs: The fiscal year 2006 total improper payment estimate of about $42 billion  did not include any amounts for 13 risk-susceptible programs having fiscal  year 2006 outlays totaling about $329 billion. The Medicaid program  represents the largest program that has not yet reported, with reported  outlays of about $183 billion. OMB had specifically required 9 of these  programs, including the Medicaid program to report selected improper  payment information for several years before IPIA reporting requirements  became effective. After passage of IPIA, OMB’s implementing guidance  required that these programs continue to report improper payment  information under IPIA. See table 3 for more detailed information.
Of these 13 programs, 11 reported that they would be able to estimate and  report on improper payments in the next 2 fiscal years, but could not do so  for fiscal year 2006. The remaining 2 programs were silent about when  they would report estimates in the future. As a result, improper payment  reporting of these programs susceptible to risk remain unknown.  OMB reported that some of the agencies were unable to determine the rate  or amount of improper payments because of measurement challenges or  time and resource constraints, which OMB expects to be resolved in future  reporting years. For example, since fiscal year 2002, HHS has conducted  pilots at the state level to further its progress toward reporting a national  improper payments estimate for its Medicaid program. Each state is  responsible for designing and overseeing its own Medicaid program within  the federal government structure. This type of program structure presents  challenges for implementing a methodology to estimate improper  payments as HHS must work with states to obtain applicable  documentation used in the calculation. An additional challenge that HHS  and other agencies with state-administered programs say they face is the  ability to hold states accountable for meeting targets to reduce and  recover improper payments in the absence of specific statutory authority.  In April 2006, we reported on the need for federal and state coordination  to report national improper payment estimates on federal programs as  state-administered programs and other nonfederal entities receive over  $400 billion annually in federal funds. Thus, federal agencies and states  share a responsibility for the prudent use of these funds.
section_title: Certain Methodologies Used to Estimate Improper Payments Do Not Result in Accurate Estimates
paragraphs: We have previously noted that agencies employed different sampling  methodologies to estimate improper payments, including statistical  sampling, nonstatistical sampling, or a combination of the two. OMB’s  implementing guidance requires that agencies generally use a statistical  sample to estimate improper payments. Agencies may also use an  alternative sampling approach provided they obtain OMB approval prior to  implementation. The advantage of using statistical sampling is that sample  results can be generalized to the entire population from which the sample  was taken. Based on our review of fiscal year 2006 reporting, we found  seven agencies that did not use statistical sampling to estimate improper  payments for nine programs totaling about $202 million, with program  outlays exceeding $88 billion. Given that total outlays for these nine risk- susceptible programs exceeded $88 billion for fiscal year 2006, the  improper payment estimate for these programs would likely have been  much greater had statistically valid methods been used.
For example, Labor analyzed fiscal year 2004 audits done under the Single  Audit Act, as amended, to identify questioned costs for its Workforce  Investment Act program, which, in turn, were used as a proxy for  reporting its improper payment estimate. Specifically, the improper  payment rate was determined by calculating the projected questioned  costs and dividing this total amount by the corresponding outlays. Using  this methodology, Labor reported a $6.4 million improper payment  estimate for fiscal year 2006. We do not believe this is a reasonable proxy  for improper payment levels because single audits, by themselves, may  lack the level of detail necessary for achieving IPIA compliance.  Specifically, single audits generally focus on the largest dollars in an  auditee’s portfolio. Thus, all programs identified as susceptible to  improper payments at the federal level may not receive extensive coverage  under a single audit. Consequently, both the depth and level of detail of  single audit results are, generally, insufficient to identify improper  payments, estimate improper payments, or both. We noted that Labor’s  OIG reported the use of single audits as a major management challenge  because serious deficiencies in single audits, including inadequate  sampling methodologies have been reported, thus making them unreliable  for purposes of estimating improper payments.
We also found that five agencies used a combination of statistical and  nonstatistical sampling methods to estimate improper payments totaling  about $11.6 billion for ten programs. For example, VA reported that  improper payment estimates for its Compensation and Pension programs  are based on statistical sampling of its quality assurance program together  with actual amounts of debt incurred that are referred to the VA Debt  Management Center. In another example, the Railroad Retirement Board  (RRB) reported that improper payment estimates for its Retirement and  Survivors Benefits program and Railroad Unemployment Insurance  Benefits program were based on a statistical sample of railroad retirement  awards and unemployment and sickness insurance claims as well as  special studies and audits that were not entirely statistically based. In its  fiscal year 2006 PAR, RRB reported that in May 2005, its general counsel  issued a legal opinion that since the levels of improper payments did not  exceed OMB’s designated thresholds—exceeding $10 million and 2.5  percent of program payments—the agency was not required to conduct  statistical sampling. We noted that both of these programs were required  to report improper payment information for several years before IPIA  reporting requirements became effective. After passage of IPIA, OMB’s  implementing guidance required that these programs continue to report  improper payment information under IPIA, including using statistical  sampling to estimate improper payments.
In addition, we noted instances where agencies estimated improper  payments for only one component of the risk-susceptible program. For  example, HHS’s Medicare program is the largest of the programs  constituting the total improper payment estimate, with an estimate of  $10.8 billion for fiscal year 2006. However, this estimate represents  payment errors only for its fee-for-service program component. HHS has  not yet begun to estimate improper payments for its managed care  component (also known as Medicare Advantage), with outlays totaling  about $55 billion, or 14 percent of Medicare program outlays. HHS’s  auditor, an independent public accounting firm that audited its financial  statements for fiscal year 2006, identified Medicare’s managed care  benefits payment cycle as a reportable condition in its report on internal  controls. The auditor found that HHS lacks a comprehensive control  environment in which the risk of inaccurate payments is not sufficiently  mitigated. Specifically, HHS had inadequate procedures to review and  process managed care payments, lacked documentation and procedures to  determine eligibility of new providers, and provided inadequate oversight  of managed care organizations. In its fiscal year 2006 PAR, HHS reported  that a methodology to estimate improper payments for the Medicare  Advantage program was in the initial stage of development. During fiscal  year 2007, HHS plans to perform a comprehensive risk assessment for the  Medicare Advantage program to determine potential areas vulnerable to  payment errors. HHS anticipates reporting on the measurement project  and select findings in its fiscal year 2008 PAR. However, HHS has not yet  provided a target date for reporting an improper payment estimate for its  Medicare Advantage program.
section_title: Improved Internal Control Is Key to Resolving Improper Payments
paragraphs: Agency OIGs reported management challenges in the annual PARs related  to agencies’ internal control weaknesses that continue to plague programs  susceptible to significant improper payments. In accordance with OMB  Circular No. A-136, OIGs are required to highlight issues that the OIGs  consider to be the most serious management and performance challenges  facing agencies. Management challenges involving internal control have a  direct effect on program integrity and improper payment issues, and thus a  review of the OIGs’ statements on management challenges can be  instructive in this regard. Generally, improper payments result from a lack  of or an inadequate system of internal control, but some result from  program design issues.
Internal control is a major part of managing an organization. It comprises  the plans, methods, and procedures used to meet missions, goals, and  objectives and supports performance-based management. Internal control  also serves as the first line of defense in safeguarding assets and  preventing and detecting errors and fraud. Our Standards for Internal  Control in the Federal Government provide a road map for entities to  establish control for all aspects of their operations and a basis against  which entities’ control structures can be evaluated. Also, our executive  guide on strategies to manage improper payments focuses on internal  control standards as they relate to reducing improper payments.
We found that over half of the programs reporting improper payment  estimates also had reported management challenges that could increase  the risk of improper payments, including challenges related to internal  controls. For example, in the Department of Education’s (Education)  fiscal year 2006 PAR, the Education OIG reported that recent audits,  inspections, and investigations continue to uncover problems with  program control and oversight of program participants, placing billions of  taxpayer dollars at risk of waste, fraud, abuse, and noncompliance. The  OIG concluded that only by improving effective oversight of its operations  and demanding accountability by its managers, staff, contractors, and  grantees can the agency be an effective steward of the billions of taxpayer  dollars supporting its programs and operations. Education’s OIG also  reported that identifying and correcting improper payments remains a  challenge for the agency due to ineffective oversight and monitoring of its  policies, programs, and participants.
Another example involved an agency’s systems used to detect fraudulent  activity. Specifically, Treasury’s OIG reported that some tax credits, such  as the Earned Income Tax Credit, provide opportunities for abuse in  income tax claims. In past years, the Internal Revenue Service (IRS) used  its Web-based Electronic Fraud Detection System (EFDS) to search for  signs of fraud at the time that tax returns are filed to help eliminate the  issuing of questionable refunds. For its 2005 processing year, IRS stopped  over $412 million in improper payments. However, IRS was unable to  utilize EFDS for the 2006 processing year because the contractor it had  hired to update the fraud detection program could not produce a working  program within the established timeframe. Because IRS believed that the  contractor would deliver the updated program, it had not developed a  contingency plan nor taken any action to return to the old system. As a  result, the Treasury OIG reported that more than $300 million in fraudulent  refunds may have been issued in 2006. We identified this issue as a  material weakness during our audit of IRS’s fiscal years 2005 and 2006  financial statements.
section_title: Agencies’ Reporting of Recovery Auditing Information
paragraphs: Section 831 of the National Defense Authorization Act for Fiscal Year 2002  provides an impetus for applicable agencies to systematically identify and  recover contract overpayments. The act requires that agencies that enter  into contracts with a total value in excess of $500 million in a fiscal year  carry out a cost-effective program for identifying and recovering amounts  erroneously paid to contractors. The law authorizes federal agencies to  retain recovered funds to cover in-house administrative costs as well as to  pay contractors, such as collection agencies. Any residual recoveries, net  of these program costs, shall be credited back to the original appropriation  from which the improper payment was made, subject to restrictions as  described in the legislation.
Recovery auditing is a method that agencies can use to recoup detected  improper payments. Recovery auditing is a detective control to help  determine whether contractor costs were proper. Specifically, it focuses  on the identification of erroneous invoices, discounts offered but not  received, improper late penalty payments, incorrect shipping costs, and  multiple payments for single invoices. Recovery auditing can be conducted  in-house or contracted out to recovery audit firms. The techniques used in  recovery auditing offer the opportunity for identifying weaknesses in  agency internal controls, which can be modified or upgraded to be more  effective in preventing improper payments before they occur for  subsequent contract outlays.
I would like to emphasize that effective internal control calls for a sound,  ongoing invoice review and approval process as the first line of defense in  preventing unallowable contract costs. Given the large volume and  complexity of federal payments and historically low recovery rates for  certain programs, it is much more efficient and effective to pay bills and  provide benefits properly in the first place. Prevention is always preferred  to detection and collection. Aside from minimizing overpayments,  preventing improper payments increases public confidence in the  administration of benefit programs and avoids the difficulties associated  with the “pay and chase” aspects of recovering improper payments.  Without strong preventive controls, agencies’ internal control activities  over payments to contractors will not be effective in reducing the risk of  improper payments.
Beginning with fiscal year 2004, OMB required that applicable agencies  publicly report on their recovery auditing efforts as part of their PAR  reporting of improper payment information. Agencies are required to  discuss any contract types excluded from review and justification for  doing so. Agencies are also required to report, in table format, various  amounts related to contracts subject to review and actually reviewed,  contract amounts identified for recovery and actually recovered, and prior  year amounts.
From fiscal year 2004 to 2006, we noted that the number of agencies  reporting recovery auditing information and the dollar amounts identified  for recovery and actually recovered had increased, as shown in table 4.
We are pleased that progress has been made over the past 3 fiscal years to  identify amounts for recovery and those amounts actually recovered. We  also noted that the rate of recovery of contract overpayments for fiscal  year 2006, about 30 percent, had substantially decreased from the prior  year reported recovery rate of 84 percent. In our November 2006 report,  we raised questions regarding the overall high recovery rate of 84 percent  and found discrepancies, such as the contract costs identified for recovery  were considerably lower than the corresponding OIG amount identified  from that year’s audit reviews. We determined that the discrepancies  significantly decreased the overall recovery rate from 84 percent to 22  percent. Although we have not performed a detailed review of the  agencies’ recovery rates for fiscal year 2006, the reported overall recovery  rate of 30 percent may provide a more realistic view of agencies’ recovery  audit efforts.
From our review, we noted that 12 agencies reported recovering about   $53 million for fiscal year 2004 compared to 18 agencies that reported  recovering about $256 million for fiscal year 2006. In addition to the 18  agencies, we found that 3 agencies—Education, the Department of  Housing and Urban Development (HUD), and Labor—did not report  recovery auditing information for fiscal year 2006. Education reported that  it reviewed all of its vendor payments from fiscal years 1998 to 2005 and  found that potential recoveries were minimal. During fiscal year 2007,  Education plans to review fiscal year 2006 contract payments. Education  also noted that its purchase card and travel card programs are subject to  monthly reviews and reconciliations to identify potential misuse or abuse.  HUD and Labor reported that based on their recovery audit results, a  recovery auditing program was not cost-beneficial or necessary, similar to  what they reported for fiscal year 2005. Specifically, in fiscal year 2006,  HUD reported that its recovery audit contractor had determined that  procedures and systems in place provide strong controls for processing  contract payments. Labor reported that from its statistical sample of 50  transactions, no improper payments were found, and therefore recovery  audit efforts were not necessary. In addition, we noted that of the 18  agencies reporting for fiscal year 2006, 3 agencies had conducted in-house  recovery audits, 8 agencies reported they contracted out their recovery  audit services, another 6 agencies reported using both in-house and  recovery audit contractors to perform recovery auditing, and the  remaining 1 agency was silent.
section_title: Concluding Observations
paragraphs: In closing, we recognize that measuring improper payments and designing  and implementing actions to reduce them are not simple tasks and will not  be easily accomplished. Further, while internal control should be  maintained as the front-line defense against improper payments, recovery  auditing holds promise as a cost-effective means of identifying contractor  overpayments.
Given today’s budgetary pressures and the American public’s increasing  demands for accountability over taxpayer funds, oversight hearings such  as this one today and the continuing leadership of OMB under the PMA,  help keep agencies focused on the goals of IPIA and being accountable for  results. Preventing, identifying, and recovering improper payments in that  order are what is needed across government. Fulfilling the requirements of  IPIA will require sustained attention to implementation and oversight to  monitor whether desired results are being achieved.
Mr. Chairman, this concludes my statement. I would be pleased to respond  to any questions that you or other members of the subcommittee may  have.
subsections: section_title: Contact and Acknowledgments
paragraphs: For more information regarding this testimony, please contact McCoy  Williams, Director, Financial Management and Assurance, at                  (202) 512-9095 or by e-mail at williamsm1@gao.gov. Contact points for our  Offices of Congressional Relations and Public Affairs may be found on the  last page of this testimony. Individuals making key contributions to this  testimony included Carla Lewis, Assistant Director; Francine DelVecchio;  Christina Quattrociocchi; Heather Rasmussen; Donell Ries; and Viny  Talwar.
section_title: Appendix I: Agencies and Related Programs Included in Our Review of Fiscal Year 2006 Performance and Accountability Reports and Annual Reports
section_title: Appendix II: Improper Payment Estimates Reported in Agency Fiscal Year 2005 and 2006 Performance and Accountability Reports or Annual Reports
paragraphs: millions) (percent) millions) (percent)
Cooperative Agreements,  Grants, and Contracts   Child and Adult Care Food  Program   Farm Security and Rural  Investment   Program (previously  Commodity Loan Programs)   12  Milk Income Loss Contract  13  National School Lunch and  School Breakfast Programs  (previously School Programs)17  Women, Infants, and Children  18  All programs and activities4  Department of Defense    19  Civilian Pay  0.1  millions) (percent) millions) (percent)
5  Department of Education  25  Student Financial Assistance—  29  Clean Water State Revolving  30  Drinking Water State Revolving  31  All programs and activities   32  All programs and activities  33  High Cost Support Program34  Universal Service Fund’s  35  All programs and activities   36  All programs and activities  37  All programs and activities38  Child Care and Development  45  State Children’s Insurance  Programmillions) (percent) millions) (percent)
Block Grant (Entitlement  Grants, States/Small Cities)
Administration’s Single Family  Acquired Asset Management  System   51  Low Income Public Housing  52  Public Housing Capital Fund   55  All programs and activities56  All programs and activities60  All programs and activities61  All programs and activities  62  All programs and activities  64  All programs and activities  65  All programs and activities0.0  millions) (percent) millions) (percent)
66  Federal Employees Group Life  68  Retirement Program (Civil  Service Retirement System  and Federal Employees  Retirement System)  69  All programs and activities   70  All programs and activities  73  All programs and activities75  7(a) Business Loan Program  78  All programs and activities  79  Old Age and Survivors’  International Information  Program—U.S. Speaker and  Specialist Program  International Narcotic and Law  Enforcement Affairs— Narcotics Program  0.1  millions) (percent) millions) (percent)
91  Earned Income Tax Credit   $41,643.3  This is a work of the U.S. government and is not subject to copyright protection in the  United States. It may be reproduced and distributed in its entirety without further  permission from GAO. However, because this work may contain copyrighted images or  other material, permission from the copyright holder may be necessary if you wish to  reproduce this material separately.