Improper Payments: DOE's Risk Assessments Should Be Strengthened
Released: 2014-12-23T00:00:00


Highlights: section_title: Why GAO Did This Study
paragraphs: Improper payments are a significant problem in the federal government. To address this problem, IPERA requires that federal agencies review their programs and identify those that are susceptible to significant improper payments—a process known as a risk assessment. DOE's history of inadequate management and oversight of its contractors led GAO to designate DOE's contract management as a high-risk area vulnerable to fraud, waste, abuse, and mismanagement. However, DOE reported that it does not have any programs susceptible to significant improper payments.

GAO was asked to review DOE's internal control environment, as it relates to IPERA, to determine whether the department was at low risk for significant improper payments. This report examines the extent to which DOE assessed its programs' risks for improper payments in fiscal years 2011 through 2013.

GAO reviewed IPERA, analyzed all risk assessments and related information for this period, and interviewed DOE officials and six contractors selected to represent the types of contractor payments made.

section_title: What GAO Found
paragraphs: The Department of Energy (DOE) developed a process to assess its programs for risks of improper payments, but its assessments do not fully evaluate risk. To comply with the Improper Payments Elimination and Recovery Act of 2010 (IPERA), in fiscal year 2011, DOE directed its programs to develop risk assessments using eight qualitative risk factors, such as recent major changes in program funding, and report quantitative information on improper payments. GAO found that 26 of 55 programs did not prepare risk assessments in 2011 and that the quantitative information reported, including the estimated amount of improper payments, was not reliable because, for example, it did not include information for all programs. In reviewing DOE's 2011 risk assessments, GAO also found the following:

DOE did not always include a clear basis for risk determinations . At least 6 of the 29 programs that prepared risk assessments did not take into account the eight qualitative risk factors, making the basis of their risk determinations unclear. At most, the assessments for 23 programs took into account the risk factors. However, support for their determinations varied widely, and some did not contain enough information to identify how the program arrived at its risk determination, which is inconsistent with federal standards for internal control. DOE's guidance directs personnel to prepare a risk assessment that considers these eight factors but does not provide further direction on what to include. Absent such direction, DOE personnel may not have a consistent understanding of how to complete their risk assessments.

DOE did not fully evaluate other relevant risk factors . DOE's risk assessments did not fully evaluate other relevant risk factors, such as weaknesses in key controls for preventing and detecting improper payments—including inadequate subcontractor oversight. GAO found that some risk assessments included information from internal control evaluations, but many did not. DOE guidance does not instruct personnel to consider weaknesses in key controls for preventing and detecting improper payments. Without providing specific examples of other relevant risk factors in guidance and directing personnel to consider them when performing risk assessments, DOE will not have reasonable assurance that each of its programs fully evaluates risks.

Based on its 2011 assessments, DOE was not required under IPERA to prepare risk assessments or report on the amount of improper payments in 2012 and 2013. However, not fully considering program risks in its 2011 assessments and including unreliable data raises questions about whether the 2011 assessments were reliable.

section_title: What GAO Recommends
paragraphs: GAO recommends that DOE take steps to improve its risk assessments including revising guidance on how programs are to address risk factors and providing examples of other risk factors likely to contribute to improper payments and directing programs to consider those factors. DOE concurred with GAO's recommendations.

section_title: Letter
paragraphs: Improper payments—payments that under statutory, contractual,  administrative, or other legally applicable requirements should not have  been made or were made in an incorrect amount—are a long-standing,  widespread, and significant problem in the federal government. The  federal government reported a total of $106 billion in estimated improper  payments in fiscal year 2013 alone. To try to address this problem, the  Improper Payments Information Act of 2002 (IPIA), as amended by the  Improper Payments Elimination and Recovery Act of 2010 (IPERA),  requires, among other things, that federal agencies review their programs  and identify those that are susceptible to significant improper payments— a process known as a risk assessment. Specifically, IPERA required  agencies to conduct risk assessments for all federal programs and  activities in fiscal year 2011 and at least once every 3 years thereafter for  programs and activities deemed not risk susceptible. Under IPERA,  improper payments are considered “significant” if they exceed both 1.5  percent of program payments and $10 million, or if the payments exceed  $100 million regardless of the percentage of program payments.

Much of our reporting on improper payments over the past decade has  focused on large programs, such as Medicare and Medicaid, or other  programs and activities that involve a significant volume of payments  made to a number of individuals. We have reviewed programs where  payment eligibility decisions were made by entities other than the federal  government, such as state or local governments. We have also reported  on improper payment challenges at federal agencies such as the  Department of Defense that rely on contractors to accomplish their  missions and, consequently, contract annually for hundreds of billions of  dollars in goods and services.

As the largest contracting agency in the federal government outside of the  Department of Defense, the Department of Energy (DOE) relies primarily  on contractors to carry out its diverse missions and operate its  laboratories and other facilities, spending approximately 90 percent of its  annual budget on contracts and large capital asset projects. DOE’s  history of inadequate management and oversight of its contractors led us  in 1990 to designate DOE’s contract management, including both contract  administration and project management, as a high-risk area vulnerable to  fraud, waste, abuse, and mismanagement. In January 2009, to recognize progress made at DOE’s Office of Science, we narrowed the  focus of the department’s high-risk designation to two DOE program  elements—the National Nuclear Security Administration and Office of  Environmental Management. In fiscal year 2011, DOE reported in its  Agency Financial Report that it did not have any programs susceptible to  significant improper payments and that it has maintained an overall  improper payments rate of less than 1 percent. Because DOE reported  that it did not have any programs susceptible to significant improper  payments in 2011, the department was not required under IPERA to  prepare risk assessments in fiscal years 2012 and 2013. For those years,  DOE again reported that it did not have any programs susceptible to  significant improper payments and that it maintained an overall improper  payment rate of less than 1 percent.

In this context, you requested that we review DOE’s internal control  environment, as it relates to IPERA, to determine whether the department  was at low risk for significant improper payments. This report examines  the extent to which DOE assessed its programs’ risks for improper  payments in fiscal year 2011 through 2013.

In conducting our work, we reviewed IPERA and IPIA requirements, OMB  and DOE implementing guidance, our executive guide for helping  agencies identify effective strategies to manage improper payments in  their programs, and Standards for Internal Control in the Federal  Government and compared them with risk assessments and other  IPERA-related information that DOE prepared for fiscal years 2011, 2012,  and 2013. We reviewed DOE documents and met with DOE officials to  determine how DOE organized its programs for the purposes of IPERA  compliance over the 3-year period. For all risk assessments prepared for  each DOE program, we analyzed the documentation and supporting  analyses, as well as reports of actual improper payments DOE indentified  through the normal course of business, for fiscal years 2011 through  2013. We reviewed each risk assessment to determine its adherence to  DOE’s IPERA guidance and whether it provided a basis for the risk  determination, among other things. We interviewed DOE headquarters  officials from the Office of the Chief Financial Officer (CFO) regarding  their roles in reviewing risk assessments and providing guidance on  preparing risk assessments. We also interviewed officials from DOE’s  Office of the Inspector General (IG) regarding their roles in reporting on  DOE’s IPERA implementation and overseeing DOE’s strategy for  ensuring that contract audits are performed. We also interviewed DOE  field CFO officials at DOE’s Oak Ridge, Tennessee, and Albuquerque,  New Mexico locations,contractor CFO and internal audit officials at six contractor locations— East Tennessee Technology Park, Los Alamos National Laboratory, Oak  Ridge Associated Universities, Oak Ridge National Laboratory, Sandia  National Laboratory, and Y-12 National Security Complex. At these sites,  we obtained perspectives from over 70 DOE and contractor officials  involved with IPERA reporting, including those that had prepared or  reviewed improper payment risk assessments. We also discussed the  guidance and direction provided by DOE to payment sites in  implementing IPERA, as well as consistency across DOE payment sites  in preparing risk assessments. We selected these sites because they are  representative of the types of contractor payments made by DOE. A more  detailed description of our objective, scope, and methodology is  presented in appendix I.   and we interviewed DOE contracting officers and  We conducted this performance audit from August 2013 to December  2014 in accordance with generally accepted government auditing  standards. Those standards require that we plan and perform the audit to  obtain sufficient, appropriate evidence to provide a reasonable basis for  our findings and conclusions based on our audit objectives. We believe  that the evidence obtained provides a reasonable basis for our findings  and conclusions based on our audit objective.
subsections: section_title: Background
paragraphs: This section discusses DOE’s missions and spending, contract types,  contract oversight, IPERA risk assessment and IG requirements, and the  roles and responsibilities of organizations involved in DOE’s IPERA  activities.
subsections: section_title: DOE’s Missions and Spending
paragraphs: DOE’s missions include developing, maintaining, and securing the  nation’s nuclear weapons capability; cleaning up the environmental  damage resulting from more than 60 years of producing nuclear  weapons; and conducting basic energy and science research and  development. The department carries out these diverse missions at 85  different sites across the country, including major laboratories and field  facilities. With a DOE workforce of about 15,000 employees and in  excess of 100,000 contractor staff, the department relies primarily on its  contractors to manage and operate its sites and accomplish its missions.  DOE oversees the work of its contractors through its staff and program  offices at DOE headquarters and its field offices. For example, DOE  contracting officers provide oversight and ensure contractors are in  compliance with the terms of their contracts.

In fiscal year 2013, DOE spent about 90 percent of its total annual  budget, or $24 billion of $26.4 billion, on contracts.

A significant share of  this spending, about $17.1 billion in fiscal year 2013, was for  management and operating (M&O) contracts, which are used by DOE  generally for the purposes of managing DOE laboratories and other  government-owned or government-controlled facilities. DOE’s M&O  contracts, among other things, provide contractors with the authority to  draw money directly from DOE-funded accounts to pay for contract  performance. In contrast, for the less common non-M&O contracts,  DOE relies on more traditional bill payment methods—which include  receipt of an invoice, payment approval and authorization, and  disbursement of funds. In addition to conducting work through its  contractors, DOE manages a number of grant and loan programs—which  accounted for about $2.4 billion of DOE spending in fiscal year 2013.  DOE also includes the Federal Energy Regulatory Commission and the  Power Marketing Administrations.

section_title: Contract Types
paragraphs: Federal agencies can choose among a number of different types of  contracts to procure goods and services, including fixed-price, time-and- materials, and cost-reimbursement contracts. The choice of contract type  is a principal means for agencies to divide the risk of cost overruns  between the government and the contractor. For example, under a firm- fixed-price contract, the contractor assumes most of the cost risk; by  accepting responsibility for completing a specified amount of work for a  fixed price, the contractor earns a profit if the total costs it incurs in  performing the contract are less than the contract price, but loses money  if its total costs exceed the contract price. Under a time-and-materials  contract, by contrast, the government bears the risk of cost overruns  because payment is based on the number of labor hours billed at a fixed  hourly rate that includes wages, overhead, general administrative costs,  profit, and the costs of materials if applicable. However, time-and- materials contracts include a ceiling price that the contractor exceeds at  its own risk, meaning there is no guarantee that costs above the ceiling  price will be reimbursed by the government.

Under cost-reimbursement types of contracts, the government assumes  the cost risk because it pays the contractor’s allowable costs incurred, to  the extent prescribed by the contract, although these contracts also  establish a ceiling that the contractor exceeds at its own risk. In fiscal  year 2013, about 90 percent, or $21.7 billion, of DOE’s total contract  spending was on cost-reimbursement type contracts that include  contractor fees, according to DOE officials. This includes cost-plus-fixed- fee, cost-plus-incentive-fee, and cost-plus-award-fee contracts. Under  these types of contracts, the federal agency reimburses a contractor for  all allowable costs and also pays a fee that is either fixed at the outset of  the contract or adjustable based on objective or subjective performance  criteria set out in the contract. Cost-reimbursement types of contracts  place the primary risk of cost overruns on the government because of the  potential for the government to pay more than the contract’s estimated  cost and because the government must reimburse the contractor’s costs  of performance up to the contract cost ceiling regardless of whether the  end item or service is completed. In a September 2009 report, we  concluded that cost-reimbursement types of contracts are suitable only  when the agency’s requirements cannot be defined sufficiently or the cost  of the work cannot be estimated with sufficient accuracy to allow for the  use of any type of fixed-price contract. Cost-reimbursement type  contracts allow the agency to contract for work that might otherwise  present too great a risk to contractors.

section_title: Contract Oversight
paragraphs: The choice of a contract type—and whether the contract is an M&O  contract or not—will also affect the types of internal control and contract  auditing activities needed to help protect the government’s interests and  reduce the risk of improper payments. Under federal standards for  internal control, control activities are an integral part of an entity’s  planning, implementing, reviewing, and accountability for stewardship of  government resources and achieving effective results. Control activities  include both preventive and detective controls. Preventive controls—such  as invoice review prior to payment—are controls designed to prevent  improper payments (errors and fraud), waste, and mismanagement.  Detective controls—such as incurred cost audits—are designed to identify  errors or improper payments after the payment is made. Incurred cost  audits are intended to examine contractors’ cost representations and  reach an opinion on whether the costs are allowable, allocable to  government contracts, and reasonable in accordance with the contract  and applicable government acquisition regulations. We have previously  concluded that a sound system of internal controls contains a balance of  both preventive and detective controls that is appropriate for the agency’s  operations.

DOE’s contracting activities for both M&O and non-M&O contracts are  governed by federal law and regulations, including the Federal Acquisition  Regulation as supplemented by the Department of Energy Acquisition  Regulation. The contracting cycle consists of activities throughout the  acquisition process, including preaward, award, and contract  administration and management. Prior to contract award, an agency  generally identifies a need and develops a requirements package. Under  the Federal Acquisition Regulation, the agency generally determines the  method of acquisition; solicits and evaluates bids or proposals;  determines the adequacy of the contractor’s accounting system; and  ultimately negotiates a price and contract terms, resulting in the contract  award. After contract award, the Federal Acquisition Regulation generally  requires the agency to perform activities related to contract administration  and management, which involves monitoring the contractor’s  performance, as well as reviewing and approving (or disapproving) the  contractor’s requests for payments.

Contract auditing assists in achieving prudent contracting by providing  those responsible for government procurement with financial information  and advice relating to contractual matters and the effectiveness,  efficiency, and economy of contractors’ operations. Depending on the  contract type, various contract audit activities can occur in the preaward,  award, and administration and management phases of a contract. For  example, before awarding a cost-reimbursement or other non-fixed-price  type contract, the Federal Acquisition Regulation requires agency  contracting officers to determine the adequacy of a contractor’s  accounting system. After certain types of contracts are awarded, contract  audits—including incurred cost audits—are intended to be a key control to  help ensure that contractors are charging the government in accordance  with applicable laws, regulations, and contract terms. At DOE, the  requirements and responsibility for conducting contract and other audits— including incurred cost audits and audits of subcontractor costs—vary,  depending on whether the contract is an M&O or a non-M&O type  contract, as follows:

M&O contracts. In its M&O contracts, DOE does not require  contractors to submit invoices; instead, the agency provides  contractors with the authority to draw funds directly from federal  accounts to pay for contract performance. Therefore, DOE does not  rely on traditional invoice reviews prior to payment as a means of  helping prevent improper payments. Instead, DOE relies on a  combination of audits of contractor accounting systems and certain  detective controls. Specifically, using a process known as the  Cooperative Audit Strategy, DOE relies on its M&O contractors to  perform the audit work necessary to ensure that their accounting  systems are adequate and that they are charging DOE for only those  costs that are allowable under the contract. As part of DOE’s  Cooperative Audit Strategy, M&O contractors are required to maintain  an internal audit organization that is responsible for performing  operational and financial audits, including incurred cost audits, and  assessing the adequacy of management control systems.addition, M&O contractors are required to provide adequate audit  coverage of subcontractors where costs incurred are a factor in   In  determining the amount payable.to submit an annual Statement of Costs Incurred and Claimed that  includes the contractor’s certification that the costs claimed represent  allowable contract costs. To support this statement, the contractors’  internal audit organization conducts an annual incurred cost audit.  Among other things, in conducting the annual incurred cost audit, the  internal auditors are expected to develop a sampling methodology  that will allow them to test selected transactions to determine whether  the associated costs are allowable under the contracts’ terms and to  make projections regarding the total amount of unallowable costs  based on the testing results. According to DOE’s Financial  Management Handbook, under the Cooperative Audit Strategy,  DOE’s IG is required to annually perform an assessment of these  statements for the 10 M&O contractors who incurred and claimed the  most costs annually. For the remaining M&O Statements of Costs  Incurred and Claimed, the IG is required to perform assessments on a  rotational basis, meaning the IG reviews a few each year until it  completes all of the remaining ones and then starts over again. DOE  officials cite the Cooperative Audit Strategy as a key internal control.

M&O contractors are also required

Non-M&O contracts. Non-M&O contractors do not fall under DOE’s  Cooperative Audit Strategy and therefore are not required to submit  an annual Statement of Costs Incurred and Claimed, maintain an  internal audit organization, or provide audit coverage of subcontracts.  Instead, DOE relies on traditional bill payment methods, which include  prepayment review of invoices, for its non-M&O contracts. DOE also  relies on contract audits—including incurred cost audits—for detecting  improper payments. The Defense Contract Audit Agency (DCAA) has  traditionally been the primary auditor for non-M&O contracts— performing preaward and annual incurred cost audits to ensure that  non-M&O contractor costs are allowable under the contract.  According to DOE’s acquisition guide, the majority of DOE’s contract  dollars have traditionally been spent on M&O contracts, and DCAA  services were used for the few other DOE contracts that were typically  of small dollar value.its use of non-M&O contracts.

More recently, however, DOE has expanded  Regardless of the approach used, DOE contracting officers are  responsible for determining whether costs incurred are allowable under  the contract. During the course of conducting incurred cost audits,  auditors sometimes question the allowability of certain costs. Based on  this information, contracting officers may eventually decide to disallow  certain costs. Before moving to disallow costs, however, the Federal  Acquisition Regulation requires agencies to “make every reasonable  effort” to reach a satisfactory settlement with the contractor.

section_title: IPERA Risk Assessment and IG Requirements
paragraphs: Under IPERA and OMB’s implementing guidance, which together provide  the specific requirements for assessing and reporting on improper  payments,activities that they administer and identify any program that may be  susceptible to significant improper payments—a process known as a risk  assessment. Agencies must institute a systematic method of reviewing  and assessing their programs, which may take the form of either a  quantitative analysis based on a statistical sample or a qualitative  evaluation.   federal agencies are required to review all programs and  IPERA requires that agencies, in performing their risk assessments, take  into account those risk factors that are likely to contribute to significant  improper payments, such as  1.  whether the program or activity reviewed is new to the agency;  2.  the complexity of the program or activity reviewed, particularly with  respect to determining correct payment amounts;  3.  the volume of payments made annually;  4.  whether payments or payment eligibility decisions are made  outside of the agency, for example, by a state or local  government, or a regional federal office;  5.  recent major changes in program funding, authorities, practices, or  6.  the level, experience, and quality of training for personnel  responsible for making program eligibility determinations or  certifying that payments are accurate; and  7.  significant deficiencies in the audit reports of the agency including  but not limited to the agency Inspector General or the Government  Accountability Office report audit findings or other relevant  management findings that might hinder accurate payment  certification.

OMB’s implementing guidance added an eighth risk factor, directing  agencies to consider the results from prior improper payment work. For  the purposes of this report, we will refer to these as the eight risk  factors. It is important to note that these eight risk factors do not  necessarily represent all of the risks for improper payments across all  federal agency programs. OMB’s guidance describes these risk factors as  the minimum that agencies should consider. Under IPERA, an agency’s  assessment of risk factors likely to contribute to significant improper  payments may include other risk factors, as appropriate, specific to the  program or activity being assessed.

We have reported on the importance of risk assessments for managing  improper payments and best practices for conducting them. As described  in our executive guide for helping agencies identify effective strategies to  manage improper payments in their programs,comprehensive review and analysis of program operations to determine if  risks exist and the nature and extent of the risks identified. The  information an agency develops during a risk assessment forms the  foundation or basis upon which agency management can determine the  nature and type of corrective actions needed, and it gives management  baseline information for measuring progress in reducing improper  payments. In addition, reducing improper payments, according to our  executive guide, requires a strategy appropriate to the organization  involved and its particular risks.   a risk assessment is a  Under IPERA, agencies were required to conduct risk assessments for all  federal programs and activities in fiscal year 2011 and at least once every  3 years thereafter for programs and activities deemed not risk  susceptible. As discussed previously, DOE reported in fiscal year 2011  that it did not have any programs susceptible to significant improper  payments. However, we note that, in fiscal years 2012 and 2013, the  department elected to conduct certain risk assessment related activities  that were not required under IPERA. Under IPERA, if, in its risk  assessment, an agency finds that a program is susceptible to significant  improper payments, the agency must conduct annual statistical sampling  of payment transactions to estimate improper payments, publicly report  the results, and implement corrective actions to reduce future improper  payments. Because DOE reported in fiscal years 2011 through 2013 that  none of its programs were susceptible to significant improper payments,  under IPERA, the department was not required to take these additional  steps. Under IPERA, however, all agencies are required to identify and  recover improper overpayments by conducting recovery audits, also  known as payment recapture audits, for agency programs that expend $1  million or more annually, if such audits would be cost-effective. OMB requires agencies, including DOE, to report annually on their recovery  auditing efforts in their Performance and Accountability Reports or their  Agency Financial Reports.

Additionally, IPERA requires that each fiscal year, as first implemented in  fiscal year 2011, the IG of each agency determine whether the agency is  in compliance with certain criteria in IPERA and submit a report on that   Specifically, IGs  determination to the head of the agency and others.are to determine whether agencies  1.  published a Performance and Accountability Report or Agency  Financial Report for the most recent fiscal year and posted that report  and any accompanying materials required by OMB on the agency  website;  2.  conducted a program-specific risk assessment for each program or  activity that conforms with IPERA (if required);  3.  published improper payment estimates for all programs and activities  identified as susceptible to significant improper payments under its  risk assessment (if required);  4.  published programmatic corrective action plans in the Performance  and Accountability Report or Agency Financial Report (if required);  5.  published, and has met, annual reduction targets for each program  assessed to be at risk and measured for improper payments;  6.  reported a gross improper payment rate of less than 10 percent for  each program and activity for which an improper payment estimate  was obtained and published in the Performance and Accountability  Report or Agency Financial Report; and  7.  reported information on its efforts to recapture improper payments.

In its fiscal year 2011 report on IPERA compliance, DOE’s IG reported  that the department had not met the OMB criteria in its implementation  guidance for compliance under IPERA. Among other things, the IG  reported that DOE, in its review of programs to determine whether any  might be susceptible to significant improper payments, had inconsistently  executed its risk assessments. The IG recommended, among other  things, that DOE implement policies and procedures to ensure oversight  and communication of the application of the improper payment definition  by its sites and adherence to the prescribed guidance. DOE concurred  with this recommendation. In subsequent reports on IPERA compliance  for fiscal years 2012 and 2013, the IG found that DOE had complied with  all requirements of IPERA.

section_title: Roles and Responsibilities of Organizations Involved in DOE’s IPERA Activities
paragraphs: DOE’s Office of the CFO, hereafter referred to as the DOE headquarters  CFO, is responsible for issuing IPERA guidance and consolidating and  reporting improper payments information annually in DOE’s Agency  Financial Report. DOE’s contractors, along with other DOE field office  staff, provide information that is the basis for DOE’s IPERA risk  assessment and reporting activities. In addition to having contractor  internal auditors, DOE has M&O contractor CFOs who play a role in  assessing risk and reporting improper payment information. Generally,  contractor CFOs assist in preparing the payment sites’ risk assessment  and improper payment data. DOE’s 11 field CFOs, in cooperation with  DOE contracting officers, are responsible for overseeing contactor and  other activities in the field and assist DOE’s headquarters CFO in  implementing IPERA requirements.

section_title: DOE Developed a Process for Assessing Improper Payment Risks, but Those Assessments Do Not Fully Evaluate Risk
paragraphs: DOE developed a process to assess its programs for risks of improper  payments in fiscal year 2011 that included both a qualitative risk  assessment and quantitative information on improper payments.  However, based on our evaluation of the department’s fiscal year 2011  risk assessment process, we found that DOE did not prepare risk  assessments for all of its programs, and the quantitative information  reported was not reliable; DOE’s risk assessments did not always include  a clear basis for the risk determination; and DOE’s risk assessments did  not fully evaluate other relevant risk factors. In addition, because DOE  found its programs to be at low risk for significant improper payments in  fiscal year 2011, the department was not required to prepare risk  assessments again until fiscal year 2014. In fiscal years 2012 and 2013,  although not required, DOE directed its sites to prepare an overall risk  assessment rating and information on the amount of actual improper  payments identified through the normal course of business. However, we  found that the information reported in fiscal years 2012 and 2013  constituted less information on improper payments risk than what was  provided in fiscal year 2011, and the information reported provided limited  insight into the risk of improper payments.
subsections: section_title: In Fiscal Year 2011, DOE Developed a Process for Assessing Improper Payment Risks
paragraphs: To comply with IPERA, DOE developed a process in fiscal year 2011 to  assess its programs’ risks for improper payments. DOE defined its  programs as including both the sites responsible for making payments on  behalf of DOE (hereafter referred to as payment sites) and its grant and  loan programs. Specifically, in 2011, DOE identified 55 payment sites as  programs. Of those sites, 38 were contractor sites, which include sites  such as DOE laboratories, weapons production facilities and major  cleanup sites. The remaining 17 payment sites were managed by DOE.  These sites include local DOE site offices and the Oak Ridge Financial  Service Center (collectively referred to as DOE field office sites); the  department’s four Power Marketing Administrations; and the Federal  Energy Regulatory Commission.

To aid in its compliance with IPERA, DOE issued guidance in fiscal year  2011 that directed payment sites to (1) develop a site-specific risk  assessment that takes into account, at a minimum, the eight risk factors,  (2) prepare a statistically valid estimate of the annual amount of improper  payments, and (3) submit a copy of the risk assessment and improper  payments estimate to the DOE headquarters CFO. DOE’s fiscal year  2011 guidance did not specify who would be responsible for evaluating  the risks of DOE’s grant and loan programs, but DOE officials told us that  DOE headquarters was responsible for performing this function.

DOE officials told us that under this process, cognizant DOE field CFO  offices reviewed payment site risk assessments before they were  submitted to the headquarters CFO. Based on the risk assessments and  statistical sampling information that payment sites submitted to the  headquarters CFO, DOE determined in 2011 that it did not have any  programs susceptible to significant improper payments. Additionally, DOE  reported in its Fiscal Year 2011 Agency Financial Report that its estimate  of the annual amount of improper payments from statistical sampling was  $17.5 million out of $31.2 billion in total outlays, which represents an  overall improper payment rate of .06 percent.

section_title: For 2011, DOE Did Not Prepare Risk Assessments for All Its Programs, and the Quantitative Information That Programs Reported Was Not Reliable
paragraphs: DOE did not prepare risk assessments for nearly half of its payment sites  for fiscal year 2011, and the quantitative information that payment sites  reported for improper payments was not reliable. In addition, DOE did not  prepare risk assessments for its grant and loan programs for fiscal year  2011.
subsections: section_title: Nearly Half of DOE’s Payment Sites Did Not Prepare Risk Assessments for 2011
paragraphs: We found that 26 of the 55 payment sites that DOE had designated as  programs for fiscal year 2011 did not prepare risk assessments. Of these  26 sites, 11 sites did not submit either a qualitative assessment or  quantitative information, and 15 submitted quantitative information on the  site’s estimated amount of improper payments but did not provide a  qualitative assessment of risk, as required by DOE guidance. IPERA  requires federal agencies to assess the risk of all programs for significant   DOE had a process and guidance in place for  improper payments.conducting risk assessments, and DOE’s fiscal year 2011 guidance  directed each payment site to complete a risk assessment that, at a  minimum, considered the eight risk factors. DOE’s guidance also states  that each site will provide a copy of the risk assessment to the DOE  headquarters CFO to support their conclusions. However, 26 sites did not  prepare and submit risk assessments as required (i.e.,10 non-M&O  contractor payment sites, 11 DOE field office sites, and 5 M&O contractor  sites).

DOE officials said the 10 non-M&O payment sites did not prepare risk  assessments for fiscal year 2011 because they were covered as part of  the risk assessments conducted by the cognizant DOE field office that  year. In reviewing risk assessments, we found that 3 of the 10 non-M&O  payment sites were discussed in the assessment by a cognizant DOE  field office site—the Richland Office. However, the discussion of the non- M&O sites did not constitute a risk assessment for those sites because  the Richland Office only made limited mention of the internal controls  used by these 3 non-M&O sites, rather than a more robust assessment of  the risk factors. Moreover, we found no evidence that the remaining 7  non-M&O sites were assessed by the cognizant field office site—in part,  because many of the other cognizant field office sites did not prepare risk  assessments in 2011. DOE officials told us that the Oak Ridge Office,  which prepared a risk assessment in 2011, was the cognizant DOE field  office that covered the risk assessments for some of the non-M&O  contracts. However, we found that its risk assessment did not address the  eight risk factors as they relate to the specific payment processes and   For example, at the time of  controls at the non-M&O contractor sites.the fiscal year 2011 reporting, the Oak Ridge payment site oversaw USA  Repository Services LLC, a non-M&O payment site, but the Oak Ridge  risk assessment does not mention the contractor or discuss any of the  processes and controls specific to that contractor. Assessing risk at the  non-M&O contractors is important because many of the prepayment  review processes and controls that impact the risk associated with  making an improper payment reside at the non-M&O contractor site. For  example, upon receipt of an invoice, DOE officials at the non-M&O site  are responsible for verifying that the goods and services reflected on the  invoice have been received. Regardless of whether the cognizant DOE  field site’s risk assessment covered these non-M&O contractors, not  having completed risk assessments for these non-M&O contractor sites  limited the information DOE needed to assess the risk for all of its  programs.

For the 11 DOE field office sites that did not prepare and submit risk  assessments as required, DOE officials said that the 11 sites did not have  to prepare risk assessments. Absent their inclusion in a risk assessment  prepared for some other program or activity within DOE, this statement is  not consistent with IPERA, and again not having completed risk  assessments for these 11 field sites limited the information DOE needed  to assess the risk for all of its programs. DOE officials further explained  that they believe the 5 M&O contractor sites did prepare risk assessments  for fiscal year 2011, but the DOE officials were unable to locate those risk  assessments in their files. As discussed later in this report, in fiscal year  2012, all but 4 payment sites prepared and submitted risk assessment  ratings and, in fiscal year 2013, all payment sites prepared and submitted  risk assessment ratings.

In July 2014, DOE issued its IPERA risk assessment guidance for fiscal  year 2014 with a number of revisions. One revision directs DOE field  office sites to consider the payment processes of the non-M&O  contractors they oversee when completing required risk assessments.  However, the guidance does not specify that those sites should address  the eight risk factors as they relate to the non-M&O sites. Without  directing field office sites in guidance to address the eight risk factors as  they relate to the non-M&O contractor risk assessments, the sites cannot  fully assess the risk of improper payments, and DOE cannot fully  understand its risks for improper payments and take corrective actions to  mitigate such risks in the future.

section_title: Quantitative Information Reported for Improper Payments for 2011 Was Not Reliable
paragraphs: The quantitative information on the amount of improper payments DOE  reported in its Fiscal Year 2011 Agency Financial Report was not reliable  because it was not complete and did not match the total information  submitted by payment sites. As discussed previously, DOE determined  for 2011 that it did not have any programs susceptible to significant  improper payments based on both the qualitative risk assessments  prepared by the payment sites as well as the statistical sampling  information that some payment sites submitted to the headquarters CFO.  DOE reported in its Fiscal Year 2011 Agency Financial Report that its  estimate of the annual amount of improper payments from statistical  sampling was $17.5 million out of $31.2 billion in total outlays. However,  our review could not verify the accuracy of the $17.5 million reported for  two reasons. First, 13 payment sites did not submit to DOE quantitative  information on their estimated improper payments or their outlays, so the  information reported was incomplete. Second, for payment sites that  submitted their information to DOE, the totals for the quantitative  information submitted did not equal the amount reported in DOE’s Agency  Financial Report.

In addition, we did not evaluate the sampling methodology that DOE used  to estimate its improper payments in fiscal year 2011 because the DOE  IG previously reported on this issue and found problems with DOE’s  methodology. In its fiscal year 2011 report on IPERA compliance, the  DOE IG found that DOE used a nonstatistical sampling method to arrive  at its estimated improper payment rate. The IG recommended that DOE  develop a system of controls to help ensure the sampling methodologies  used at the sites align with the methodology required in the department’s  IPERA reporting guidance. At that time, DOE concurred with the  recommendation. However, according to DOE officials, DOE decided not  to conduct statistical sampling in later years because IPERA does not  require that agencies perform statistical sampling as part of a risk  assessment.

section_title: DOE Headquarters Did Not Prepare Risk Assessments for Its Grant and Loan Programs for Fiscal Year 2011
paragraphs: DOE did not prepare required risk assessments for its grant and loan  programs for fiscal year 2011. As discussed previously, DOE officials told  us that DOE headquarters was responsible for evaluating the risks of its  grant and loan programs for improper payments for 2011. However, DOE  headquarters officials told us that they did not prepare the required risk  assessments for these programs for 2011. DOE headquarters officials  said they did not conduct a risk assessment on grant programs for 2011  because they were awaiting more detailed guidance from OMB on how to  assess grant programs under IPERA—specifically, whether to assess risk  at the primary or the subrecipient level. In terms of the loan programs,  DOE officials said that they held discussions with OMB and identified  strong financial controls and oversight associated with the Federal  Financing Bank that administers DOE’s loan payments and determined  that the existence of these controls provided a low risk of improper  payments in the loans area. Therefore, DOE officials concluded that a  separate risk assessment for loans was not warranted for fiscal year  2011. However, DOE did not provide documentation to support this  conclusion. Moreover, this is inconsistent with IPERA and OMB’s  implementing guidance, which requires federal agencies to review all  programs for significant improper payments, and DOE’s 2011 guidance,  which directs each payment site to complete a risk assessment.

In July 2014, DOE issued its IPERA risk assessment guidance for fiscal  year 2014 with a number of revisions. One revision directs payment sites  with cognizance over grants to report their known improper grant  payments. Another revision directs DOE’s Loan Guarantee Program  Office to prepare a risk assessment for DOE’s loan programs. In August  2014, DOE officials told us that cognizant payment sites will now be  responsible for considering grant payments in their risk assessments, and  that payment sites and the DOE Loan Office will explicitly address the risk  factors for grant and loan programs, respectively. If implemented  effectively, this revision to DOE’s guidance could address our findings  related to DOE not fully assessing its grant and loan programs.

section_title: DOE’s Fiscal Year 2011 Risk Assessments Did Not Always Include a Clear Basis for the Risk Determination
paragraphs: DOE’s fiscal year 2011 risk assessments did not always include a clear  basis for their risk determinations. For the 29 payment sites that prepared  risk assessments for fiscal year 2011, we analyzed them to determine  whether the risk assessments took into account the eight risk factors.

Based on our analysis of the risk assessment documentation provided,  we found that some payment sites did not take into account the eight risk  factors. For those that did, the support for their conclusions varied widely,  and some assessments did not contain enough information for us to  determine how the payment sites arrived at their risk determination.

Based on our analysis, we determined that at least 6 of the 29 sites that  prepared risk assessments did not take into account the eight risk factors,  making the basis of their risk assessment determinations unclear. For  example, one site’s risk assessment did not address the eight factors and  instead noted that it conducted a 100 percent payment review for all  invoices and thus determined that its risk of improper payments was low.  However, the risk assessment did not provide any information as to the  results of its invoice reviews. In another instance, a site’s risk assessment  consisted of two sentences noting that its account volume of payments  had not changed significantly and that its funding, authorities, practices,  and procedures, as well as the level and quality of training of its  personnel had not changed significantly. Based on this, the site  concluded it had a low amount of improper payments and had controls in  place to identify and record them. In a third instance, a site’s risk  assessment contained information on its internal controls indicating that  many of its payment processes were high risk. Specifically, this risk  assessment rated each of the subprocesses associated with payroll  administration, payables management, and travel administration as high  or medium risk. For example, under the payables management  subprocess, some of the high-risk areas that were noted include the  unauthorized approval of invoices; payments made without an approved  invoice; and invalid payees established in the payee data file.

Nonetheless, this site concluded that its risk of improper payments was  low, but it provided no additional clarification on how it arrived at this  conclusion.

Through our analysis, we also determined that at most the 23 remaining  payment sites submitted risk assessments that took into account the eight  risk factors. However, support for their conclusions varied widely, and  some assessments did not contain enough information for us to  determine how the payment sites arrived at their risk determination,  raising questions about who at DOE was responsible for reviewing and  approving risk assessments for consistency. DOE’s guidance directs its  sites to submit a risk assessment to DOE headquarters that incorporates  the eight factors in support of their risk determination. However, its  guidance does not provide further direction on what should be provided in  the assessment to address each risk factor. DOE officials told us that they  left it up to the payment sites to determine how to address the eight risk  factors. As a result, we found that the support provided to address each  risk factor was inconsistent, ranging from several paragraphs of narrative  to one sentence answers or “yes or no” responses. In some cases, we  could not determine how payment sites considered the eight risk factors  to arrive at a risk determination. For example, in one case, the risk  assessment was a table populated with a designation of high, medium, or  low for each of the eight risk factors by specific payment functions, such  as accounts payable, travel, and payroll. In this example, it was not clear  how the site arrived at the risk designations for each of the specific  payment functions or how the site weighted each risk designation to  arrive at a risk determination for the program.

DOE’s fiscal year 2011 IPERA guidance directed each site to provide a  copy of the risk assessment to support its risk designation, but it did not  specify how sites were to document the basis for their risk determinations.  Under the Standards for Internal Control in the Federal Government,  internal controls and all transactions and other significant events need to  be clearly documented. Based on our review of DOE’s risk assessments,  the documentation they contained did not always provide a clear basis for  the risk determinations. Instead, like the discussion of risk factors, the  support for risk determinations was inconsistent, ranging from several  paragraphs of narrative to mere designations of high, medium, or low risk  with no accompanying documentation. Absent clarification in guidance of  how payment sites are to address the eight risk factors and document the  basis for their risk rating determinations, DOE personnel may not have a  consistent understanding of how to complete risk assessments.

In addition, DOE’S fiscal year 2011 IPERA guidance did not specify who  at DOE was responsible for reviewing and approving risk assessments for  consistency with IPERA requirements and OMB and DOE guidance.  Under the federal standards for internal control, federal agencies are to  employ internal control activities, such as reviews by management at the  functional or activity level, and such activities include approvals,  authorizations, verifications, and reconciliations. As previously mentioned,  DOE officials told us that cognizant DOE field CFOs reviewed payment  site risk assessments. However, given the level of inconsistency we found  in our review of payment site risk assessments, it is unclear who was  reviewing the assessments. Without clarifying in guidance who at DOE is  responsible for reviewing and approving risk assessments for consistency  across sites, DOE may not have reasonable assurance that the  assessments are receiving the same level of oversight at each site.

As discussed previously, DOE issued new IPERA risk assessment  guidance in July 2014 with a number of revisions. Among other things,  these revisions are aimed at addressing inconsistencies in the risk  assessments. One revision directs payment sites to include a brief  explanation for each risk factor. DOE officials also told us in August 2014  that their IPERA training covers how payment sites are to perform risk  assessments. However, the 2014 guidance does not specify how  payment sites should address each factor and what documentation they  are to include in support of their risk determinations, which is inconsistent  with federal standards for internal control. As mentioned earlier, without  clarifying in guidance how payment sites are to address the eight risk  factors and document the basis for their risk rating determinations, DOE  cannot be assured that its personnel have a consistent understanding of  how to complete risk assessments. The 2014 guidance also does not  clarify who at DOE is responsible for reviewing and approving risk  assessments for consistency. Also mentioned earlier, without clarifying in  guidance who at DOE is responsible for reviewing and approving risk  assessments consistent with federal standards for internal control, DOE  may not have reasonable assurance that the assessments are receiving  the same level of oversight at each site. In addition, while DOE provided  training for its payment sites for its fiscal year 2011 IPERA reporting,  given the number of deficiencies we identified with that process, clarifying  the guidance could help prevent inconsistencies in future risk  assessments.

section_title: DOE’s Fiscal Year 2011 Risk Assessments Did Not Fully Evaluate Other Relevant Risk Factors
paragraphs: DOE’s risk assessments did not fully evaluate other relevant risk factors.  As previously stated, the eight risk factors do not necessarily represent all  of the risks for improper payments across all federal agency programs,  and OMB’s guidance describes these risk factors as the minimum that  agencies should consider. DOE’s 2011 IPERA guidance requires that  programs consider, at a minimum, the eight risk factors, but it does not  require programs to consider other factors that are specific to the program  being assessed. In particular, DOE’s guidance does not require programs  to consider, as part of their risk assessments, weaknesses in key controls  for preventing and detecting improper payments.

Control activities such as prepayment reviews and matching invoices with  receiving reports are important for preventing improper payments, and  contract audits—including subcontract audits and annual incurred cost  audits—are intended to be a key control for detecting improper payments.  However, the DOE IG found in April 2013 that, from 2010 to 2012,  subcontracts with a total value in excess of $906 million had either not  been audited by M&O contractors or had audits that did not meet audit  standards. The report further noted that the insufficient audit coverage  substantially increases the risk that improper payments will be incurred  and not detected in a timely manner. In addition, DOE officials told us that  contract audits, particularly for non-M&O contracts, are not always  performed in a timely manner. DCAA has traditionally performed contract  audits for DOE’s non-M&O contracts; however, a significant backlog of  audits at the Department of Defense has impacted DCAA’s ability to   Untimely contract  perform work for other agencies, including DOE.audits, regardless of the cause, represent a risk that improper payments  will not be identified in a timely manner. However, DOE’s 2011 guidance  did not require that programs consider risk factors related to internal  control weaknesses—such as untimely contract audits or inadequate  subcontractor oversight.

DOE’s fiscal year 2011 IPERA guidance states that programs must have  an effective system of internal control to prevent and detect improper  payments and to recover overpayments. The guidance also states that  key controls should be tested as part of OMB Circular A-123 evaluations.  A-123 is OMB’s Circular on reporting for internal controls and certain   DOE officials said that during DOE’s IPERA training,  financial risks.sites have been instructed to consider the results of the A-123  evaluations, which include evaluation of key risks and controls, when  determining susceptibility to high risk of improper payments. In addition,  DOE officials said that DOE headquarters CFO officials have reviewed A- 123 results across the department when determining the department’s  overall risk. However, DOE does not require programs to consider  weaknesses in its internal controls as part of its risk assessment. In our  review of DOE’s fiscal year 2011 risk assessments, of the 29 sites that  did risk assessments, at most, 10 included information stating that the  results of A-123 evaluations were considered as part of the risk  assessments. Information from A-123 evaluations on internal controls  could potentially provide information relevant to assessing the risk of  improper payments. However, based on the documentation provided in  the fiscal year 2011 risk assessments, it was not clear how many sites  considered the results of their A-123 evaluations and for those that did,  how those results were factored into the risk assessment.

In implementing Standards for Internal Control in the Federal  Government, management is responsible for developing the detailed  policies, procedures, and practices to fit agency operations and to ensure  that they are an integral part of operations. In addition, according to our  executive guide on strategies for managing improper payments, reducing  improper payments requires a strategy appropriate to the organization  involved and its particular risks. However, DOE’s 2011 IPERA guidance did not direct sites to augment the eight risk factors for a qualitative  evaluation with other risk factors that might be appropriate to a program  and its particular risks, so many of the payment sites did not fully consider  other risk factors.

In its July 2014 updated IPERA risk assessment guidance, DOE  recognized the need to address other risk factors relevant to agencies’  operating environments. One revision directs payment sites to consider a  ninth risk factor: Evaluate the inherent risk of improper payments due to  the nature of the agency’s programs/operations. The guidance states that  this new risk factor was added based on a 2014 draft revision of OMB’s  improper payments guidance. However, it is unclear how DOE’s  guidance will be implemented by the department’s payment sites because  the guidance does not provide specific examples of potential inherent  risks for improper payments—such as untimely contract audits or  inadequate subcontractor oversight—that all payment sites should  consider and this is not consistent with federal standards for internal  control and effective strategies included in GAO’s executive guide.  Without providing in its guidance specific examples of other risk factors  that present inherent risks likely to contribute to improper payments and  directing payment sites to consider those other factors when performing  their improper payment risk assessments, DOE will not have reasonable  assurance that its payment sites consistently consider other relevant risk  factors to fully evaluate risks.

section_title: For Fiscal Years 2012 and 2013, DOE Directed Programs to Report Less Information on Improper Payment Risks
paragraphs: In fiscal years 2012 and 2013, we found that DOE directed programs to  report less information on improper payment risks. Specifically, DOE  required fewer payment sites to report under IPERA and, for those sites  that were required to report, we found that DOE requested less  information on the risks of improper payments. DOE reported that it did  not have any programs susceptible to significant improper payments in  2011. As previously discussed, we found that DOE did not fully consider  program risks in its fiscal year 2011 risk assessments and included  unreliable data, which raises questions about whether the 2011  assessments were reliable. Nonetheless, because of its 2011  determination that it did not have programs susceptible to significant  improper payments, the department was not required under IPERA to  prepare risk assessments in 2012 and 2013. DOE elected to conduct  certain risk assessment related activities in fiscal years 2012 and 2013.  However, we found the risk assessment and other related information that  sites reported provided limited insight into the department’s risk of  improper payments.

In electing to conduct certain risk assessment related activities in fiscal  years 2012 and 2013, DOE required fewer sites to report and allowed the  remaining sites to provide more limited information on risk. Specifically,  for fiscal years 2012 and 2013, DOE’s guidance redefined its programs,  reducing the number from 55 to 43 payment sites by combining certain  contractor payment sites with payment sites managed by DOE. According  to DOE officials, for the purposes of IPERA reporting, cognizant DOE field  offices—which are themselves payment sites—are now responsible for  assessing risk for all non-M&O contracts. In addition, DOE’s fiscal year  2012 and 2013 guidance did not direct sites to submit risk assessments.  Instead, the guidance directed sites to (1) prepare an overall risk  assessment rating for the site of high, medium, or low based on the eight  risk factors and the amount of actual improper payments identified  through the normal course of business; (2) submit the overall risk rating  and known improper payment information to DOE headquarters CFO;  and (3) maintain any detailed risk assessment support or other detailed  support for the known improper payments data. DOE’s guidance included  a reporting template listing the eight risk factors and a place for payment  sites to indicate their overall risk rating, which DOE prepopulated with a  low risk rating. The template also included tables to report information on  known improper payments. According to DOE’s fiscal years 2012 and  2013 guidance, known improper payments include, among other things,  payments identified by a contractor’s internal accounting practices or  those identified during the course of IG audits.

Based on our review of the reporting templates that were submitted by  payment sites in fiscal years 2012 and 2013, we found that 4 payment  sites did not submit a reporting template in 2012, but that all sites  submitted a reporting template in 2013. In addition, we found that the  overall risk assessment rating for each payment site provides limited  insight into DOE’s risk for improper payments. Although DOE’s 2012 and  2013 guidance directed sites to maintain support for their overall risk  assessments rating, it did not require sites to submit supporting  documentation for their risk ratings. The low risk designation that all of the  sites provided in both years without supporting documentation did not  provide information on how those sites considered the eight risk factors,  how they weighed each factor against the others, or how they considered  the eight factors in relation to their improper payments data to arrive at  their overall risk rating.

We also found that DOE’s reporting of a program’s amount of improper  payments for fiscal years 2012 and 2013 also provided limited insight into  DOE’s risk of improper payments. IPERA and OMB guidance do not  require DOE to report total known improper payments and, although not  required to, DOE reports its total known improper payments annually in its  Agency Financial Report. DOE cites this reporting as evidence in  determining that its programs, and the department as a whole, are at low  risk for improper payments. For example, in its Fiscal Year 2013 Agency  Financial Report, DOE reported that it had identified $21.8 million in  improper payments made in fiscal year 2012 out of $46.5 billion in total  outlays. In reporting this number, DOE did not report the full extent of its  improper payments as it did not disclose information on prior year  improper payments. In addition, DOE did not disclose information on  settled costs, as shown in the following:

Prior year improper payments. According to DOE officials, the  amount of DOE’s total known improper payments does not include  known improper payments identified in prior years. This means that  improper payments that occurred in prior fiscal years but were not  identified until a later reporting year are not included. Thus, the $21.8  million in improper payments that DOE reported in its Fiscal Year  2013 Agency Financial Report only includes improper payments made  and identified during fiscal year 2012. Therefore, DOE’s reporting  does not provide the full extent of DOE’s total improper payments.  Specifically, DOE pays contractors throughout the year for services  performed, and those charges are subject to incurred cost audits to  ensure that they are allowable under the terms of the contract. If  charges are ultimately found to be unallowable by DOE, those  charges are considered improper payments under IPERA. The  process for ultimately determining that costs are unallowable can take  a considerable amount of time, and the amount of money involved  can be significant. For example, in April 2012 and October 2012, the  IG reported about $4.4 million in disallowed costs identified in fiscal  year 2012 related to prior year payments. However, this $4.4 million  was not included when DOE reported its known improper payments  for fiscal year 2012 in DOE’s Fiscal Year 2013 Agency Financial  Report.

Settled costs. DOE’s IG and contractor internal auditors have the  ability to question costs they find to be potentially unallowable under  the terms of a contract. Once costs have been questioned, DOE must  ultimately make a determination whether to allow or disallow those  costs. Before disallowing costs, the Federal Acquisition Regulation  requires agencies to “make every reasonable effort” to reach a  satisfactory settlement with the contractor. In one settlement  agreement we reviewed, the contractor agreed to reimburse DOE for  $10 million in questioned costs, referring to them as “potential  unallowable costs.” Because those costs are not explicitly identified as  unallowable in the settlement agreement, DOE does not consider  them improper under IPERA and therefore does not disclose them in  its reporting.

DOE officials told us that their reporting of current year known improper  payments in their Agency Financial Report is consistent with OMB  guidance. We recognize that DOE is reporting more information than is  required. However, citing an amount of improper payments without further  explanation is potentially misleading to external stakeholders, including  Congress and the public. According to federal standards for internal  control, effective communications should occur in a broad sense with  information flowing down, across, and up the organization.should ensure there are adequate means of communicating with, and  obtaining information from, external stakeholders that may have a  significant impact on the agency achieving its goals. By not disclosing  more information in its IPERA reporting about total known improper  payments, DOE does not allow readers, including congressional and  public stakeholders, to fully understand what the total known improper  payments amount represents and the extent to which this improper  payments total could potentially be more pervasive.

section_title: Conclusions
paragraphs: Recognizing the importance of assessing the risks of improper payments,  DOE issued new guidance in 2014 to address payment processes  involving non-M&O contractors, to clarify the way payment sites address  risk factors, and to consider inherent risks of improper payments due to  the nature of the agency’s programs/operations. These are positive steps,  but further efforts could help to more fully assess DOE’s risk of improper  payments and make more effective use of DOE and contractor resources.  Specifically, DOE’s 2014 guidance directs DOE field sites to consider the  payment processes of the non-M&O contractors they oversee when  completing required risk assessments. However, the guidance does not  specify that those sites should address the eight risk factors as they relate  to the non-M&O sites. We found that risk assessments for non-M&O  payment sites were not always conducted in fiscal year 2011. Without  directing in its guidance that sites address the eight risk factors as they  relate to the non-M&O contractor risk assessments, the sites cannot fully  assess the risk of improper payments, and DOE cannot fully understand  its risks for improper payments and take corrective actions to mitigate  such risks in the future. In addition, DOE’s 2014 guidance directs  payment sites to include a brief explanation for each risk factor supporting  the risk rating. However, the 2014 guidance does not specify how  payment sites should address each factor and what supporting  documentation to include as the basis for their risk rating determinations,  which is inconsistent with federal standards for internal control. Without  clarifying in guidance how payment sites are to address the eight risk  factors and document the basis for their risk rating determinations, DOE  cannot be assured that its personnel have a consistent understanding of  how to complete risk assessments. In addition, the 2014 guidance does  not clarify who at DOE is responsible for reviewing and approving risk  assessments for consistency. Without clarifying in guidance who at DOE  is responsible for reviewing and approving risk assessments consistent  with federal standards for internal control, DOE may not have reasonable  assurance that the assessments are receiving the same level of oversight  at each site.

Furthermore, DOE’s 2014 guidance directs payment sites to consider an  additional, ninth risk factor on inherent risks, in its risk assessments  beyond the previous eight risk factors that need to be considered to be  consistent with federal standards for internal controls and GAO’s  executive guide. However, it is unclear how DOE’s guidance will be  implemented by the department’s payment sites because the guidance  does not provide specific examples of potential inherent risks for improper  payments—such as untimely contract audits or inadequate subcontractor  oversight—that all payment sites should consider, and this is not  consistent with GAO’s executive guide. Without providing specific  examples in guidance of other risk factors that present inherent risks  likely to contribute to improper payments and directing payment sites to  consider those other factors when performing their improper payment risk  assessments, DOE will not have reasonable assurance that its payment  sites consistently consider other relevant risk factors. Finally, DOE  annually reports the amount of its total known improper payments and  cites this amount as a key reason why its programs and the department  as a whole are low risk. However, this amount provides limited insight on  the extent of improper payments and is potentially misleading. By  disclosing additional information in its IPERA reporting, DOE could better  position readers, including congressional and public stakeholders, to fully  understand what the total known improper payments amount represents  and the extent to which improper payments could potentially be more  pervasive.

section_title: Recommendations for Executive Action
paragraphs: To help improve its ability to assess the risk of improper payments and  make more effective use of DOE and contractor resources, we  recommend the Secretary of Energy direct the department’s Chief  Financial Officer to take the following four actions to revise the  department’s IPERA guidance: direct field office sites with responsibility for non-M&O contractor risk  assessments to address risk factors as they relate to those sites and  take steps to ensure sites implement it;  clarify how payment sites are to address risk factors and document  the basis for their risk rating determinations and take steps to ensure  sites implement it;  clarify who is responsible at DOE for reviewing and approving risk  assessments for consistency across sites and take steps to ensure  those entities implement it; and provide specific examples of other risk factors that present inherent  risks likely to contribute to significant improper payments, in addition  to the eight risk factors, direct payment sites to consider those when  performing their improper payment risk assessments, and take steps  to ensure sites implement it.

To provide better transparency regarding its total known improper  payments reported under IPERA, we recommend the Secretary of Energy  direct the department’s Chief Financial Officer to improve public reporting  on the amount of total known improper payments by disclosing additional  information regarding this amount and the extent to which improper  payments could be occurring.

section_title: Agency Comments and Our Evaluation
paragraphs: We provided a draft of this report to DOE for comment. In its initial  comments, DOE had concerns with our recommendation to disclose more  information on its total known improper payments number included in its  Agency Financial Report. In reviewing DOE’s initial comments, it was  clear there was a misunderstanding about the intent of the  recommendation. Subsequently, we discussed the recommendation with  DOE officials, clarified our intent, and modified the recommendation to  ensure that DOE discloses information on the extent of improper  payments that could be occurring. In its final comments, reproduced in  appendix II, DOE concurred with all five of our recommendations. DOE  also provided technical comments that were incorporated, as appropriate.

We are sending copies of this report to the appropriate congressional  committees, the Secretary of the Department of Energy, and other  interested parties. In addition, the report is available at no charge on the  GAO website at http://www.gao.gov. If you or your staff have any  questions about this report, please contact me at (202) 512-3841 or  trimbled@gao.gov. Contact points for our Offices of Congressional  Relations and Public Affairs may be found on the last page of this report.  GAO staff who made key contributions to this report are listed in   appendix III.

section_title: Appendix I: Objective, Scope, and Methodology
paragraphs: This report examines the extent to which the Department of Energy  (DOE) assesses its programs’ risks for improper payments. To determine  this, we reviewed the Improper Payments Elimination and Recovery Act  of 2010 (IPERA). For additional context, we also reviewed the Improper  Payments Information Act of 2002 and the Improper Payments  Elimination and Recovery Improvement Act of 2012. We examined the  Office of Management and Budget’s (OMB) and DOE’s IPERA guidance.  We reviewed relevant effective practices for conducting risk assessments  as described in our executive guide on strategies for managing improper  payments. Given the relevance and stated importance of DOE’s  Cooperative Audit Strategy, we analyzed the strategy and related  documents, including the DOE Office of Inspector General (IG) Audit  Manual, the DOE Financial Management Handbook, contractor incurred  cost audits, and IG reviews of those audits.

We interviewed key officials with the DOE headquarters Office of the  Chief Financial Officer (CFO). Specifically, we met with officials from the  Office of Financial Control and Reporting within the Office of the CFO,  which carries out DOE’s efforts to comply with IPERA by issuing guidance  and consolidating and reporting information annually in DOE’s Agency  Financial Report. We discussed DOE’s process for implementing IPERA,  including how payment site risk assessments were reviewed and  approved by DOE and how headquarters conducted risk assessments on  the grant and loan programs. We interviewed IG officials to discuss their  role in overseeing DOE’s IPERA implementation and DOE’s strategy to  oversee the auditing of its contractors’ incurred costs. We reviewed the  IG’s fiscal year 2011, 2012, and 2013 IPERA compliance audits, including  how they were conducted and their findings, conclusions, and  recommendations. We determined that these reports were sufficiently  reliable for the purposes of using them to support our results.

For fiscal years 2011 through 2013, we analyzed DOE’s IPERA reporting,  including qualitative risk assessments and quantitative information. We  choose to review fiscal years 2011 through 2013 because those were the  years subject to IPERA requirements for which we had available  documentation. We reviewed each risk assessment to determine if it (1)  contained narrative responses specifically taking into account the eight  factors; (2) provided a basis for the risk determination; and (3) if it was a  DOE field office, whether it specifically addressed the eight risk factors  with regard to any non-M&O contractors they oversee. We also  determined if the risk assessment documented consideration of  evaluations conducted pursuant to OMB Circular A-123. To assess the  reliability of financial data used in DOE’s payment site risk assessments,  we compared the figures reported in all payment site risk assessments  associated with known improper payments and outlays with the  aggregated figures contained in DOE’s Fiscal Year 2011 Agency  Financial Report. Where applicable and appropriate, we also compared  the figures reported in payment site risk assessments with the back-up  documentation provided by various specific DOE payment sites (or  “programs”). We assessed the reliability of financial data used in DOE’s  payment site risk assessments. To gain additional context related to  documenting these analyses, we also reviewed our Standards for Internal  Control in the Federal Government.

We visited two DOE field CFOs in Oak Ridge, Tennessee, and  Albuquerque, New Mexico, and with officials from DOE’s Oak Ridge  Financial Service Center. We chose these two locations because they  oversee IPERA reporting for M&O and non-M&O contracts that  accounted for about 28 percent of DOE’s IPERA reported outlays in fiscal  year 2013. In addition, we selected the Oak Ridge Financial Services  Center to visit because it handles all payments made to non-M&O  contracts. DOE’s 11 field CFO’s, in cooperation with site-located  contracting officers, oversee contactor and other activities in the field and  assist DOE headquarters in carrying out IPERA. We discussed how DOE  payment sites were implementing IPERA and how payment site risk  assessments were reviewed by DOE. During these trips, we also met with  six contractor site locations overseen by these field CFOs. These six  contractor locations include the following:

East Tennessee Technology Park;

Los Alamos National Laboratory;

Oak Ridge Associated Universities;

Oak Ridge National Laboratory;

Sandia National Laboratory; and

Y-12 National Security Complex.

We choose to visit these payment sites because they represent a cross  section of the types of contractor payments made at DOE and because  they accounted for about 38 percent of DOE’s total outlays in fiscal year  2013. At each payment site, we met with contractor CFO and internal  audit officials, as well as the cognizant DOE contracting officer. During  our meetings, we obtained perspectives from over 70 DOE and contractor  officials involved with IPERA reporting, including those that had prepared  or reviewed improper payment risk assessments. We also discussed the  guidance and direction provided by DOE to payment sites in  implementing IPERA, as well as consistency across DOE payment sites  in preparing risk assessments.

We reviewed prior GAO and IG reports that identified deficiencies in DOE  internal controls, such as subcontract audits and annual incurred cost  audits, including how they were conducted and their findings,  conclusions, and recommendations. We also reviewed the IG’s fiscal year  2011, 2012, and 2013 IPERA compliance audits, including how they were  conducted and their findings, conclusions, and recommendations. We  interviewed IG officials to discuss their prior reports and their role in  overseeing DOE’s IPERA implementation and DOE’s strategy to oversee  the auditing of its contractors’ incurred costs. We determined that these  reports were sufficiently reliable for the purposes of using them to support  our results.

section_title: Appendix II: Comments from the Department of Energy

section_title: Appendix III: GAO Contact and Staff Acknowledgments
subsections: section_title: GAO Contact

section_title: Staff Acknowledgments
paragraphs: In addition to the individual named above, Diane LoFaro (Assistant  Director), Cheryl Arvidson, Vaughn Baltzly, Mark Braza, Mark Keenan,  Jason Kirwan, Phillip McIntyre, Jeanette Soares, Kiki Theodoropoulos,  Nicholas Weeks, and William Woods made key contributions to this  report.


Question-summary annotations: questions: question: What process did DOE develop?
answer: The Department of Energy (DOE) developed a process to assess its programs for risks of improper payments, but its assessments do not fully evaluate risk.

question: How did DOE comply with the Improper Payments Elimination and Recovery Act of 2010?
answer: To comply with the Improper Payments Elimination and Recovery Act of 2010 (IPERA), in fiscal year 2011, DOE directed its programs to develop risk assessments using eight qualitative risk factors, such as recent major changes in program funding, and report quantitative information on improper payments.
child_questions: question: What flaws did GAO find in how the DOE directed its programs to develop risk assessments?
answer: GAO found that 26 of 55 programs did not prepare risk assessments in 2011 and that the quantitative information reported, including the estimated amount of improper payments, was not reliable because, for example, it did not include information for all programs.

questions: question: How well did DOE's programs account for the eight qualitative risk factors?
answer: DOE did not always include a clear basis for risk determinations . At least 6 of the 29 programs that prepared risk assessments did not take into account the eight qualitative risk factors, making the basis of their risk determinations unclear. At most, the assessments for 23 programs took into account the risk factors. However, support for their determinations varied widely, and some did not contain enough information to identify how the program arrived at its risk determination, which is inconsistent with federal standards for internal control.

question: What guidance does DOE provide for preparing risk assessments?
answer: DOE's guidance directs personnel to prepare a risk assessment that considers these eight factors but does not provide further direction on what to include.
child_questions: question: What results from DOE not providing further direction on what risk factors to include?
answer: Absent such direction, DOE personnel may not have a consistent understanding of how to complete their risk assessments.

questions: question: What relevant risk factors did DOE's risk assessments fail to fully evaluate?
answer: DOE's risk assessments did not fully evaluate other relevant risk factors, such as weaknesses in key controls for preventing and detecting improper payments—including inadequate subcontractor oversight.

question: What did GAO find?
answer: GAO found that some risk assessments included information from internal control evaluations, but many did not.

question: What is missing from DOE guidance?
answer: DOE guidance does not instruct personnel to consider weaknesses in key controls for preventing and detecting improper payments.
child_questions: question: Why is providing examples of other relevant risk factors important?
answer: Without providing specific examples of other relevant risk factors in guidance and directing personnel to consider them when performing risk assessments, DOE will not have reasonable assurance that each of its programs fully evaluates risks.

questions: question: What is a significant problem within the federal government?
answer: Improper payments are a significant problem in the federal government.
child_questions: question: How did IPERA address the problem of improper payments?
answer: To address this problem, IPERA requires that federal agencies review their programs and identify those that are susceptible to significant improper payments—a process known as a risk assessment.

question: Why did GAO designate DOE's contract management as a high-risk area vulnerable to fraud?
answer: DOE's history of inadequate management and oversight of its contractors led GAO to designate DOE's contract management as a high-risk area vulnerable to fraud, waste, abuse, and mismanagement.
child_questions: question: How did DOE respond to GAO's designation?
answer: However, DOE reported that it does not have any programs susceptible to significant improper payments.