Fraud Risk Management: OMB Should Improve Guidelines and Working-Group Efforts to Support Agencies' Implementation of the Fraud Reduction and Data Analytics Act
Released: 2018-12-04T00:00:00

Letter

Background

Fraud Risk Management

Fraud and “fraud risk” are distinct concepts. Fraud—obtaining something of value through willful misrepresentation—is a determination to be made through the judicial or other adjudicative system, and that determination is beyond management’s professional responsibility. Fraud risk exists when individuals have an opportunity to engage in fraudulent activity, have an incentive or are under pressure to commit fraud, or are able to rationalize committing fraud. Although the occurrence of fraud indicates there is a fraud risk, a fraud risk can exist even if actual fraud has not yet been identified or occurred. When fraud risks can be identified and mitigated, agencies may be able to improve fraud prevention, detection, and response. Managers of federal programs maintain the primary responsibility for enhancing program integrity and managing fraud risks. Those who are effective at managing their fraud risks collect and analyze data and identify fraud trends and use data and trends to improve fraud risk management activities. Implementing effective fraud risk management processes is important to help ensure that federal programs fulfill their intended purpose, funds are spent effectively, and assets are safeguarded.

The Fraud Risk Framework provides a comprehensive set of leading practices that serve as a guide for agency managers developing or enhancing efforts to combat fraud in a strategic, risk-based manner. The Fraud Risk Framework is also aligned with Principle 8 (“Assess Fraud Risk”) of the Standards for Internal Control. It is designed to focus on preventive activities, which generally offer the most cost-efficient use of resources since they enable managers to avoid a costly and inefficient “pay-and-chase” model of recovering funds from fraudulent transactions after payments have been made. The leading practices in the Fraud Risk Framework are organized into four components—commit, assess, design and implement, and evaluate and adapt—as depicted in figure 1.

FRDAA Requirements

Legislation and guidance has increasingly focused on the need for program managers to take a strategic approach to managing risks, including fraud. FRDAA was enacted to improve federal agency controls and procedures to assess and mitigate fraud risks, and to improve agencies’ development and use of data analytics for the purpose of identifying, preventing, and responding to fraud. FRDAA requires agencies to establish financial and administrative controls that incorporate the Fraud Risk Framework’s leading practices, including 1. conducting an evaluation of fraud risks and using a risk-based approach to design and implement financial and administrative control activities to mitigate identified fraud risks; 2. collecting and analyzing data from reporting mechanisms on detected fraud to monitor fraud trends, and using that data and information to continuously improve fraud-prevention controls; and 3. using the results of monitoring, evaluation, audits, and investigations to improve fraud prevention, detection, and response.

Further, agencies are required to annually report to Congress on their progress in implementing the act for each of the first 3 fiscal years after its enactment.

FRDAA required OMB, in consultation with the Comptroller General, to establish guidelines for agencies that incorporate leading practices from the Fraud Risk Framework as well as to establish a working group that shares best practices in fraud risk management. In addition, the working group is required to submit a plan to develop a federal interagency data analytics library for fraud risk management. This working group was also required to consult with the Offices of Inspector General and federal and nonfederal experts on fraud risk assessments, financial controls, and other relevant matters as well as to meet not fewer than four times per year. See figure 2 for additional details on FRDAA’s requirements and implementation timeline.

Agencies Have Taken Steps to Manage and Report on Fraud Risks as FRDAA Requires, but Have Identified Challenges

Agencies Indicated They Are Planning or Implementing Activities to Manage Fraud Risks

Agencies’ steps to manage fraud risks at the agency-wide level—and in response to FRDAA—are at varying stages of planning and implementation, according to our survey of agencies subject to the act. In our survey, we asked the 72 agencies subject to FRDAA to characterize (1) the overall status of their efforts to plan for and implement the act as “not started,” “started but not mature,” or “mature” and (2) whether they regularly undertook specific fraud risk management activities prior to and after FRDAA’s enactment. With respect to overall status, most surveyed agencies (85 percent) indicated that they have at least started planning how they will meet FRDAA requirements (started or mature), and about 78 percent indicated that they have also started or are mature in their efforts to implement the requirements. Fewer agencies, however, characterized either their planning or implementation efforts as “not started” (about 15 and 22 percent, respectively). See figure 3 for agency responses on their FRDAA planning and implementing efforts.

While most agencies indicated they have taken planning and implementation steps, agencies varied in the extent to which they indicated undertaking specific fraud risk management activities required by FRDAA at the agency-wide level, according to our survey results. We asked agencies whether they were currently performing key fraud risk management activities at the agency-wide level. The fraud risk management activities identified in the survey were an abbreviated version of the FRDAA requirements for agencies to establish financial and administrative controls, which included (1) conducting an evaluation of fraud risks and using a risk-based approach to design and implement financial and administrative control activities to mitigate identified fraud risks; (2) collecting and analyzing data from reporting mechanisms on detected fraud to monitor fraud trends and using that data and information to continuously improve fraud-prevention controls; and (3) using the results of monitoring, evaluation, audits, and investigations to improve fraud prevention, detection, and response. Most agencies (about 86 percent) indicated they use the results of monitoring, evaluation, audits, and investigations to manage fraud risk. Fewer agencies (about 63 percent) indicated they collect fraud-related data for prevention. Agencies also varied in the frequency with which they perform certain activities. For example, of the agencies that indicated that they collect fraud-related data for prevention, 44 percent indicated they do so regularly, while 18 percent indicated that they do so but not on a regular basis. See figure 4 for additional information on the frequency with which agencies indicated they perform fraud risk management activities related to FRDAA requirements for financial and administrative controls.

The majority of agencies we surveyed indicated that they were engaged in a variety of fraud risk management activities before FRDAA’s enactment, but a larger number indicated action in each of these activities since the law was enacted. For example, 86 percent of agencies indicated they used findings from monitoring, auditing, or evaluation of fraud risk activities after the enactment of FRDAA, compared with 79 percent of agencies that indicated they used such findings before FRDAA. See figure 5 for a comparison of the number of agencies reporting that they undertook fraud risk management activities before and after the enactment of FRDAA.

To identify relationships among survey responses associated with progress implementing elements of FRDAA and fraud risk management practices, we considered direction and strength of correlations between those questions. Agencies that indicated that they have started implementing FRDAA (85 percent) also reported higher use of some key fraud risk management activities, according to our analysis of the survey data. For example, agencies that indicated their implementation efforts were “mature” or “started but not mature” indicated at higher rates that they conduct risk-based evaluations of fraud risks and collect fraud- related data for prevention since the enactment of FRDAA. As mentioned, these activities are FRDAA requirements and are leading practices in the Fraud Risk Framework. These agencies also indicated at higher rates that they incorporated fraud risk activities into broader ERM, as directed by OMB Circular A-123. Further, while most (89 percent) agencies indicated having a designated entity for managing fraud risk, consistent with one leading practice identified in the Fraud Risk Framework, fewer (74 percent) have designated an entity specifically for FRDAA implementation. Agencies that indicated they had a designated entity for implementing FRDAA indicated that they were at a mature stage of FRDAA implementation more often than agencies without such an entity.

All CFO Act Agencies Reported on Their Progress Implementing FRDAA, but Reporting Varied in Completeness and Detail

Each of the 24 CFO Act agencies reported on their progress implementing FRDAA in their fiscal year 2017 annual financial reports to Congress, as FRDAA requires, but the reporting varied in completeness and detail. FRDAA specifies that, beginning in fiscal year 2017 and for the following 2 fiscal years, agencies must include the following 11 elements in their reports:

Agencies must report their progress implementing the financial and administrative controls required to be established by the agency, which include (1) conducting an evaluation of fraud risks and using a risk-based approach to design and implement financial and administrative control activities to mitigate identified fraud risks; (2) collecting and analyzing data from reporting mechanisms on detected fraud to monitor fraud trends and using that data and information to continuously improve fraud-prevention controls; (3) using the results of monitoring, evaluation, audits, and investigations to improve fraud prevention, detection, and response; (4) implementing the fraud risk principle as described in the Standards for Internal Control; and (5) implementing the OMB Circular A-123 section related to leading practices for managing fraud risk.

Agencies must report their progress identifying risks and vulnerabilities to fraud. These include (6) payroll, (7) beneficiary payments, (8) grants, (9) large contracts, and (10) purchase and travel cards.

Agencies must report their progress (11) establishing strategies, procedures, and other steps to curb fraud.

In August 2017, OMB updated its financial-reporting guidance in Circular A-136, Financial Reporting Requirements, with a section on FRDAA reporting requirements, including the reporting elements specified in the act. While the reporting requirements in FRDAA and OMB’s guidance list three categories of information, as noted above, we broke out the unique requirements in each category for our assessment. As a result, our analysis of the completeness of agencies’ annual financial reports is based on whether they contain each of 11 specific reporting elements. See appendix I (table 2) for additional information about these reporting elements.

The 24 CFO Act agencies each included fraud-reduction sections in their annual financial reports as FRDAA requires but, at times, the completeness and detail of reporting was limited because some reports did not completely address all of the elements specified in the act. Four agencies reported on all of the specified elements, 19 agencies reported on more than half of the specified elements, and 1 agency reported on fewer than half of the specified elements, according to our analysis. For example, each of the 24 CFO Act agencies reported on their progress in establishing financial and administrative fraud controls required by FRDAA and OMB Circular A-123, but 7 agencies did not report on progress in implementing the fraud risk principle in the Standards for Internal Control. In addition, some agencies did not report on their progress in identifying risks and vulnerabilities with respect to payroll, beneficiary payments, and other elements specified in the act. Specifically, 12 of the CFO Act agencies did not report on payroll, 11 did not report on beneficiary payments, 5 did not report on grants, 9 did not report on large contracts, and 7 did not report on purchase and travel cards. See figure 6 for an analysis of the inclusion of required FRDAA reporting elements in agency reports.

Variation in reporting on progress in identifying specific risks and vulnerabilities could result from some agencies’ determinations about their applicability to the agency. For example, some agencies that participated in our roundtable discussion noted that grant risks are not applicable to their agency because they do not have grant programs. However, this would not explain some areas of risk that are applicable to all agencies, but were not reported, such as payroll. As discussed later in this report, variation in reporting on progress in identifying specific risks and vulnerabilities may also be partly due to some agencies’ uncertainty about what information must be reported.

The reports also varied in terms of detail provided about agencies’ efforts, including specific actions taken to implement elements of FRDAA. For example, one agency reported that its efforts to comply with the fraud risk principle in the Standards for Internal Control included implementing enterprise risk management (ERM) and establishing a policy for having a common risk assessment tool to ensure consistency across the agency and to determine appropriate mitigation strategies for risks identified in all programs. Conversely, another agency reported that it updated an annual entity-level control assessment to comply with this principle, but the agency did not describe how this update achieved compliance. Without this detail in the report, it is not possible to determine the extent of the agency’s implementation progress, as we describe later in the report.

Further, most (16 of the 24 CFO Act agencies) included details about financial fraud risks but did not address nonfinancial fraud risks. For example, one agency reported it had low fraud risk and, as such, did not implement any new controls in response to FRDAA. As support, the agency provided examples of identifying no or limited financial fraud risks, and concluded that it did not have fraud risks to address. The agency did not discuss nonfinancial fraud. However, a 2016 GAO report identified this agency as having vulnerabilities to nonfinancial fraud that present national security risks. In addition, a 2017 report recommended that two agencies responsible for a program with national security–related responsibilities conduct joint fraud risk assessments to obtain comprehensive information on inherent fraud risks that may affect program integrity; provide reasonable assurance that their controls mitigate those risks; and ensure that fraud-prevention efforts target the areas of highest risk. However, one of these agencies did not mention nonfinancial fraud in its report. Further, neither agency identified this program in their report. As mentioned in the Fraud Risk Framework, nonfinancial fraud, such as fraudulently obtained credentials, can potentially facilitate other crimes related to national security such as international terrorism and drug trafficking. In addition, a leading practice of the Fraud Risk Framework is that managers consider nonfinancial effects of fraud, such as those related to the program’s reputation and compliance with laws, regulations, or standards. As discussed later in this report, these limitations in agency reporting may be partly due to limited guidance provided by OMB to agencies regarding the level of detail and type of information that should be included in the reports.

Agencies Identified Challenges Undertaking Fraud Risk Management Activities

Agencies identified challenges undertaking some fraud risk management activities required by FRDAA, according to our analysis of survey and roundtable responses. Top identified challenges were generally related to staffing and resources, among other things. These challenges may affect agencies’ ability to implement leading practices from the Fraud Risk Framework. Some roundtable participants also noted strategies for mitigating some of these challenges. The factors agencies most frequently indicated as great or moderate challenges in undertaking fraud risk management activities include the following:

Availability of resources. Agencies most frequently noted the availability of resources, such as staffing and funding to conduct fraud risk management activities, as a challenge to managing fraud risk. About 75 percent of agencies indicated in their surveys that this was a great or moderate challenge. Agencies that participated in our roundtable discussion identified similar “bandwidth” concerns related to staffing. For example, one agency noted the ability of staff to manage multiple responsibilities—such as conducting fraud risk management activities in addition to daily program-related activities— as a top challenge, especially within smaller units of the agency. Some agencies at the roundtable discussion told us that having the authority to use program-integrity funding for fraud risk management would help provide necessary resources to undertake fraud risk management activities required by FRDAA. However, one agency noted that this may not be a viable solution for all agencies, since not all agencies may receive additional program-integrity funding to conduct fraud risk management activities.

Limited tools and techniques for data analytics. Most agencies (about 68 percent) indicated that limitations in having and using tools and techniques for data analytics were a great or moderate challenge, according to our survey. Using data analytics to manage fraud risk is a leading practice in the Fraud Risk Framework. While one agency at our roundtable discussion told us that the agency does not have software to assist staff in performing data analytics, other agencies suggested leveraging free or existing resources to gain access to and use data tools. For example, one agency representative described the usefulness of the Department of the Treasury’s Do Not Pay Business Center. This agency representative noted that the Department of the Treasury can proactively analyze agency data it has received and share it with agencies. Another agency suggested that agencies ask their shared service providers to provide data analytics, provide insight, and benchmark against other agencies.

Lack of available expertise. The availability of staff with expertise to conduct fraud risk management activities also presents challenges for agencies. Leading practices in the Fraud Risk Framework include designating an antifraud entity that serves as the repository of knowledge on fraud risks and controls and increasing managers’ and employees’ awareness of potential fraud schemes through training and education. About 56 percent of agencies we surveyed, however, identified availability of staff expertise as a great or moderate challenge. Agencies that identified this as a challenge also more frequently indicated that they experience some other challenges associated with FRDAA implementation, such as understanding FRDAA requirements and implementation time frames; reporting on implementation progress in the annual financial reports; and sufficiency of other information or tools to aid in implementation. During the roundtable discussion, some agencies also described having a staffing gap where data-analytic skills were concerned. In response to this challenge, one agency moved its centralized antifraud unit to a newly created, more-experienced unit within the agency to increase the antifraud unit’s capacity to conduct data- analytics reviews.

Access to data and information. A majority of agencies also identified having access to data to look for fraud or fraud indicators as a challenge. About 55 percent of agencies indicated that access to data is a great or moderate challenge to their ability to implement fraud risk activities. Agencies that participated in our roundtable discussion also told us that access to data is a key challenge associated with implementing FRDAA requirements. For example, one agency stated that the Privacy Act presents a challenge to data matching that may limit agencies’ ability to share data with one another, such as Social Security numbers involved in potentially fraudulent activity that could cut across multiple agencies. This challenge is not new. In our July 2013 report on using data analytics for oversight and law enforcement and in our March 2017 report on using data analytics to address fraud and improper payments, we reported on similar perceived challenges from other agencies and organizations regarding data sharing among agencies.

Some agencies at the roundtable discussion also stated that they did not receive information from their respective Office of Inspector General that would help them manage fraud risks and implement FRDAA. The Fraud Risk Framework highlights the role of the Office of Inspector General in agencies’ fraud risk management activities. According to the framework, the Office of Inspector General itself should not lead or facilitate fraud risk assessments, in order to preserve its independence when reviewing the program’s activities. However, the framework notes that program managers and their Office of Inspector General should collaborate and communicate to help improve understanding of fraud risks and identify emerging fraud risks, in order to proactively enhance fraud-prevention activities. While one agency at the roundtable discussion identified the lack of information from their Office of Inspector General limiting their ability to address fraud risks, some agencies appear to be reaching out to their respective Offices of Inspector General for this information. We spoke with the Council of the Inspectors General on Integrity and Efficiency, which comprises representatives of Offices of Inspector General in the executive branch. During the Council of the Inspectors General on Integrity and Efficiency meeting, representatives from three agency Inspectors General told us that their agencies reached out to them to discuss fraud, such as how an agency can use databases to look for fraud. At least one representative expected to coordinate with the representative’s agency to strengthen internal controls as the agency continues to implement FRDAA.

OMB Established Guidelines and a Working Group as Required by FRDAA, but Limited Details and Coordination Hindered Agencies’ Implementation of the Act

OMB has taken steps to establish guidelines and a working group for agencies, as required by FRDAA, but limited guidelines and working- group coordination hindered some agencies’ implementation of the act. Specifically, OMB issued guidelines for agencies to implement FRDAA’s requirement to establish controls and report on their progress and has established a FRDAA working group, but agencies indicated the need for additional guidance and involvement in working-group activities. Our analysis of survey responses, roundtable discussion results, and agencies’ annual financial reports indicates that (1) agencies had mixed perspectives on the usefulness of OMB’s guidelines for agencies to establish controls; (2) limited details in OMB’s reporting guidelines contributed to CFO Act agencies’ incomplete and insufficiently detailed annual financial reports; and (3) agencies had challenges implementing FRDAA in part due to their lack of involvement in and lack of communication from the working group. In addition to FRDAA, OMB has issued guidance on other government-wide reform and burden-reduction initiatives that could shape how agencies address FRDAA implementation, such as reforms that may change the structure of agencies and related programs or how agencies collect data used in managing fraud risks. While it is still too early to determine the effect of these broader initiatives on agencies’ efforts to implement FRDAA, we have previously reported that broader reform efforts can be leveraged by OMB and agencies to address the high-risk areas and government-wide challenges that present vulnerabilities to fraud, waste, abuse, and mismanagement.

OMB Updated Existing Guidelines to Meet FRDAA Requirements, but Agencies Have Mixed Perspectives on the Guidelines’ Usefulness

To comply with FRDAA, OMB updated existing guidelines for agencies to establish financial and administrative controls to manage fraud risks, but agencies indicated having challenges with the usefulness of these guidelines, according to our survey and roundtable discussion results. Specifically, OMB incorporated guidelines to meet FRDAA requirements into its July 2016 update of Circular A-123, Management’s Responsibility for Enterprise Risk Management and Internal Control, within 90 days of enactment, as required by the act. This particular update of Circular A-123 introduced requirements for agencies to implement ERM and integrate with existing internal control capabilities to improve mission delivery, reduce costs, and focus corrective actions on key risks. The update to Circular A-123 also included a discussion of the Fraud Risk Framework and aligned internal control processes with the 2014 update to the Standards for Internal Control—such as the reference to the fraud risk principle (Principle 8)—which OMB staff stated provided agencies with a broad context for why fraud risk management is expected of agencies.

According to OMB staff, including the reference to the Fraud Risk Framework in the circular met the FRDAA requirement to issue guidelines for agencies to establish financial and administrative controls to identify and assess fraud risks. The guidelines have a section on “Managing Fraud Risks in Federal Programs” that encourages agencies to develop the same financial and administrative controls that are listed in FRDAA requirements. This section also directs agencies to adhere to the leading practices described in the Fraud Risk Framework as part of their efforts to effectively design, implement, and operate an internal control system that addresses fraud risks. However, based on our review of the guidance, because FRDAA is never mentioned in the guidelines, there is a risk that agencies may not be aware that the guidelines directly apply to implementing FRDAA’s requirement to establish financial and administrative controls. In addition, OMB’s guidelines provide limited information related to steps that agencies should take to implement FRDAA’s requirement to establish financial and administrative controls, according to our review of the guidelines.

Agencies indicated having mixed views on the sufficiency of OMB’s guidelines. For example, 65 percent of the agencies surveyed indicated that OMB’s Circular A-123 guidelines were moderately or very useful. However, 40 percent of the agencies surveyed also identified the sufficiency of OMB’s guidelines as a great or moderate challenge in implementing the act. Among other things, these challenges included agencies’ uncertainty about how ERM and FRDAA requirements differ, given that OMB included the guidelines for managing fraud risk as a subsection of ERM requirements. These challenges contributed to agencies’ lack of clarity, among other things, on the actions they should take to implement FRDAA, as described below.

Challenges using OMB guidelines to implement FRDAA’s requirement to establish controls. Some agencies indicated that using OMB guidelines for FRDAA implementation was a challenge, according to our analysis of survey responses. Specifically, 40 percent of agencies indicated the sufficiency of the guidelines was a great or moderate challenge to their implementation efforts. CFO Act agencies reported this challenge more often than non–CFO Act agencies (61 and 30 percent, respectively).

Selected Agency Officials’ Perspectives on Office of Management and Budget (OMB) Fraud Reduction (FRDAA) and Data Analytics Act of 2015 Guidelines “What does compliance mean specifically when it comes to FRDAA?” “aving looked at other guidance that’s come out of OMB, particularly like the DATA Act or even ERM [enterprise risk management], there was lots of guidance. . . . In this particular case I think it has not been as robust”

Lack of guidance and unclear requirements were also identified as top challenges in our roundtable discussion on implementation of FRDAA required controls. For example, some roundtable participants stated that clearer requirements, such as information on what activities would be considered compliant with the act, would be helpful to better implement FRDAA. In particular, two agencies identified grants and contracts as an area where additional guidance on managing fraud risks would be helpful.

In contrast, a theme of the roundtable discussion was that there were trade-offs in having clarity on the objectives and having the flexibility to tailor requirements to different programs. One roundtable participant said that agencies had different definitions of fraud and that it would be difficult to create standardized tools that met every agency’s needs. In order to better understand what steps they should take to implement the controls required by FRDAA, two roundtable participants sought out alternative sources of information to determine whether they were complying with Circular A-123, such as a previously issued GAO report on the Fraud Risk Framework. Other roundtable participants described using non-OMB guidance to implement FRDAA, such as the ERM playbook developed by the CFO Council and Performance Improvement Council, and materials developed by the Association of Certified Fraud Examiners. While relying on other sources of information can be helpful, agencies that do not have knowledge of or access to additional resources such as these may not have sufficient information to effectively implement the act. This point is underscored by the 40 percent of agencies that identified the sufficiency of OMB’s guidance as a great or moderate challenge to their implementation of FRDAA.

Selected Agency Officials’ Perspectives on Office of Management and Budget Fraud Reduction and Data Analytics Act of 2015 (FRDAA) Guidelines “I would like some clarification on the intent of , like what will it achieve that the other A-123 or ERM [enterprise risk management] is not achieving?”

Uncertainty about the difference between ERM and FRDAA requirements. Many agencies are leveraging existing ERM processes to implement fraud risk activities, according to our survey results, but OMB guidelines were unclear on the relationship between FRDAA and ERM requirements, according to our review of the guidelines and roundtable discussion responses. Under ERM, agencies are required to assess the full spectrum of an organization’s risks, and identify those that are enterprise-level risks. For enterprise risks, agencies are expected to rate those risks in terms of impact and build internal controls to monitor and assess the risk developments at various time points and incorporate risk awareness into the agencies’ culture and operations. Our survey results indicate that more agencies (56 percent) are currently incorporating fraud risk activities into broader ERM compared with before FRDAA enactment in June 2016 (34 percent). Additionally, some roundtable participants stated that they leveraged their existing ERM process and teams to implement FRDAA’s control requirements. While Circular A-123 directs agencies to assess fraud risks as part of a broader assessment of enterprise risk, it does not provide information on how ERM and fraud risk management requirements differ. For example, it does not clarify that FRDAA encompasses a broad set of actions that agencies must take to manage fraud risks, regardless of whether the fraud risk is identified as an enterprise risk.

Additionally, Circular A-123 does not specify how to implement the strategies identified in the Fraud Risk Framework within the context of ERM. According to the circular, managers should adhere to the leading practices identified in the framework and are responsible for determining the extent to which the leading practices are relevant to their program. Managers are also responsible for tailoring the practices to align with the program’s operations. While the Fraud Risk Framework does state that the leading practices can be tailored, it enumerates four components and overarching concepts that are necessary for an effective risk management approach. These four components of the framework— commit, assess, design and implement, and evaluate and adapt— collectively encompass the control activities for managing fraud risks and, as outlined in the framework and Standards of Internal Control, should be present in some form to be effective. Therefore, even if agency officials identify fraud risks in a particular program that are not determined to be enterprise-level risks, the officials are still responsible for designing and implementing controls to address them and evaluating and adapting improvements to these controls over time, in line with the Fraud Risk Framework requirements. However, OMB staff informed us that if a fraud risk does not rise to the level of an enterprise risk for an agency in the ERM process, the agency may not go through all of the steps outlined in the Fraud Risk Framework or required by FRDAA to assess and respond to that risk. The Fraud Risk Framework acknowledges that agencies may use initiatives like ERM efforts to assess their fraud risks, but it does not eliminate the separate and independent fraud risk management requirements of FRDAA.

In response to our draft report, OMB staff stated that other parts of Circular A-123 helped to fulfill their requirement to establish guidelines for agencies to establish financial and administrative controls. According to OMB, if agencies identify fraud risks that are not discussed in ERM, they will still be addressed by the broader risk management requirements in Circular A-123. These other sections of Circular A-123 existed prior to FRDAA and therefore, were not developed in response to FRDAA’s requirement that OMB establish guidelines for agencies. However, our review of Circular A-123 found that there are some references to managing fraud risks that are in alignment with the spirit of the financial and administrative controls identified in FRDAA. For example, other sections of Circular A-123 describe requirements for agencies to develop a risk profile and state that agency risk profiles must include an operational objective related to administrative and major program operations, including financial and fraud objectives. Further, agencies should identify the existing management process that will be used to implement and monitor proposed actions to address the risks. However, according to Circular A-123, these sections of the document define management’s responsibilities for ERM, which is focused on enterprise level risks. Further, these sections of Circular A-123 do not encourage agencies to incorporate the leading practices outlined in the Fraud Risk Framework to manage their fraud risks, as required by FRDAA.

According to OMB staff, if agencies identify fraud risks that are not discussed in ERM, they will still be addressed by the broader risk management requirements in Circular A-123. These other sections of Circular A-123 existed prior to FRDAA and therefore were not developed in response to OMB’s requirement to provide guidance on FRDAA. However, our review of Circular A-123 found that there are some references to managing fraud risks that are in alignment with the spirit of the financial and administrative controls identified in FRDAA. For example, other sections of Circular A-123 describe requirements for agencies to develop a risk profile and state that agency risk profiles must include an operational objective related to administrative and major program operations, including financial and fraud objectives. Further, agencies should identify the existing management process that will be used to implement and monitor proposed actions to address the risks. However, according to Circular A-123, these sections of the document define management’s responsibilities for ERM, which is focused on enterprise-level risks. Further, these sections of Circular A-123 do not encourage agencies to incorporate the leading practices outlined in the Fraud Risk Framework to manage their fraud risks, as required by FRDAA.

In addition, OMB staff stated that they believe that, along with Circular A-123, the Standards for Internal Control and the Fraud Risk Framework provide all the guidance that agencies need to implement and comply with FRDAA. However, based on the results of our survey and roundtable, we informed OMB that agencies reported experiencing confusion about the similarities and differences between FRDAA and other requirements, including ERM. According to OMB staff, Circular A- 123 and its focus on ERM is the appropriate place for the FRDAA guidelines because fraud is one type of risk an agency might face. However, OMB staff noted that it is the agencies’ responsibility to determine how to implement the act’s requirements in a way that aligns with the agency’s mission, and accordingly does not have immediate plans to update Circular A-123 to provide more-detailed guidelines for agencies to implement the financial and administrative controls required by FRDAA.

The Standards for Internal Control state that management should implement control activities through policies. Documentation of responsibilities through policies and periodic review of control activities contribute to the design, implementation, and operating effectiveness of control activities. In addition, management should externally communicate the necessary quality information to achieve the entity’s objectives. These standards are practices that can assist any entity that is providing guidance to agencies with ensuring that intended objectives are accomplished. To better understand the type and level of detail in guidance that agency managers need to implement management controls, OMB and other similar oversight bodies often seek input and comments from agencies on draft guidance. In this case, OMB staff has not provided evidence that it consulted with agencies on whether the update to Circular A-123 met their needs in implementing FRDAA. While OMB staff stated they held three solicitations for agency comments on a draft update of Circular A-123 prior to FRDAA’s enactment, they did not obtain input from agencies on whether the updates provided the guidance agencies needed to implement the controls in FRDAA’s final enacted requirements.

Without input from agencies, OMB does not have the information it needs to determine what additional guidance agencies need to effectively implement the controls required by the act. In addition, without clarifying that FRDAA’s requirements must be addressed for all fraud risks— including those that agencies may have assessed and determined are not enterprise-level risks—agencies may not follow through on the additional steps of designing, implementing, evaluating, and improving controls for their remaining fraud risks. Lastly, without additional detailed guidelines for implementing FRDAA’s control requirements, agencies will continue to lack clarity on the actions they should take to effectively implement the act.

OMB’s Guidelines on FRDAA Reporting Requirements Lack Information Needed for Agencies to Produce Complete and Detailed Reports

OMB updated existing guidelines to include a section on FRDAA reporting requirements, but did not include enough information to effectively assist agencies in producing complete and detailed reports, according to our analysis of annual financial reports and survey and roundtable responses. FRDAA directs agencies to report to Congress on the progress of FRDAA implementation in their annual financial reports for each of the 3 fiscal years after enactment. Although FRDAA does not require OMB to establish guidelines for agencies to comply with the act’s reporting obligations, OMB generally provides guidance to support agencies’ annual financial-reporting requirements in Circular A-136, Financial Reporting Requirements, and accordingly updated this guidance to include a section on FRDAA reporting requirements first in August 2017 and again in July 2018. There were no significant changes to the FRDAA section of Circular A-136 in the July 2018 update.

Agencies are to include in their annual financial reports to Congress their progress in: (1) implementing the financial and administrative fraud controls as required by FRDAA, the fraud risk principle in the Standards for Internal Control, and the OMB Circular A-123 section related to leading practices for managing fraud risk; (2) identifying risks and vulnerabilities to fraud, including with respect to payroll, beneficiary payments, grants, large contracts, and purchase and travel cards; and (3) establishing strategies, procedures, and other steps to curb fraud. However, as previously discussed, our analysis of the 24 CFO Act agencies’ annual financial reports found that many reports issued in 2017—the first year of reporting—were incomplete and lacked detail. Some agencies did not report on their progress in identifying risks and vulnerabilities with respect to payroll, beneficiary payments, and other elements specified in the act and did not address nonfinancial fraud risks. In addition, according to our survey results, some agencies considered reporting on implementation progress in the annual financial reports a challenge. Specifically, 31 percent of agencies indicated that reporting was a great or moderate challenge, see figure 7.

Further, some of our roundtable participants indicated that they needed more detailed guidance on what should be reported to comply with FRDAA. In the absence of more-detailed guidance from OMB, some agencies turned to each other for help. For example, some roundtable participants indicated that they looked at other agencies’ annual financial reports to see what they were reporting. While relying on other agencies’ reports can be helpful, agencies may be reviewing incomplete information based on our review of the annual financial reports, and may not have appropriate examples of how FRDAA information should be reported.

OMB’s guidance to agencies on FRDAA reporting did not include information on the level of detail agencies should report. The FRDAA section of Circular A-136 is a near-exact replication of the reporting elements listed in FRDAA and specifies the period in which agencies are to report on their progress implementing FRDAA. According to OMB staff, they included the content of FRDAA verbatim in Circular A-136 because the reporting requirements are outlined in the act. However, the act provides high-level information on what should be included in agency reports, not operational guidance on how to address the reporting requirements, which is typically outlined in executive guidance to agencies. Further, OMB staff informed us that they instructed agencies to provide a status update of fraud-reduction efforts undertaken in the final quarter of fiscal year 2016 through fiscal year 2017, but did not provide agencies with any specific guidance on how detailed that reporting should be in their annual financial reports. The Standards for Internal Control state that management should implement control activities through policies and documentation and externally communicate the necessary quality information to achieve the entity’s objective. Until OMB provides additional guidelines directing agencies to report more-complete and more-detailed information related to their progress on both financial and nonfinancial risks, some agencies may continue to report incomplete information on their full range of fraud risks and activities they are performing to manage these risks.

On the basis of the limitations we identified in agencies’ annual financial reports, Congress and OMB do not have complete and detailed information about agencies’ progress implementing FRDAA’s requirements to establish fraud controls as intended by the act. For example, as previously mentioned, 12 of the 24 CFO Act agencies did not report on payroll fraud risks, which are applicable to all agencies, and 16 did not report on nonfinancial risks such as effect on reputation and compliance with laws, regulations, or standards. The agency reporting requirement was intended to help Congress monitor the progress made by agencies in addressing and reducing fraud risk, including the success or failures of the guidelines created by OMB as a result of the act. Similar to reporting requirements for improper payments, agencies’ reports on their progress implementing FRDAA serve as important oversight tools that can be used to evaluate agency efforts to make needed changes to their processes and policies. In the absence of additional OMB guidelines that include more-complete and more-detailed information for reporting on both financial and nonfinancial risks, some agencies may continue to produce incomplete information on their full range of fraud risks and fraud risk management activities. However, as noted, OMB did not make changes to the FRDAA section in its July 2018 update of Circular A-136, which might have informed agencies’ 2018 reporting efforts.

On the basis of FRDAA’s requirements, Congress sought 3 years of reporting on FRDAA implementation, and therefore agencies’ obligation to report on their progress expires after fiscal year 2019. Even if OMB makes changes to its guidelines in 2019 to support more-complete and more-detailed reporting, agencies would report only one time after that— in their 2019 annual financial reports, due in November 2019. We have previously reported on the importance of reporting information that helps facilitate proper stewardship of federal resources, congressional oversight, transparency, and public accountability, among other things. Without an extension of reporting requirements, Congress will not have access to useful information through this reporting mechanism to support oversight and accountability of agencies’ progress implementing the fraud risk management practices required by FRDAA.

OMB Established a Working Group, but Agencies Identified Involvement and Information Sharing as Challenges

OMB established a working group of agencies as required by FRDAA, but has not met all of the requirements for the working group, such as those related to member composition, and meeting frequency. As a result of these and other working-group limitations, agencies identified a lack of involvement in and limited information sharing from the working as two of the top challenges to implementing the act. As required, OMB established a working group within 180 days of enactment to improve the sharing of financial and administrative controls and other best practices for detecting, preventing, and responding to fraud, including improper payments, and the sharing and development of data-analytics techniques. OMB also submitted to Congress—but not within 270 days of enactment—a plan for the establishment and use of a federal interagency library of data analytics and data sets to facilitate fraud risk management. However, OMB did not initially include the CFO of each agency in earlier working-group meetings, or, according to OMB, meet four times per year in 2017 as required. The working group also did not effectively facilitate the sharing of controls, best practices, and data-analytics techniques, according to our survey results and roundtable discussion. OMB encountered challenges that limited its ability to fulfill some of these requirements, but did not take the necessary actions to implement others.

Plan for data library. In May 2017, OMB submitted a letter to Congress describing the working group’s plan to use a phased approach to establish a federal interagency library of data analytics and data sets, as required by FRDAA. However, OMB did not do so within 270 days of enactment, as required by FRDAA. According to OMB’s letter, the working group is taking a phased approach to develop the plan to establish an interagency data library and took some steps, but identified challenges in the process. When developing the plan, the working group identified two challenges to developing the interagency data library: (1) standardizing how agencies define fraud in their programs, and (2) developing a fraud taxonomy to accurately compile fraud risks and categories. According to the letter, to address these challenges, the working group is creating a fraud-classification system that leverages the existing Association of Certified Fraud Examiners fraud-classification system. OMB’s letter also states that the working group performed an initial inventory of existing tools and materials that will be used to populate the first phase of the library, which is currently located in the OMB MAX Information System. According to the letter, the working group is partnering with agencies to identify a permanent location for the library as well as to develop future enhancements based on the needs of agencies. OMB stated in the letter that it plans to provide Congress additional information once the next phase of the library is implemented.

Working-group composition. FRDAA requires the working group to include the CFO of each agency. OMB, in its role as Chair, did not involve all of the relevant agencies in the working group by inviting them to participate or otherwise providing access and input into the working group as required by FRDAA, according to agencies we surveyed and our assessment of OMB documents. In addition to the statutory requirement, we have previously reported that early outreach to participants to identify shared interests is a key practice for enhancing interagency collaboration. However, OMB’s initial working-group efforts in particular did not include some CFO Act agencies or most non–CFO Act agencies subject to FRDAA, representing missed opportunities to share practices and collaborate on ways to advance federal efforts to reduce fraud, waste, and abuse. While the May 2017 letter to Congress states that the CFO from every agency was invited to participate in the working group, OMB staff later noted that only the 24 CFO Act agencies and the Small Agency Council representative from the CFO Council were invited to the working-group meetings. OMB staff indicated that they did not independently reach out to non–CFO Act agencies to invite them to participate because they believed the Small Agency Council representative was responsible for communicating this information to its members. Nevertheless, FRDAA requires the working group to include the CFO of each agency subject to the act, as well as other parties determined to be appropriate by OMB.

According to our survey results, about half of the agencies subject to FRDAA were not at all familiar with the working group and about two- thirds did not have an entity responsible for participating in it. Non–CFO Act agencies indicated these responses more often than CFO Act agencies. Specifically, 71 percent of non–CFO Act agencies indicated they were not at all familiar with the working group compared with 21 percent of CFO Act agencies. In addition, 90 percent of non–CFO Act agencies indicated they did not have a designated person or entity participating in the working group, compared with 29 percent of CFO Act agencies (see fig. 8).

Similarly, two roundtable participants stated that they thought the working group was geared towards the CFO Act agencies. Most of the CFO Act agencies that participated in our discussion noted that they had been involved in the FRDAA working group. In contrast, almost all of the non– CFO Act agencies that participated in our discussion stated that they were not aware of the working group.

Selected Non–Chief Financial Officers (CFO) Act Agency Officials’ Perspectives on Lack of Communication from and Participation in the Working Group “There’s been nothing that I’m aware at Small Agency Council level that’s had meetings or anything to give extra guidance … and I think that would have been very helpful. In most things in small agencies we wait for things to trickle down from the larger agencies if OMB [Office of Management and Budget] doesn’t give us guidance, and we just haven’t gotten any sort of feedback.”

It is also unclear how many and which CFO Act agencies attended the working-group meetings. In particular, OMB and agencies provided conflicting information about which agencies attended the working-group meetings. For example, according to one CFO Act agency roundtable participant, the representative was invited to the first meeting and not invited to the next. The participant further stated that the agency recently started to receive information from OMB. However, the information OMB provided about this agency’s involvement in working-group meetings conflicted with this participant’s description of the agency’s attendance at the first four meetings.

Agencies identified the lack of involvement in the working group as one of the top challenges to implementing FRDAA. Most CFO and non–CFO Act agencies indicated that their lack of involvement was a moderate or great challenge to implementing FRDAA (see fig. 9). Agencies that indicated having these challenges also more frequently reported challenges with sharing best practices and data-analytics techniques about fraud with other agencies, which was the purpose of the working group. The need for this coordination underscores the importance of identifying shared interests and developing collaborative solutions to help achieve outcomes.

OMB and the working group did consult with the Offices of Inspector General on fraud risk matters, as required by FRDAA, by including them in working-group meetings. In OMB’s May 2017 letter to Congress, the agency reported that the working group coordinated with the Council of the Inspectors General on Integrity and Efficiency and other interagency working groups to discuss and share best practices in mission-specific areas. In addition, two agencies’ Offices of Inspector General are listed as having attended the first four working-group meetings. This coordination between the working group and Inspectors General—who often identify and investigate instances of fraud in agencies—is a positive step for the working group. Inspectors General may be able to provide agencies with information that can assist the agencies in analyzing data for potential fraud, such as fraud indicators. In addition, we have previously reported that if collaborative efforts, like the working group, do not consider the input of all relevant stakeholders, important opportunities’ for achieving outcomes may be missed.

Frequency of meetings. The working group did not meet the FRDAA requirement to hold at least four meetings per year. OMB staff stated that there have been eight working-group meetings to date—one in 2016, three in 2017, and four in 2018—but these meetings do not meet the FRDAA requirement to meet at least four times per year in 2017. As of October 2018, OMB has shown improvements towards meeting this particular FRDAA requirement in 2018. Specifically, the working group has met at least four times in fiscal year and calendar year 2018, as of October 2018.

Vacant appointment positions at OMB and the agencies have slowed efforts to establish the working group, according to OMB staff. FRDAA requires the OMB Controller to serve as the chairperson of the working group, but as of October 2018 the Senate has not made a confirmation for this position. During the roundtable discussion, one participant shared that there was a period when there was no OMB leadership and the working group was largely silent for months. According to OMB staff, it has also been difficult to establish agency membership of the working group due to the lack of confirmed CFOs at some of the 24 CFO Act agencies. As of September 2018, 7 of the 24 CFO Act agencies did not have a CFO. However, OMB and the working group could have held the required minimum number of meetings regardless of OMB and agency vacancies, as evidenced by the seven meetings that were held in the midst of these vacancies. Further, according to OMB staff, aside from the first meeting led by the former Controller, all working-group meetings have been led by the Deputy Controller and other OMB staff, while the Controller position was vacant.

Information sharing about controls, best practices, and data- analytics techniques. It is unclear whether OMB, as chair of the working group, documented working-group meetings or any work products that were developed to facilitate sharing information about financial and administrative controls, best practices for fraud management, and data- analytics techniques. OMB staff stated that they do not have documented minutes or notes from working-group meetings, but in August 2018 stated that they uploaded work products to the FRDAA federal community site on the MAX Information System website. However, apart from two screenshots of the MAX website provided to us in February 2018, which indicated that a fraud taxonomy was among the materials produced by the working group, we were not able to obtain documentation of these work products. We have previously reported that one key practice for enhancing and sustaining agency collaboration is using plans and reports to reinforce accountability for collaborative efforts. Without documented discussions, plans, or reports for these collaborative meetings, OMB is unable to share the lessons learned from the meetings with those who cannot attend, and does not have a record of the plans and actions that the working group has agreed to take. This documentation is also important to maintaining the continuity of the working group’s initiatives when leadership changes occur within the agencies and OMB.

With respect to the information that was shared at some of the initial working-group meetings, roundtable participants stated that the topics discussed were related to the interagency data library and the working- group plan required to be submitted to Congress, as OMB described in the May 2017 letter. For example, some participants confirmed that the first few meetings were spent discussing ways to establish a standard definition of fraud, the implementation plan due to Congress, and the difficulties agencies experience in sharing data. Our survey results indicate that most agencies identified the sufficiency of information coming from the working group as a great or moderate challenge in their efforts to implement FRDAA (see fig. 10).

Roundtable participants also identified data access and sharing, and inter- and intra-agency communication and collaboration, as top challenges for implementing FRDAA. We have previously reported that collaborative mechanisms can be used for a range of purposes such as information sharing. Without participation in appropriately recurring working-group meetings and documentation to facilitate information sharing, agencies will continue to miss opportunities to learn from each other’s experiences and share solutions for establishing financial and administrative controls to prevent, detect, and respond to fraud risks in their programs.

FRDAA Implementation during Broader Reforms

OMB has recently issued guidance on other government-wide reform and burden-reduction initiatives that could shape how agencies address FRDAA implementation, such as reforms that may change the structure of agencies and related programs or how agencies collect data used in managing fraud risks. These changes may present challenges and opportunities in establishing the fraud risk management practices outlined in the FRDAA. As examples of these recent reforms, in March 2017 the President issued an executive order requiring a proposed plan to reorganize executive branch agencies. In April 2017, OMB provided guidance to federal agencies for developing their reform and workforce- reduction plans, as required by the President’s executive order. Executive Order 13781—Comprehensive Plan for Reorganizing the Executive Branch—and other recent administration actions prompted OMB to issue a memorandum (M-17-22), that required agencies to submit an agency reform plan to OMB by September 2017. These reform plans were part of the agencies’ fiscal year 2019 budget submission to OMB that included long-term workforce reductions. In addition, OMB issued a memorandum (M-17-26) that required agencies to streamline reporting requirements— an initial effort at removing duplicative, outdated reporting requirements, with the goal of making the federal government more efficient and effective.

In March 2018, OMB released the President’s Management Agenda, which provided updated information on the status of government reorganization efforts and is connected with these reform efforts. The President’s Management Agenda also identified a set of cross-agency priority goals, required under the GPRA [Government Performance and Results Act] Modernization Act of 2010, to target those areas where multiple agencies must collaborate to effect change and report progress in a manner the public can easily track. One of these collaborative efforts is focused on reducing the amount of dollars lost to taxpayers through improper payments, including payments resulting from fraud. In addition to the President’s Management Agenda, OMB was required by the March 2017 executive order to develop a comprehensive government-wide reform plan, including, as appropriate, recommendations for both legislative proposals and administrative actions based on agency reform plans, OMB-coordinated crosscutting proposals, and public input.

In June 2018, OMB released the government-wide reform plan, which consists of government-wide reorganization and reform proposals with the goal of increasing focus on integrated mission, service, and stewardship delivery. While it is too early to tell whether or how all of these reforms will affect agencies’ efforts to implement FRDAA, we have previously reported that OMB and agencies can leverage these broader reform efforts to address the high-risk areas and government-wide challenges that present vulnerabilities to fraud, waste, abuse, and mismanagement, or are in need of transformation. We surveyed the 72 agencies about whether their plans to implement reforms have had an effect on their efforts to implement FRDAA. About 83 percent of the agencies surveyed reported that they did not address aspects of their fraud risk management in their agency reform plans. Further, OMB reported to us that these plans are still evolving, and have not yet been finalized. However, as we have previously reported, OMB and agencies can consider whether (1) the agency has addressed ways to decrease the risk of fraud, waste, and abuse of programs as part of its proposed reforms and (2) the size of the workforce or resources dedicated to fraud risk management activities may be affected by any of the organizational reforms or efforts to reduce burden, and to make decisions with these considerations in mind.

Conclusions

Fraud is one contributor to financial and nonfinancial risks that cost taxpayers dollars, threaten national security, or put consumers at risk. Therefore, agencies must take a more-rigorous preventive approach to managing the risk of fraud in their programs. Compliance with FRDAA provisions can support these efforts. We recognize that effective implementation of the act will take time, and each program and agency may evolve at a different pace. While a small number of agencies reported being mature in their implementation of FRDAA activities, most are in the process of developing key fraud risk activities, and others have yet to start developing them. Wherever agencies fall on this spectrum, it is important that they continue taking actions to enhance their ability to prevent, detect, and respond to fraud risks in their programs and operations.

OMB plays an important role in supporting agencies’ efforts to manage fraud risks by providing clear guidelines and facilitating agencies’ involvement with the working group. OMB has taken steps to assist agencies, such as updating ERM guidelines and chairing working-group meetings, but improvements to these efforts could better facilitate agencies’ abilities to implement the act. Specifically, agencies reported the need for additional guidance and clarity on the actions they should take to effectively establish the required controls and report their progress on implementation of the act’s requirements, uncertainty about the difference between ERM and FRDAA requirements, and the need for more involvement and information from the working group. With enhanced guidelines from OMB and improvements to collaboration, agencies would be better positioned to improve controls and procedures to assess and mitigate fraud risks, as FRDAA intends.

Promoting the oversight and accountability of agency fraud risk activities through reporting is an important aspect of congressional oversight, as agencies enhance their fraud risk management controls. However, the progress reports submitted by agencies as part of their annual financial reports were incomplete and lacked detailed information to effectively inform Congress of agencies’ implementation status. Further, agencies are only required to report their progress in implementing the requirements of FRDAA through fiscal year 2019. However, it is not clear that more-complete information will be reported by then. Until OMB provides additional guidelines directing agencies to report more-complete and more-detailed information related to both financial and nonfinancial risks, agencies may continue to produce incomplete information on their fraud risk management activities. Requiring agencies to report on the progress of their implementation efforts beyond 2019 could better position Congress to ensure oversight and accountability.

Matter for Congressional Consideration

We are making the following matter for congressional consideration.

Congress should consider extending the requirement in FRDAA for agencies to report on their implementation of fraud controls, identification of fraud risks, and strategies for mitigating them, beyond the current 2019 expiration. (Matter for Consideration 1)

Recommendations for Executive Action

We are making the following three recommendations to OMB:

The Director of OMB should enhance the guidelines for agencies to establish the controls required by FRDAA, by clarifying the difference between FRDAA and ERM requirements, and through collaboration with agencies to determine what additional information agencies need to implement the controls. (Recommendation 1)

The Director of OMB should enhance FRDAA reporting guidelines by directing agencies to report complete and detailed information on each of the reporting elements specified by FRDAA, which should include information related to financial and nonfinancial fraud. (Recommendation 2)

The Director of OMB should ensure the working group’s composition meets FRDAA requirements by involving the CFO of all agencies subject to the act by inviting them to participate or otherwise providing access and input into the working group, and ensure that mechanisms to share controls, best practices, and data-analytics techniques are in place. (Recommendation 3)

Agency Comments and our Evaluation

We provided a draft of this report to OMB for review and comment. OMB staff provided oral comments that disagreed with our three recommendations, which we summarize below. OMB staff also provided technical comments that we incorporated as appropriate.

OMB disagreed with our first recommendation that it should enhance the guidelines for agencies to establish the controls required by FRDAA by clarifying the difference between FRDAA and ERM requirements, and through collaboration with agencies to determine what additional information agencies need to implement the controls. According to OMB staff, Circular A-123 incorporates all of the guidance that agencies need to implement FRDAA and, outside of the current guidance in Circular A- 123 which OMB staff stated incorporates both GAO’s Standards for Internal Control and GAO’s Fraud Risk Framework, agencies are in the best position to make decisions about how they should implement FRDAA. Further, OMB staff stated that they did not believe that our survey of the 72 agencies and the roundtable with the 14 agencies provided sufficient evidence that a change in their guidance is needed because these responses are based on agencies’ opinions.

While Circular A-123 contains a section on Managing Fraud Risks in Federal Programs, we identified important limitations to that section of guidance in our report. In its comments on our report, OMB staff stated that other parts of Circular A-123 provide guidance on FRDAA requirements. These sections of Circular A-123 existed prior to FRDAA and therefore, were not developed in response to FRDAA’s requirement that OMB establish guidelines for agencies. Our review of Circular A-123 found that there are some references to managing fraud risks that are in alignment with the financial and administrative controls identified in FRDAA, and therefore we incorporated that additional information into our report. However, as we reported, agencies stated that they needed additional guidance on how to effectively establish the controls required by FRDAA. OMB was required by FRDAA to establish guidelines. Specifically, lack of guidance and unclear requirements were identified as top challenges during the roundtable discussion, and the sufficiency of OMB’s guidelines was a challenge for 40 percent of the agencies we surveyed. OMB staff stated that they did not believe that our survey and roundtable results are sufficient evidence to warrant a change in their guidance because these responses are based on agencies’ opinions. However, because the purpose of OMB’s guidance is to assist agencies in implementing the administrative controls required by FRDAA, agencies’ experiences and perspectives on the sufficiency of the guidance is an essential part of assessing its effectiveness. Therefore, we reiterate the positions expressed by many agencies that they do not have sufficient guidance on implementing FRDAA requirements related to the establishment of financial and administrative controls. As a result, our recommendation on improving this guidance is still warranted.

OMB also disagreed with our second recommendation that it should enhance FRDAA reporting guidelines by directing agencies to report complete and detailed information on each of the reporting elements specified by FRDAA, which should include information related to financial and nonfinancial fraud. According to OMB staff, Circular A-136 is sufficient guidance because it includes the requirements stated in FRDAA, and incorporating this guidance into Circular A-136 was not a requirement of the act. Although not required by FRDAA, OMB’s guidance to agencies on FRDAA reporting is important because these reports can be used to evaluate agency efforts to make changes to their processes and policies. OMB Circular A-136 establishes reporting guidance for executive branch entities required to submit agency financial reports, among other things. Agencies were required to report on their progress implementing FRDAA in these reports. However, FRDAA provides high-level information on what should be included in agency reports, not operational guidance on how to address the reporting requirements, which is typically outlined in executive guidance to agencies. Consequently, the initiative that OMB took to provide guidance on FRDAA in Circular A-136 was an important step in the right direction. However we found that the 24 CFO Act agencies’ annual financial reports for 2017 were incomplete and lacked details, which can be attributed in part to the limited guidance provided by OMB. We found that 31 percent of surveyed agencies indicated that reporting on FRDAA progress was a great or moderate challenge. The agency reporting requirement was intended to help Congress monitor the progress made by agencies in addressing and reducing fraud risks, including the success and failures of the guidelines created by OMB as a result of the act. Therefore, our recommendation to improve OMB’s reporting guidelines is still appropriate.

OMB also disagreed with our third recommendation that it should ensure that the FRDAA working group’s composition meets the act’s requirements by involving the CFO of all agencies subject to the act by inviting them to participate or otherwise providing access and input into the working group, and ensuring mechanisms to share controls, best practices, and data-analytics techniques are in place. According to OMB staff, they disagreed because they believe that OMB provided an opportunity for all agencies to attend the working group meeting and they have held four working group meetings in 2018. However, evidence submitted by OMB throughout our review and agencies’ responses to our survey indicate that not all agencies had the opportunity to participate in the working group. The working group was required to include the CFOs of every agency subject to FRDAA, including those that are not subject to the CFO Act. However, 71 percent of non–CFO Act agencies were not at all familiar with the working group, and ninety percent did not have a designated person or entity that participated in the working group, according to our survey. Moreover, 21 percent of CFO Act agencies, which represent the largest federal agencies, were not at all familiar with the working group, and 29 percent did not have a designated person or entity that participated in it, according to our survey results, as of March 2018. To ensure that we obtained information from the right contacts regarding agency participation, we surveyed the CFO or the CFO’s designee of each agency subject to FRDAA. During our audit, OMB indicated that it did not have a list of CFO contacts for all agencies subject to the act, and requested that we share our list of contacts. We have agreed to do so consistent with our protocols, upon public release of the report. Given our findings, our recommendation for OMB to ensure that every agency is then given the opportunity to participate is still warranted.

Our survey results also indicated that most agencies identified the sufficiency of information coming from the working group as a great or moderate challenge in their efforts to implement FRDAA. Further, OMB staff stated that they do not have documented minutes or notes from working-group meetings. As we stated in our report, without documented discussions, plans, or reports for these collaborative meetings, OMB is unable to share the lessons learned from the meetings with those who cannot attend, and does not have a record of the plans and actions that the working group has agreed to take. This documentation is also important to maintaining the continuity of the working group’s initiatives when leadership changes occur within the agencies and OMB. As we previously noted, without participation in working-group meetings and documentation to facilitate information sharing, agencies will continue to miss opportunities to learn from each other’s experiences and share solutions for establishing financial and administrative controls to prevent, detect, and respond to fraud risks in their programs. Therefore, we believe that our recommendation on ensuring mechanisms are in place to share controls, best practices, and data-analytics techniques is still warranted. Finally, although OMB did not hold the required number of meetings per year in 2017, it has done so for fiscal year and calendar year 2018, as of November 2018. Therefore, we modified our recommendation to reflect the new actions taken.

We are sending copies of this report to appropriate congressional committees and OMB. In addition, the report is available at no charge on the GAO website at http://www.gao.gov.

If you or your staff have any questions about this report, please contact Rebecca Shea at (202) 512-6722 or shear@gao.gov. Contact points for our Offices of Congressional Relations and Public Affairs may be found on the last page of this report. GAO staff who made key contributions to this report are listed in appendix III.

Appendix I: Objectives, Scope, and Methodology

This report reviews agencies’ and the Office of Management and Budget’s (OMB) efforts to implement the Fraud Reduction and Data Analytics Act of 2015 (FRDAA). Specifically, it examines (1) federal agencies’ progress and challenges in implementing fraud risk management practices, including those required by FRDAA, and (2) the extent to which OMB has taken steps that complied with FRDAA requirements and that facilitated agencies’ implementation of the act. To address both of these objectives, we developed and implemented a government-wide survey of agencies subject to the act, conducted a roundtable discussion with selected agencies, reviewed the 24 Chief Financial Officer (CFO) Act agencies’ annual financial reports, interviewed staff from OMB, the CFO Council and the Council of the Inspectors General on Integrity and Efficiency, and reviewed relevant OMB circulars and documents.

Survey

Determination of Executive Branch Agencies Subject to FRDAA

To determine which agencies were subject to FRDAA and subsequently surveyed, we first sent information requests to 93 federal executive branch entities to determine whether their organization met the definition of “agency” in 5 U.S.C. § 551(1). FRDAA requires the CFO of each agency to be a member of the FRDAA working group. Therefore we identified each entity’s CFO or equivalent using publicly available websites. We sent an email to the 93 entities’ CFO or equivalent and GAO liaison, if present, to notify the agency that we planned to administer a government-wide survey related to the act and requested that an official from the entity’s Office of the General Counsel confirm whether the entity is an “agency” as defined in 5 U.S.C. § 551(1). If the CFO was not the official who was most appropriate to answer our survey about activities related to the act, we requested that the agency identify who should receive our survey. Of these 93 entities, 72 indicated they met this definition of agency, 20 reported that they did not, and 1 entity, the Central Intelligence Agency, did not respond. See table 1 for a list of the 72 executive branch agencies that identified themselves as being subject to the act.

Survey Questionnaire Development

To improve the response rate of agencies receiving our survey, while mitigating respondent burden and reducing total survey error, we developed the survey using a variety of quality-assurance techniques. Survey error can arise from population coverage, measurement, nonresponse, and processing errors associated with questionnaire surveys. GAO survey specialists determined survey design parameters and developed, tested, revised, and finalized the questionnaire, in consultation with subject-matter experts on the engagement team. The survey design parameters included population coverage, mode of administration, respondent communication methods, and protection from disclosure of identifiable information.

To reduce measurement error, we pretested the questionnaire with selected agency representatives using cognitive interviewing techniques, such as nondirective probing of answers and asking respondents to think aloud when formulating answers. This process allowed us to determine whether questions were understood and answered as intended. Specifically, pretests examined respondent issues related to comprehension of the questions, ability to accurately respond to the questions, perceptions of bias in the questions or scales, and completeness of answer responses. For example, during pretesting we probed respondents on whether our scales were appropriately balanced, and whether individual questions were likely to be applicable to all respondents. We conducted pretests over the phone with CFOs or other FRDAA designated officials from three types of agencies for a total of six agencies: two executive-department CFO Act agencies; two CFO Act agencies that are not executive departments, and two non-CFO Act agencies that are not executive departments. As a result of these pretests, we made modifications to question wordings, scale categories, and other response options to improve respondent comprehension, reduce respondent burden, and mitigate risks of inaccurate or biased responses.

An additional survey specialist, who had not been involved in the development of the questionnaire, also reviewed the questionnaire. We then modified the questionnaire based on suggestions made by the reviewer and subject-matter experts. The final version of the questionnaire was copy edited for grammatical and editorial errors.

The final questionnaire included questions designed to capture information about FRDAA implementation government-wide and obtain a high-level status update of agencies’ implementation of the act including, but not limited to, the steps agencies had taken since the enactment of the act, fraud risk management activities, challenges they have experienced implementing FRDAA, and their perspectives about OMB’s support of these efforts. It was composed of questions with predetermined answer choices (closed-ended questions) and questions without predetermined answer choices requiring written response (open- ended questions). See appendix II for survey questions and frequencies of agencies’ responses.

Survey Administration

To administer the survey, we emailed each agency a fillable PDF questionnaire. We fielded the survey from January 18, 2018, through March 27, 2018. To follow up with agencies that did not respond to the initial notice, we emailed or called multiple times to encourage survey participation or provide technical assistance, as appropriate. We received usable questionnaire responses from all 72 agencies, for a response rate of 100 percent. Because this survey was sent to all agencies that were identified as being subject to FRDAA, there is no error as a result of sampling, and results cover the entire population. However, the practical difficulties of conducting any survey may also introduce other types of errors, commonly referred to as nonsampling errors. For example, difficulties in how a particular question is interpreted, in the sources of information available to respondents, or in how the data were entered into a database or analyzed can introduce unwanted variability into the survey results. With this survey, we took a number of steps to minimize these nonsampling errors. For example, our staff with subject-matter expertise designed the questionnaire in collaboration with our survey specialists, and all questions were cognitively pretested with knowledgeable respondents. When the survey data were received from agencies and analyzed, a second independent analyst on our staff verified the analysis programs to ensure the accuracy of the code and the appropriateness of the methods used for the computer-generated analysis. Since this was an electronic survey, respondents entered their answers directly into the questionnaire, thereby mitigating the need to have the data keyed into a database, thus avoiding a source of data-entry error.

Roundtable Discussion

To collect information about agencies’ experiences implementing FRDAA, we also facilitated a roundtable discussion with selected agencies subject to FRDAA that had completed the survey. The purpose of the roundtable discussion was to obtain agency officials’ perspectives on the strategies and activities used to establish fraud controls and related fraud risk management activities; the guidance and resources used to facilitate the implementation of FRDAA; their challenges in implementing FRDAA; and potential solutions to improve implementation of the act, including any additional guidance or resources that may be useful to implementing the act.

We randomly selected and invited a diverse group of agencies that are subject to FRDAA. We planned for a group of agencies that were diverse in terms of the following: 1. agency type, such as whether the agency was a CFO Act agency, an executive department or non–executive department, and membership in the Small Agency Council; and 2. FRDAA implementation status as indicated by their responses to two survey questions. These two survey questions were “overall, what is the status of your agency-wide efforts to implement FRDAA” and “as of today, does your agency do the following to manage fraud risk at the agency-wide level.” We used the survey responses to divide agencies into two groups, a more-mature implementation group and a less-mature implementation group.

We invited a total of 27 agencies to participate in our roundtable, an initial group of 20 agencies and 7 backup agencies. Fourteen agencies attended our roundtable: six executive-department CFO Act agencies; two CFO Act agencies that are not executive departments; and six Small Agency Council member agencies. Agency representatives included agency officials with responsibility for antifraud activities, including either the agency’s CFO, Chief Risk Officer, or other staff responsible for fraud risk management activities.

The roundtable discussion was held March 26, 2018, and included three sessions: an opening session, a breakout session, and a closing session. In the opening session, all 14 of the roundtable participants were given an overview of our researchable questions and the agenda for the day. Then the agencies were split into two breakout groups based on their response to our survey questions about the maturity of their implementation of FRDAA. In the two breakout groups, roundtable participants discussed the guidance and resources they used for implementation of the act, their approaches used for implementation of the act, and the strategies and challenges associated with implementation of the act. In each breakout group, roundtable participants identified and voted on their top challenges in implementing FRDAA. After the breakout session, GAO facilitators and subject-matter experts on the engagement team then met to create a new list of the top voted challenges of both groups as well as any crosscutting challenges. Finally, in the closing session, all 14 agencies came back together to recap the breakout discussions and have a broader discussion about experiences of successful implementation and potential solutions to improve implementation, including any additional guidance or resources that may be useful to implementing the act. Roundtable participants identified and voted on their top challenges to implementing FRDAA. These results are not generalizable to agencies beyond the 14 that participated.

Fiscal Year 2017 Annual Financial Reports

To further assess steps that agencies have taken to implement fraud risk management practices, as required by FRDAA, we also reviewed the fiscal year 2017 annual financial reports for the 24 agencies subject to the CFO Act. FRDAA required agencies to report to Congress on the status of their efforts to implement financial and administrative controls that incorporate leading practices from GAO’s Fraud Risk Framework, identify fraud risks, and establish strategies to mitigate fraud in these reports. We selected these 24 agencies because they were known at the time of our selection to be agencies that were subject to FRDAA, and are estimated to account for over 99 percent of the government-wide improper payments in fiscal year 2015. These agencies also are required to submit their reports directly to GAO. We conducted a content analysis to determine the completeness and quality of the information provided in these reports related to these FRDAA requirements.

Because content analysis relies on the judgment of coders to determine whether qualitative data reflects particular categories, we took several steps to ensure that this judgment remained objective, accurate, and consistent. Prior to beginning the content analysis, we worked with subject-matter and legal experts to develop a codebook and definitions for the different kinds of information that FRDAA requires agencies to report, as well as supplemental coding categories related to leading practices in fraud risk management identified in our framework. In order to test the clarity of these codes, we had four independent analysts pretest the content analysis on two annual financial reports, and found high levels of interrater reliability. Specifically, each of the categories had at least 95 percent agreement between coders. As a result to this pretest, minor changes were made to the category definitions.

We used two independent coders within GAO to ensure consistent judgment of categories. For the content analysis, each of the 24 annual financial reports was coded by two independent analysts, including one subject-matter expert familiar with fraud risk management and another familiar with each of the CFO Act agencies. Agreement among coders exceeded 99 percent across all of the coding categories. On the basis of this high level of agreement between coders, we are confident that our content analysis represents an objective, accurate, and consistent assignment of these coding categories. Because these coding categories would be further reviewed in making our determinations about completeness and detail, we decided to resolve any intercoder disagreements by keeping all coded material for that review.

To assess the completeness of agencies’ reporting on FRDAA implementation, we broke out the unique requirements in each of the three broad categories outlined in FRDAA’s reporting requirements. As a result, our analysis included an assessment of 11 coding categories, which are listed with their definitions in table 2 below. An element was considered present if the corresponding code was applied one or more times in the annual financial reports, and missing if the corresponding code was applied zero times. Each annual financial report was then categorized into one of four categories of completeness, based on these assessments: 1. Fully complete: agencies with reports that contained information on all 11 elements. 2. Mostly complete: agencies with reports that contained information on 6–10 elements. 3. Partially complete: agencies with reports that contained information on 1–5 elements. 4. Not at all complete: agencies with reports that contained information on 0 elements.

In addition to assessing whether the annual financial report contained these elements, as required by FRDAA, we also reviewed the content of each of these coding categories, as well as additional categories related to leading practices in fraud risk management. In order to demonstrate the range of the quality and level of detail provided for each element, and for the overall reporting on fraud risk management efforts, we reviewed the specific coded excerpts in NVivo for each agency and summarized the level of detail, length, and other observations specific to each category.

To address our second objective, determining the extent to which OMB has taken steps that complied with FRDAA requirements and that facilitated agencies’ implementation of the act, we reviewed relevant documents produced to support the implementation of FRDAA. We also assessed the extent to which the guidelines were consistent with leading practices from the Fraud Risk Framework and the Standards for Internal Control in the Federal Government.

To determine the extent to which OMB has taken steps that complied with FRDAA requirements and facilitated agencies’ implementation of the act, we did the following: 1. We interviewed staff from OMB’s Office of Federal Financial Management and Office of Personnel and Performance Management regarding their development of guidelines, the working group, and any challenges OMB may have experienced while implementing the act’s requirements, to determine the extent to which OMB’s efforts to facilitate agency implementation of the act were viewed as helpful by agencies. 2. We reviewed relevant memorandum, circulars, and other OMB documents including Circular A-123, Management’s Responsibility for Enterprise Risk Management and Internal Control, and Circular A-136, Financial Reporting Requirements, and compared these with the requirements for OMB outlined in FRDAA. 3. We evaluated agencies’ perspectives and experiences using OMB’s guidelines and other initiatives to implement the act by assessing our survey responses, annual financial-report analysis, and roundtable discussion for responses related to OMB guidelines and other efforts, and related strengths and challenges. 4. We also interviewed officials from the CFO Council and Council of the Inspectors General on Integrity and Efficiency to get a broader opinion about the effectiveness of OMB and agency efforts to implement FRDAA.

We conducted this performance audit from August 2017 to December 2018 in accordance with generally accepted government auditing standards. Those standards require that we plan and perform the audit to obtain sufficient, appropriate evidence to provide a reasonable basis for our findings and conclusions based on our audit objectives. We believe that the evidence obtained provides a reasonable basis for our findings and conclusions based on our audit objectives.

Appendix II: Results of GAO’s Survey on Agencies’ Implementation of the Fraud Reduction and Data Analytics Act of 2015

To obtain information about the extent to which executive branch agencies have taken steps required by the Fraud Reduction and Data Analytics Act of 2015 (FRDAA), we identified 72 agencies subject to the act and surveyed these agencies about their fraud risk management practices and related challenges. We received responses from all 72 agencies, for a response rate of 100 percent. The questions we asked in our survey and the percentage of agencies’ responses are shown below. Our survey was composed of questions with predetermined answer choices (closed-ended questions) and questions without predetermined answer choices requiring written response (open-ended questions). In this appendix, we include all survey questions and results of responses to the closed-ended questions; we do not provide information on responses to open-ended questions.

The tables below represent the percentage of agencies’ responses to the close-ended questions. The percentages we report are rounded to the nearest whole number. For a more-detailed discussion of our survey methodology, see appendix I.

Survey question 13: What other information, if any, should GAO know about your agency’s efforts to implement FRDAA or manage fraud risks? (open-ended response)

Survey question 14: Do you have any additional explanations for your answers or comments on any of the issues in this questionnaire? (open-ended response)

Survey question 15: Please enter the contact information for the primary person who completed this survey. (open-ended response)

Appendix III: GAO Contact and Staff Acknowledgments

GAO Contact

Staff Acknowledgments

In addition to the contact named above, Latesha Love (Assistant Director); Georgette Hagans (Analyst in Charge); Sarah Cantatore, Joy Kim, Grant Mallie, James Murphy, Eve Nealon, Steven Putansu, Kristen Timko, and Shana Wallace made key contributions to this report. Other contributors include Marcus Corbin, Carrie Davidson, Colin Fallon, Barbara Lewis, and Maria McMullen.