Government Efficiency and Effectiveness: Opportunities to Address Pervasive Management Risks and Challenges while Reducing Federal Costs
Released: 2017-05-17T00:00:00

Letter

Actions Needed to Address Growth in Improper Payments

Improper payments remain a significant and pervasive government-wide issue. For several years, we have reported improper payments as a material weakness in our audit reports on the consolidated financial statements of the U.S. government. Since fiscal year 2003—when certain agencies began reporting improper payments as required by the Improper Payments Information Act of 2002 (IPIA)—cumulative reported improper payment estimates have totaled over $1.2 trillion, as shown in figure 1.

For fiscal year 2016, agencies reported improper payment estimates totaling $144.3 billion, an increase of over $7 billion from the prior year’s estimate of $136.7 billion. The reported estimated government-wide improper payment error rate was 5.1 percent of related program outlays. These figures do not include the Department of Defense’s (DOD) Defense Finance and Accounting Service Commercial Pay program because of concerns regarding the reliability of the program’s estimate, which I will discuss later in this statement. As shown in figures 2 and 3, the reported improper payment estimates—both dollar estimates and error rates—have been increasing over the past 3 years, largely because of increases in Medicaid’s reported improper payment estimates.

For fiscal year 2016, overpayments accounted for approximately 93 percent of the improper payment estimate, according to www.paymentaccuracy.gov, with underpayments accounting for the remaining 7 percent.

Although primarily concentrated in three areas (Medicare, Medicaid, and the Earned Income Tax Credit), the reported estimated improper payments for fiscal year 2016 were attributable to 112 programs spread among 22 agencies (see figure 4).

Agencies reported improper payment estimates exceeding $1 billion for 14 programs, as shown in table 1, and error rates exceeding 10 percent for 11 programs (see table 2).

Multiple Factors Hinder Efforts to Determine the Full Extent of and Reduce Improper Payments

In our audit report on the fiscal year 2016 consolidated financial statements of the U.S. government, we continued to report a material weakness in internal control related to improper payments because the federal government is unable to determine the full extent to which improper payments occur and reasonably assure that appropriate actions are taken to reduce them. Challenges include programs that do not report any improper payment estimates or report unreliable or understated estimates, noncompliance issues, fraud, and potentially inaccurate risk assessments.

Programs That Do Not Report Improper Payment Estimates

We found that not all agencies had developed improper payment estimates for all of the programs and activities they identified as susceptible to significant improper payments. Eight agencies did not report improper payment estimates for 18 risk-susceptible programs (see table 3).

Because agencies did not report improper payment estimates for these risk-susceptible programs, the government-wide improper payment estimate is understated and agencies are hindered in their efforts to reduce improper payments in these programs. For example, the Department of Health and Human Services (HHS) did not report an improper payment estimate for Temporary Assistance for Needy Families, a program with outlays of over $15 billion for fiscal year 2016. HHS cited statutory limitations prohibiting the agency from requiring states to participate in an improper payment measurement for the program.

Another example is the U.S. Department of Agriculture’s (USDA) Supplemental Nutrition Assistance Program (SNAP). Although USDA has reported improper payment estimates for this program in prior years, the agency did not report an estimate for fiscal year 2016. In its fiscal year 2016 agency financial report, USDA stated that it was unable to validate data provided by 42 of the 53 state agencies that administer the program. USDA stated that it could not adjust for this unreliability and calculate a national error rate.

Potentially Unreliable or Understated Estimates

Improper payment estimates for certain programs may be unreliable or understated. For example, in May 2013 we reported that DOD had major deficiencies in its process for estimating fiscal year 2012 improper payments in the Defense Finance and Accounting Service (DFAS) Commercial Pay program, including deficiencies in identifying a complete and accurate population of payments. The foundation of reliable statistical sampling estimates is a complete, accurate, and valid population from which to sample. As of October 2016, DOD was still developing key quality assurance procedures to ensure the completeness and accuracy of sampled populations. Therefore, DOD’s fiscal year 2016 improper payment estimates, including its estimate for the DFAS Commercial Pay program, may not be reliable. DFAS Commercial Pay’s reported program outlays are significant—approximately $249 billion for fiscal year 2016. Consequently, a small change in the program’s estimated error rate could result in a significant change in the dollar value of its improper payment estimate.

Also, flexibility in how agencies are permitted to implement improper payment estimation requirements can contribute to inconsistent or understated estimates. For example, in February 2015, we reported that DOD uses a methodology for estimating TRICARE improper payments that is less comprehensive than the methodology the Centers for Medicare & Medicaid Services (CMS) used for Medicare. Though the programs are similar in that they pay providers on a fee-for-service basis and depend on contractors to process and pay claims, TRICARE’s methodology does not examine the underlying medical record documentation to discern whether each sampled payment was supported or whether the services provided were medically necessary. On the other hand, Medicare’s methodology more completely identifies improper payments beyond those resulting from claim processing errors, such as those related to provider noncompliance with coding, billing, and payment rules.

As a result, the estimated improper payment error rates for TRICARE and Medicare are not comparable, and TRICARE’s error rate is likely understated. In addition, corrective actions for TRICARE improper payments do not address issues related to medical necessity errors—a significant contributor to Medicare improper payments. We recommended that DOD implement a more comprehensive TRICARE improper payment methodology and develop more robust corrective action plans that address the underlying causes of improper payments. In October 2016, DOD requested proposals for claim record reviews—including medical record reviews—to begin the process of incorporating medical record reviews in its methodology for calculating improper payment rates.

IGs Report Greater Agency Noncompliance

Since fiscal year 2011, the Improper Payments Elimination and Recovery Act (IPERA) has required agencies’ inspectors general (IG) to annually report on the respective agencies’ compliance under the act. IGs at 15 of the 24 Chief Financial Officers Act (CFO Act) agencies found their respective agencies to be noncompliant under IPERA for fiscal years 2014 and 2015, the highest total since IGs began their annual compliance reviews. Although noncompliance has occurred across all six of the criteria listed in IPERA, the most common issues are noncompliance related to reporting and meeting improper payment reduction targets or reporting an error rate below 10 percent. Continued noncompliance further highlights the need for additional efforts to reduce improper payments.

Improper Payments Involving Fraud

Fraud is one specific type of improper payment and is particularly difficult to identify and estimate. Fraud involves obtaining something of value through willful misrepresentation. Whether an act is fraudulent is determined through the judicial or other adjudicative system, which is one reason why fraud is not likely to be part of agencies’ annual improper payment estimates. According to Office of Management and Budget (OMB) guidance, agencies should refer matters involving possible fraudulent activities to the appropriate parties, such as the relevant Office of the Inspector General or the Department of Justice (DOJ).

While improper payment estimates are not a measure of fraud, a lack of sufficient supporting documentation may mask the true causes of improper payments—including fraud. When payments lack the appropriate supporting documentation, their validity cannot be determined. It is possible that these payments were for valid purposes, but it is also possible that the lack of documentation could conceal fraudulent activities. For fiscal year 2016, HHS cited documentation errors as a major contributor to improper payments in its Medicare fee-for- service program, such as durable medical equipment and home health claims. We have found that these areas are also vulnerable to fraud, and recent cases continue to raise concerns.

The report on the Health Care Fraud and Abuse Control (HCFAC) program for fiscal year 2016 lists several examples of fraud specifically related to durable medical equipment and home health claims, including one case in which a doctor approved and certified in excess of 11,000 Medicare beneficiaries, who were not home bound, for home health care services between 2006 and 2011, resulting in nearly $375 million in fraudulent claims. For fiscal year 2016, HHS and DOJ reported that the federal government won or negotiated over $2.5 billion in health care fraud judgments and settlements through the HCFAC program. In fiscal year 2016, DOJ opened 930 new criminal health care fraud investigations, and HHS IG investigations resulted in 765 criminal actions and 690 civil actions. Table 4 lists other examples of fraud in various programs.

Additionally, we have recently reported on antifraud efforts and cases of potential fraud in various programs, including the following examples.

In April 2017, we reported that the Social Security Administration (SSA) needed to develop a comprehensive strategic approach to help enhance antifraud activities in its disability programs. Although SSA has taken steps in this area, its new antifraud office is still evolving. SSA has worked to identify and address fraud risks in its disability programs, but it has not yet comprehensively assessed these fraud risks or developed a strategic approach to help ensure its antifraud activities effectively mitigate those risks. Although SSA has several prevention and detection activities in place to address known fraud risks in its disability programs, the agency has not developed and documented an overall antifraud strategy that aligns its antifraud activities to its fraud risks.

Without conducting a fraud risk assessment that aligns with leading practices and developing an antifraud strategy, SSA’s disability programs may remain vulnerable to new fraud schemes, and SSA will not be able to effectively prioritize its antifraud activities. Among other things, we recommended that SSA conduct a comprehensive fraud risk assessment for its disability programs and develop a corresponding antifraud strategy. SSA agreed with the recommendations.

In August 2014, we identified 28 cases of potential fraud related to Supplemental Nutrition Assistance Program benefits (food stamps). Over 30 days, we detected 28 postings from one popular e-commerce website that advertised the potential sale of food stamp benefits in exchange for cash, services, and goods—including places to live, vehicles, cooking and cleaning services, phones, and beer. We recommended that USDA take steps, such as providing guidance and training, to enhance the consistency of state reporting on their antifraud efforts. Though it has not yet implemented the new form, USDA has revised the form to collect recipient integrity performance information and has provided training to state agency and regional office personnel on the new form.

In December 2014, we reported approximately $39 million of Hurricane Sandy assistance as at risk for potential fraud or improper payments. Among other issues, these cases included instances in which Social Security numbers were not valid or were used by multiple recipients, rental assistance was received while the recipient was incarcerated, and duplicate payments were not flagged by the Federal Emergency Management Agency (FEMA). Among other things, we recommended that FEMA assess the cost and feasibility of obtaining SSA’s full death file to help identify potentially fraudulent or improper applications for assistance. In June 2016, FEMA reported that it was evaluating the cost and feasibility of obtaining the publicly available Death Master File. However, our recommendation refers to SSA’s full death file, which is a more comprehensive source of death data. We continue to believe that FEMA should assess the cost and feasibility of obtaining SSA’s full death file.

In May 2015, we found thousands of Medicaid beneficiaries and hundreds of providers involved in potential improper or fraudulent payments in four selected states (Arizona, Florida, Michigan, and New Jersey) during fiscal year 2011, which at the time of our study was the most recent year for which reliable data were available. For example, people using the identities of about 200 deceased beneficiaries received about $9.6 million in Medicaid benefits subsequent to the beneficiaries’ deaths, and about 90 providers had suspended or revoked licenses in the state where they performed Medicaid services yet received a combined total of at least $2.8 million from those states. We recommended that CMS issue guidance for screening beneficiaries who are deceased and supply more- complete data for screening Medicaid providers. HHS has taken certain actions—such as working with states to address data access issues—but has not provided guidance to states as we recommended.

While fraud can be more difficult to address than other types of improper payments, implementing strategies to reduce improper payments in general may also help to reduce opportunities for fraud. In July 2015, we issued A Framework for Managing Fraud Risks in Federal Programs (Framework). The Framework identifies a comprehensive set of leading practices that serve as a guide for program managers to use when developing or enhancing efforts to combat fraud in a strategic, risk-based manner. The leading practices described in the Framework include control activities to prevent, detect, and respond to fraud, with an emphasis on prevention, as well as structures and environmental factors that influence or help managers achieve their objective to mitigate fraud risks. In addition, the Framework calls for managers to conduct monitoring and incorporate feedback on an ongoing basis.

Enacted in June 2016, the Fraud Reduction and Data Analytics Act of 2015 required OMB to establish guidelines for agencies to identify fraud risks and design and implement control activities to prevent, detect, and respond to fraud. The act required OMB to incorporate the leading practices found in the Framework. Further, the act requires agencies to report on their fraud risks and their implementation of fraud reduction strategies as part of their annual financial reports beginning in fiscal year 2017. We will assess these efforts to help Congress monitor agencies’ progress in addressing and reducing fraud risks. As stewards of taxpayer dollars, federal managers have the ultimate responsibility in overseeing how hundreds of billions of dollars are spent annually. Thus, they are well positioned to use the leading practices outlined in the Framework, while considering the related fraud risks as well as the associated costs and benefits of implementing the practices, to help ensure that taxpayer resources are spent efficiently and effectively.

Potentially Inaccurate Risk Assessments

Agencies conduct risk assessments to determine which programs need to develop improper payment estimates. However, in IPERA compliance reports for fiscal year 2015—the most current reports available—various IGs reported issues related to agencies’ improper payment risk assessments. For example:

The IG for the General Services Administration (GSA) reported that the agency’s risk assessment was flawed because, among other things, the questionnaires in the assessment did not ask if programs actually experience improper payments and were distributed to individuals who did not have direct or specific knowledge of improper payments. Further, the IG found that the agency did not evaluate relevant reports—such as IG reports or our reports—to identify relevant findings, and two of the six questionnaires that the IG reviewed included incomplete information.

The IG for the Department of Housing and Urban Development (HUD) found that the agency did not assess all of its programs on a 3-year cycle and did not consider all nine of the required risk factors in conducting its risk assessment. The IG also noted instances in which the agency did not rate risk factors in accordance with the agency’s own policy.

It is also important to note that 9 of the 24 CFO Act agencies either reported no improper payment estimates or reported estimates for only disaster relief programs funded through the Disaster Relief Appropriations Act, 2013 for fiscal year 2016. The nine agencies were:

U.S. Agency for International Development

Department of Commerce (disaster relief only)

Department of the Interior (disaster relief only)

Department of Justice (disaster relief only)

National Aeronautics and Space Administration (disaster relief only).

Strategies for Reducing Improper Payments

Agencies can use detailed root cause analysis and related corrective actions to implement preventive and detective controls to reduce improper payments. Collaboration with other relevant entities can also assist federal agencies in reducing improper payments.

Root Cause Analysis

Root cause analysis is key to understanding why improper payments occur and developing effective corrective actions to prevent them. In 2014, OMB established new guidance to assist agencies in better identifying the root causes of improper payments and assessing their relevant internal controls. Agencies across the federal government began reporting improper payments using these more detailed root cause categories for the first time in their fiscal year 2015 financial reports. Further identification of the true root causes of improper payments can help to determine the potential for fraud. Figure 5 shows the root causes of government-wide improper payments for fiscal year 2016, as reported by OMB. We will continue to focus on agencies’ efforts to both identify the root causes and take appropriate actions to reduce improper payments.

Implementing strong preventive controls can serve as the frontline defense against improper payments. When agencies proactively prevent improper payments, they increase public confidence in program administration and they avoid the difficulties associated with the “pay and chase” aspects of recovering overpayments. Examples of preventive controls include up-front eligibility validation through data sharing, predictive analytic technologies, and program design review and refinement. For example, we have made the following recommendations and matters for congressional consideration to improve preventive controls in various programs.

Using the Do Not Pay (DNP) working system. Established by OMB and hosted by the Department of the Treasury (Treasury), the DNP working system is a web-based, centralized data-matching service that allows agencies to review multiple databases—such as data on deceased individuals and entities barred from receiving federal awards—before making payments. In October 2016, we found that the 10 agencies we reviewed used the DNP working system in limited ways, in part because OMB had not provided a clear strategy and guidance. Only 2 of these 10 agencies used the DNP working system on a preaward or prepayment basis for certain types of payments. Because the DNP working system offers a single point of access to multiple databases, agencies may be able to streamline their existing data matching processes. Among other things, we recommended that OMB develop a strategy—and communicate it through guidance—for whether and how agencies should use the DNP working system to complement or streamline existing data matching processes. OMB generally agreed with the concept of developing a strategy and said it would explore the concept further.

Further, we found that the death records offered through the DNP working system do not include state-reported death data. SSA officials stated that sharing its full death file—which includes state-reported death data—would require an amendment to the Social Security Act. We suggested that Congress amend the Social Security Act to explicitly allow SSA to share its full death file with Treasury for use through the DNP working system. Sharing the full death file through the DNP working system would enhance efforts to identify and prevent improper payments.

Expanding error correction authority. The Internal Revenue Service (IRS) has the authority to correct some calculation errors and check for other obvious noncompliance such as claims for a deduction or credit that exceed statutory limits. We have suggested to Congress that such authority be authorized on a broader basis rather than on a piecemeal basis and that controls may be needed to help ensure that this authority is used properly. Also, Treasury has proposed expanding IRS’s “math error” authority to “correctible error” authority to permit it to correct errors in cases where information provided by the taxpayer does not match information in government databases, among other things. Providing these authorities could help IRS correct additional errors—including some errors with Earned Income Tax Credit claims—and avoid burdensome audits and taxpayer penalties.

Adding prepayment reviews in Medicare fee-for-service. In April 2016, we found that CMS could improve its claim review programs by conducting additional prepayment reviews. Using prepayment reviews to deny improper claims and prevent overpayments is consistent with CMS’s goal to pay claims correctly the first time. It can also better protect Medicare funds because not all overpayments can be collected. CMS uses recovery auditors (RA)–among other types of claim review contractors–and in 2013 and 2014, 85 percent of RA claim reviews were postpayment. Because CMS is required by law to pay RAs contingency fees from recovered overpayments, the RAs can only conduct prepayment reviews under a demonstration. From 2012 through 2014, CMS conducted a demonstration in which the RAs conducted prepayment reviews and were paid contingency fees based on claim denial amounts. CMS officials considered the demonstration a success. However, CMS has not requested legislation that would allow for RA prepayment reviews by amending existing payment requirements and thus may be missing an opportunity to better protect Medicare funds.

We recommended that CMS seek legislative authority to allow RAs to conduct prepayment claim reviews. HHS did not concur with this recommendation, stating that CMS has implemented other programs as part of its efforts to move away from the “pay and chase” process of recovering overpayments. We continue to believe that seeking authority to allow RAs to conduct prepayment reviews is consistent with CMS’s strategy to pay claims properly the first time.

Detective Controls

Although preventive controls remain the frontline defense against improper payments, effective detection techniques can help to quickly identify and recover those overpayments that do occur. Detective controls play a significant role not only in identifying improper payments but also in providing information on why these improper payments were made, highlighting areas that need stronger preventive controls. Examples of detective controls include data mining and recovery auditing. The following are examples of recommendations we have made to improve detective controls in various programs.

Improvements to recovery efforts in Medicare Advantage. In April 2016, we reported that CMS needs to fundamentally improve its efforts to recover substantial amounts of improper payments in the Medicare Advantage program. CMS conducts two types of risk adjustment data validation (RADV) audits to identify and correct Medicare Advantage improper payments: national RADV activities and contract-level RADV audits. Both types of audits determine whether the diagnosis codes submitted by Medicare Advantage organizations are supported by a beneficiary’s medical record documentation. Contract-level RADV audits seek to identify and recover improper payments from Medicare Advantage organizations and thus to deter them from submitting inaccurate beneficiary diagnoses. However, we found that CMS does not focus its RADV audits on the contracts with the highest potential for improper payments and has not developed specific plans or a timetable for including recovery auditor contractors in the contract-level RADV audit process.

We made several recommendations, including that CMS modify the selection of contracts for contract-level RADV audits to focus on those most likely to have high rates of improper payments and that CMS develop specific plans and a timetable for incorporating a recovery audit contractor in the Medicare Advantage program. In response to our report, HHS concurred with the recommendations and reaffirmed its commitment to identifying and correcting Medicare Advantage improper payments. By implementing our recommendations, CMS could recover hundreds of millions of dollars in improper payments by improving its processes for auditing payments to Medicare Advantage organizations.

Review of federal determinations of Medicaid eligibility. In October 2015, we reported that additional efforts were needed to ensure that state spending is appropriately matched with federal funds in Medicaid. States and the federal government share in the financing of the Medicaid program, with the federal government matching most state expenditures for Medicaid services on the basis of a statutory formula. CMS has implemented interim measures to review the accuracy of state eligibility determinations and examine states’ expenditures for different eligibility groups, for which states may receive multiple federal matching rates.

However, some states have delegated authority to the federal government to make Medicaid eligibility determinations through the federally facilitated exchange. CMS has excluded these states from the reviews. This creates a gap in efforts to ensure that only eligible individuals are enrolled in Medicaid and that state expenditures are correctly matched by the federal government. We recommended that CMS review federal Medicaid eligibility determinations to ascertain the accuracy of these determinations and institute corrective action plans where necessary.

HHS has taken some steps to improve the accuracy of Medicaid eligibility determinations, as we recommended, but has not conducted a systematic review of federal eligibility determinations. For example, in March 2017, HHS reported that it is reviewing federal determinations of Medicaid eligibility in two of the nine states that have delegated eligibility determination authority to the federal marketplace. Although the actions HHS has taken have value, they are not sufficient to identify erroneous eligibility determinations. Specifically, without a systematic review of federal eligibility determinations, the agency lacks a mechanism to identify and correct errors and associated payments.

Collaborating with Other Entities

Agencies may consider collaborating with relevant entities—such as OMB, states, state auditors, and the IG community—to strengthen efforts to reduce improper payments. In November 2016, we held a discussion with various state auditors and federal agencies to identify potential opportunities to strengthen collaboration, focusing on federal and state initiatives related to improper payments. Further, in September 2015, we reported on the Recovery Operations Center’s (ROC) significant analytical services, provided primarily to IGs to support antifraud and other activities. While funding for the ROC ended in September 2015, officials from some small- and medium-sized IGs stated that they do not have the capabilities to develop independent data analytics or pay for a similar service, thus foregoing the ROC’s capabilities. We suggested that Congress may wish to consider directing the Council of the Inspectors General on Integrity and Efficiency to develop a legislative proposal to reconstitute the essential capabilities of the ROC to help ensure federal spending accountability.

Opportunities Exist to Improve the Acquisition and Operation of IT and to Address Cybersecurity Challenges

The federal government is projected to invest more than $89 billion on IT in fiscal year 2017. Our work has found that federal IT investments have too frequently failed or incurred cost overruns and schedule slippages while contributing little to mission-related outcomes. The federal government has spent billions of dollars on failed and poorly performing IT investments, which often suffered from ineffective management in areas such as project planning, requirements definition, and program oversight and governance. In many instances, agencies had not consistently applied best practices that are critical to successfully acquiring IT.

In addition to spending money on new IT development, federal agencies reported spending the majority of their IT funds on operating and maintaining a large number of legacy (i.e., steady-state) investments. Of the more than $80 billion reportedly spent on federal IT in fiscal year 2015, 26 federal agencies spent about $61 billion on operations and maintenance, more than three-quarters of the total amount spent. (See figure 6).

Further, federal legacy IT investments are becoming increasingly obsolete; many use outdated software languages and hardware parts that are unsupported. Specifically, in May 2016, we reported that many agencies were using systems which had components that were, in some cases, at least 50 years old. For example, we determined that DOD was using 8-inch floppy disks in a legacy system that coordinates the operational functions of the nation’s nuclear forces. In addition, Treasury was using assembly language code—a computer language initially used in the 1950s and typically tied to the hardware for which it was developed. Table 5 provides examples of legacy systems across the federal government that agencies report are 30 years old or older and use obsolete software or hardware, and identifies those that do not have specific plans with time frames to modernize or replace these investments.

To address this issue, we recommended that 12 agencies identify and plan to modernize or replace legacy systems, including establishing time frames, activities to be performed, and functions to be replaced or enhanced. Most agencies agreed with our recommendations or had no comment.

The spending on legacy systems has also increased over time. Specifically, between fiscal years 2010 and 2017, operations and maintenance spending has increased, while the amount invested in developing new systems has decreased by about $7.3 billion since fiscal year 2010. (See figure 7.)

Recognizing the severity of issues related to the government-wide management of IT, in December 2014, Congress enacted IT acquisition reform provisions (commonly referred to as the Federal Information Technology Acquisition Reform Act or FITARA) as part of the Carl Levin and Howard P. ‘Buck’ McKeon National Defense Authorization Act for Fiscal Year 2015. Among other things, the law requires action to: (1) consolidate federal data centers, (2) enhance transparency and improve risk management, (3) enhance agency chief information officer (CIO) authority, (4) review IT investment portfolios, (5) expand training and use of IT acquisition cadres, (6) purchase software government-wide, and (7) maximize the benefit of federal strategic sourcing.

In February 2015, we introduced a new government-wide high-risk area, Improving the Management of IT Acquisitions and Operations. This area highlights several critical IT initiatives in need of additional executive branch and congressional oversight, including (1) reviewing troubled projects; (2) increasing the use of incremental development; (3) providing transparency relative to the cost, schedule, and risk levels for major IT investments; (4) reviewing agencies’ operational investments; (5) consolidating data centers; and (6) streamlining agencies’ portfolios of IT investments. We noted that agencies have inconsistently implemented these initiatives and that more work remained to demonstrate progress in achieving successful IT acquisitions and operations outcomes.

Further, our February 2015 High-Risk report stressed that, beyond implementing FITARA, OMB and agencies needed to continue to implement our prior recommendations in order to improve their ability to effectively and efficiently invest in IT. Specifically, between fiscal years 2010 and 2015, we made 803 recommendations to OMB and federal agencies to address shortcomings in IT acquisitions and operations, including many to improve the implementation of the critical IT initiatives mentioned earlier and other government-wide, cross-cutting efforts. We noted that OMB and agencies should demonstrate government-wide progress in the management of IT investments by, among other things, implementing at least 80 percent of our recommendations related to managing IT acquisitions and operations within 4 years.

In February 2017, we issued an update to our High-Risk Series and reported that, while progress had been made in improving the management of IT acquisitions and operations, significant work still remained to be completed. For example, as of December 2016, OMB and the agencies had fully implemented 366 (or about 46 percent) of the 803 recommendations. This was a 23 percent increase compared to the percentage we reported as being fully implemented in 2015. However, in fiscal year 2016, we made 202 new recommendations, thus further reinforcing the need for OMB and agencies to address the shortcomings in IT acquisitions and operations. Our ongoing work has shown that OMB and agencies’ implementation of these recommendation will likely result in billions of dollars in cost savings.

To better ensure that IT investments are made in the most effective manner possible, OMB has established several initiatives to improve the acquisition and operations of IT and achieve cost savings. However, these efforts have been implemented inconsistently and additional OMB and agency progress is needed to more effectively and efficiently invest in IT.

Incremental development. OMB has emphasized the need to deliver investments in smaller parts, or increments, in order to reduce risk; deliver capabilities more quickly; increase the likelihood that cost, schedule, and performance goals will be met; and facilitate the adoption of emerging technologies. In 2010, it called for agencies’ major investments to deliver functionality every 12 months and, since 2012, every 6 months. Subsequently, FITARA codified a requirement that agency CIOs certify that IT investments are adequately implementing incremental development, as defined in the annual capital planning guidance issued by OMB. However, in August 2016, we reported that approximately 36 percent of active software projects had not planned to deliver usable functionality every 6 months for fiscal year 2016, as required by OMB guidance.

We also reported that, although OMB had issued guidance requiring covered agency CIOs to certify that each major IT investment’s plan for the current year adequately implements incremental development, only three of seven agencies selected for in-depth GAO review (the Departments of Commerce, Homeland Security, and Transportation) had defined processes and policies intended to ensure that the department CIO certifies that major IT investments are adequately implementing incremental development. Accordingly, we recommended that the remaining four agencies establish a policy and process for certifying that major IT investments’ adequately use incremental development. Education and HHS agreed with our recommendation, while DOD disagreed and stated that its existing policies address the use of incremental development. However, we noted that the department’s policies did not comply with OMB’s guidance and that we continued to believe our recommendation was appropriate. Treasury did not comment on the recommendation. In total, we have made 23 recommendations to OMB and agencies to improve their implementation of incremental development; and as of May 2017, 17 of our recommendations remained open.

Federal data center consolidation. Over time, the federal government’s increasing demand for IT has led to a dramatic rise in the number of federal data centers (defined as data processing and storage facilities over 500 square feet with strict availability requirements) and a corresponding increase in operational costs. To improve the efficiency, performance, and environmental footprint of federal data center activities, OMB established the Federal Data Center Consolidation Initiative in February 2010. In a series of reports over the past 6 years, we determined that, while data center consolidation could potentially save the federal government billions of dollars, weaknesses existed in several areas, including agencies’ data center consolidation plans and OMB’s tracking and reporting on cost savings.

As of March 2017, the 24 federal agencies participating in OMB’s data center consolidation initiative had collectively reported closing 4,679 of the 10,058 total data centers and achieving approximately $2.8 billion in cost savings or avoidances from fiscal year 2012 through 2016. Further, as of December 2016, agencies were planning a total of approximately $378 million in cost savings between fiscal years 2016 and 2018. However, this is significantly less than the approximately $4.0 billion in fiscal year 2016 through 2018 planned savings that agencies reported to us in November 2015 and OMB’s $2.7 billion cost savings goal for agencies to achieve by the end of fiscal year 2018. Of the recommendations that we made to 10 agencies in March 2016 to complete their planned data center cost savings targets for fiscal years 2016 through 2018, all remain open. In total, we have made 111 recommendations to OMB and agencies to improve the federal data center consolidation effort. As of May 2017, 45 of our recommendations remained open.

IT investment portfolio management. In March 2012, OMB launched an initiative, referred to as PortfolioStat, to maximize the return on IT investments across the government’s portfolio. PortfolioStat is designed to assist agencies in assessing the current maturity of their IT investment management process, making decisions on eliminating duplicative investments, and moving to shared solutions (such as cloud computing) within and across agencies.

In November 2013, we reported that agencies had identified duplicative spending as part of PortfolioStat and that this initiative had the potential to save at least $5.8 billion through fiscal year 2015; however, weaknesses existed in agencies’ implementation of the initiative, such as limitations in the CIOs’ authority. In April 2015, we reported that, although agencies had achieved approximately $1.1 billion in PortfolioStat savings, inconsistencies in OMB’s and agencies’ reporting made it difficult to reliably measure progress in achieving savings. In total, we have made 69 recommendations to improve OMB and agencies’ implementation of PortfolioStat; and as of May 2017, only 7 of our recommendations had been implemented.

Management of software licenses. In May 2014, we reported on federal agencies’ management of software licenses and determined that better management was needed to achieve significant savings government-wide. In particular, 22 of the 24 major agencies did not have comprehensive license policies and only 2 had comprehensive license inventories. As a result, agencies’ oversight of software license spending was limited or lacking, thus, potentially leading to missed savings. The potential savings could be significant considering that, in fiscal year 2012, 1 major federal agency reported saving approximately $181 million by consolidating its enterprise license agreements, even though its oversight process was ad hoc. We recommended that OMB issue needed guidance to agencies and made 135 recommendations to the agencies to improve their policies and practices for managing licenses. As of May 2017, 123 of our recommendations have not yet been implemented.

In light of these issues, we convened a forum on September 14, 2016, to explore challenges and opportunities for CIOs to improve federal IT acquisitions and operations—with the goal of better informing policymakers and government leadership. Forum participants, including 13 current and former federal agency CIOs, members of Congress, and private sector IT executives, identified key actions related to seven topics: (1) strengthening FITARA, (2) improving CIO authorities, (3) budget formulation, (4) governance, (5) workforce, (6) operations, and (7) transition planning. For example, participants noted that challenges with IT operations, such as the use of increasingly obsolete systems, should be addressed by, among other things, using a strategic approach for legacy system migration and migrating more services to cloud computing services. A summary of the key actions, by topic area, identified during the forum is provided in figure 8.

Cybersecurity Presents an Ongoing Challenge

In addition to improving the acquisition and operation of IT, opportunities also exist to better ensure the security of federal information systems and cyber critical infrastructure and protect the privacy of personally identifiable information (PII). Safeguarding federal computer systems and the systems that support critical infrastructures—referred to as cyber critical infrastructure protection—has been a longstanding concern. The security of federal cyber assets has been on our High-Risk List since 1997, the first time we added a government-wide issue to the list. In 2003, we expanded this high-risk area to include the protection of critical cyber infrastructure. In 2015, we added protecting the privacy of PII that is collected, maintained, and shared by both federal and nonfederal entities.

As we reported in our February 2017 High-Risk report, the federal government has taken steps intended to improve the security of its cyber assets. For example, in July 2016, the President released Presidential Policy Directive (PPD)-41, which set forth principles governing the federal government’s response to cyber incidents involving government or private sector entities. Further, in July 2016, OMB issued a revised Circular A- 130, Managing Information as a Strategic Resource, to reflect changes in law and advances in technology and to ensure consistency with executive orders, presidential directives, recent OMB policy, and National Institute of Standards and Technology (NIST) standards and guidelines. Most recently, on May 11, 2017, the President issued an executive order titled Strengthening the Cybersecurity of Federal Networks and Critical Infrastructure. Among other things, the order is intended to hold department and agency heads accountable for managing cybersecurity risk to their enterprise and support cybersecurity risk management efforts of owners and operators of the Nation’s critical infrastructures.

In addition, the Executive Office of the President (EOP) and the Department of Homeland Security (DHS) developed corrective action plans intended to improve the protection of cyber assets and PII. DHS and EOP also took other steps, such as developing and using metrics for measuring agency progress in implementing initiatives on information security regarding continuous monitoring, strong authentication, and anti- phishing and malware defense.

However, securing cyber assets remains a challenge for federal agencies. In prior reports, we made a number of recommendations to federal agencies concerning challenges in the following areas:

Designing and implementing risk-based cybersecurity programs at federal agencies.

Providing government-wide intrusion detection and prevention services.

Strengthening security over industry and public health data at the Food and Drug Administration.

Improving security controls over high-impact systems.

Addressing cybersecurity for the nation’s critical infrastructures.

Protecting the security and privacy of electronic health information.

Ensuring privacy when face recognition systems are used.

Protecting the privacy of users’ data on state-based marketplaces.

Improving consumer privacy protections.

Until the administration and executive branch agencies implement the approximately 1,000 open recommendations that we have made to address these cyber challenges, resolve identified deficiencies, and fully implement effective security programs and privacy practices, a broad array of federal assets and operations remain at risk of fraud, misuse, and disruption, and the nation’s most critical federal and private sector infrastructure systems will remain at increased risk of attack from adversaries. As we have previously stated, Congress should also consider amending privacy laws to more fully protect the PII collected, used, and maintained by the federal government.

Challenges Remain in Reducing Unneeded Federal Facilities and Managing the Federal Fleet of Vehicles

In 2003, we added Federal Real Property to our High-Risk List, in part due to long-standing challenges federal agencies face in managing federally owned real property, including disposal of excess and underutilized property. Continuing to maintain these unneeded facilities puts the government at risk for wasting resources due to ongoing maintenance costs as well as lost revenue from failing to sell surplus property. Despite past and ongoing efforts, the federal government continues to maintain excess and underutilized property.

Our work has found that significant challenges persist in managing real property in general and underutilized property in particular, including a lack of reliable data to measure the extent of the problem, a complex disposal process, costly environmental requirements, competing stakeholder interests, and limited accessibility of some federal properties. As of May 2017, we have 32 open recommendations to the General Services Administration (GSA) to address these challenges. The experiences of the Department of Veterans Affairs (VA), DOD, DHS, and the GSA illustrate some of these challenges.

VA facility alignment. VA operates one of the largest health care systems in the United States, with 168 medical centers and more than 1,000 outpatient facilities, totaling over 6,000 reported buildings in its portfolio. Of these buildings, VA reported in February 2016 that over 1,000 are unneeded or underutilized, representing 11.5 million square feet of space, requiring an estimated $26 million annually to operate and maintain according to VA (see figure 9). As VA’s care model shifts over time from inpatient to outpatient care, this will likely result in additional underutilized space. However, VA has found it difficult and costly to modernize existing facilities. A previous VA effort aimed at modernizing and better aligning facilities was not fully implemented due in part to stakeholder opposition. We recommended in April 2017 that VA improve guidance to effectively communicate with stakeholders and evaluate those efforts. VA agreed with the recommendations.

DHS reuse of St. Elizabeths. DHS efforts to consolidate its headquarters on the west campus of St. Elizabeths has faced numerous delays and cost increases. The west campus of St. Elizabeths, a National Historic Landmark in Washington, D.C., is made up of 61 buildings on about 182 acres. Many of the buildings have been vacant for extended periods of time and are in badly deteriorated condition. (See figure 10.) The Coast Guard has moved into a newly constructed building on the campus, but most of the project has been delayed. The estimated timeline for completing the project has been extended multiple times, from an initial estimated completion date of 2016, to an estimated completion date of 2021 based on a scaled back plan.

DOD support infrastructure. DOD manages a global real property portfolio that consists of more than 562,000 facilities. In 1997, we added DOD’s support infrastructure management to the High-Risk List and since then, have reported on various obstacles DOD has experienced in reducing excess infrastructure, more efficiently using facilities, reducing base support costs, and achieving efficiencies by consolidating or eliminating duplicative support services. DOD has shown some improvement in managing its infrastructure to better achieve reductions and efficiencies, but challenges remain.

DOD continues to maintain excess facilities, and needs to ensure accuracy of its real property data to better identify potential areas to reduce and consolidate facilities. For example, in March 2016 we found DOD lacked reliable data to effectively assess how it uses leases. We recommended actions to improve the accuracy and completeness of these data, such as breaking out the cost and square footage information on multiple properties included in a single lease. DOD agreed with our findings, but did not agree with our recommendation and has not taken action to implement it. If DOD does not improve the reliability of its data, the department will continue to be limited in its ability to monitor its reduction of excess infrastructure, identify opportunities to consolidate underutilized facilities, and identify opportunities to reduce reliance on costly leased space by moving DOD organizations into excess facilities.

GSA warehouses. In 2014, we found that some GSA warehouses listed as “used” had been vacant for as long as 10 years. GSA only lists warehouses as unused if they are in the process of being disposed, making it difficult to identify which warehouses are actually underutilized or vacant. Two examples located in Washington, D.C. are shown in figure 11. We recommended that GSA improve its data related to warehouses. GSA agreed with the recommendations.

GSA, however, continues to lack a strategic approach to prioritize warehouses and make long-term, informed decisions about government warehouse space. As a result, GSA may have limited ability to address this potentially growing gap as well as the unique challenges facing GSA’s warehouse portfolio. Such a strategy would enable GSA and tenant agencies to prioritize their needs and take a long-term view of the warehouse inventory to support better informed decisions.

GSA high-value leases. To reduce its overreliance on costly leases, we recommended in September 2013 that GSA develop a long-term, cross-agency strategy that facilitates consideration of targeted investments in ownership. GSA agreed with our recommendation and has taken steps to prioritize lease purchases, but has not yet developed a strategy that considers its full portfolio of high-value leases. Such a strategy would strengthen the business case for stakeholders to increase ownership investments in high-value leased properties—a necessary step for fully addressing GSA’s overreliance on leasing in situations where ownership would be more cost effective in the long run.

The administration and Congress have taken recent steps to reform real property management and address the long-standing challenge of reducing excess and underutilized property. For example, in 2015, OMB implemented our recommendation by issuing government-wide guidance—the National Strategy for the Efficient Use of Real Property— which aligns with many of the desirable characteristics of effective national strategies that we have previously identified. In December 2016, two real property reform laws were also enacted that could address the long-standing problem of federal excess and underutilized property.

The Federal Assets Sale and Transfer Act of 2016 may help address stakeholder influence by establishing an independent board to identify and recommend civilian federal buildings for disposal. The President has not yet appointed the board, but GSA has started gathering information from the agencies to support the board once it is constituted. In addition, the Federal Property Management Reform Act of 2016 codified the Federal Real Property Council (FRPC)—a group of senior real property officers from each federal agency— to collaborate to improve real property management and reduce costs to the federal government. For example, the act requires that the FRPC, in consultation with OMB and GSA, update annually a property management plan template with government-wide performance measures to reduce surplus property and achieve better utilization of underutilized property.

Challenges to Managing the Federal Vehicle Fleet

In fiscal year 2015, federal agencies spent about $4.3 billion on over 640,000 vehicles that agencies own or lease. Agencies are responsible for managing their vehicle fleet, which includes making decisions about the number of vehicles the agency needs and deciding when to dispose of a vehicle. In two reviews we conducted between 2015 and 2017, we found that selected agencies were spending over $20 million annually on vehicles that may not have been fully utilized. At six agencies, we found that agencies either had no criteria to determine if a vehicle was used, could not document that the agency applied their utilization criteria, or retained vehicles that did not meet the agency’s criteria.

In January 2016 and April 2017, we recommended that specific agencies take actions to identify and eliminate unnecessary vehicles from their respective fleets. In response to our recommendations, some agencies have taken steps to identify underutilized vehicles in their fleets. However, given the decentralized nature of federal fleets and our analysis of a small sample of agencies, it is likely that additional cost savings are possible through enhanced agency practices.

I recently met with the Director of OMB to discuss a range of issues, including those discussed today. Following that meeting, I sent the Director a letter highlighting open priority recommendations to OMB on important issues. I am also meeting with the heads of the major agencies to discuss the pressing management risks and challenges that confront their agencies, as well as sending them individual letters identifying the priority GAO open recommendations that need their personal attention. We have found in recent years that such letters are helpful in focusing attention on the most important issues.

Ultimately, addressing the federal government’s long-term unsustainable fiscal path will require broad fiscal policy changes to address the imbalance between federal revenues and spending. However, by taking immediate action on government-wide management challenges, Congress and the executive branch can begin to address our fiscal situation by preventing fraud, waste, and abuse and ensuring funds are put to the best possible use.

Thank you, Chairman Enzi, Ranking Member Sanders, and members of the Committee, this concludes my prepared statement. I would be pleased to answer questions.

GAO Contacts

For further information on this testimony, please contact J. Christopher Mihm, Managing Director, Strategic Issues, who may be reached at (202) 512-6806 or mihmj@gao.gov, or Susan J. Irving, Director for Federal Budget Analysis, Strategic Issues, who may be reached at (202) 512- 6806 or irvings@gao.gov. Contact points for the individual areas listed in our 2017 Fragmentation, Overlap, and Duplication annual report can be found on the first page of each area in GAO-17-491SP. Contact points for the individual high-risk areas are listed in GAO-17-317 and on our high- risk website. Contact points for our Congressional Relations and Public Affairs offices may be found on the last page of this statement.

Related GAO Products

2017 Annual Report: Additional Opportunities to Reduce Fragmentation, Overlap, and Duplication and Achieve Other Financial Benefits. GAO-17-491SP. Washington, D.C.: April 26, 2017.

High-Risk Series: Progress on Many High-Risk Areas, While Substantial Efforts Needed on Others. GAO-17-317. Washington, D.C.: February 15, 2017.

High-Risk Series: An Update. GAO-15-290. Washington, D.C.: February 11, 2015.

Improper Payments

SSA Disability Benefits: Comprehensive Strategic Approach Needed to Enhance Antifraud Activities. GAO-17-228. Washington, D.C.: April 17, 2017.

Financial Audit: Fiscal Years 2016 and 2015 Consolidated Financial Statements of the U.S. Government. GAO-17-283R. Washington, D.C.: January 12, 2017.

Improper Payments: Strategy and Additional Actions Needed to Help Ensure Agencies Use the Do Not Pay Working System as Intended. GAO-17-15. Washington, D.C.: October 14, 2016.

Medicare: Claim Review Programs Could Be Improved with Additional Prepayment Reviews and Better Data. GAO-16-394. Washington, D.C.: April 13, 2016.

Medicare Advantage: Fundamental Improvements Needed in CMS’s Effort to Recover Substantial Amounts of Improper Payments. GAO-16-76. Washington, D.C.: April 8, 2016.

Medicaid: Additional Efforts Needed to Ensure that State Spending is Appropriately Matched with Federal Funds. GAO-16-53. Washington, D.C.: October 16, 2015.

Federal Spending Accountability: Preserving Capabilities of Recovery Operations Center Could Help Sustain Oversight of Federal Expenditures. GAO-15-814. Washington, D.C.: September 14, 2015.

A Framework for Managing Fraud Risks in Federal Programs.

GAO-15-593SP. Washington, D.C.: July 2015.

Medicaid: Additional Actions Needed to Help Improve Provider and Beneficiary Fraud Controls. GAO-15-313. Washington, D.C.: May 14, 2015.

Improper Payments: TRICARE Measurement and Reduction Efforts Could Benefit from Adopting Medical Record Reviews. GAO-15-269. Washington, D.C.: February 18, 2015.

Supplemental Nutrition Assistance Program: Enhanced Detection Tools and Reporting Could Improve Efforts to Combat Recipient Fraud. GAO-14-641. Washington, D.C.: August 21, 2014.

DOD Financial Management: Significant Improvements Needed in Efforts to Address Improper Payment Requirements. GAO-13-227. Washington, D.C.: May 13, 2013.

Health Care Fraud: Types of Providers Involved in Medicare, Medicaid, and the Children’s Health Insurance Program Cases. GAO-12-820. Washington, D.C.: September 7, 2012.

Recovery Act: IRS Quickly Implemented Tax Provisions, but Reporting and Enforcement Improvements Are Needed. GAO-10-349. Washington, D.C.: February 10, 2010.

Information Technology

Information Technology: Opportunities for Improving Acquisitions and Operations. GAO-17-251SP. Washington, D.C.: April 11, 2017.

Information Technology Reform: Agencies Need to Increase Their Use of Incremental Development Practices. GAO-16-469. Washington, D.C.: August 16, 2016.

Information Technology: Federal Agencies Need to Address Aging Legacy Systems. GAO-16-468. Washington, D.C.: May 25, 2016.

Data Center Consolidation: Agencies Making Progress, but Planned Savings Goals Need to Be Established . GAO-16-323. Washington, D.C.: March 3, 2016.

Information Technology: Additional OMB and Agency Actions Needed to Ensure Portfolio Savings Are Realized and Effectively Tracked. GAO-15-296. Washington, D.C.: April 16, 2015.

Data Center Consolidation: Reporting Can Be Improved to Reflect Substantial Planned Savings. GAO-14-713. Washington, D.C.: September 25, 2014.

Federal Software Licenses: Better Management Needed to Achieve Significant Savings Government-Wide. GAO-14-413. Washington, D.C.: May 22, 2014.

Information Technology: Additional OMB and Agency Actions Are Needed to Achieve Portfolio Savings. GAO-14-65. Washington, D.C.: November 6, 2013.

Information Technology: OMB and Agencies Need to More Effectively Implement Major Initiatives to Save Billions of Dollars. GAO-13-796T. Washington, D.C.: July 25, 2013.

Data Center Consolidation: Strengthened Oversight Needed to Achieve Cost Savings Goal. GAO-13-378. Washington, D.C.: April 23, 3013.

Data Center Consolidation: Agencies Making Progress on Efforts, but Inventories and Plans Need to Be Completed. GAO-12-742. Washington, D.C.: July 19, 2012.

Data Center Consolidation: Agencies Need to Complete Inventories and Plans to Achieve Expected Savings. GAO-11-565. Washington, D.C.: July 19, 2011.

Federal Real Property and Vehicles

Federally Owned Vehicles: Agencies Should Improve Processes to Identify Underutilized Vehicles. GAO-17-426. Washington, D.C.: April 25, 2017.

VA Real Property: VA Should Improve Its Efforts to Align Facilities with Veterans’ Needs. GAO-17-349. Washington, D.C.: April 5, 2017.

Federal Real Property: Efforts Made, but Challenges Remain in Reducing Unneeded Facilities. GAO-16-869T. Washington, D.C.: September 23, 2016.

Defense Infrastructure: More Accurate Data Would Allow DOD to Improve the Tracking, Management, and Security of Its Leased Facilities. GAO-16-101. Washington, D.C.: March 15, 2016.

Federally Leased Vehicles: Agencies Should Strengthen Processes to Reduce Underutilized Vehicles. GAO-16-136. Washington, D.C.: January 14, 2016.

Federal Real Property: Strategic Focus Needed to Help Manage Vast and Diverse Warehouse Portfolio. GAO-15-41. Washington, D.C.: November 12, 2014.

DOD Joint Bases: Implementation Challenges Demonstrate Need to Reevaluate the Program. GAO-14-577. Washington, D.C.: September 19, 2014.

Defense Infrastructure: DOD Needs to Improve Its Efforts to Identify Unutilized and Underutilized Facilities. GAO-14-538. Washington, D.C.: September 8, 2014.

Federal Real Property: Greater Transparency and Strategic Focus Needed for High-Value GSA Leases. GAO-13-744. Washington, D.C.: Sept. 19, 2013.

Federal Real Property: National Strategy and Better Data Needed to Improve Management of Excess and Underutilized Property. GAO-12-645. Washington, D.C.: June 20, 2012.

Excess Facilities: DOD Needs More Complete Information and a Strategy to Guide Its Future Disposal Efforts. GAO-11-814. Washington, D.C.: September 19, 2011.

Long-Term Fiscal Outlook

The Nation’s Fiscal Health: Action is Needed to Address the Federal Government’s Fiscal Future. GAO-17-237SP. Washington, D.C.: January 17, 2017.

Fiscal Outlook & The Debt Key Issues Page, accessed April 28, 2017,

Social Security’s Future: Answers to Key Questions. GAO-16-75SP.

Washington, D.C.: October 27, 2015.

Fiscal Outlook: Addressing Improper Payments and the Tax Gap Would Improve the Government’s Fiscal Position. GAO-16-92T. Washington, D.C.: October 1, 2015.

This is a work of the U.S. government and is not subject to copyright protection in the United States. The published product may be reproduced and distributed in its entirety without further permission from GAO. However, because this work may contain copyrighted images or other material, permission from the copyright holder may be necessary if you wish to reproduce this material separately.