Improper Payments and Recovery Audits: Legislation, Implementation, and Analysis
Released: 2013-10-18T00:00:00

Improper Payments Elimination and Recovery Act of 2010

Background

In an effort to reduce and ultimately eliminate billions of dollars in improper payments made by federal agencies each fiscal year, Congress passed the Improper Payments Information Act (IPIA; P.L. 107-300 ; 116 Stat. 2350) in 2002. IPIA established an initial framework for identifying, measuring, preventing, and reporting on improper payments at each agency. Separately, Congress also passed legislation, the Recovery Audit Act of 2002 ( P.L. 107-107 ; Section 831; 115 Stat. 1186), which required agencies that awarded more than $500 million annually in contracts to implement plans to recover overpayments to contractors.

Reports on improper payments and recovery audits were first issued for FY2004. After five years of reporting, the data showed that progress under IPIA was uneven—while many individual programs reduced their improper payment rates, the total amount of improper payments and the government-wide improper payment rate both increased between FY2004 and FY2008. During that same time period, Government Accountability Office (GAO) auditors had identified weaknesses in numerous agencies' recovery audit programs.

In response, Congress passed new legislation, the Improper Payments Elimination and Recovery Act of 2010 (IPERA; P.L. 111-204 ; 124 Stat. 2224), which replaced and consolidated the requirements of both IPIA and the Recovery Audit Act. As discussed below, IPERA retained the core provisions of the IPIA while requiring improvements in agency improper payment estimation methodologies and improper payment reduction plans. It also significantly expanded the scope and reporting requirements of recovery audit programs.

Improper Payments

IPERA defines an improper payment as a payment that should not have been made or that was made in an incorrect amount, including both overpayments and underpayments. This definition includes payments that were made to an ineligible recipient, duplicate payments, payments for a good or service not received, and payments that do not account for credit for applicable discounts. Under IPERA, "payment" is defined as a transfer or commitment to transfer federal funds in the future—including cash, securities, loans, loan guarantees, and insurance subsidies—to a nonfederal entity. Thus, the law applies to federal funds paid or obligated by a federal agency to nonfederal grantees, contractors, and loan recipients, including state or local governments who administer federal programs or activities.

Risk Assessments

IPERA requires agencies to take specific steps to identify and reduce improper payments. First, it requires agencies to perform a risk assessment of all programs and activities and identify those that were susceptible to "significant" improper payments. IPERA defines "significant" for FY2011 and FY2012 as either (1) improper payments that exceed both $10 million and 2.5% of program or activity outlays; or (2) improper payments in excess of $100 million. Beginning in FY2013, the 2.5% threshold drops to 1.5%, with other aspects of the definition unchanged. IPERA also requires agencies to perform the initial risk assessment for every program and activity during the year in which IPERA was enacted (i.e., in 2011) and to perform subsequent risk assessments at least every three years.

When performing risk assessments, IPERA requires agencies to consider several risk factors that may make a program or activity susceptible to "significant" improper payments:

whether the program or activity is new to the agency; the complexity of the program or activity; the volume of payments; whether payments or payment eligibility decisions are made outside the agency, such as by a state government; recent major changes in program funding, authorities, practices, or procedures; the level of experience and quality of training for personnel responsible for making program eligibility determinations or certifying that payments are accurate; and major deficiencies in an agency's audit report or other source that might result in inaccurate payment certification.

Once a program or activity has been identified as susceptible to "significant" improper payments, agencies are required to estimate the amount of improper payments made under each.

Reporting on Agency Efforts to Reduce Improper Payments

IPERA requires agencies to report on the actions they have taken to reduce improper payments for each program and activity in the accompanying materials to their annual financial statement. IPERA also requires agencies to provide an estimate of improper payments for each program or activity identified as susceptible through the risk assessment, describe the causes of improper payments, the actions planned or taken to correct those problems, and when those actions were completed or will be completed. Target dates for achieving reductions in improper payments must be approved by the Office of Management and Budget (OMB), and agencies must include annual performance criteria used to hold the appropriate parties accountable for meeting those targets—whether they work for the agency or for a state or local government that helps implement the program. The performance criteria must also include an evaluation of the internal controls within the agency, or state or local government, that are intended to prevent, detect, and recover improper payments. IPERA also requires agencies to include a statement as to whether they have sufficient resources to develop their own internal controls for reducing improper payments—such as human capital and information systems—and, if not, to identify what additional resources are needed to do so. OMB is also required to establish criteria that agencies must meet to demonstrate that they have effective internal control systems.

IPERA also requires OMB to submit a report to two congressional committees—the House Committee on Oversight and Government Reform and the Senate Committee on Homeland Security and Government Affairs—that provides a government-wide summary of agency efforts to reduce and recover improper payments. This report must include (1) government-wide improper payment reduction targets; (2) the compliance status of each agency; (3) a discussion of progress made towards meeting improper payment reduction targets; and (4) a summary of the improper payment reduction and recovery actions of each agency. IPERA further directs OMB to provide guidance on the timing and format of the improper payments reports required by IPERA, both at the agency level and government wide. OMB's guidance, which was issued in 2011, is discussed in detail in the " OMB Guidance " section of this report.

Compliance

The inspector general of each agency must determine whether the agency is in compliance with IPERA and report its findings to the head of the agency, the Comptroller General, the House Committee on Oversight and Government Reform, and the Senate Committee on Homeland Security and Government Affairs. An agency is deemed in compliance if it has

published an annual financial statement; conducted risk assessments for each program or activity; published improper payment estimates, corrective action plans, and improper payment reduction targets for all risk-susceptible programs and activities; and reported no improper payment rate that met or exceeded 10%.

By definition, then, an agency must report that all of its programs and activities have an improper payment rate of less than 10% to be deemed in compliance with IPERA.

Agencies that are deemed noncompliant must submit a plan to Congress that describes the steps they will take to become fully compliant. The plan must include (1) measurable milestones that will result in compliance for each program or activity deemed noncompliant; (2) the name of a senior agency official who is responsible for ensuring the agency becomes compliant; and (3) an "accountability mechanism" that may include incentives and consequences tied to the ability of the responsible official to bring the agency into compliance.

If an agency is deemed noncompliant for two consecutive years, and OMB has determined that additional funding would help the agency become compliant, then the agency head would be required to obligate additional funds—in an amount determined by OMB—for "intensified compliance efforts." IPERA does not provide agencies with new authority for transferring funds. Agencies that were unable to obligate all of the additional funds required by OMB under their existing authorities, then, would need statutory authority to transfer funds under Title 31 of the U.S. Code .

If an agency is deemed noncompliant for three or more consecutive years for the same program or activity, then the agency must submit to Congress reauthorization proposals for those programs or activities, along with proposed statutory changes that may bring the agency into compliance.

IPERA gives OMB the authority to conduct compliance pilot programs to "test potential accountability mechanisms" and to report the findings from those pilot programs within five years from enactment (i.e., before July 22, 2015).

Recovery Audits

A recovery audit, or payment recapture audit, is a review process designed to identify overpayments. According to OMB guidance, "It is not an audit in the traditional sense. Rather it is a detective and corrective control activity designed to identify and recapture overpayments, and, as such, is a management function and responsibility."

The idea of recouping overpayments through the recovery auditing process had received attention in previous Congresses. In a hearing on eliminating agency payment errors, Senator Tom Carper noted that, "even as agencies report greater improper payments, we are seeing actually fewer improper payments recovered." When Senator Carper introduced IPERA in the 110 th Congress, the legislation addressed this issue through the inclusion of a section on recovery audits.

IPERA requires agencies to perform recovery audits on each program or activity with expenditures of $1 million or more per year. In addition, the legislation stipulates that the performance of recovery audits is conditional on cost-effectiveness, though the term "cost-effective" is not defined in law. IPERA contains provisions for the conduct of these recovery audits. The legislation establishes agencies' threshold requirement for recovery auditing, details certain procedures for the performance of recovery audits, mandates collection of overpayments, specifies disposition allotments for recovered amounts, and imposes reporting requirements on actions to recover improper payments.

The legislation institutes two procedural requirements for the conduct of recovery audits. First, it requires agencies to prioritize both the most recent payments and those deemed susceptible to "significant" improper payments. Second, the legislation specifies options for recovery audit services—they could be performed within the agency itself or by other U.S. departments and agencies, or private sector services could be procured by contract.

Although IPERA permits contractors to conduct recovery audits on agencies' behalf, it circumscribes their scope of authority. Only with the express consent of the agency head are contractors authorized to notify entities of potential overpayments, respond to questions pertaining to potential overpayments, and take administrative action on overpayment claims. In addition, contractors are not allowed to render a final decision as to whether or not an overpayment occurred, and they are not authorized to adjudicate overpayment claims. IPERA requires recovery audit contractors to report all overpayments detected through recovery audits to the procuring agency, regardless of whether a given overpayment occurred at the agency that contracted the audit or another agency beyond the scope of the contract.

Nongovernmental entities are prohibited from disclosing information uncovered through a recovery audit that would identify an individual for any purpose other than the recovery audit itself. An individual could waive this privacy protection, however, and permit the executive agency that contracted the audit to disclose identifying information for other purposes.

The legislation directs agencies to take "prompt and appropriate action" to collect overpayments identified in recovery audits upon receipt of an overpayment notification. Distribution of collected amounts was left to the discretion of agency heads, though there were limits on the maximum percentage of recovered amounts that could be applied to certain programs, purposes, and activities:

At most, 25% for a financial management improvement program, to be implemented by agency heads to address improper payments and reduce errors and waste across agency programs and operations. At most, 25% credited to the appropriation or fund from which the overpayment was made. At most, 5% for inspector general activities relating to implementation of the legislation itself or investigation of improper payments. The remaining 45% of collected amounts—and up to 100% depending on how much the agencies actually allocated in accordance with these criteria—are to be deposited in the Treasury as miscellaneous receipts.

IPERA specifies four reporting requirements which relate to the conduct of recovery audits. First, the legislation requires agency heads to provide a report on improper payment recovery actions, which is to include a statistically valid estimate of improper payments made by each program or activity, along with the following:

a discussion of the methods used to recover overpayments; the amounts recovered, outstanding, and determined not to be collectable; a written justification explaining any uncollected amounts; an aging schedule of outstanding amounts; a summary of the disposition of recovered amounts; a discussion of conditions giving rise to improper payments and how these are being resolved; and if an agency determined that a recovery audit was not cost-effective, then a justification as to why.

Second, by November 1 of each year, agencies are required to submit a report to OMB and Congress on actions taken on those conditions that promote overpayments, as identified and reported by recovery audit contractors. Third, the Director of OMB must provide the Senate Committee on Homeland Security and Governmental Affairs and the House Committee on Oversight and Government Reform a government-wide report on agencies' reports of improper payments information and recovery actions, as well as the compliance status of each agency covered by the law. Lastly, within two years of IPERA's enactment, the Chief Financial Officers Council must conduct a study, in consultation with the Council of Inspectors General on Integrity and Efficiency and recovery audit experts, on the implementation of IPERA's recovery audit provisions, the costs and benefits of agency recovery audit activities, and, in particular, the effectiveness of service provision by private contractors, agency employees, cross-servicing from other agencies, or any combination of the three. A report on this study was to be submitted to the Senate Committee on Homeland Security and Governmental Affairs, the House Committee on Oversight and Government Reform, and the Comptroller General by July 22, 2012.

OMB Guidance

OMB circulars operationalize implementation for agencies. Frequently, if legislation gives OMB discretion over administrative concerns, OMB details the legislation's procedural requirements and may impose its own additional requirements, provided that these do not contravene the enacted legislation. IPERA requires OMB to issue implementation guidance to agencies. This government-wide guidance was issued April 11, 2011, through the revision of Appendix C of OMB Circular A-123 (hereinafter, A-123), Management's Responsibility for Internal Control . Agencies were required to begin using the revised guidance for their FY2011 reporting.

Improper Payments

OMB's definition of an improper payment is consistent with IPERA's, though A-123 clarifies that when an agency does not have the documentation necessary to determine that a payment was proper, it is to be considered improper. OMB's guidance also provides a definition for program, which IPERA does not. According to A-123, a program includes all types of grants, procurements, and credit programs, as well as regulatory activities, research and development activities, and activities that agencies perform to support their programs. OMB's guidance specifies that payments to other agencies and to employees are not considered programs.

Risk Assessments

A-123, like IPERA, requires agencies to (1) review all programs and identify those susceptible to improper payments; (2) develop a valid estimate of the amount of improper payments for those programs identified as susceptible to "significant" improper payments; (3) implement a plan to reduce improper payments; and (4) report estimates of the annual amounts of improper payments and progress in reducing them. For each of those steps, discussed below, A-123 establishes a detailed process by which agencies are to fulfill their obligations under IPERA.

A-123 and IPERA both use the same definition of "significant" improper payments for agencies to follow when identifying programs susceptible to improper payments, including the use of a 2.5% threshold for FY2011 and FY2012, and a 1.5% threshold for FY2013 and beyond. The guidance and IPERA also identified the same risk factors that may indicate a program is susceptible to "significant" improper payments. OMB may determine on a case-by-case basis whether certain programs below the threshold may be required to have risk assessments performed.

Like IPERA, A-123 requires OMB to approve of agency sampling methodologies to ensure they accurately reflect the annual amount of improper payments. A-123 provides agencies with detailed explanations of steps they should take to establish valid methodologies, including sampling technique and size. OMB's guidance specifies that improper payment estimates should only include the erroneous amount. For example, if a payment of $50 was due, and the agency paid $60, then only the $10 above the correct amount would be counted in the improper payment total. Similarly, if the agency had paid $40 to a recipient that was supposed to receive $50, then only the $10 below the correct amount would be counted as improper. However, if a $100 payment was made without sufficient documentation to confirm that the payment was correct, the entire $100 would be included in the improper payment total. A-123 permits agencies to sample transactions at certain steps within the lifecycle of a payment rather than the entire payment process, if the agency believes that only those steps have the highest risk or have the greatest return on investment. For example, if an agency determines that a five-step payment has two high-risk steps, then it may sample, review, and report an estimate for just those two steps.

A-123 mirrors IPERA in that it requires each agency to develop a plan to reduce improper payments that includes three components: a description of the root causes of improper payments for each risk-susceptible program; OMB-approved improper payment reduction targets and a timeline within which those targets will be reached; and the steps taken to ensure that all of the parties involved—federal and nonfederal—are held accountable. The guidance does not provide examples of accountability mechanisms, but it does require agencies to assess whether they or their partners have the necessary infrastructure (i.e., human capital, internal controls, information systems) to reduce improper payments. A-123, like IPERA, also requires agencies to identify any statutory or regulatory barriers to implementing their plans. However, A-123 permits agencies to request a waiver for this reporting for programs or activities that have been deemed not risk-susceptible for two consecutive years, an allowance which is not found in IPERA.

A-123 requires agencies to include an estimate of the annual amount of improper payments for all of their programs and activities, and it clarifies that the estimate is to include programs or activities with estimated improper payment totals below $10 million. Consistent with IPERA, OMB's guidance also requires agencies to publish a report each year that includes the improper payment estimate; narrative information on agency plans to prevent, detect, and recover improper payments; and what resources, if any, they lack to implement their plans.

Compliance

A-123 provides numerous examples of steps agencies should take to prevent, detect, and recapture improper payments. The guidance acknowledges that fully implementing long-term corrective actions may take several years, but that those actions should be intensified and expanded whenever possible. A-123 identifies best-practices that could be used by agencies to reduce and recover improper payments, including predictive modeling, forensic accounting, partnering with agency inspectors general to focus on fraud prevention, data mining, and training agency staff on tools to identify improper payments.

Recovery Audits

As noted, IPERA requires agencies that have programs or activities with expenditures of $1 million or more per fiscal year to conduct payment recapture audits. A-123 further requires agencies to implement payment recapture audit programs, which consist of overall plans for risk analysis, payment recapture audits, and recapture (recovery) activities. While the agency head has discretion over the manner and combination of payment recapture activities, the cost-effectiveness mandate means that the benefits of the payment recapture audit program, such as recaptured amounts, should exceed the costs of implementation and oversight. Payment recapture activities should include a management improvement program to address problems with internal controls that contributed to those overpayments identified through implementation of a payment recapture program.

A-123's scope for payment recapture audit programs is consistent with IPERA, though A-123 provides greater specificity regarding the types of programs and activities which require recovery audits, including grants, benefits, loans, and contract programs. In addition, A-123 states that agencies

must prioritize payment recapture audits for the most recent payments and those deemed susceptible to "significant" improper payments; must design the program so as to ensure the greatest financial benefit for the government; may exclude payments from recovery audit activities if payment recapture audits are not determined to be cost-effective; may permit payment recapture audit contractors to notify entities of potential overpayments, respond to questions about overpayments, and take administrative action on overpayment claims but cannot authorize these contractors to render a final decision as to whether or not an overpayment occurred nor to adjudicate overpayment claims; and must correct underpayments identified through the recovery audit process, as well as overpayments.

IPERA requires agencies to perform recovery audits if doing so is cost-effective. According to A-123, agencies should consider the likelihood of overpayment recapture in determining whether a recapture audit is cost-effective. In making this determination, agencies may weigh (1) whether laws or regulations permit recovery; (2) whether the recipient of the overpayment is likely to have resources to repay overpayments from nonfederal funds; (3) whether the evidence of overpayment is clear versus contestable; and (4) whether the overpayment is truly a recoverable improper payment rather than a payment with unsupported documentation.

If an agency determines that a payment recapture audit program would not be cost-effective, then it must advise OMB and the agency's inspector general of this decision, along with the analysis it performed to reach that decision. OMB may review the analysis and instruct the agency to conduct a payment recapture audit program.

Agencies are required to establish annual payment recapture targets for their programs, which should vary in accordance with the different types of payments the agency makes, such as grants versus contracts. Targets are based on the rate of recovery, which the guidance defines as "the amount of improper payments recovered divided by the amount of improper payments identified." Agencies may set their own targets for OMB review and approval but must aim for annual recapture targets of at least 85% within three years. If they cannot achieve this target by FY2013, they must provide OMB a justification for setting a lowered target and obtain OMB's approval before setting it.

A-123 establishes guidelines for coordination between federal agencies and state or local governments, with respect to both payment recapture audits and financial management improvement efforts authorized by IPERA. Grant programs are subject to IPERA's recovery audit provisions, as noted previously, and these programs are often administered by states and local governments. The guidance instructs federal agencies to work with state and local governments to ensure that sufficient resources are available to perform payment recapture audits; federal agencies must also coordinate among themselves to reach partnerships with grant recipients for cost-effective payment recapture audit implementation. In addition, agency heads are required to use information obtained from payment recapture programs to implement financial management improvement programs that will improve the agency's internal controls to address improper payments, as well as reduce errors and waste across agency programs and operations. In so doing, agencies with state-administered programs may provide money to states and local governments for their financial management improvement efforts.

IPERA specifies three options for recovery audit services—recovery audits can be performed (1) within the agency itself, (2) by other U.S. departments and agencies, or (3) by a private sector entity. A-123 added a fourth option: by nonfederal entities that expend federal awards. IPERA allows agencies flexibility in the type of contract they use to procure recovery audit services, including contingency contracts, in which private sector contractors receive a percentage of overpayments that the agency is able to collect as payment for their services. However, certain types of payments recovered—amounts recovered due to interim improper payments made under ongoing contracts, recoveries from nondiscretionary appropriations, amounts recovered from unexpired appropriations, amongst others—cannot be used to pay contingency fee contracts. In these cases, agencies must establish alternative payment arrangements, such as through appropriations, to pay contractors.

A specific set of requirements and prohibitions governs the use of contracted payment recapture auditing firms. Contractors are required to provide semi-annual reports to the contracting agency on conditions giving rise to improper payments and recommendations for mitigation of these conditions; notify the agency of identified overpayments, regardless of whether they occurred at the contracting agency or another agency beyond the scope of the contract; and report credible evidence of fraud to the agency and its Office of Inspector General. In addition, contractors must familiarize themselves with agencies' policies and procedures and protect the confidentiality of sensitive financial information that could identify an individual. Payment recapture audit contractors are not prohibited from visiting the property of a payment recapture audit subject, though they cannot compel the production of records or information from the agency's contractors, nor can they act as agents for the federal government in the recovery of funds. Actual collection activities are carried out by federal agencies or nonfederal entities expending federal awards; a payment recapture audit contractor may only perform the collection activity if it is permitted by statute.

A-123 elaborates on IPERA's delineation of the disposition of amounts from nonexpired and expired discretionary funds. Overpayments recaptured from nonexpired discretionary funds, appropriated after the enactment of IPERA, must be returned to the appropriation from which they were made and not used for any other purpose. Overpayments from mandatory fund accounts, trust fund accounts, or special fund accounts must revert back to those accounts, as well. The distribution of any expired, recaptured discretionary collected amounts is at the discretion of agency heads, though amounts allocated to (1) the financial management improvement program, (2) the appropriation or fund from which the overpayment was made, or (3) inspector general activities are subject to maximum limits under IPERA. Within these constraints, agency heads may determine the actual percentages after reimbursing expenses for administering payment recapture audit programs and paying contractors for payment recapture audit services.

IPERA subjects agencies to two reporting requirements. First, it requires agencies to report annually on their payment recapture audit programs in their Performance and Accountability Reports (PARs) or Agency Financial Reports (AFRs). OMB's guidance on information to be included in these reports is consistent with IPERA, though it adds some additional requirements:

Provision of the total amount of payments subject to review, the actual amount of payments reviewed, the amounts identified for recapture, and the amounts actually recaptured in the current year; these amounts should be separated by those attributable to internal agency activities versus payment recapture audit contractors. Description and justification of the classes of payments excluded from payment recapture audit review by the agency.

Second, agencies using federal employees or external contractors must complete an additional annual report for OMB, Congress, and their inspectors general, containing recommendations from payment recapture auditors on mitigation of conditions that promote overpayments and corrective actions taken by the agency in response to these recommendations. It is due by November 1each year and should describe recommendations and actions taken by the agency during the previous fiscal year.

Analysis

Agencies have had 10 years to implement improper payment legislation, beginning with the enactment of IPIA in 2002, which established the core requirements of improper payments reduction. IPERA, while enacted more recently, reinforced IPIA's core requirements and expanded agencies' responsibilities to prevent and recover improper payments. Therefore, it is possible to evaluate agency efforts in reducing payment error rates over several years, and to make an initial assessment of recovery audit programs.

Improper Payments

The government's improper payment rate of 4.4% in FY2004—the first year of reporting required by IPIA—appears static when compared to the same rate for FY2012. Over time, though, the rate has declined to a low of 2.81% in FY2007 and reached a high of 5.42% in FY2009, as shown in Table 1 . As a consequence, agencies continue to make tens of billions of dollars a year in improper payments. Since the IPIA reporting requirements took effect, agencies have made over half a trillion dollars ($688 billion) in improper payments. In FY2012 alone the government made $108 billion in improper payments.

The inability of the government to reduce its overall improper payment rate is partly due to agencies' failure to reduce substantially the error rates for risk-susceptible federal programs with multi-billion dollar annual outlays. In some cases, error rates for those programs have actually increased over time. Moreover, the full extent of the improper payment problem is not known because agencies have yet to develop improper payment rates for some programs, including programs which OMB estimates may have annual improper payments of at least $750 million annually.

Agencies did not have improper payment estimates in place for all of their risk-susceptible programs and activities for the first year of IPIA reporting, FY2004. Since then, agencies have expanded the number of programs reported each year as they develop valid improper payment estimates for them. During this same time, the annual dollar amount of improper payments reported has more than doubled, rising from $45 billion in FY2004 to $108 billion in FY2012.

While the inclusion of additional programs accounts for much of the growth in improper payments reported since FY2004, there are a number of multi-billion dollar programs which have seen little or no improvement in their improper payment rates, and in some cases the error rates for these programs have actually increased over time. The improper payment rate for the Medicare Fee-for-Service program, for example, increased from 5.2% in FY2005 to 8.5% in FY2012, and the amount of improper payments made under the program has more than doubled in that same period of time, increasing from $12 billion to approximately $30 billion. Similarly, the improper payment rate for the Unemployment Insurance (UI) program increased from 10% in FY2005 to 11% in FY2012, and the amount of improper payments under UI increased from $3 billion to $10 billion. Error rates—and improper payment amounts—have also increased over time for the Supplemental Security Income (SSI) program and Medicare Advantage (Part C). While OMB has argued that administrative problems, such as the lack of required documentation, are the root causes of most improper payments, this does not explain why a program's improper payment error rate would increase over time—particularly when agencies were to begin addressing these weaknesses 10 years ago with the enactment of IPIA.

Incomplete Scope

The full scope of improper payments has not been determined because agencies have not yet developed estimates for all of their risk-susceptible programs or are re-calculating their initial estimates. Among these programs are several that have multi-billion dollar outlays and may have annual improper payment amounts in the hundreds of millions to billions of dollars. The Department of Health and Human Services (HHS), for example, is re-estimating its error rate for the Children's Health Insurance Program (CHIP). In FY2008, HHS initially reported an error rate of 14.7% for CHIP and outlays of $5.7 billion, resulting in $834 million in improper payments. Similarly, the Federal Communications Commission (FCC) is re-estimating the improper payment rate for the High-Cost Program component of the Universal Service Fund (USF). The initial improper payment rate for the High-Cost Program, published for FY2007 expenditures, was 16.5%, and total outlays exceeded $3.7 billion, resulting in $620 million in improper payments that year. One of the largest risk-susceptible programs that lacks a valid improper payment error rate is the Earned Income Tax Credit (EITC), which is administered by the Department of the Treasury. The initial improper payment rate for the EITC, published for FY2004 expenditures, was 24.5%, with total outlays $39.4 billion, resulting in $9.7 billion in improper payments. OMB estimates that the FY2011 improper payment rate for the EITC was between 21% and 26%, with a "rough" estimate of improper payments in excess of $15 billion. Until these and all other risk-susceptible programs have valid improper payment rates, the extent of the problem will remain unknown.

Ineffective Internal Controls

According to GAO, many agencies have not yet established internal controls that are effective enough to significantly reduce the risk of improper payments. As noted, OMB has reported that the three most common causes of improper payments are administrative in nature, specifically due to agencies failing to (1) verify that recipient-reported information is accurate, such as whether a recipient is working; (2) ensure that requests for payments are for valid purposes, such as whether a claim for a particular medical service is necessary given the recipient's medical condition; and (3) have the required documentation for each recipient, such as a completed application for benefits.

To address these deficiencies, GAO has recommended that agencies to consider implementing a range of preventive controls, including technological tools. Among these tools, GAO recommended that agencies share data to validate recipient eligibility from a variety of sources. HHS, for example, shares information from its New Hires database with the Department of Labor to confirm the employment status of an individual claiming benefits from the Unemployment Insurance program. GAO also recommended that agencies utilize predictive analytic technologies, which identify unusual patterns or abnormalities in service utilization or billing that may indicate fraudulent activity. Predictive analytic technology, for example, is currently employed by HHS to screen all claims under the Medicare Fee-for-Service program prior to payment. GAO is evaluating the effectiveness of the technology in preventing payments for fraudulent claims.

GAO also recommended that agencies provide more extensive training tailored for the various parties involved in the lifecycle of a payment: agency staff, beneficiaries, and service providers (when applicable). The training for agency staff, for example, might emphasize methods for detecting improper payments, while training for beneficiaries and service providers might focus on program requirements.

In addition, GAO reiterated the need for agency managers to ensure that audit findings are resolved in a timely manner. Managers have three important responsibilities in this regard, according to GAO. First, they must promptly review any audit findings that show deficiencies in agency internal controls; second, they must determine the proper steps needed to resolve these deficiencies; and third, they must complete those steps within an established, expeditious time frame.

Recovery Audits

One argument advanced by the proponents of IPERA was that it would increase the recovery of overpayments. OMB issued government-wide guidance on the implementation of IPERA in April 2011. However, only about seven months of IPERA's payment recapture audit provisions were in effect by the time agencies reported on improper payments in their FY2011 Agency Financial Reports (AFRs). That said, IPERA may have had a positive impact on efforts to recoup overpayments. According to the Treasury Department, agencies recaptured more than $1.2 billion in improper payments to contractors and vendors in FY2011, which is nearly double the $688 million recaptured in FY2010.

A recent GAO report noted that some agencies have indicated that statutory or regulatory barriers have interfered with their ability to perform recovery audits. GAO identified the Office of Personnel Management (OPM) and the Department of Agriculture (USDA) as specific cases in point. In its FY2011 AFR, OPM stated that current law and Treasury Department regulations prohibit financial institutions from providing the requisite information to recover overpayments for its Retirement Program. The USDA cited Section 281 of the Agriculture Reorganization Act of 1994 as the chief impediment to conducting recovery audits for the Farm Service Agency (FSA) and Commodity Credit Corporation (CCC). Section 281 prohibits the recovery of incorrect payments after 90 days unless the participant believes the decision to be erroneous.

Other agencies not cited in the GAO report have encountered problems, as well. The Department of Housing and Urban Development (HUD) explained that certain programs lack "the means to capture and report the amounts of improper payments identified and recovered." The Department of Education (ED) cited the high burden of proof required to recover funds under the General Education Provisions Act (GEPA) as a barrier to recovery auditing.

IPERA's cost-effectiveness requirement may limit the funds recovered through recovery audits. Under the law, agencies are required to conduct recovery audits only if so doing is cost-effective. If an agency determines that a recovery audit would not be cost-effective, it must notify the Office of Management and Budget (OMB) and its inspector general with the analysis it performed to reach this decision.

For FY2011, several agencies determined that recovery audits would not be cost-effective; two selected examples include the Treasury Department and the Small Business Administration (SBA). According to the Department of the Treasury's Office of Inspector General (OIG), neither the Treasury Executive Office for Asset Forfeiture (TEOAF) nor the Bureau of the Public Debt's Office of Public Debt Accounting (OPDA) performed recovery audits. The Treasury Department considered them low risk and immaterial and so deemed that recovery audits would not be cost-effective. SBA cited low error rates and program complexity as reasons that payment audits would not be cost-effective. With regard to contracting specifically, for example, SBA stated that contracting's limited amount of outlays—$133.4 million over the improper payment period—meant that recovery audits would not be cost-effective. Given that $133.4 million exceeded the $1 million threshold for conducting recovery audits under IPERA, SBA was required to provide a justification for this decision, but it did not.

While OMB Circular A-123, Appendix C, instructs agencies on considerations they should take into account when evaluating whether a recovery audit would be cost-effective, there are no clear-cut criteria that would achieve a uniform response across agencies. Agency "opt-out" in the absence of definitive standards of cost-effectiveness could result in missed opportunities to recoup overpayments. In addition, understating amounts potentially available for recovery could limit congressional oversight, as incomplete and incorrect information might impede effective program monitoring and review.

Improper Payments Elimination and Recovery Audit Improvement Act of 2012

In an attempt to expand the scope of data used to verify that payments are being made to eligible recipients and for the correct amount, Congress passed the Improper Payments Elimination and Recovery Audit Improvement Act of 2012 (IPERIA; P.L. 112-248 ). IPERIA is in the early stages of implementation—President Obama signed it into law on January 10, 2013—so there is no evidence yet as to the law's effectiveness in reducing improper payments and increasing the amounts recovered. The following section describes key provisions and provides a brief analysis of the potential benefits of the law.

Improper Payments

IPERIA requires OMB to identify a list of "high-priority" federal programs for greater levels of oversight. These programs must be chosen on the basis of the relatively high dollar value or error rate of improper payments, or because they are deemed more susceptible to improper payments when compared to other high-risk programs, regardless of size. OMB is also required to establish annual targets, as well as quarterly and semi-annual actions for reducing improper payments for the high-priority programs. In addition, each agency with a high-priority program is required to submit an annual report on the steps agencies have taken, and plan to take, to prevent and recover future improper payments. The report will be submitted to the inspector general of the agency and posted on a website accessible to the public. The inspector general, in turn, must submit a report to Congress that assesses the quality of the improper payment estimates for each high-priority program, determines whether proper controls are in place to identify and prevent future improper payments, and makes recommendations to Congress on how agency plans might be modified to improve their improper payment estimates and internal controls.

IPERIA also requires OMB to issue new guidance intended to increase the accuracy of agency improper payment estimates. The bill

establishes new standards for sampling payments; bars agencies from relying on self-reporting by recipients for estimates; requires agencies to include all improper payments in their estimates, including those payments recovered or in the process of being recovered; and includes payments to employees in their estimates.

In addition, IPERIA requires a "Do Not Pay Initiative" similar to the "Do Not Pay List" established by President Barack Obama. Under IPERIA, agencies are required to verify recipient eligibility by reviewing available databases prior to issuing a payment or award. At a minimum, agencies must verify eligibility by reviewing data in the

Death Master File, maintained by the Social Security Administration; Excluded Parties List System, maintained by the General Services Administration; Debt Check Database, maintained by the Department of the Treasury; Credit Alert System, maintained by the Department of Housing and Urban Development; and List of Excluded Parties and Entities, maintained by the inspector general of the Department of Health and Human Services.

IPERIA gives OMB the authority to include additional databases as part of the "Do Not Pay Initiative," as long as the public is provided notice and opportunity to comment before the database is included. OMB must issue a report to Congress each year that evaluates agency efforts to implement the "Do Not Pay Initiative," including whether the initiative has led to reduced improper payments and the identification of incorrect data.

To facilitate data integration across agencies, IPERIA requires OMB to submit a plan by March 11, 2013, for (1) including other databases in the "Do Not Pay Initiative"; (2) maximizing agency access to the databases; and (3) developing agreements between agency inspectors general that would permit data sharing. OMB is required to issue guidance on the IG agreements, including standards for reimbursement of costs associated with implementation, retention and destruction of records, and privacy protections. Thirty days after OMB submits its plan, it is required to ensure that a working data-sharing system is in place, although it only needs to include three agencies by that deadline. By June 1, 2013, all agencies must review all their payments for all programs through the initiative.

In addition to drawing on data from existing sources, IPERIA requires the Attorney General to submit a report to Congress within a year of enactment that would assess the ability of using state, local, and federal incarceration status as a method for identifying and preventing improper payments. IPERIA also requires the Social Security Administration (SSA) to take steps to improve the accuracy and timeliness of death data maintained by SSA.

Recovery Audits

Under IPERA, agencies must establish annual payment recapture targets for their programs. By FY2013, the proportion of recovered amounts to amounts identified for recovery must be at least 0.85 (that is, a recovery rate of at least 85%). IPERIA expands upon these provisions by requiring the Director of OMB to set recovery targets for improper payments, with specific amounts identified for recovery audit contractors. In addition, the legislation requires the Director of OMB to determine both current and historical improper payments recovery amounts and rates, including those recaptured by recovery audit contractors, and provide a list of agency recovery audit contract programs.

Initial Analysis

IPERIA's provisions target areas for improvement that are known to be weak, particularly with regard to developing more accurate improper payment estimates. In addition, the explicit requirement to include payments to federal employees when estimating improper payments may yield new areas for savings, as OMB has reported that federal benefit programs may be susceptible to high rates of improper payments—perhaps over $1 billion a year. In FY2008, for example, the Office of Personnel Management reported more than $330 million in improper payments for federal health, life, and retirement programs, and the Department of Defense reported more than $730 million in improper payments for military and civilian pay, health, and retirement programs. Finally, the ability of agencies to access data from a range of sources across the government may prove to be a valuable tool for preventing payments to ineligible recipients. It may be useful, however, to compare the cost of integrating and improving existing data sources, as IPERIA requires, to the potential savings generated by doing so.

S. 1360: Improper Payments Agency Cooperation Enhancement Act of 2013

On May 8, 2013, the Senate Committee on Homeland Security and Governmental Affairs held a hearing on eliminating improper payments to people who have already died. IPERIA included provisions that were intended to address this problem—the law requires agencies to check SSA's Death Master File (DMF) to ensure intended recipients are still alive before issuing payments. A report by the Government Accountability Office (GAO), however, determined that DMF data were flawed and that many improper payments to decedents were going undetected. Senator Carper, committee chairman, called the problem "frustrating but solvable" and stated that he wanted the hearing to result in steps that the government could take to ensure agencies receive the most accurate information from the DMF.

According to Daniel Burtoni, GAO director of Education, Workforce, and Income Security Issues, who testified at the hearing, the accuracy of the DMF is uncertain because SSA does not verify all of the death reports it receives. Multiple sources report deaths to SSA, some of which SSA considers "highly accurate" and others that SSA considers "less accurate." SSA reviews each file submitted from a "less accurate" source before recording an individual as deceased in the DMF. The "less accurate" sources include post offices, financial institutions, the Department of Veterans Affairs, and the Centers for Medicare and Medicaid Services. SSA does not verify death reports from "highly accurate" sources before recording an individual as deceased in the DMF. The "highly accurate" sources include data from states reported through the Electronic Death Registration System (EDRS), family members, and funeral directors. Regardless of the source, SSA does not verify deaths reported for non-beneficiaries. If a post office submitted a death report to SSA, for example, the death would be recorded in the DMF without verification if the decedent was not receiving SSA benefits. Burtoni did not provide an estimate of how many DMF files are inaccurate.

Burtoni also discussed the degree to which agencies utilize the DMF. As noted, SSA receives death data from state governments. The Social Security Act, however, prohibits SSA from sharing state data with federal agencies that do not pay benefits. SSA, therefore, must determine whether an agency is eligible for access to the full DMF on a case-by-case basis. As of May 8, 2013, SSA had granted full access to only six federal agencies, all of which make benefit payments:

Centers for Medicare and Medicaid Services (CMS) Department of Defense (DOD) Department of Veterans Affairs (VA) Internal Revenue Service (IRS) Office of Personnel Management (OPM) Railroad Retirement Board (RRB)

Agencies are generally required to reimburse SSA for the "reasonable cost of sharing the [DMF] data." Despite this, Burtoni noted that SSA is not reimbursed by all agencies for access to the full DMF. The VA is statutorily exempt from paying SSA, so it does not reimburse SSA at all. Neither does OPM, which has an arrangement with SSA under which the agencies exchange information at no cost to either party. CMS and DOD do reimburse SSA, but at different amounts.

Other federal agencies—including some that pay benefits—purchase only the partial DMF. These agencies include the Departments of Labor, Agriculture, and Justice. The partial DMF excludes data provided by states—estimated at about 11 million death reports. The agencies that pay benefits may be eligible for access to the full DMF, but they have not requested access. Burtoni did not explain why some benefit-paying agencies had not requested access to the full DMF.

S. 1360

In response to issues raised at the May 8, 2013, hearing, Chairman Carper introduced S. 1360 , the Improper Payments Agency Cooperation Enhancement Act of 2013. The bill's provisions, discussed below, are directed at improving the accuracy of, and increasing access to, DMF data.

Registry Access and Data Quality

S. 1360 would require the SSA Commissioner (Commissioner) to establish a National Deaths Registry (Registry) that must include information agencies need to fully implement IPERIA. The Commissioner would also be required to enter into agreements with federal agencies that would enable them to have full access to all of the death data in the Registry. Agencies would be required to reimburse the Commissioner for the reasonable cost of carrying out the agreement. The Commissioner would also be required to enter into similar agreements with state, local, and tribal governments, "to the extent feasible." The agreements would help them prevent, identify, and recover improper payments made under federally funded programs. These agreements, like those made with federal agencies, would require state, local, or tribal governments to reimburse the Commissioner for access to the Registry.

The bill would also require the Commissioner to implement procedures for

identifying and correcting errors, including those identified by members of the public; determining the accuracy of death records in the Registry; ensuring that the Registry is operated and maintained according to best practices for privacy, security, and disclosure; and providing data to contractors that have been certified by a federal agency, or state, local, or tribal government, as being compliant with applicable privacy and security protocols.

The Commissioner would be given the specific authority to share all of the information in the Registry with any federal agency, including data received from states. This provision would supersede the language in the Social Security Act that prohibits the Commissioner from sharing state data with federal agencies that do not provide benefits.

Reporting Data to the Registry

S. 1360 would require the Director of the Office of Management and Budget (Director) to identify agencies that have data which might be used for matching data in the Registry. If an agency has data on annuity recipients, for example, the Director must establish a method for comparing the data the agency has with the data in the Registry. The Commissioner would then use the comparison to confirm the accuracy and completeness of the Registry data, and to identify conflicting data that needs to be further researched. Each agency identified by the Director would be required to submit to the Commissioner, on a regular basis, data relating to the death of a federal beneficiary, federal annuitant recipient, or other individual that might be in the Registry. The Director would be required to submit a plan to Congress that explains how state, local, and tribal governments will use data matching to improve the accuracy of data in the Registry and in their own databases.

Sharing Data

S. 1360 would require the U.S. Postal Service to provide agencies access to delivery addresses, including a list of known locations of commercial mailboxes. The Postal Service has the authority to request reimbursement from agencies that use this data. In addition, federal agencies with data that pertain to federal beneficiaries or annuitants must share that data with other agencies.

Data Analytics

S. 1360 would require the Secretary of the Treasury, within 180 days of enactment, to submit a report to Congress which includes a description of any analysis or investigation of data used to implement the "Do Not Pay Initiative." Examples include matching data in the Registry to state beneficiary enrollment lists, and comparing program data from multiple agencies to identify payment duplication. The Secretary of the Treasury would also be required to describe the metrics used to determine whether data analytics reduced improper payments.

Task Force on Federal Annuitants

S. 1360 would require the OMB Director to assemble a task force of agencies to reduce payments to deceased federal annuitants. To that end, the task force would be a forum to share best practices for identifying deceased annuitants and to improve data-sharing among agencies. The task force must include representatives from four agencies: DOD, SSA, VA, and OPM. In addition, the task force must include any other agency that provides or conducts oversight of annuities.

Analysis of S. 1360

S. 1360 includes provisions that, if fully implemented, may improve the accuracy of death data, which in turn may reduce improper payments to deceased individuals. Expanding data matching with state, local, and tribal governments, for example, would provide new sources of information against which the data in the Registry could be compared. Participation in data sharing, however, comes with a cost. The Department of Defense, for example, pays $40,000 a year for access to the Registry. It is not known how many state, local, and tribal governments would be able to obtain the funds needed to reimburse SSA for access to the Registry.

As noted, the Electronic Death Registration System (EDRS) is considered a "highly accurate" source of data for the Registry. As of March 2013, however, only 35 states submitted their death reports using EDRS. SSA estimates that with the necessary funding, EDRS could be implemented in the remaining states within four years. One option for improving the quality and quantity of death data in the Registry would be to consider funding the implementation of EDRS nation-wide. Among the questions that might be asked to assist Congress in this decision are

Do the states without EDRS have the capacity to implement it without a major technology upgrade? Would states contribute to the cost of implementing EDRS? How long would it take for the government to recover its investment in EDRS expansion through the prevention and recovery of improper payments?

S. 1360 includes language that would permit SSA to share state death data with federal agencies that do not issue benefit payments—agencies that are currently prohibited from accessing state death data by the Social Security Act. Agencies may discover similar statutory obstacles as they try to formalize data sharing agreements, as required by S. 1360 . One option for identifying these statutory obstacles and making them known to Congress would be to require the Secretary of the Treasury to include them in its report on data analytics. S. 1360 requires the Secretary to submit a report within 180 days of enactment that includes a description of "multiple agencies and programs for which comparison of data could show payment duplication." As part of that review, the Secretary could be required to work with agencies to determine whether any statutory barriers to sharing that data exist. Another option would be to require the OMB Director to include statutory barriers in its annual report on the implementation of S. 1360 . The first such annual report would be required not more than one year after the enactment of S. 1360 .